com.tsoft.irecorder.activity.SplashActivity
android.intent.action.MAIN
General
-
Target
iRecorder - Screen Recorder_2.0_Apkpure (2).xapk
-
Size
28.0MB
-
MD5
c633d1828fb1d455febd32e2b1cb1961
-
SHA1
ff558bc9d5f61ac611f1d81b73f46281a22e5213
-
SHA256
8611b2e4bc12932b5b663ef92ee831d92ed00bb1a35fa8113184bd301b72e0fa
-
SHA512
7af665ec036eaa3c263f52577d16f302787c100ddfb41ac5d96e6b37c945be9ebc52678c018c25f19af5cd6fab70996f351e64fb09d61c75281a9825d9390f01
-
SSDEEP
786432:SF6OGP6/RD+6cRE/5DAipYTK61mzc5Jt7s+eOVfY2o6I2GJCNICtVJoVgmXqMC0+:C6xPsRDaEZAiiy+eSfYVY
Score
10/10
Malware Config
Extracted
Family
ahrat
C2
http://80876dd5.shop:22223
https://order.80876dd5.shop/
Signatures
-
Ahrat family
-
Requests dangerous framework permissions 7 IoCs
description ioc Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to read audio files from external storage. android.permission.READ_MEDIA_AUDIO Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES Allows an application to read video files from external storage. android.permission.READ_MEDIA_VIDEO Required to be able to access the camera device. android.permission.CAMERA Allows an application to record audio. android.permission.RECORD_AUDIO
Files
-
iRecorder - Screen Recorder_2.0_Apkpure (2).xapk.zip
Password: 111
-
com.tsoft.app.iscreenrecorder.apk.apk android
Password: 111
com.tsoft.app.iscreenrecorder
com.tsoft.irecorder.activity.SplashActivity
Activities
Permissions
android.permission.INTERNET
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.VIBRATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_MEDIA_AUDIO
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VIDEO
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CAMERA
android.permission.READ_PRIVILEGED_PHONE_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.RECORD_AUDIO
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
Receivers
com.tsoft.irecorder.serviceteasoft.MainBroadcastReceiver
respawnService
com.tsoft.irecorder.serviceteasoft.TS01BootReceiver
android.intent.action.BOOT_COMPLETED
com.tsoft.irecorder.serviceteasoft.TS01WifiConnectionReceiver
android.location.PROVIDERS_CHANGED
android.net.conn.CONNECTIVITY_CHANGE
android.net.wifi.WIFI_STATE_CHANGED
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
android.net.conn.CONNECTIVITY_CHANGE
androidx.work.impl.background.systemalarm.RescheduleReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.UpdateProxies
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.diagnostics.REQUEST_DIAGNOSTICS
Services
-
SF-UI-Display-Thin.otf
-
baseline.prof
-
baseline.profm
-
f01.ttf
-
f02.ttf
-
f03.ttf
-
f04.ttf
-
f05.ttf
-
f06.ttf
-
f07.ttf
-
f08.ttf.ps1
-
f09.ttf
-
f10.ttf
-
f11.ttf
-
f12.ttf
-
f13.ttf
-
loading_new.json
-
rate-app.json
-
config.ar.apk.apk android
Password: 111
com.tsoft.app.iscreenrecorder
-
config.armeabi_v7a.apk.apk android arch:arm
Password: 111
com.tsoft.app.iscreenrecorder
-
config.de.apk.apk android
Password: 111
com.tsoft.app.iscreenrecorder
-
config.en.apk.apk android
Password: 111
com.tsoft.app.iscreenrecorder
-
config.es.apk.apk android
Password: 111
com.tsoft.app.iscreenrecorder
-
config.fr.apk.apk android
Password: 111
com.tsoft.app.iscreenrecorder
-
config.hi.apk.apk android
Password: 111
com.tsoft.app.iscreenrecorder
-
config.in.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.it.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.ja.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.ko.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.my.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.pt.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.ru.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.th.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.tr.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.vi.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.xxhdpi.apk.apk android
com.tsoft.app.iscreenrecorder
-
config.zh.apk.apk android
com.tsoft.app.iscreenrecorder
-
icon.png.png
-
manifest.json