apt42 | backdoor[.]zip

General

Target

backdoor.zip
Size

10.8MB
MD5

7a7420f9c4c48468dcc22ab702fe9188
SHA1

4a00c99743e41efcd0ca2f04772b7cf45f4df728
SHA256

f5aacbe16a302dc49b9689631285e381d940f6482f2ec3e9152feb4a0bc97eeb
SHA512

f4a03348af9dfd5be0e8b13c211e974349a53e9264d33c341164f4e89f9d07920d59f2c72e63d1715bedad5c29a90ee8ad86e34f079759633b14bfaf9e29c8bb
SSDEEP

196608:LSlcIrffAkbnYsU2fu9FfFyWT5x/0mVoBv3n43KM9fBlhTOx7HoKW3ZE:LSlcaAonjzfu3FL0Nv3HM9JlhTSDW3ZE

Score

10^/10

apt42

APT42 Android payload 1 IoCs

resource	yara_rule
sample	family_apt42_vinethorn

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG