xamalicious | EZFNLauncherV2[.]apk

General

Target
EZFNLauncherV2.apk
Size 38.1MB
Sample240316-lyl5jaae87
SHA256 af6985992d674ac664c07a659515de10eae7ecade0183fda28ac46bb83bcc425
MD5 147e6b26aa1f252bf912c7a1c3a01cb6
SHA1 2cf8e0ccb43311f5885d95bc0188462077a9f77d
SHA512 89a72e52c0b739bdde18c80aef5ab162cad73f88a077429d3aff34c7d84ae7206949d5145acede4ff3359d324323fece006230a70064380e1878b3020172e89b
SSDEEP 786432:/Ym2d67A9Ls3unQn1SxlMTpxABB9F5d3fHQ62G3Zu3V0u/U1S2G:3Tn1SvMNxABB9vdx3ZgygUhG
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Android Xamalicious payload 1 IoCs

resource	yara_rule
sample	family_xamalicious

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

SHA256 af6985992d674ac664c07a659515de10eae7ecade0183fda28ac46bb83bcc425
MD5 147e6b26aa1f252bf912c7a1c3a01cb6
SHA1 2cf8e0ccb43311f5885d95bc0188462077a9f77d
SHA512 89a72e52c0b739bdde18c80aef5ab162cad73f88a077429d3aff34c7d84ae7206949d5145acede4ff3359d324323fece006230a70064380e1878b3020172e89b
SSDEEP 786432:/Ym2d67A9Ls3unQn1SxlMTpxABB9F5d3fHQ62G3Zu3V0u/U1S2G:3Tn1SvMNxABB9vdx3ZgygUhG
MD5 SHA1 SHA512 SSDEEP

com.ezfn.launcher

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.QUERY_ALL_PACKAGES

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

com.ezfn.launcher.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION