e854ab9d92b7dbe398b3bee858a2b896[.]bin

Sharing

Copy URL Twitter E-mail

General

Target

e854ab9d92b7dbe398b3bee858a2b896.bin
Size

2.5MB
MD5

726f31a8f76ca1afe5fe6c03a6ff213f
SHA1

a2e4e00a91e2e456191cdfc705f80482a49f7298
SHA256

10a30cc0c9a92c44bd2b852f10232928b90e01d5bd972202e60358dcba6efa1d
SHA512

a4ac5d2c1515ddf07e447e55eb9bb6446a0a548fa70753236773179d05f5a7a7e85e49d7d24f8e10d63d948c7bdb51b02d49e5ae1065034616ebc0751f1a14da
SSDEEP

49152:fUloEK1yFXbU1//UVb4BwlZHdqgiC4V+T/M0Ri+HL8GRsx8bphDK3kQN:xwbC/UVcBw/YjA/LRnL80sGXDukQN

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS

Files

e854ab9d92b7dbe398b3bee858a2b896.bin
.zip

Password: infected
fa9c2fdaddd3b0fa9e7b58cbe576fab5f56000551a96c86a0c3270ca8e6966b8.apk
.apk android

Password: infected

com.lydia.route

.main

Activities

Permissions

com.lydia.route.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.INTERNET
android.permission.READ_SMS
android.permission.VIBRATE
android.permission.POST_NOTIFICATIONS
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WAKE_LOCK
android.permission.ACCESS_NETWORK_STATE
com.google.android.c2dm.permission.RECEIVE
com.google.android.gms.permission.AD_ID
com.lydia.route.permission.C2D_MESSAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.QUERY_ALL_PACKAGES
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.READ_CONTACTS
android.permission.WRITE_CONTACTS

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION

.mysms$mysms_BR

android.intent.action.BOOT_COMPLETED
android.provider.Telephony.SMS_RECEIVED

Services

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

anywheresoftware.b4a.objects.FirebaseNotificationsService

com.google.firebase.MESSAGING_EVENT
getewayport.txt
link.txt
number.txt

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

com.lydia.route

.main

Activities

Permissions

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

.mysms$mysms_BR

Services

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

anywheresoftware.b4a.objects.FirebaseNotificationsService