230908-dzpm2sgc54_pw_infected[.]zip

Sharing

Copy URL

Twitter E-mail

Reason

readat analyses/230908/230908-hq7vgshe94/static1/unpack002/amap_resource1_0_0.png: negative offset

General

Target

230908-dzpm2sgc54_pw_infected.zip
Size

3.1MB
MD5

a5a0cfd5d4cccf68644983bf794ad9be
SHA1

905d3efaeba91578e4c5ae9294a40a7aafcae4fd
SHA256

c3a68f5783001da938ec752fe34e9dca921f190bb65ed408a873e72be7d25236
SHA512

6c678a902a0a5a662dac0fd40fd28141c3ca32520410b6d09f55ef843408c136af0c820df04559f7c583392ba6e37ee9666476304072eccccb5110af71c4217f
SSDEEP

98304:W5zurV4M0MFU4wX9t4FIw0+mIEA8vma4YNW:W5zupDKNG1Kq

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS

Files

230908-dzpm2sgc54_pw_infected.zip
.zip

Password: infected
Lol.apk
.apk android

com.dogilowopuna.zico

com.dogilowopuna.zico.gija

Activities

com.dogilowopuna.zico.gija

android.intent.action.MAIN

com.fupipetiyoleju.piwixu.geharopokixixezu.vedabanimi

android.intent.action.SENDTO
android.intent.action.SEND

Permissions

android.permission.READ_EXTERNAL_STORAGE
android.permission.GET_ACCOUNTS
android.permission.INTERNET
android.permission.GET_TASKS
android.permission.RECEIVE_SMS
android.permission.READ_PHONE_NUMBERS
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.FOREGROUND_SERVICE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_CONTACTS
android.permission.READ_CALL_LOG
android.permission.READ_PHONE_STATE
android.permission.QUICKBOOT_POWERON
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_CLIPS
android.permission.CAMERA
android.permission.ACCESS_NETWORK_STATE
com.sonyericsson.home.permission.BROADCAST_BADGE
android.permission.SEND_SMS
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CALL_PHONE
android.permission.GET_CLIPS
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
android.permission.REQUEST_DELETE_PACKAGES
android.permission.DISABLE_KEYGUARD
android.permission.READ_CLIPS
android.permission.READ_SMS
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.QUERY_ALL_PACKAGES
android.permission.RECEIVE_LAUNCH_BROADCASTS
android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

Receivers

com.fupipetiyoleju.piwixu.vevenovezake.kidicifucoha

android.provider.Telephony.SMS_RECEIVED
android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE
android.app.action.DEVICE_ADMIN_DISABLED
android.app.action.ACTION_DEVICE_ADMIN_DISABLE_REQUESTED
android.app.action.DEVICE_ADMIN_ENABLED

com.fupipetiyoleju.piwixu.yoga.ruxijirilo

android.intent.action.BOOT_COMPLETED
android.provider.Telephony.SMS_RECEIVED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.REBOOT

com.fupipetiyoleju.piwixu.yoga.xojuzizu

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.ACTION_SHUTDOWN
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.net.conn.CONNECTIVITY_CHANGE
android.net.wifi.WIFI_STATE_CHANGED
android.intent.action.AIRPLANE_MODE
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.BATTERY_OKAY
android.intent.action.DATE_CHANGED

