metasploit | 7d2bf906bdc06d1de0eb4d8c68490950e05bf02c9ff0929a71d6037e49443677

Sharing

Copy URL Twitter E-mail

General

Target

7d2bf906bdc06d1de0eb4d8c68490950e05bf02c9ff0929a71d6037e49443677
Size

23.3MB
MD5

e066fbd34803833bac432d4c3fbed27d
SHA1

ab75070c032223004cbb9e9755d9797e6c037201
SHA256

7d2bf906bdc06d1de0eb4d8c68490950e05bf02c9ff0929a71d6037e49443677
SHA512

708d258aaed05544363d6d1de339bf9c49f7c1e808618b41e9e5af1d7502f018bad300434980abe75c6cbc029a481e29b496df31dbde4f6215059017554c2bd1
SSDEEP

393216:jTWPbi5SWBq9GvHRcrqWJjanNfpog3hIbKBkm7E:jTW8/g9EHR/1nBHAK+m7E

Score

10^/10

metasploit

Malware Config

Signatures

Metasploit family
metasploit

Metasploit payload 1 IoCs

resource	yara_rule
sample	family_metasploit

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS

Files

7d2bf906bdc06d1de0eb4d8c68490950e05bf02c9ff0929a71d6037e49443677
.apk android arch:x86 arch:x64 arch:arm arch:arm64

com.google.android.keep

com.google.android.apps.keep.ui.activities.BrowseActivity

Activities

com.google.android.apps.keep.ui.activities.SecureDrawingLauncherActivity

com.motorola.stylus.secure.OPEN
com.motorola.stylus.OPEN

com.google.android.apps.keep.system.ui.SystemLauncherActivity

android.intent.action.CREATE_NOTE

com.google.android.apps.keep.ui.widgets.singlenote.SingleNoteWidgetConfigureActivity

android.appwidget.action.APPWIDGET_CONFIGURE

Permissions

android.permission.SET_WALLPAPER
android.permission.CALL_PHONE
android.permission.WRITE_CONTACTS
android.permission.RECEIVE_SMS
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.SEND_SMS
android.permission.READ_SMS
android.permission.CAMERA
android.permission.READ_PHONE_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_CALL_LOG
android.permission.READ_CALL_LOG
android.permission.WRITE_SETTINGS
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.GET_ACCOUNTS
android.permission.GET_PACKAGE_SIZE
android.permission.INTERNET
android.permission.POST_NOTIFICATIONS
android.permission.READ_SYNC_SETTINGS
android.permission.READ_SYNC_STATS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.SUBSCRIBED_FEEDS_READ
android.permission.SUBSCRIBED_FEEDS_WRITE
android.permission.USE_CREDENTIALS
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_SYNC_SETTINGS
com.google.android.providers.gsf.permission.READ_GSERVICES
com.google.android.voicesearch.AUDIO_FILE_ACCESS
com.google.android.c2dm.permission.RECEIVE
android.permission.READ_CONTACTS

Receivers

com.google.android.keep.sharing.SharingRepostNotificationReceiver

android.intent.action.LOCALE_CHANGED
android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED

com.google.android.keep.appindexing.AppIndexingUpdateReceiver

com.google.firebase.appindexing.UPDATE_INDEX

com.google.android.keep.homescreenwidget.MemoryAppWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE
com.google.android.keep.intent.action.PROVIDER_CHANGED
com.google.android.keep.intent.action.WIDGET_CONFIGURED

com.google.android.keep.quickaddwidget.QuickAddWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE
com.google.android.keep.intent.action.PROVIDER_CHANGED
com.google.android.keep.intent.action.WIDGET_CONFIGURED

com.google.android.apps.keep.shared.serviceenabler.EnablerBroadcastReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED

com.google.android.apps.keep.shared.sliceprovider.impl.SliceBroadcastReceiver

com.google.android.keep.slices.action.CHECK
com.google.android.keep.slices.action.UNCHECK

com.google.android.keep.notification.NotificationChannelReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED
android.intent.action.LOCALE_CHANGED

com.google.android.keep.notification.ReminderNotificationReceiver

android.intent.action.TIME_SET
android.intent.action.LOCALE_CHANGED
android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED
com.google.android.keep.intent.action.PROVIDER_CHANGED
com.google.android.gsf.settings.GoogleLocationSettings.UPDATE_LOCATION_SETTINGS
com.google.android.keep.intent.action.POST_LOCATION_NOTIFICATION

com.google.android.apps.keep.ui.widgets.singlenote.SingleNoteWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE
com.google.android.keep.intent.action.WIDGET_CONFIGURED
com.google.android.keep.intent.action.PROVIDER_CHANGED

com.google.android.libraries.internal.growth.growthkit.inject.GrowthKitBootCompletedBroadcastReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.MY_PACKAGE_REPLACED

com.google.android.libraries.internal.growth.growthkit.internal.debug.TestingToolsBroadcastReceiver

com.google.android.libraries.internal.growth.growthkit.ADD_PROMO
com.google.android.libraries.internal.growth.growthkit.ADD_PREVIEW_PROMO
com.google.android.libraries.internal.growth.growthkit.LOG_DEBUG_DATA
com.google.android.libraries.internal.growth.growthkit.SYNC
com.google.android.libraries.internal.growth.growthkit.CLEAR_COUNTERS
com.google.android.libraries.internal.growth.growthkit.FETCH_PROMOTIONS
com.google.android.libraries.internal.growth.growthkit.FETCH_EVAL_RESULTS
com.google.android.libraries.internal.growth.growthkit.GET_REGISTRATION_STATE

com.google.android.libraries.notifications.platform.entrypoints.accountchanged.AccountChangedReceiver

android.accounts.LOGIN_ACCOUNTS_CHANGED

com.google.android.libraries.notifications.platform.entrypoints.localechanged.LocaleChangedReceiver

android.intent.action.LOCALE_CHANGED

com.google.android.libraries.notifications.platform.entrypoints.push.PushReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.libraries.notifications.platform.entrypoints.restart.RestartReceiver

android.intent.action.BOOT_COMPLETED

com.google.android.libraries.notifications.platform.entrypoints.timezonechanged.TimezoneChangedReceiver

android.intent.action.TIMEZONE_CHANGED

com.google.android.libraries.notifications.platform.entrypoints.update.UpdateReceiver

android.intent.action.MY_PACKAGE_REPLACED

com.google.android.libraries.phenotype.client.stable.AccountRemovedBroadcastReceiver

android.accounts.action.ACCOUNT_REMOVED

com.google.android.libraries.phenotype.client.stable.PhenotypeUpdateBackgroundBroadcastReceiver

com.google.android.gms.phenotype.UPDATE

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.assistant.appactions.widgets.pinappwidget.PinAppWidgetBroadcastReceiver

com.google.android.assistant.appactions.widgets.COMPLETE_PIN_APP_WIDGET

com.google.android.keep.gfdvq.Xieqm

android.intent.action.BOOT_COMPLETED

Services

com.google.android.keep.syncadapter.KeepSyncAdapterService

android.content.SyncAdapter

com.google.android.libraries.phenotype.registration.PhenotypeMetadataHolderService

com.google.android.libraries.phenotype.registration.PhenotypeMetadataHolderService

com.google.android.keep.notification.RemindersListenerService

com.google.android.gms.reminders.BIND_LISTENER

com.google.assistant.appactions.widgets.pinappwidget.PinAppWidgetService

com.google.android.assistant.appactions.widgets.PIN_APP_WIDGET

com.google.android.build.data.PropertiesServiceHolder

com.google.android.build.data.Properties

Android Permissions

7d2bf906bdc06d1de0eb4d8c68490950e05bf02c9ff0929a71d6037e49443677

Permissions

android.permission.SET_WALLPAPER

android.permission.CALL_PHONE

android.permission.WRITE_CONTACTS

android.permission.RECEIVE_SMS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.CAMERA

