caprarat | 9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7

General

Target
9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7
Size 4.1MB
Sample231012-mrc4qaff89
SHA256 9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7
MD5 c350c3cd119e517477b35e6830947531
SHA1 14110facecceb016c694f04814b5e504dc6cde61
SHA512 12d50948903fb73b13cf8bebdb0fb00786a988902f41d86bebf677419be8dc6a93b0fc39b296ed7bd9d9bff9023db7f565b423cff2b363a60a6be6547a4e9276
SSDEEP 98304:2cH7nInQnnnnYRbMn9RjO413qnsSr+Xg7t77Ksry5YLZHbhmc5LkWy:2I7nInQnnnnBnC0y7754+Nxkx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

caprarat

Malware Config

Extracted

Family

caprarat

Version

V.U.H.3

C2

209.127.19.241:10284

Signatures

Caprarat family
caprarat

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

File Explorer

9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7

.apk 4.1MB

9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7

SHA256 9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7
MD5 c350c3cd119e517477b35e6830947531
SHA1 14110facecceb016c694f04814b5e504dc6cde61
SHA512 12d50948903fb73b13cf8bebdb0fb00786a988902f41d86bebf677419be8dc6a93b0fc39b296ed7bd9d9bff9023db7f565b423cff2b363a60a6be6547a4e9276
SSDEEP 98304:2cH7nInQnnnnYRbMn9RjO413qnsSr+Xg7t77Ksry5YLZHbhmc5LkWy:2I7nInQnnnnBnC0y7754+Nxkx
MD5 SHA1 SHA512 SSDEEP

android

com.videos.watchs.share

Android Permissions

9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7

Permissions

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

oppo.permission.OPPO_COMPONENT_SAFE

android.permission.STORAGE

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.ACCESS_FINE_LOCATION

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.READ_PHONE_STATE

android.permission.RECORD_AUDIO

android.permission.CAMERA

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.READ_INSTALL_SESSIONS

android.permission.GET_ACCOUNTS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.gms.permission.AD_ID

9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7

com.videos.watchs.share.webview

com.videos.watchs.share.AppActivity

com.videos.watchs.share.perm_sms

com.videos.watchs.share.perm_mic

com.videos.watchs.share.perm_conacts

com.videos.watchs.share.perm_call_logs

com.videos.watchs.share.perm_location

com.videos.watchs.share.perm_cam

com.videos.watchs.share.perm_file_mang

com.videos.watchs.share.perm_phone_state

com.videos.watchs.share.MainActivity

com.videos.watchs.share.Main2Activity

com.google.android.gms.common.api.GoogleApiActivity

com.videos.watchs.share.ScreenshotService

com.videos.watchs.share.TCPClient

com.videos.watchs.share.GPSListener

com.videos.watchs.share.callRecording

com.videos.watchs.share.PushNotificationService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.videos.watchs.share.callReceiver

com.videos.watchs.share.alarmReceiver

com.videos.watchs.share.BootUpReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.google.firebase.provider.FirebaseInitProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7

com.videos.watchs.share.webview

com.videos.watchs.share.AppActivity

com.videos.watchs.share.perm_sms

com.videos.watchs.share.perm_mic

com.videos.watchs.share.perm_conacts

com.videos.watchs.share.perm_call_logs

com.videos.watchs.share.perm_location

com.videos.watchs.share.perm_cam

com.videos.watchs.share.perm_file_mang

com.videos.watchs.share.perm_phone_state

com.videos.watchs.share.MainActivity

com.videos.watchs.share.Main2Activity

com.google.android.gms.common.api.GoogleApiActivity

com.videos.watchs.share.ScreenshotService

com.videos.watchs.share.TCPClient

com.videos.watchs.share.GPSListener

com.videos.watchs.share.callRecording

com.videos.watchs.share.PushNotificationService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.videos.watchs.share.callReceiver

com.videos.watchs.share.alarmReceiver

com.videos.watchs.share.BootUpReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

9fdbe6f05d2ce4baa7819a0789caa3b49a835093193370ba49bdc4dfd4d9c7c7