General

  • Target

    GMRummy.apk

  • Size

    55.1MB

  • MD5

    9857f7d15ec172b3d1d5c28ddd3507b7

  • SHA1

    61a629ec667baf85e364228eb0a1ea6c0030a94b

  • SHA256

    c2d8b753a7c194f0dfb9cc963a1ad41b22c4cb9ca5e80bb776eb05b3543dbdbe

  • SHA512

    6a40fd46f42d3978288ec46787c1cd241b36f713fe6ca9ea161e02bf9155d9fa1264a935e86def69fe611dd39df961410336f23af8ce493e2cd9d37bbc0ed705

  • SSDEEP

    1572864:LLSQYyGSrN2JtqvakA5GJHyIYs28ZVleRHTuzCaL4:L+yGnjeXHyIW+V4T

Score
10/10

Malware Config

Extracted

Family

axbanker

C2

https://mega-gridlogic-rummy-default-rtdb.firebaseio.com

Signatures

  • Axbanker family
  • Requests dangerous framework permissions 12 IoCs

Files

  • GMRummy.apk
    .apk android

    com.mega.app.rummy

    in.glg.container.views.activities.SplashActivity


Android Permissions

GMRummy.apk

Permissions

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_SETTINGS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.WAKE_LOCK

android.permission.CAMERA

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.EXPAND_STATUS_BAR

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_AUDIO

android.permission.FOREGROUND_SERVICE

com.google.android.gms.permission.AD_ID

android.permission.POST_NOTIFICATIONS

com.google.android.c2dm.permission.RECEIVE

com.truecaller.permission.sdk.internal.read_account_state

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.mega.app.rummy.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION