5fae777a2d8f1134c8555b6826c2db1aa28ddbe7[.]apk[.]tar[.]gz

Resubmissions

11/12/2023, 20:54

231211-zp3ykshbfq 6

11/12/2023, 20:45

11/12/2023, 20:41

11/12/2023, 20:40

11/12/2023, 20:39

11/12/2023, 20:38

Sharing

Copy URL

Twitter E-mail

General

Target

5fae777a2d8f1134c8555b6826c2db1aa28ddbe7.apk.tar.gz
Size

13.1MB
MD5

e1fb281f428a399a669b3f4a7c101517
SHA1

e11d095ba7e2515eb92ff505f1786518beb03def
SHA256

20504921632538b31e36b367243fbd1b41314fd1c471323e06e900119f817019
SHA512

fed04141d5fea99ce55d5fd6ed361f7cb0dc1cca9e6fa642b34e2ef533991bfa6c96b092f50bee444ef59115ff65773c6a434489a437328b9746d748d2bce490
SSDEEP

393216:ukmW4u1Dk2ySQlJlFoc0QuxxcAHujLa6c:ukzVQuDJmLa6c

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION

Files

5fae777a2d8f1134c8555b6826c2db1aa28ddbe7.apk.tar.gz
.zip

Password: infected_te_report
5fae777a2d8f1134c8555b6826c2db1aa28ddbe7.apk
.apk android arch:arm

Password: infected_te_report

com.zimperium.zanti

com.zimperium.zanti.zcloud.ZcloudMainActivity

Activities

com.zimperium.zanti.zcloud.ZcloudMainActivity

android.intent.action.MAIN

Permissions

android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.GET_ACCOUNTS
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.ACCESS_COARSE_LOCATION
android.permission.BROADCAST_STICKY
android.permission.ACCESS_FINE_LOCATION
com.zimperium.permission.UPDATE_ZIPS_INFO
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_SUPERUSER
android.permission.CHANGE_NETWORK_STATE

Receivers

com.zimperium.zanti.BootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_RESTARTED

.CrackerPlugin.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

.RouterPwnPlugin.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

.zmitm.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

.ztether.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

com.zimperium.zanti.zetasploit.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

com.zimperium.zanti.macchanger.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

com.zimperium.zanti.heartbleedplugin.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

com.zimperium.zanti.ShellShockPlugin.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

com.zimperium.zanti.SSLPoodlePlugin.PluginAnnouncer

com.zimperium.zanti.plugins.DETECT

Services

Resubmissions

Sharing

General

Malware Config

Signatures

Files

Password: infected_te_report

Password: infected_te_report

com.zimperium.zanti

com.zimperium.zanti.zcloud.ZcloudMainActivity

Activities

com.zimperium.zanti.zcloud.ZcloudMainActivity

Permissions

Receivers

com.zimperium.zanti.BootReceiver

.CrackerPlugin.PluginAnnouncer

.RouterPwnPlugin.PluginAnnouncer

.zmitm.PluginAnnouncer

.ztether.PluginAnnouncer

com.zimperium.zanti.zetasploit.PluginAnnouncer

com.zimperium.zanti.macchanger.PluginAnnouncer

com.zimperium.zanti.heartbleedplugin.PluginAnnouncer

com.zimperium.zanti.ShellShockPlugin.PluginAnnouncer

com.zimperium.zanti.SSLPoodlePlugin.PluginAnnouncer

Services