5f609ce7020df85f0231e9862b7435fb[.]bin

Sharing

Copy URL

Twitter E-mail

General

Target

5f609ce7020df85f0231e9862b7435fb.bin
Size

25.6MB
MD5

ea017a3042bb5d7eb2dc3d57da991bf6
SHA1

9fab8fdd64797eec768f44d7f37b04b524b54480
SHA256

88b1eb82e396ff6212af54c09bf22971f0b3309dcedbcc1aa7e7f8e9de382442
SHA512

df2b61f085fef9bd604d5e2d6dee7399fe52b1d94df08a4c3ff9309d01027b94f2769517f4d03972d4cf03868f8e729b442d14baf53972d5584d2d23f5d1cd46
SSDEEP

786432:eRVuXGG3Crh4JQuRVHpF29nd1kBMrIY1Q:7RqSOqVzi1kBeJ1Q

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Files

5f609ce7020df85f0231e9862b7435fb.bin
.zip

Password: infected
85899457d67ec7a33751203ce6af4f98699d6832f0cf0264db1163c21e70b8ba.zip
.zip

Password: infected
com.glovie.plus.apk
.apk android

Password: infected

com.glovie.plus

com.glovie.plus.MainActivity

Activities

com.glovie.plus.MainActivity

android.intent.action.MAIN
android.intent.action.SEND

com.facebook.CustomTabActivity

android.intent.action.VIEW

Permissions

android.permission.INTERNET
com.google.android.gms.permission.AD_ID
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.WAKE_LOCK
android.permission.FOREGROUND_SERVICE
android.permission.POST_NOTIFICATIONS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.VIBRATE
android.permission.USE_FULL_SCREEN_INTENT
android.permission.SCHEDULE_EXACT_ALARM
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
com.google.android.c2dm.permission.RECEIVE
com.android.vending.BILLING
com.applovin.array.apphub.permission.BIND_APPHUB_SERVICE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.ACCESS_ADSERVICES_AD_ID
android.permission.ACCESS_ADSERVICES_ATTRIBUTION
android.permission.ACCESS_ADSERVICES_TOPICS
com.glovie.plus.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
com.majeur.launcher.permission.UPDATE_BADGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_APP_BADGE
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
me.everything.badger.permission.BADGE_COUNT_READ
me.everything.badger.permission.BADGE_COUNT_WRITE

Receivers

io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingReceiver

com.google.android.c2dm.intent.RECEIVE

com.dexterous.flutterlocalnotifications.ScheduledNotificationBootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON

id.flutter.flutter_background_service.BootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_ACCESS_TOKEN_CHANGED

com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_AUTHENTICATION_TOKEN_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION

Services

io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT
AssetManifest.bin
AssetManifest.json
CupertinoIcons.ttf
FontManifest.json
MaterialIcons-Regular.otf
NOTICES.Z
.gz

Password: infected
NOTICES.Z
ad.html
.html .js
android_bridge.js
.js
app_icon.png
.png

Password: infected
audience_network.dex
.dex
banner_default_h.png
.png

Password: infected
baseline.prof
baseline.profm
cid
.elf linux x86
cntAnytimeLeft.png
dt-mraid-video-controller.js
.js
dt-omsdk-mraid-video-tracker.js
.js
features_config.json
fyb_iframe_endcard_tmpl.html
.html
fyb_static_endcard_tmpl.html
.js
ia_js_load_monitor.txt
.html .js
ia_mraid_bridge.txt
.html .js
ic_launcher.png
.png

Password: infected
ink_sparkle.frag
movie_default.png
.png

Password: infected
mraid.js
.js
mraid3.js
.js
no_sleep.js
.js
omid-session-client-v1.js
.js
omsdk-v1.js
.js
rv_binddatas.xml
.xml
t-rex.css
t-rex.html
.js
toastify.css
toastify.js
.js
tt_mime_type.pro
ui.js
.js
vpaid_html_template.html
.html .js
x_home_account.png
.png

Password: infected
x_home_application.png
.png
x_home_bank_card.png
.png
x_home_email.png
.png
x_home_group.png
.png
x_home_password.png
.png
x_setting_about.png
.png
x_setting_evaluate.png
.png
x_setting_feedback.png
.png
x_setting_share.png
.png
config.ar.apk
.apk android

com.glovie.plus
config.arm64_v8a.apk
.apk android arch:arm64

com.glovie.plus
config.de.apk
.apk android

com.glovie.plus
config.en.apk
.apk android

com.glovie.plus
config.es.apk
.apk android

com.glovie.plus
config.fr.apk
.apk android

com.glovie.plus
config.hi.apk
.apk android

com.glovie.plus
config.in.apk
.apk android

com.glovie.plus
config.it.apk
.apk android

com.glovie.plus
config.ja.apk
.apk android

com.glovie.plus
config.ko.apk
.apk android

com.glovie.plus
config.my.apk
.apk android

com.glovie.plus
config.pt.apk
.apk android

com.glovie.plus
config.ru.apk
.apk android

com.glovie.plus
config.th.apk
.apk android

com.glovie.plus
config.tr.apk
.apk android

com.glovie.plus
config.vi.apk
.apk android

com.glovie.plus
config.xxhdpi.apk
.apk android

com.glovie.plus
config.zh.apk
.apk android

com.glovie.plus
icon.png
.png
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

com.glovie.plus

com.glovie.plus.MainActivity

Activities

com.glovie.plus.MainActivity

com.facebook.CustomTabActivity

Permissions

Receivers

io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingReceiver

com.dexterous.flutterlocalnotifications.ScheduledNotificationBootReceiver

id.flutter.flutter_background_service.BootReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

Services

io.flutter.plugins.firebase.messaging.FlutterFirebaseMessagingService

com.google.firebase.messaging.FirebaseMessagingService

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

Password: infected

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus

com.glovie.plus