dd28810e5eb0aa85c71fd5e1211b7a2a[.]bin

General

Target

dd28810e5eb0aa85c71fd5e1211b7a2a.bin
Size

10.2MB
MD5

773224a69174a28cae8fd15aa7509a4f
SHA1

2139117c7fa8b5c840a90e8bc0cced5dbde67699
SHA256

8ad2057740526eac679f81bd8d2888b853df6745ba0b8a3f95ae6c95ad9df95e
SHA512

1b7dc2617de50a8fc710302cdbaa5a3b3ce86ec814cd2f095371725301c98cf4949f4641b569d68c0b9b409c51d6c3891f8bb3464abbbeda2c9790fe96d7e17d
SSDEEP

196608:Iv/DR4IEaBR9rM80FHIG+vl22yM7CbZmdPcedaOSif/+h6VSdK1Qe0hRqrHCxj3j:Iv/DRoorM80FodZ57/kOF34RdY0zqrHS

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Required to be able to access the camera device.	android.permission.CAMERA

Files

dd28810e5eb0aa85c71fd5e1211b7a2a.bin
.zip

Password: infected
5809066a109718683fa1ffe3abcd0e6c9bd5f613279e081e31bc17e628d9bfba.apk
.apk android

com.my.spy.app

com.my.spy.app.ui.activities.login.LoginActivity

Activities

com.my.spy.app.ui.activities.login.LoginActivity

android.intent.action.MAIN

com.facebook.CustomTabActivity

android.intent.action.VIEW

com.google.firebase.auth.internal.GenericIdpActivity

android.intent.action.VIEW

com.google.firebase.auth.internal.RecaptchaActivity

android.intent.action.VIEW

Permissions

android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.PROCESS_OUTGOING_CALLS
android.permission.READ_PHONE_STATE
android.permission.CALL_PHONE
android.permission.CAPTURE_AUDIO_OUTPUT
android.permission.RECORD_AUDIO
android.permission.READ_CONTACTS
android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.WRITE_SMS
android.permission.CAMERA
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.PACKAGE_USAGE_STATS
android.permission.VIBRATE
android.permission.WAKE_LOCK
com.google.android.gms.permission.AD_ID
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
com.my.spy.app.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Receivers

com.my.spy.app.receiver.SmsReceiver

android.provider.Telephony.SMS_RECEIVED

com.my.spy.app.receiver.CallsReceiver

android.intent.action.NEW_OUTGOING_CALL
android.intent.action.PHONE_STATE

com.my.spy.app.receiver.MonitorReceiver

com.my.spy.app.receiver.RESTART_MONITOR_RECEIVER

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION

Services

com.my.spy.app.services.accessibilityData.AccessibilityDataService

android.accessibilityservice.AccessibilityService

com.my.spy.app.services.notificationService.NotificationService

android.service.notification.NotificationListenerService

Sharing

General

Malware Config

Signatures

Files

Password: infected

com.my.spy.app

com.my.spy.app.ui.activities.login.LoginActivity

Activities

com.my.spy.app.ui.activities.login.LoginActivity

com.facebook.CustomTabActivity

com.google.firebase.auth.internal.GenericIdpActivity

com.google.firebase.auth.internal.RecaptchaActivity

Permissions

Receivers

com.my.spy.app.receiver.SmsReceiver

com.my.spy.app.receiver.CallsReceiver

com.my.spy.app.receiver.MonitorReceiver

androidx.profileinstaller.ProfileInstallReceiver

Services

com.my.spy.app.services.accessibilityData.AccessibilityDataService

com.my.spy.app.services.notificationService.NotificationService