7dd3e40c3124c5c26f5e6cc8c97c338b65b52cb583b53ba0cd7cfb1bfbb3f45c[.]apk[.]zip

General

Target

7dd3e40c3124c5c26f5e6cc8c97c338b65b52cb583b53ba0cd7cfb1bfbb3f45c.apk.zip
Size

4.9MB
MD5

786c2c861fee1b4afce370f561ee0bd1
SHA1

ef6f7267ca76b64f97417ec073e6c584a5cb1654
SHA256

4021a455dbe4033dd6a6a8105afab313ebe10a931a828627bf6e9948757743ea
SHA512

6ce0cebd2037fe9e1c7618d200b44084163bc0f19a49496c18701f1623f451504a4ae7c46882b00e074e4e5b3f30bae7a893d6a558a1bb179c75161453dcde67
SSDEEP

98304:6O6O2ipU9r8nsu+zlL9F6eReUUa6tDlvB4ES3XfCN+UnsJLTArDuL:6O6O1R4nYewUUa6tDlveno+UsJ9

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Files

7dd3e40c3124c5c26f5e6cc8c97c338b65b52cb583b53ba0cd7cfb1bfbb3f45c.apk.zip
.zip

Password: infected
7dd3e40c3124c5c26f5e6cc8c97c338b65b52cb583b53ba0cd7cfb1bfbb3f45c.apk
.apk android

org.wso2.iot.agent

org.wso2.iot.agent.activities.SplashActivity

Activities

org.wso2.iot.agent.activities.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.WAKE_LOCK
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_EXTERNAL_STORAGE
org.wso2.iot.agent.permission.C2D_MESSAGE
android.permission.READ_PHONE_STATE
com.google.android.c2dm.permission.RECEIVE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_LOGS
android.permission.ACCESS_GPS
android.permission.ACCESS_FINE_LOCATION
android.permisssion.ACCESS_COARSE_LOCATION
android.permission.INTERNET
android.permission.MANAGE_MEDIA_PROJECTION
android.permission.GET_ACCOUNTS
android.permission.CHANGE_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERACT_ACROSS_USERS
android.permission.GET_TASKS
android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
org.wso2.iot.system.service.permission.ACCESS
org.wso2.iot.agent.permission.ACCESS
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.READ_EXTERNAL_STORAGE

Receivers

org.wso2.iot.agent.services.AgentDeviceAdminReceiver

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.PROFILE_PROVISIONING_COMPLETE

org.wso2.iot.agent.services.AgentStartupReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.ACTION_POWER_CONNECTED
android.net.conn.CONNECTIVITY_CHANGE
org.ws2.iot.agent.APPLICATION_UPDATED
org.ws2.iot.agent.APPLICATION_CRASHED

org.wso2.iot.agent.services.NetworkConnectedReceiver

android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE

org.wso2.iot.agent.events.listeners.ApplicationStateListener

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_DATA_CLEARED

org.wso2.iot.agent.events.listeners.KioskAppInstallationListener

android.intent.action.PACKAGE_ADDED

org.wso2.iot.agent.services.LocationUpdateReceiver

org.ws2.iot.agent.LOCATION_UPDATE

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

Services

org.wso2.iot.agent.services.ApplicationManagementService

org.wso2.iot.agent.START_SERVICE

org.wso2.iot.agent.services.EnrollmentService

org.wso2.iot.agent.enrollment.START_SERVICE

org.wso2.iot.agent.services.FCMMessagingService

com.google.firebase.MESSAGING_EVENT

org.wso2.iot.agent.services.VPNService

android.net.VpnService

org.wso2.iot.agent.services.FCMInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT
ringing.json

Sharing

General

Malware Config

Signatures

Files

Password: infected

org.wso2.iot.agent

org.wso2.iot.agent.activities.SplashActivity

Activities

org.wso2.iot.agent.activities.SplashActivity

Permissions

Receivers

org.wso2.iot.agent.services.AgentDeviceAdminReceiver

org.wso2.iot.agent.services.AgentStartupReceiver

org.wso2.iot.agent.services.NetworkConnectedReceiver

org.wso2.iot.agent.events.listeners.ApplicationStateListener

org.wso2.iot.agent.events.listeners.KioskAppInstallationListener

org.wso2.iot.agent.services.LocationUpdateReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

Services

org.wso2.iot.agent.services.ApplicationManagementService

org.wso2.iot.agent.services.EnrollmentService

org.wso2.iot.agent.services.FCMMessagingService

org.wso2.iot.agent.services.VPNService

org.wso2.iot.agent.services.FCMInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.iid.FirebaseInstanceIdService