wipelock | 40e158e077a3bd18e57df47a70d553668365a61195cb3233eca09f21a4abcf90[.]zip

General

Target

40e158e077a3bd18e57df47a70d553668365a61195cb3233eca09f21a4abcf90.zip
Size

559KB
MD5

d8bf76eb658c9907a66890198296f2fe
SHA1

d02de1021cc87c077ee14d613c2c668e6f310d50
SHA256

17d937c4a908a8ef6635f7b962db5e83a5c8157b9d5cdd47860a18133cbce5a0
SHA512

9ca7f3e5c93c124d1d961e300bda9fb230f354e4844e512a7db122745260bfd5ac07f55bfdc32af68252b692513441cdd0512c89f1977da73ef31a97450cac8c
SSDEEP

12288:e6LJbf/gR8rhGBTOExY/ZQJ0uom866r/qnCVxSdiRP:1FhGBhYOe5rC8iyP

Score

10^/10

wipelock

Wipelock Android payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/40e158e077a3bd18e57df47a70d553668365a61195cb3233eca09f21a4abcf90.apk	family_wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

Processes:

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 8 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

40e158e077a3bd18e57df47a70d553668365a61195cb3233eca09f21a4abcf90.zip
.zip

Password: infected
40e158e077a3bd18e57df47a70d553668365a61195cb3233eca09f21a4abcf90.apk
.apk android

Password: infected

com.rovio.angrybirdstransformers

com.elite.MainActivity

Activities

com.elite.MainActivity

android.intent.action.MAIN

com.elite.UninstallAdminDevice

android.intent.action.SEND

Permissions

android.permission.GET_TASKS
android.permission.READ_PHONE_STATE
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.READ_CONTACTS
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WRITE_SETTINGS
android.permission.WAKE_LOCK

Receivers

com.elite.AdminReciever

android.app.action.DEVICE_ADMIN_ENABLED

com.elite.SMSReceiver

android.provider.Telephony.SMS_RECEIVED

com.elite.BootReceiver

android.intent.action.BOOT_COMPLETED

Services