2f73b57cefdc49066c3be08d13668095[.]bin

Reason

unexpected chunk type

General

Target

2f73b57cefdc49066c3be08d13668095.bin
Size

688KB
MD5

15b4978d72ec4a64f6e91ac627c8c9c7
SHA1

030ce3e375bc1e582f1ddef135eea192de34a596
SHA256

c115defeaf439c964ebd759f6b5f119f8cdbc6cdf635f38699e159e7f80ed4f6
SHA512

4d0457251c9d0950bca17d61f3a91cc6ea0725dc648f9c321b5f183ac558bd0521138d3763f54e51d539c69503208ba650cfa80f722a90e1226c5a80d9c00c1a
SSDEEP

12288:dkvfnoBw3sd22lo1XcAhcenrNCd/ea6sam/ob7NAP7Ghpf87zhpgG6u0HC1m0ghz:SvvKx22lqXsHd/eaa7NAPityha8z0z

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO

Files

2f73b57cefdc49066c3be08d13668095.bin
.zip

Password: infected
2c8d655808cde5a1107bd7164150d1b7a147f977030ceb18836f9eaa780744b9.apk
.zip

Password: infected
ֻͨ/ETS_VPN_Connection.apk
.apk android

org.codeandroid.vpnc_frontend

.VPNC

Activities

.VPNC

android.intent.action.MAIN

Permissions

android.permission.VIBRATE

Services

MonitorServiceImpl

org.codeandroid.vpnc_frontend.MonitorServiceImpl
ֻͨ/ETSdialer_Server.apk
.apk android

com.golden.eagle

Permissions

android.permission.INJECT_EVENTS
android.permission.INTERNET
android.permission.MODIFY_PHONE_STATE
android.permission.READ_PHONE_STATE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.CALL_PHONE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_SMS
android.permission.WRITE_SMS
android.permission.SEND_SMS
android.permission.READ_CONTACTS
android.permission.READ_SMS
android.permission.WRITE_CONTACTS
android.permission.ACCESS_FINE_LOCATION
android.permission.RECORD_AUDIO
android.permission.RESTART_PACKAGES

Receivers

com.golden.eagle.BootMointor

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_TICK

com.golden.eagle.oderbock.InstructionBlockService

android.provider.Telephony.SMS_RECEIVED

com.golden.eagle.BootMointor

android.intent.action.USER_PRESENT

com.everysoft.autoanswer.AutoAnswerReceiver

android.intent.action.PHONE_STATE

Services

com.golden.eagle.BufferServices

com.amir.nightjar.service.BUFFER_SERVICES

com.golden.eagle.ConfigService

com.amir.nightjar.service.CONFIG_SERVICES

com.golden.eagle.service.MobileCallService

com.golden.eagle.MobileCallRecoder
ֻͨ/ʹ˵.txt

Sharing

Errors

General

Malware Config

Signatures

Files

Password: infected

Password: infected

org.codeandroid.vpnc_frontend

.VPNC

Activities

.VPNC

Permissions

Services

MonitorServiceImpl

com.golden.eagle

Permissions

Receivers

com.golden.eagle.BootMointor

com.golden.eagle.oderbock.InstructionBlockService

com.golden.eagle.BootMointor

com.everysoft.autoanswer.AutoAnswerReceiver

Services

com.golden.eagle.BufferServices

com.golden.eagle.ConfigService

com.golden.eagle.service.MobileCallService