Resubmissions

26/05/2023, 05:13

230526-fwmqdsdh49 10

17/05/2023, 09:59

230517-lz81paef44 10

16/05/2023, 11:19

230516-nfb8qahe6t 8

16/05/2023, 11:19

230516-nev97sae35 7

16/05/2023, 11:17

230516-nd61baae27 7

16/05/2023, 09:19

230516-k9564saf5v 8

General

  • Target

    7f4670ae852ec26f890129a4a3d3e95c079f2f289e16f1aa089c86ea7077b3d8

  • Size

    10.7MB

  • MD5

    703b22fcea432d2c681cebbc150394f1

  • SHA1

    f561e628ae17d7a547ca55b0be72ebaf1ed88af3

  • SHA256

    7f4670ae852ec26f890129a4a3d3e95c079f2f289e16f1aa089c86ea7077b3d8

  • SHA512

    aecedd324311c3e95a93ad4129eddc4e46974db635e71bec406256be91bac7a1cb2817ea6b6e410a58d669cd32af4605ec393e5273d62ff078fa6bc9cd1fea1c

  • SSDEEP

    196608:ZynCaYQLCbkUYUMjNgR39mR70CyCopc24BFix/Q+hT1/XQqrj:G5YQCYeW90C8D4DiFZhmqrj

Score
10/10

Malware Config

Extracted

Family

fakecalls

C2

http://o20.orange-app.today/

Signatures

  • FakeCalls payload 1 IoCs
  • Fakecalls family
  • Requests dangerous framework permissions 2 IoCs

Files

  • 7f4670ae852ec26f890129a4a3d3e95c079f2f289e16f1aa089c86ea7077b3d8
    .apk android arch:arm arch:arm64

    com.grn.nbz.ktvhe.xeubdv

    com.mes.gfsnfg.poj.qcd.HomeActivity


  • 0OO00l111l1l
  • introduction.html
    .apk android arch:arm

    com.mks.rjrqm.rffu.qejtl

    ko.shinhansavings.phone.MainActivity


  • jpush_close.png
    .png
  • o0oooOO0ooOo.dat
  • ring.html
    .apk android

    com.mks.rjrqm.rffu.qejtl

    ko.shinhansavings.phone.MainActivity


  • t86
  • tosversion

Android Permissions

7f4670ae852ec26f890129a4a3d3e95c079f2f289e16f1aa089c86ea7077b3d8

Permissions

android.permission.INTERNET

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES