wyrmspy | b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905[.]7z

Resubmissions

27/03/2024, 14:50

240327-r7nbvahf6s 10

27/03/2024, 14:46

240327-r5ddvsed39 10

Sharing

Copy URL Twitter E-mail

General

Target

b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905.7z
Size

334KB
MD5

c2a65e9b65263105e888fe9d9fc56b17
SHA1

72e48085258d141df105bf35e14382ce8d7ac6b9
SHA256

09d77ed3f79770cec53afb47cdd9c457f7898c3bedfafa9e76ea1e2bf3dbfeb9
SHA512

a8a67c5bbc99054b57283be743bff005fecba67fc6e81a6372114cda75202e57271d399595510395010a3e249ed0c730afc4287ce0510673ba848c1f02177413
SSDEEP

6144:glWDri/lw2pTLeJObcva98YAWOkDuS+Lf7HTsSNYC+M2+rKc40rP8Mfoe3D5:glW3iO8eJeUWOk+zseY30Dfoet

Score

10^/10

wyrmspy

Malware Config

Extracted

Family

wyrmspy

http://121.42.149.52:8002/

Signatures

WyrmSpy payload 1 IoCs

resource	yara_rule
static1/unpack001/b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905	family_wyrmspy1

Wyrmspy family
wyrmspy

Requests dangerous framework permissions 27 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG

Files

b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905.7z
.7z

Password: infected
b66847d571e471ac78ffa11a82dded5ac6d2f52b25304adbfab90716d22c0905
.apk android arch:arm

Password: infected

com.sec.android.provide.badge

com.flash18.MainActivity

Activities

com.flash18.MainActivity

android.intent.action.MAIN

com.ryg.dynamicload.DLProxyActivity

com.ryg.dynamicload.proxy.activity.VIEW

Permissions

android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.READ_PHONE_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
android.permission.RECORD_AUDIO
android.permission.CAMERA
android.permission.SYSTEM_ALERT_WINDOW
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_USER_PRESENT
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.READ_PHONE_STATE
android.permission.PROCESS_OUTGOING_CALLS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.INTERNET
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.READ_LOGS
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_SETTINGS
android.permission.INTERNET
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.GET_ACCOUNTS
com.android.browser.permission.READ_HISTORY_BOOKMARKS
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_CONTACTS
android.permission.WRITE_CONTACTS
android.permission.ACCESS_FINE_LOCATION
android.permission.GET_TASKS
android.permission.WAKE_LOCK
android.permission.SEND_SMS
android.permission.WRITE_SETTINGS
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.PROCESS_OUTGOING_CALLS
android.permission.RECEIVE_SMS
android.permission.READ_CALL_LOG
android.permission.WRITE_CALL_LOG

Receivers

com.flash18.BootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.USER_PRESENT
android.intent.action.RM

Services

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

Password: infected

com.sec.android.provide.badge

com.flash18.MainActivity

Activities

com.flash18.MainActivity

com.ryg.dynamicload.DLProxyActivity

Permissions

Receivers

com.flash18.BootReceiver

Services