user_cert[.]apk | Triage

Sharing

General

Target

user_cert.apk
Size

12.1MB
MD5

8eb39bce6c328e5543c01f8cb65aeb98
SHA1

30b53784091a3f9943814789a6cf9fe418b30d44
SHA256

c20ee37b09a5fcdbd354f5b681b32fc0424b5f09739afc61be63aae281994ac7
SHA512

66d6b4b958a5e10262fa251b6e4ea9295f78525f2be06afad2b3b969119ed3d45bee5ab93c707a1a4616b75d83551312a1ea45fe310f5e5a8048fd56650094ab
SSDEEP

98304:lkZAu5bEh+rfjsPlRwcN+K62u5MyAvOwx6mBYhL0qF2ed8AHD:A5bPfjI0/s2GKQ5AHD

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Files

user_cert.apk
.apk android

com.secure.itsonfire

com.secure.itsonfire.MalwareInvadersActivity

Activities

com.secure.itsonfire.MalwareInvadersActivity

android.intent.action.MAIN

Permissions

android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.REORDER_TASKS
android.permission.USE_FULL_SCREEN_INTENT
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
android.Manifest.permission.CALL_PHONE
android.permission.POST_NOTIFICATIONS
com.google.android.c2dm.permission.RECEIVE
android.permission.INTERNET
com.google.android.gms.permission.AD_ID
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE

Services

com.secure.itsonfire.MessageWorker

com.google.firebase.MESSAGING_EVENT
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.ACTION_BOOT_COMPLETED
android.intent.action2.RESTART
android.intent.action.REBOOT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT
baseline.prof
baseline.profm
damageshelter.ogg
invaderexplode.ogg
oh.ogg
playerexplode.ogg
shoot.ogg
uh.ogg

Android Permissions

user_cert.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.REORDER_TASKS

android.permission.USE_FULL_SCREEN_INTENT

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.Manifest.permission.CALL_PHONE

android.permission.POST_NOTIFICATIONS

com.google.android.c2dm.permission.RECEIVE

android.permission.INTERNET

com.google.android.gms.permission.AD_ID

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE