8601144d85216c19c15ac9e381e0d26432d5736a3f9e3a1c36560531b5c200a3[.]apk[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

8601144d85216c19c15ac9e381e0d26432d5736a3f9e3a1c36560531b5c200a3.apk.zip
Size

50.1MB
MD5

1ff68b1d6a9809ba331bd1db1d422ce1
SHA1

466ebfcc238ad072ef698fa491211c2d737f790a
SHA256

34ffab0857b2e1deff9d768c846f09ab28eb4efe88a0253cb5bfd52de4942985
SHA512

046b1a3f29dc7a7e4cbbe54ae892d86902273b6f0327f83b45d80601f61353a357594e296b779376551c9c9258f9096ae4cf7b67587b7411b0de432e7546e7a7
SSDEEP

786432:Z5xPRuXhVwGrtvsRPYQ2A4X95iPndgVRntoVZTdDwuhdCrBGqOcdSfr8Aa0e+B:ZbPEhVwGMP2AIwGrtKTdDwqIrBFdyA+B

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to write the user's calendar data.	android.permission.WRITE_CALENDAR
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

Files

8601144d85216c19c15ac9e381e0d26432d5736a3f9e3a1c36560531b5c200a3.apk.zip
.zip

Password: infected
8601144d85216c19c15ac9e381e0d26432d5736a3f9e3a1c36560531b5c200a3.apk
.apk android arch:arm64 arch:arm arch:x86 arch:x64

com.pegazus.fallprotect

host.exp.exponent.MainActivity

Activities

host.exp.exponent.MainActivity

android.intent.action.MAIN

host.exp.exponent.experience.TvActivity

android.intent.action.MAIN

net.openid.appauth.RedirectUriReceiverActivity

android.intent.action.VIEW

expo.modules.payments.stripe.RedirectUriReceiver

android.intent.action.VIEW

abi39_0_0.expo.modules.payments.stripe.RedirectUriReceiver

android.intent.action.VIEW

abi38_0_0.expo.modules.payments.stripe.RedirectUriReceiver

android.intent.action.VIEW

abi37_0_0.expo.modules.payments.stripe.RedirectUriReceiver

android.intent.action.VIEW

abi36_0_0.expo.modules.payments.stripe.RedirectUriReceiver

android.intent.action.VIEW

com.facebook.CustomTabActivity

android.intent.action.VIEW

Permissions

com.pegazus.fallprotect.permission.C2D_MESSAGE
com.google.android.c2dm.permission.RECEIVE
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.WAKE_LOCK
android.permission.MANAGE_DOCUMENTS
android.permission.READ_INTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.USE_FINGERPRINT
android.permission.VIBRATE
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CAMERA
android.permission.READ_CONTACTS
android.permission.READ_CALENDAR
android.permission.WRITE_CALENDAR
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECORD_AUDIO
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_SETTINGS
host.exp.exponent.permission.C2D_MESSAGE
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.USE_BIOMETRIC
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.FOREGROUND_SERVICE
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
com.majeur.launcher.permission.UPDATE_BADGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_APP_BADGE
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
me.everything.badger.permission.BADGE_COUNT_READ
me.everything.badger.permission.BADGE_COUNT_WRITE
com.google.android.providers.gsf.permission.READ_GSERVICES
com.google.android.gms.permission.ACTIVITY_RECOGNITION
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

host.exp.exponent.referrer.InstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.android.gms.analytics.AnalyticsReceiver

com.google.android.gms.analytics.ANALYTICS_DISPATCH

host.exp.exponent.notifications.receivers.SchedulingTriggerReceiver

android.intent.action.REBOOT
android.intent.action.BOOT_COMPLETED
android.intent.action.TIMEZONE_CHANGED
android.intent.action.TIME_CHANGED
android.intent.action.QUICKBOOT_POWERON

expo.modules.notifications.notifications.service.ScheduledAlarmReceiver

expo.modules.notifications.TRIGGER_EVENT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON

expo.modules.taskManager.TaskBroadcastReceiver

expo.modules.taskManager.TaskBroadcastReceiver.INTENT_ACTION
android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_ACCESS_TOKEN_CHANGED

com.facebook.CampaignTrackingReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