android.permission.READ_PHONE_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_CALL_LOG

android.permission.READ_CALL_LOG

android.permission.WRITE_SETTINGS

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_NETWORK_STATE

android.permission.GET_ACCOUNTS

android.permission.GET_PACKAGE_SIZE

android.permission.INTERNET

android.permission.POST_NOTIFICATIONS

android.permission.READ_SYNC_SETTINGS

android.permission.READ_SYNC_STATS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECORD_AUDIO

android.permission.SUBSCRIBED_FEEDS_READ

android.permission.SUBSCRIBED_FEEDS_WRITE

android.permission.USE_CREDENTIALS

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.WRITE_SYNC_SETTINGS

com.google.android.providers.gsf.permission.READ_GSERVICES

com.google.android.voicesearch.AUDIO_FILE_ACCESS

com.google.android.c2dm.permission.RECEIVE

android.permission.READ_CONTACTS

Sharing

General

Malware Config

Signatures

Files

com.google.android.keep

com.google.android.apps.keep.ui.activities.BrowseActivity

Activities

com.google.android.apps.keep.ui.activities.SecureDrawingLauncherActivity

com.google.android.apps.keep.system.ui.SystemLauncherActivity

com.google.android.apps.keep.ui.widgets.singlenote.SingleNoteWidgetConfigureActivity

Permissions

Receivers

com.google.android.keep.sharing.SharingRepostNotificationReceiver

com.google.android.keep.appindexing.AppIndexingUpdateReceiver

com.google.android.keep.homescreenwidget.MemoryAppWidgetProvider

com.google.android.keep.quickaddwidget.QuickAddWidgetProvider

com.google.android.apps.keep.shared.serviceenabler.EnablerBroadcastReceiver

com.google.android.apps.keep.shared.sliceprovider.impl.SliceBroadcastReceiver

com.google.android.keep.notification.NotificationChannelReceiver

com.google.android.keep.notification.ReminderNotificationReceiver

com.google.android.apps.keep.ui.widgets.singlenote.SingleNoteWidgetProvider

com.google.android.libraries.internal.growth.growthkit.inject.GrowthKitBootCompletedBroadcastReceiver

com.google.android.libraries.internal.growth.growthkit.internal.debug.TestingToolsBroadcastReceiver

com.google.android.libraries.notifications.platform.entrypoints.accountchanged.AccountChangedReceiver

com.google.android.libraries.notifications.platform.entrypoints.localechanged.LocaleChangedReceiver

com.google.android.libraries.notifications.platform.entrypoints.push.PushReceiver

com.google.android.libraries.notifications.platform.entrypoints.restart.RestartReceiver

com.google.android.libraries.notifications.platform.entrypoints.timezonechanged.TimezoneChangedReceiver

com.google.android.libraries.notifications.platform.entrypoints.update.UpdateReceiver

com.google.android.libraries.phenotype.client.stable.AccountRemovedBroadcastReceiver

com.google.android.libraries.phenotype.client.stable.PhenotypeUpdateBackgroundBroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

com.google.assistant.appactions.widgets.pinappwidget.PinAppWidgetBroadcastReceiver

com.google.android.keep.gfdvq.Xieqm

Services

com.google.android.keep.syncadapter.KeepSyncAdapterService

com.google.android.libraries.phenotype.registration.PhenotypeMetadataHolderService

com.google.android.keep.notification.RemindersListenerService

com.google.assistant.appactions.widgets.pinappwidget.PinAppWidgetService

com.google.android.build.data.PropertiesServiceHolder

Android Permissions

7d2bf906bdc06d1de0eb4d8c68490950e05bf02c9ff0929a71d6037e49443677