95ec45a28e76b0e805e1fa5aaef3f6033355caf2bb400fef058084fac402d3c6

General

Target

95ec45a28e76b0e805e1fa5aaef3f6033355caf2bb400fef058084fac402d3c6
Size

21.7MB
MD5

d407b8607facbb689f8bd8fc63053873
SHA1

d1ce83049e43778fc3a618c0cc3b384e7975e176
SHA256

95ec45a28e76b0e805e1fa5aaef3f6033355caf2bb400fef058084fac402d3c6
SHA512

d4e10848e5e65ae374b856ed79537bfaf0650b22753a221782fbd93674812ca721e9a528eafb7ef573540cf44e09758682594cd45725232427bff52df451f702
SSDEEP

393216:Cv+SEyw6hU6G6TpbMkB6/Mp+ntVHNo16LJ9d29sW4X6nfQ+8xDhe3:fdyfnTR9gbtok8ze6nXAQ

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

95ec45a28e76b0e805e1fa5aaef3f6033355caf2bb400fef058084fac402d3c6
.apk android arch:arm64 arch:arm arch:x86 arch:x64

com.golink.tun

com.golink.tun.splash.SplashActivity

Activities

com.golink.tun.splash.SplashActivity

android.intent.action.MAIN

com.golink.tun.home.GoLinkActivity

android.service.quicksettings.action.QS_TILE_PREFERENCES

com.golink.tun.JPush.TestActivity

jpush.testAction

cn.jpush.android.ui.PushActivity

cn.jpush.android.ui.PushActivity

cn.jpush.android.service.JNotifyActivity

cn.jpush.android.intent.JNotifyActivity

Permissions

com.golink.tun.permission.JPUSH_MESSAGE
android.permission.READ_CONTACTS
android.permission.INTERNET
android.permission.NFC
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.VIBRATE
android.permission.CAMERA
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.FOREGROUND_SERVICE
android.permission.WAKE_LOCK
com.google.android.providers.gsf.permission.READ_GSERVICES
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.FLASHLIGHT
android.permission.READ_PHONE_STATE
com.android.vending.BILLING
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
com.google.android.c2dm.permission.RECEIVE

Receivers

cn.jpush.android.service.PushReceiver

cn.jpush.android.intent.NOTIFICATION_RECEIVED_PROXY
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

com.golink.tun.JPush.MyReceiver

cn.jpush.android.intent.REGISTRATION
cn.jpush.android.intent.MESSAGE_RECEIVED
cn.jpush.android.intent.NOTIFICATION_RECEIVED
cn.jpush.android.intent.NOTIFICATION_OPENED
cn.jpush.android.intent.CONNECTION

com.golink.tun.JPush.MyJPushMessageReceiver

cn.jpush.android.intent.RECEIVE_MESSAGE

com.golink.tun.BootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.LOCKED_BOOT_COMPLETED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

com.xdandroid.hellodaemon.WakeUpReceiver

android.intent.action.USER_PRESENT
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
com.xdandroid.hellodaemon.CANCEL_JOB_ALARM_SUB

com.xdandroid.hellodaemon.WakeUpReceiver$WakeUpAutoStartReceiver

android.intent.action.BOOT_COMPLETED
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

Services

cn.jpush.android.service.PushService

cn.jpush.android.intent.REGISTER
cn.jpush.android.intent.REPORT
cn.jpush.android.intent.PushService
cn.jpush.android.intent.PUSH_TIME

cn.jpush.android.service.DaemonService

cn.jpush.android.intent.DaemonService

com.golink.tun.bg.TileService

android.service.quicksettings.action.QS_TILE

com.golink.tun.JPush.PushService

cn.jiguang.user.service.action

com.golink.tun.firebase.MyFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.golink.tun.bg.VpnService

android.net.VpnService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

Android Permissions

95ec45a28e76b0e805e1fa5aaef3f6033355caf2bb400fef058084fac402d3c6

Permissions

com.golink.tun.permission.JPUSH_MESSAGE

android.permission.READ_CONTACTS

android.permission.INTERNET

android.permission.NFC

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.VIBRATE

android.permission.CAMERA

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FLASHLIGHT

android.permission.READ_PHONE_STATE

com.android.vending.BILLING

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.c2dm.permission.RECEIVE

Sharing

General

Malware Config

Signatures

Files

com.golink.tun

com.golink.tun.splash.SplashActivity

Activities

com.golink.tun.splash.SplashActivity

com.golink.tun.home.GoLinkActivity

com.golink.tun.JPush.TestActivity

cn.jpush.android.ui.PushActivity

cn.jpush.android.service.JNotifyActivity

Permissions

Receivers

cn.jpush.android.service.PushReceiver

com.golink.tun.JPush.MyReceiver

com.golink.tun.JPush.MyJPushMessageReceiver

com.golink.tun.BootReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

com.xdandroid.hellodaemon.WakeUpReceiver

com.xdandroid.hellodaemon.WakeUpReceiver$WakeUpAutoStartReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

Services

cn.jpush.android.service.PushService

cn.jpush.android.service.DaemonService

com.golink.tun.bg.TileService

com.golink.tun.JPush.PushService

com.golink.tun.firebase.MyFirebaseMessagingService

com.golink.tun.bg.VpnService

com.google.firebase.messaging.FirebaseMessagingService

Android Permissions

95ec45a28e76b0e805e1fa5aaef3f6033355caf2bb400fef058084fac402d3c6