Services

host.exp.exponent.fcm.ExpoFcmMessagingService

com.google.firebase.MESSAGING_EVENT

host.exp.exponent.services.ScopedExpoNotificationsService

expo.modules.notifications.NOTIFICATION_EVENT

expo.modules.notifications.FirebaseListenerService

com.google.firebase.MESSAGING_EVENT

expo.modules.notifications.notifications.service.ExpoNotificationsService

expo.modules.notifications.CATEGORY_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT
BCLjoy_200.emd
BCLlefteyeclosed_200.emd
BCLrighteyeclosed_200.emd
LMprec_600.emd
MFT_fssd_accgray.pb
MFT_fssd_fastgray.pb
app.bundle
.js
app.manifest
asset_02bc1fa7c0313217bde2d65ccbff40c9.png
.png
asset_0886a6b127c6057cee83f9c65c7ffd62.json
asset_09dd345dbd4ec5a0874841d5749ac153.json
asset_0ea69b5077e7c4696db85dbcba75b0e1.png
.png
asset_140c53a7643ea949007aa9a282153849.ttf
asset_1a0e3525dd5df87e77057204129a5e6e.json
asset_1e5157c55999be592eb6ea5f920f2147.json
asset_2379ae894c2c9f63b852a9f3676c2763.png
.png
asset_23bfef5a2cc986befc66df420cb56889.json
asset_2ac32dec71143dccca808a592a85eb9f.json
asset_2dd3a3e61fb252e9dcb6af9e6aec37ab.json
asset_35ba0eaec5a4f5ed12ca16fabeae451d.png
.png
asset_376d6a4c7f622917c39feb23671ef71d.png
.png
asset_39843e5d52a6c5c42d5abdb0b34bcaa6.json
asset_3a2ba31570920eeb9b1d217cabe58315.ttf
asset_3c851d60ad5ef3f2fe43ebd263490d78.ttf
asset_3e6805fbc794680014716b8c752f20b8.json
asset_461d9bba8b6a3c91675039df12cfe6ca.json
asset_5223c8d9b0d08b82a5670fb5f71faf78.png
.png
asset_54a5c98d22f313098b3dbe2d5b2e87ba.json
asset_59e1d07580be5bc3c66af78930b04b98.json
asset_5cdf883b18a5651a29a4d1ef276d2457.ttf
asset_60668d999bbaf663420340f7bdd580d7.json
asset_647543ebfccf6e5495434383598453d1.json
asset_665d9d6a3227c85fcb50f3f86ccad80c.png
.png
asset_672c933f8123dda6d0e731c58bd5f4e1.json
asset_6d960622b5d2bdcd2e757ea77d8cd4ea.json
asset_744ce60078c17d86006dd0edabcd59a7.ttf
asset_74d124a3caeac2bea111f3ca2f2dd34a.json
asset_778ffc9fe8773a878e9c30a6304784de.png
.png
asset_7c519c6f00d65602c16b98bdffddc6f4.png
.png
asset_7d40544b395c5949f4646f5e150fe020.png
.png
asset_7e078700f0c35367a56c5bbb2047dda7.json
asset_8b12b3e16d591abc926165fa8f760e3b.json
asset_8e7f807ef943bff1f6d3c2c6e0f3769e.ttf
asset_92342ace2ac52e29a7fce51b89c2cbd0.png
.png
asset_94c4ffdcbffeb0570c635d7f8edd8a25.json
asset_9f05530c64a774d02410e02d0d1554f3.json
asset_a132ecc4ba5c1517ff83c0fb321bc7fc.png
.png
asset_a37b0c01c0baf1888ca812cc0508f6e2.ttf
asset_a4e0725c66112486cc6f4ab4e0025528.png
.png
asset_a5e0abbdbd82bc804c2eb86eff046d52.png
.png
asset_ae74bb20586a731af545e6b00fe14a09.png
.png
asset_b06871f281fee6b241d60582ae9369b9.ttf
asset_b2e0fc821c6886fb3940f85a3320003e.ttf
asset_b49ae8ab2dbccb02c4d11caaacf09eab.ttf
asset_b70cea0339374107969eb53e5b1f603f.ttf
asset_bcc034acc51c5c8f92c257a28ec9a1d6.json
asset_c39278f7abfc798a241551194f55e29f.ttf
asset_c79c3606a1cf168006ad3979763c7e0c.png
.png
asset_ca9ce9ff0676a9b04ef0f8a3ad17dd08.ttf
asset_ccb993f31c04afbcca02178df04f4170.png
.png
asset_cdd04e13d4ec83ff0cd13ec8dabdc341.png
.png
asset_d2285965fe34b05465047401b8595dd0.ttf
asset_d260a261f41d93b96bdfc1ab7323f29b.json
asset_d916e34c419b7246d59efe2dc965ff75.png
.png
asset_ddf6610eb512edae2ba722a7212c3ecc.png
.png
asset_e20945d7c929279ef7a6f1db184a4470.ttf
asset_f1f91feb805137c9283fb766620ec5eb.json
asset_f39b4d4f351495ad948f880253d58943.png
.png
asset_f5b790e2ac193b3d41015edb3551f9b8.png
.png
asset_f6180ec50c427ae211e2006b5f4db1c5.json
asset_f6c6f6c8cb7784254ad00056f6fbd74e.ttf
asset_fdc01171a7a7ea76b187afcd162dee7d.json
audience_network.dex
.dex
blazeface.tfl
contours.tfl
fssd_100_8bit_gray_v1.tflite
fssd_100_8bit_v1.tflite
fssd_25_8bit_gray_v1.tflite
fssd_25_8bit_v1.tflite
kernel-manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: infected

com.pegazus.fallprotect

host.exp.exponent.MainActivity

Activities

host.exp.exponent.MainActivity

host.exp.exponent.experience.TvActivity

net.openid.appauth.RedirectUriReceiverActivity

expo.modules.payments.stripe.RedirectUriReceiver

abi39_0_0.expo.modules.payments.stripe.RedirectUriReceiver

abi38_0_0.expo.modules.payments.stripe.RedirectUriReceiver

abi37_0_0.expo.modules.payments.stripe.RedirectUriReceiver

abi36_0_0.expo.modules.payments.stripe.RedirectUriReceiver

com.facebook.CustomTabActivity

Permissions

Receivers

host.exp.exponent.referrer.InstallReferrerReceiver

com.google.android.gms.analytics.AnalyticsReceiver

host.exp.exponent.notifications.receivers.SchedulingTriggerReceiver

expo.modules.notifications.notifications.service.ScheduledAlarmReceiver

expo.modules.taskManager.TaskBroadcastReceiver

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.CampaignTrackingReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

Services

host.exp.exponent.fcm.ExpoFcmMessagingService

host.exp.exponent.services.ScopedExpoNotificationsService

expo.modules.notifications.FirebaseListenerService

expo.modules.notifications.notifications.service.ExpoNotificationsService

com.google.firebase.messaging.FirebaseMessagingService