fc58b7c408d2d0423a1ec2accfca06097b77061ed398fed7b9c45b88bff3f38b[.]apk[.]zip

General

Target

fc58b7c408d2d0423a1ec2accfca06097b77061ed398fed7b9c45b88bff3f38b.apk.zip
Size

4.9MB
MD5

08ab2761097f6892397cab2683a48b44
SHA1

14f4a235ced4a1bcb1355f994d5138cfb7cded71
SHA256

a5ff65d5b42c1d911b4634f9d74f9fde1ecfadbfe6997fee325da8ba40bda7ee
SHA512

1e5378e4ede5c6afe4584fadb33b1d87ecdc0073f56fddd1b18455485ac92a6514bb67228ee6314f00b3b283c6147975a32775717d9769053b896463d1b63e55
SSDEEP

98304:OKHCWk6sqvbhhhB9+TSVS9QDwQpnPhq/Xq0fOdBQRbmpwjEtoavJ:OKf7sqvbPhBUTaCrOE9jEtoavJ

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Files

fc58b7c408d2d0423a1ec2accfca06097b77061ed398fed7b9c45b88bff3f38b.apk.zip
.zip

Password: infected
fc58b7c408d2d0423a1ec2accfca06097b77061ed398fed7b9c45b88bff3f38b.apk
.apk android

org.wso2.iot.agent

org.wso2.iot.agent.activities.SplashActivity

Activities

org.wso2.iot.agent.activities.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.WAKE_LOCK
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_EXTERNAL_STORAGE
org.wso2.iot.agent.permission.C2D_MESSAGE
android.permission.READ_PHONE_STATE
com.google.android.c2dm.permission.RECEIVE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_LOGS
android.permission.ACCESS_GPS
android.permission.ACCESS_FINE_LOCATION
android.permisssion.ACCESS_COARSE_LOCATION
android.permission.INTERNET
android.permission.MANAGE_MEDIA_PROJECTION
android.permission.GET_ACCOUNTS
android.permission.CHANGE_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERACT_ACROSS_USERS
android.permission.GET_TASKS
android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
org.wso2.iot.system.service.permission.ACCESS
org.wso2.iot.agent.permission.ACCESS
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.READ_EXTERNAL_STORAGE

Receivers

org.wso2.iot.agent.services.AgentDeviceAdminReceiver

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.PROFILE_PROVISIONING_COMPLETE

org.wso2.iot.agent.services.AgentStartupReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.ACTION_POWER_CONNECTED
android.net.conn.CONNECTIVITY_CHANGE
org.ws2.iot.agent.APPLICATION_UPDATED
org.ws2.iot.agent.APPLICATION_CRASHED

org.wso2.iot.agent.services.NetworkConnectedReceiver

android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE

org.wso2.iot.agent.events.listeners.ApplicationStateListener

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_DATA_CLEARED

org.wso2.iot.agent.events.listeners.KioskAppInstallationListener

android.intent.action.PACKAGE_ADDED

org.wso2.iot.agent.services.LocationUpdateReceiver

org.ws2.iot.agent.LOCATION_UPDATE

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

Services

org.wso2.iot.agent.services.ApplicationManagementService

org.wso2.iot.agent.START_SERVICE

org.wso2.iot.agent.services.EnrollmentService

org.wso2.iot.agent.enrollment.START_SERVICE

org.wso2.iot.agent.services.FCMMessagingService

com.google.firebase.MESSAGING_EVENT

org.wso2.iot.agent.services.VPNService

android.net.VpnService

org.wso2.iot.agent.services.FCMInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT
ringing.json

Sharing

General

Malware Config

Signatures

Files

Password: infected

org.wso2.iot.agent

org.wso2.iot.agent.activities.SplashActivity

Activities

org.wso2.iot.agent.activities.SplashActivity

Permissions

Receivers

org.wso2.iot.agent.services.AgentDeviceAdminReceiver

org.wso2.iot.agent.services.AgentStartupReceiver

org.wso2.iot.agent.services.NetworkConnectedReceiver

org.wso2.iot.agent.events.listeners.ApplicationStateListener

org.wso2.iot.agent.events.listeners.KioskAppInstallationListener

org.wso2.iot.agent.services.LocationUpdateReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

Services

org.wso2.iot.agent.services.ApplicationManagementService

org.wso2.iot.agent.services.EnrollmentService

org.wso2.iot.agent.services.FCMMessagingService

org.wso2.iot.agent.services.VPNService

org.wso2.iot.agent.services.FCMInstanceIdService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.iid.FirebaseInstanceIdService