Resubmissions

08-05-2023 06:43

230508-hhfe9sbb4t 10

07-05-2023 11:03

230507-m5tnmagc2y 10

General

  • Target

    Visafe.apk

  • Size

    10.8MB

  • MD5

    4806636896f7607a631bdae5e1f23269

  • SHA1

    4d3e2918f95b9c099bef4449d0734c6c707d9020

  • SHA256

    489dd2e0414ee0e93519e9134fb10c1d7b89fccd747014c78e22060ce08d4166

  • SHA512

    787d9298478ac6db7dbc3ae579cd3be6be96ebf77d755d9362e0ab76896ac99aee5547df4600d45e1f029e773d9db5bf8687cea60eac4ed21e526ac2539007a9

  • SSDEEP

    196608:FPlkjEqFXpbYiuFl8xW5k+x2bBgNB6SzbMOafkir/hS1+vFzNcQAytf:FPOZXxYikl8cuMzpXiDasNLf

Score
10/10

Malware Config

Extracted

Family

gigabud

C2

http://bdkap1.cc/x/command?token=

http://8.219.85.91:8888/push-streaming?id=1234

Signatures

  • Gigabud family
  • Requests dangerous framework permissions 9 IoCs

Files

  • Visafe.apk
    .apk android arch:arm

    com.air.paz

    com.mobilelive.show.activity.SplashActivity


Android Permissions

Visafe.apk

Permissions

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.REQUEST_DELETE_PACKAGES

android.permission.QUERY_ALL_PACKAGES

android.permission.GET_INSTALLED_APPS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_FRAME_BUFFER

android.permission.DISABLE_KEYGUARD

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.SYSTEM_OVERLAY_WINDOW

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.WRITE_SETTINGS

android.permission.ACCESS_NOTIFICATION_POLICY