5542057062072320[.]zip | Triage

Sharing

General

Target

5542057062072320.zip
Size

3.8MB
MD5

8a7ae832060890124072d1d508554428
SHA1

9a1e1d4a973c051603a98f622615a5060b597a65
SHA256

6b65f570c6d0ae17274951f6857df3876a222a5791cfa7f21ca1461d2c324018
SHA512

133ebedff8175abeba768a269411b6c5467812cd7d11bd3f7e17aa779a3b1d7e93bf0c707905e48d2e1908e28af03ecee10794832580fdc68b4d43cb5717087c

Score

8^/10

Malware Config

Signatures

Requests dangerous framework permissions 4 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Files

5542057062072320.zip
.zip

Password: infected
fd1aac87399ad22234c503d8adb2ae9f0d950b6edf4456b1515a30100b5656a7
.apk android

com.egov.app

com.egov.app.ui.SplashActivity

Activities

com.egov.app.ui.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_FINE_LOCATION
android.permission.CHANGE_WIFI_STATE
android.permission.WAKE_LOCK
android.permission.READ_CONTACTS
android.permission.WRITE_EXTERNAL_STORAGE

Receivers

com.egov.app.Receiver

android.intent.action.BOOT_COMPLETED
android.intent.action.BATTERY_LOW

com.egov.app.UserPresentHandler

android.intent.action.USER_PRESENT
android.intent.action.BATTERY_CHANGED

Services