6ec9b07d143afbc8a315d7adec599445[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

6ec9b07d143afbc8a315d7adec599445.bin
Size

37.7MB
MD5

f80c78659b520bb1b005b059f089d23a
SHA1

c4a43bb6881e733eeb1abf950ff4c1787139038e
SHA256

8bcd8b1a4c34a583b727d94619d8d34ce136624a60c59f3b3ddcb21d96487b56
SHA512

2d566dffb080387dbc15af917e3090b95f6bafdbcb83ac7d27b22372ee2486c488d226f0c7b8361a80fc3ab45aff3e2cc54e991f96965851c1147f52545ea99a
SSDEEP

786432:u7Q6VNR1L0Ngvi4t66czjrQ3mefjPgLUZg7tWO6Is0/8koYXBmcWWrnjhgqie:6VtL0NmHtDcz3xAQdt600vIscZrjhce

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION

Files

6ec9b07d143afbc8a315d7adec599445.bin
.zip

Password: infected
d46bfb6bef3bdaac361cacbbc9afde10432f96bfc9ac1dac314bfc86d9b08ebd.apk
.apk android arch:arm arch:x64

Password: infected

im.token.app

org.consenlabs.imtoken.MainActivity

Activities

org.consenlabs.imtoken.MainActivity

android.intent.action.MAIN
android.intent.action.VIEW

cn.jpush.android.ui.PushActivity

cn.jpush.android.ui.PushActivity

cn.jpush.android.service.JNotifyActivity

cn.jpush.android.intent.JNotifyActivity

cn.jpush.android.service.DActivity

cn.jpush.android.intent.DActivity

Permissions

android.permission.SYSTEM_ALERT_WINDOW
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.READ_EXTERNAL_STORAGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CAMERA
android.permission.INTERNET
android.permission.BLUETOOTH_ADMIN
android.permission.BLUETOOTH
android.permission.WAKE_LOCK
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.USE_FINGERPRINT
android.permission.USE_BIOMETRIC
android.permission.REQUEST_INSTALL_PACKAGES
im.token.app.permission.JPUSH_MESSAGE
android.permission.RECEIVE_USER_PRESENT
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.CHANGE_WIFI_STATE
android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
android.permission.CHANGE_NETWORK_STATE
android.permission.GET_TASKS
android.permission.VIBRATE
android.permission.WRITE_SETTINGS
com.fingerprints.service.ACCESS_FINGERPRINT_MANAGER
com.samsung.android.providers.context.permission.WRITE_USE_APP_FEATURE_SURVEY
com.google.android.c2dm.permission.RECEIVE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

cn.jiguang.plugins.push.receiver.JPushModuleReceiver

cn.jpush.android.intent.RECEIVE_MESSAGE

cn.jiguang.plugins.push.receiver.JPushBroadcastReceiver

cn.jpush.android.intent.NOTIFICATION_OPENED

cn.jpush.android.service.PushReceiver

cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

Services

com.helpscout.beacon.internal.presentation.push.fcm.BeaconFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

cn.jpush.android.service.PushService

cn.jpush.android.intent.REGISTER
cn.jpush.android.intent.REPORT
cn.jpush.android.intent.PushService
cn.jpush.android.intent.PUSH_TIME

cn.jiguang.plugins.service.JCoreModuleService

cn.jiguang.user.service.action

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT
CodePushHash
Entypo.ttf
EvilIcons.ttf
Feather.ttf
FontAwesome.ttf
Foundation.ttf
Ionicons.ttf
MaterialCommunityIcons.ttf
MaterialIcons.ttf
Octicons.ttf
Roboto-Regular.ttf
SimpleLineIcons.ttf
TZDB.dat
Zocial.ttf
data.bin
index.android.bundle
.js
pingpp_web.html
.html
sa_mcc_mnc_mini.json

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

im.token.app

org.consenlabs.imtoken.MainActivity

Activities

org.consenlabs.imtoken.MainActivity

cn.jpush.android.ui.PushActivity

cn.jpush.android.service.JNotifyActivity

cn.jpush.android.service.DActivity

Permissions

Receivers

cn.jiguang.plugins.push.receiver.JPushModuleReceiver

cn.jiguang.plugins.push.receiver.JPushBroadcastReceiver

cn.jpush.android.service.PushReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

Services

com.helpscout.beacon.internal.presentation.push.fcm.BeaconFirebaseMessagingService

cn.jpush.android.service.PushService

cn.jiguang.plugins.service.JCoreModuleService

com.google.firebase.messaging.FirebaseMessagingService