Resubmissions

15/04/2025, 08:33

250415-kf2xlazq15 10

10/04/2024, 11:14

240410-nb7ttsdf64 10

General

  • Target

    5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5

  • Size

    11.8MB

  • MD5

    8a847b0f466b3174741aac734989aa73

  • SHA1

    03eadb4ab93a1a0232cb40b7d2ef179a1cd0174d

  • SHA256

    5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5

  • SHA512

    85f2f3769087d92fcc69f047f2d5b5e7bb31e8342fb301bc5800110341d10904afdb9d225de0c5af13709977a0ec10a5ed41d803f17545645e10e32c3a91defd

  • SSDEEP

    196608:0/ruFMnjielhXAzLekMhH6rHVFIA2+7zWc7yi0UWsGZaHlgcm+2YplVl2toTkUmc:0/ruqnjiNPqhiF2+Z2x9taFgspDl2to1

Score
10/10

Malware Config

Signatures

  • APT42 Android payload 1 IoCs
  • Apt42 family
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 14 IoCs

Files

  • 5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    com.example.vpnner

    com.example.vpnner.MainActivity


Android Permissions

5d3ff202f20af915863eee45916412a271bae1ea3a0e20988309c16723ce4da5

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_CONTACTS

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.CALL_PHONE

android.permission.READ_CALL_LOG

android.permission.READ_LOGS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.WAKE_LOCK

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

oppo.permission.OPPO_COMPONENT_SAFE

com.huawei.permission.external_app_settings.USE_COMPONENT