836768884f610abb11db2f4a9cc1c45e86573544789c2bb977cb0ec3f8385eca

General

Target

836768884f610abb11db2f4a9cc1c45e86573544789c2bb977cb0ec3f8385eca
Size

22.5MB
MD5

11bd43dacfc7051f17788c1a16aeceae
SHA1

e1c75b5a91ebfb59a90a05988a28a156d633b892
SHA256

836768884f610abb11db2f4a9cc1c45e86573544789c2bb977cb0ec3f8385eca
SHA512

a7eb5eda21067e64d0316cd1e99cc137903550149e700dc2258782bc6d4139fbe03ea6faf62c297b36227c088a46b72debdc9255135778e6af178fb30b48e0da
SSDEEP

393216:HoSOikdKmqaLaY4oIJbzhTn65tuZPTlcT5MSwbRJaXZ2hjRvl+yjLdrH7Jdri:ITdOaeY+z96aZC5MSwbR+Z2htvRFji

Score

8^/10

upx

Malware Config

Signatures

Patched UPX-packed file 2 IoCs

Sample is packed with UPX but required header fields are zeroed out to prevent unpacking with the default UPX tool.

resource	yara_rule
sample	patched_upx
sample	patched_upx

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx
sample	upx

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Files

836768884f610abb11db2f4a9cc1c45e86573544789c2bb977cb0ec3f8385eca
.apk android arch:arm

com.wedoit.servicestation

com.wedoit.servicestation.ui.activity.SplashActivity

Activities

com.wedoit.servicestation.ui.activity.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.CHANGE_WIFI_MULTICAST_STATE
android.permission.VIBRATE
android.permission.READ_PHONE_STATE
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.GET_TASKS
android.permission.CAMERA
android.permission.Loca
android.permission.CALL_PHONE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.GET_ACCOUNTS
android.permission.READ_CONTACTS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACCESS_MOCK_LOCAT
android.permission.READ_LOGS
android.permission. INTERACT_ACROSS_USERS

Receivers

com.wedoit.servicestation.socket.MyReceiver

com.wedoit.servicestation.destroy

Services
amap_resource1_0_0.png
.apk android

com.amap.api.map3d
autonavi_Resource1_1_0.png
.apk android

com.amap.api.navi

com.amap.api.navi.AmapRouteActivity

Activities

Permissions

android.permission.INTERNET
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_SETTINGS
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_FINE_LOCATION
android.permission.READ_PHONE_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_CONFIGURATION
android.permission.WAKE_LOCK
android.permission.READ_EXTERNAL_STORAGE

Android Permissions

836768884f610abb11db2f4a9cc1c45e86573544789c2bb977cb0ec3f8385eca

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.CHANGE_WIFI_MULTICAST_STATE

android.permission.VIBRATE

android.permission.READ_PHONE_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_LOCATION_EXTRA_COMMANDS

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.GET_TASKS

android.permission.CAMERA

android.permission.Loca

android.permission.CALL_PHONE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.GET_ACCOUNTS

android.permission.READ_CONTACTS

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACCESS_MOCK_LOCAT

android.permission.READ_LOGS

android.permission. INTERACT_ACROSS_USERS

Sharing

General

Malware Config

Signatures

Files

com.wedoit.servicestation

com.wedoit.servicestation.ui.activity.SplashActivity

Activities

com.wedoit.servicestation.ui.activity.SplashActivity

Permissions

Receivers

com.wedoit.servicestation.socket.MyReceiver

Services

com.amap.api.map3d

com.amap.api.navi

com.amap.api.navi.AmapRouteActivity

Activities

Permissions

Android Permissions

836768884f610abb11db2f4a9cc1c45e86573544789c2bb977cb0ec3f8385eca