Managed XDR

am-tunnel-no-password.apk — malware analysis report

File info

Filename
am-tunnel-no-password.apk
File type
Zip archive data, at least v2.0 to extract
File size
22.5 MB
First seen
Last seen

Environment

droid7/x86 ru

Hashes

SHA1
9734eabe52e76b185bd2882cc977b6f76ddebdc8
SHA256
b485aab038b6683b669c602a12a781146c1d4e2fdd0cbc76e7cd03ce4bd0bfd6
MD5
f410368499ca1f80b1dd9aec2594362c

Signatures

Other

send_sms: Sends sms
dexclassloader: Uses class loader to executre dynamic code
dynamic_load: Uses undocumented methods to load apk/dex/classes
runtime_exec: Starts native process
skip_main_activity: Abort loading MainActivity
kill_process: Kills process
super_user: Checks root access
dex_elements: Modifies classes path (possibly, dynamic code loading)
reflection: Uses reflection
framework_check: Checks frida/xposed/substrate
read_or_write_global_settings: Read or write global settings
trowable: Throwable exceptions
start_activity: Starts activity
load_jni_lib: Loads native library
get_runtime: Gets Runtime class