gigabud | fake_application_dol[.]zip

General

Target

fake_application_dol.zip
Size

9.9MB
MD5

388618f9954ea12014bbca1af74085c0
SHA1

9d6a0ee944112663859f8b32e38c0d5961e8d7f4
SHA256

df47187707ce3aa7a1aa677e2ed6dc26024017ad447323ccca4eb642615cdbc4
SHA512

f7ba04929d470c28dcca6a06ef48a4ac194b9075185f21875fe6b039a8d5f4af6c71a3c8ba88e8b830ebb82477f408268531555a00082a8db2ceaf720b2fbb94
SSDEEP

196608:t372EyJaQvPqvskCiiLoYiL2lV6xs7NMkPInJjoF2xphl5iKg:tBCaqP4CpUUa+IJE4vpiL

Score

10^/10

gigabud

Malware Config

Signatures

Gigabud family
gigabud

Gigabud payload 1 IoCs

resource	yara_rule
static1/unpack001/appปลอมกรมที่ดิน_DOL.apk	family_gigabud

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Files

fake_application_dol.zip
.zip

Password: secplayground
appปลอมกรมที่ดิน_DOL.apk
.apk android arch:arm64 arch:arm

Password: secplayground

nrmahn.kwqzdrb.nahh

com.xingchat.android.activity.SplashActivity

Activities

com.xingchat.android.activity.SplashActivity

android.intent.action.MAIN

Permissions

android.permission.BIND_ACCESSIBILITY_SERVICE
android.permission.REQUEST_DELETE_PACKAGES
android.permission.QUERY_ALL_PACKAGES
android.permission.GET_INSTALLED_APPS
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.DISABLE_KEYGUARD
android.permission.WAKE_LOCK
android.permission.SYSTEM_ALERT_WINDOW
android.permission.SYSTEM_OVERLAY_WINDOW
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.FOREGROUND_SERVICE
android.permission.READ_PHONE_STATE
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.READ_SMS
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_EXTERNAL_STORAGE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.WRITE_SETTINGS
android.permission.ACCESS_NOTIFICATION_POLICY

Receivers

com.xingchat.android.receiver.GlobalBroadcast

com.xingchat.android.show.dialog
com.xingchat.android.close.dialog

Services

com.xingchat.android.controller.OpenService

cjnofdanfonoafd.hfmphfphfmhpf.gdnaogdaon

com.xingchat.android.controller.TouchAccessibilityService

android.accessibilityservice.AccessibilityService

com.blankj.utilcode.util.MessengerUtils$ServerService

nrmahn.kwqzdrb.nahh.messenger

Sharing

General

Malware Config

Signatures

Files

Password: secplayground

Password: secplayground

nrmahn.kwqzdrb.nahh

com.xingchat.android.activity.SplashActivity

Activities

com.xingchat.android.activity.SplashActivity

Permissions

Receivers

com.xingchat.android.receiver.GlobalBroadcast

Services

com.xingchat.android.controller.OpenService

com.xingchat.android.controller.TouchAccessibilityService

com.blankj.utilcode.util.MessengerUtils$ServerService