backdoor.zip
- SHA256 f5aacbe16a302dc49b9689631285e381d940f6482f2ec3e9152feb4a0bc97eeb
-
APT42 Android payload
Password
infected
Behavioral task
behavioral1
Sample
5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5.apk
Resource
android-x64-arm64-20220823-en
android-11-x64
0 signatures
1800 seconds
General
- Target backdoor.zip
- Size 10.8MB
- Sample230513-ghk53sff22
- SHA256 f5aacbe16a302dc49b9689631285e381d940f6482f2ec3e9152feb4a0bc97eeb
- MD5 7a7420f9c4c48468dcc22ab702fe9188
- SHA1 4a00c99743e41efcd0ca2f04772b7cf45f4df728
- SHA512 f4a03348af9dfd5be0e8b13c211e974349a53e9264d33c341164f4e89f9d07920d59f2c72e63d1715bedad5c29a90ee8ad86e34f079759633b14bfaf9e29c8bb
- SSDEEP 196608:LSlcIrffAkbnYsU2fu9FfFyWT5x/0mVoBv3n43KM9fBlhTOx7HoKW3ZE:LSlcaAonjzfu3FL0Nv3HM9JlhTSDW3ZE
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- APT42 Android payload 1 IoCs
resource yara_rule sample family_apt42_vinethorn - Apt42 family
- Requests dangerous framework permissions 12 IoCs
description ioc Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an app to access location in the background. android.permission.ACCESS_BACKGROUND_LOCATION Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Required to be able to access the camera device. android.permission.CAMERA Allows an application to record audio. android.permission.RECORD_AUDIO Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an application to read the user's call log. android.permission.READ_CALL_LOG
File Explorer
-
backdoor.zip.zip 10.8MB
-
5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5.apk.apk 11.8MB
5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5.apk
- SHA256 5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5
- MD5 8a847b0f466b3174741aac734989aa73
- SHA1 03eadb4ab93a1a0232cb40b7d2ef179a1cd0174d
- SHA512 85f2f3769087d92fcc69f047f2d5b5e7bb31e8342fb301bc5800110341d10904afdb9d225de0c5af13709977a0ec10a5ed41d803f17545645e10e32c3a91defd
- SSDEEP 196608:0/ruFMnjielhXAzLekMhH6rHVFIA2+7zWc7yi0UWsGZaHlgcm+2YplVl2toTkUmc:0/ruqnjiNPqhiF2+Z2x9taFgspDl2to1
- MD5 SHA1 SHA512 SSDEEP
-
APT42 Android payload
com.example.vpnner
com.example.vpnner.MainActivity
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_CONTACTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.CALL_PHONE
android.permission.READ_CALL_LOG
android.permission.READ_LOGS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.WAKE_LOCK
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
oppo.permission.OPPO_COMPONENT_SAFE
com.huawei.permission.external_app_settings.USE_COMPONENT
com.example.vpnner.RepeatActivity
com.example.vpnner.DiallingActivity
com.example.vpnner.SMSActivity
com.example.vpnner.CameraActivity
com.example.vpnner.AucioRecorderActivity
com.example.vpnner.CallLogsActivity
com.example.vpnner.AccessStorageActivity
com.example.vpnner.LocationActivity
com.example.vpnner.READCONTACTSActivity
com.example.vpnner.ShotActivity
com.example.vpnner.MainActivity
android.intent.action.MAIN
de.blinkt.openvpn.DisconnectVPNActivity
com.example.vpnner.FullScreenActivity
com.example.vpnner.LockScreenActivity
com.google.android.gms.common.api.GoogleApiActivity
de.blinkt.openvpn.core.OpenVPNService
android.net.VpnService
com.example.vpnner.MainService
com.example.vpnner.MyJobIntentService
com.example.vpnner.StartActivityOnBootReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.LOCKED_BOOT_COMPLETED
android.intent.action.USER_UNLOCKED