68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6[.]zip

General

Target
68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.zip
Size 2.5MB
Sample220803-hdwlpahbgr
SHA256 692b1eec160c686b055ac441f8e18b2cd5927136cf031829b2f915abcb9f26dd
MD5 eeb45e48091f8c4e63b844318949f341
SHA1 a86d53a2ed499abff9abef63b7c9e2877ac559dc
SHA512 fb59a8d3decfd9b42a055c98a2123d935e4701fe0a47030a9a38656d5c7bde3e92fab27cb0ea16ff7282a063e39b1077ae60f5e0371db681efe29a0369441755
SSDEEP 49152:pOEYPVEPL7r+NLF/vYzJsqtiuTlMAeyejnx+wliMQfoZ91OZfFI:pOEIVEPnr+PvmxiCe/rLIoB+fa
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

File Explorer

68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.zip

.zip 2.5MB
68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.apk

.apk 2.5MB

68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.zip

SHA256 692b1eec160c686b055ac441f8e18b2cd5927136cf031829b2f915abcb9f26dd
MD5 eeb45e48091f8c4e63b844318949f341
SHA1 a86d53a2ed499abff9abef63b7c9e2877ac559dc
SHA512 fb59a8d3decfd9b42a055c98a2123d935e4701fe0a47030a9a38656d5c7bde3e92fab27cb0ea16ff7282a063e39b1077ae60f5e0371db681efe29a0369441755
SSDEEP 49152:pOEYPVEPL7r+NLF/vYzJsqtiuTlMAeyejnx+wliMQfoZ91OZfFI:pOEIVEPnr+PvmxiCe/rLIoB+fa
MD5 SHA1 SHA512 SSDEEP

Password

infected

68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.apk

SHA256 68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6
MD5 0e593549e712398a9f64a4c363601650
SHA1 4f74b03d330993674607793cf80e985887ad88a7
SHA512 9e747f9731f8bb43f00152cd5d38c98287bc93431fd97f3d7e6333c967a99029d467849b1e3f6c1350665236a8a85b76c92099d44607b318aca4666bf3fd661e
SSDEEP 49152:PjHNQSUekcNUk+C87dFCjhHF2snQJYIaFPrwdGMTOiNrimkq4Puarzg7:PrNkl9dFkBQJIFAsisagukzu
MD5 SHA1 SHA512 SSDEEP

android

th.media.itsme

68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.zip

68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.apk

com.google.android.gms.common.api.GoogleApiActivity

.main

.drawer_permission_activity

.permissions_activity

.adm_activity

.alert_manuale

.fakepin_activity

.getdefaultsms_activity

.inject_activity

.notification_activity

.permission_activity_a11y

.policy_permissions_activity

.test_overlaye

.vnc_activity

.h_service

.locken

.managerservice

.safeyprotect

.sms_deliver

.sms_push

.sms_resp

.teste_safey

.websockservice

.httputils2service

anywheresoftware.b4a.objects.AdminReceiver2

.h_service$h_service_BR

.locken$locken_BR

.managerservice$managerservice_BR

.safeyprotect$safeyprotect_BR

.sms_deliver$sms_deliver_BR

.sms_push$sms_push_BR

.sms_resp$sms_resp_BR

.teste_safey$teste_safey_BR

.websockservice$websockservice_BR

.httputils2service$httputils2service_BR

Sharing

General

Malware Config

Signatures

File Explorer

68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.zip

68d8fb137c13635a33b04eb3ef1ee16431abea526b899fba326a253f5513e8e6.apk

com.google.android.gms.common.api.GoogleApiActivity

.main

.drawer_permission_activity

.permissions_activity

.adm_activity

.alert_manuale

.fakepin_activity

.getdefaultsms_activity

.inject_activity

.notification_activity

.permission_activity_a11y

.policy_permissions_activity

.test_overlaye

.vnc_activity

.h_service

.locken

.managerservice

.safeyprotect

.sms_deliver

.sms_push

.sms_resp

.teste_safey

.websockservice

.httputils2service

anywheresoftware.b4a.objects.AdminReceiver2

.h_service$h_service_BR

.locken$locken_BR

.managerservice$managerservice_BR

.safeyprotect$safeyprotect_BR

.sms_deliver$sms_deliver_BR

.sms_push$sms_push_BR

.sms_resp$sms_resp_BR

.teste_safey$teste_safey_BR

.websockservice$websockservice_BR

.httputils2service$httputils2service_BR