com.fupipetiyoleju.piwixu.geharopokixixezu.masasiho

android.provider.Telephony.SMS_RECEIVED

com.fupipetiyoleju.piwixu.geharopokixixezu.xilasihesu

android.provider.Telephony.WAP_PUSH_DELIVER

com.fupipetiyoleju.piwixu.geharopokixixezu.jojuropiwega

android.provider.Telephony.SMS_DELIVER

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

Services

com.fupipetiyoleju.piwixu.zubihubosimukaju.puwaju

android.service.notification.NotificationListenerService

com.fupipetiyoleju.piwixu.morape.tofohularaluzici

android.accessibilityservice.AccessibilityService

com.fupipetiyoleju.piwixu.geharopokixixezu.hutevi

android.intent.action.RESPOND_VIA_MESSAGE
AZURE.png
BLUE.png
CYAN.png
GREEN.png
GreatVibes-Regular.ttf
MAGENTA.png
ORANGE.png
RED.png
ROSE.png
VIOLET.png
YELLOW.png
amap_resource1_0_0.png
.apk android
amap_sdk_lineDashTexture_circle.png
amap_sdk_lineDashTexture_square.png
amap_sdk_lineTexture.png
card_logo_bmac.png
card_logo_cdtft.png
card_logo_changsha.png
card_logo_cityu.png
card_logo_cqtk.png
card_logo_default.png
card_logo_gongshang.png
card_logo_guangda.png
card_logo_guangfa.png
card_logo_gzyct.png
card_logo_haerbin.png
card_logo_huaxia.png
card_logo_hzt.png
card_logo_jianshe.png
card_logo_jiaotong.png
card_logo_kunming.png
card_logo_lanzhou.png
card_logo_lingnan.png
card_logo_mastercard.png
card_logo_minsheng.png
card_logo_nanchang.png
card_logo_ningbo.png
card_logo_nongye.png
card_logo_octopus.png
card_logo_pingan.png
card_logo_pufa.png
card_logo_qingdao.png
card_logo_sptc.png
card_logo_suzhoutong.png
card_logo_szt.png
card_logo_visa.png
card_logo_wht.png
card_logo_xian.png
card_logo_xingye.png
card_logo_youzheng.png
card_logo_zhaoshang.png
card_logo_zhengzhou.png
card_logo_zhongguo.png
card_logo_zhongxin.png
card_logo_zhoushan.png
consentform.html
.html .js
cover.jpg
.jpg
de.json
en.json
es.json
fr.json
hud.png
id.json
infowindow_bg.9.png
it.json
ja.json
ko.json
libByteAINN.so
.elf linux arm
libbuffer.so
.elf linux arm
libfile_lock.so
.elf linux arm
libgifimage.so
.elf linux arm
libheif.so
.elf linux arm
libnative-filters.so
.elf linux arm
libnpth_dl.so
.elf linux arm
libttmverify.so
.elf linux arm
libttmverifylite.so
.elf linux arm
libvcnverify.so
.elf linux arm
libvcnverifylite.so
.elf linux arm
location_map_gps_3d.png
location_map_gps_locked.png
location_pressed.png
location_selected.png
location_unselected.png
map_indoor_select.png
maps_dav_compass_needle_large.png
marker_default.png
marker_gps_no_sharing.png
nl_nl.json
offlinemapv4.png
pl.json
pskPXGY.json
pt_br.json
ru.json
style.css
th.json
tr_tr.json
tracelinetexture.png
vi.json
webvideo.html
.js
youtube_sans_light.xml
.xml
youtube_sans_medium.xml
.xml
youtube_sans_semibold.xml
.xml
zepto.min.js
.js
zh_cn.json
zh_hk.json
zh_tw.json
zoomin_pressed.png
zoomin_selected.png
zoomin_unselected.png
zoomout_pressed.png
zoomout_selected.png
zoomout_unselected.png

Sharing

Errors

General

Malware Config

Signatures

Files

Password: infected

com.dogilowopuna.zico

com.dogilowopuna.zico.gija

Activities

com.dogilowopuna.zico.gija

com.fupipetiyoleju.piwixu.geharopokixixezu.vedabanimi

Permissions

Receivers

com.fupipetiyoleju.piwixu.vevenovezake.kidicifucoha

com.fupipetiyoleju.piwixu.yoga.ruxijirilo

com.fupipetiyoleju.piwixu.yoga.xojuzizu

com.fupipetiyoleju.piwixu.geharopokixixezu.masasiho

com.fupipetiyoleju.piwixu.geharopokixixezu.xilasihesu

com.fupipetiyoleju.piwixu.geharopokixixezu.jojuropiwega

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

Services

com.fupipetiyoleju.piwixu.zubihubosimukaju.puwaju

com.fupipetiyoleju.piwixu.morape.tofohularaluzici

com.fupipetiyoleju.piwixu.geharopokixixezu.hutevi