abstractemu | ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12

General

Target
ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12
Size 6.2MB
Sample240412-jac6lsgf95
SHA256 ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12
MD5 b451af80f8d6b255bf36d03976f140c5
SHA1 72b127983d70f79e366a2a1bc0b2d95af9e58d3f
SHA512 93ff057aee089c4f8b97633d5f0166d2d0f7c73199d6c876a10f585250ae20ca154cf2248e6d4201bf54595740465d9a27380051e3f88d8084082a7e23d0eeb8
SSDEEP 196608:/9gioLpNX0aJoDigoI7QJ6WPqMbTojj/xovcL6/Rq://8pNX0pigoGYrPquTUjZovcL6/Rq
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

AbstractEmu payload 1 IoCs

resource	yara_rule
sample	family_abstractemu

Abstractemu family
abstractemu

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

File Explorer

ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12

.apk 6.2MB

ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12

SHA256 ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12
MD5 b451af80f8d6b255bf36d03976f140c5
SHA1 72b127983d70f79e366a2a1bc0b2d95af9e58d3f
SHA512 93ff057aee089c4f8b97633d5f0166d2d0f7c73199d6c876a10f585250ae20ca154cf2248e6d4201bf54595740465d9a27380051e3f88d8084082a7e23d0eeb8
SSDEEP 196608:/9gioLpNX0aJoDigoI7QJ6WPqMbTojj/xovcL6/Rq://8pNX0pigoGYrPquTUjZovcL6/Rq
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm

AbstractEmu payload

com.st.launcher.lite

com.st.launcher.lite.LiteLauncherReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.ACTION_POWER_CONNECTED

com.st.launcher.lite.broadcast.LocaleChangedReceiver

android.intent.action.LOCALE_CHANGED

com.st.launcher.lite.broadcast.IncomingCallHandler

android.intent.action.PHONE_STATE

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12

Permissions

android.permission.BLUETOOTH

android.permission.GET_ACCOUNTS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.READ_CONTACTS

android.permission.CALL_PHONE

android.permission.READ_PHONE_STATE

android.permission.EXPAND_STATUS_BAR

android.permission.REQUEST_DELETE_PACKAGES

android.permission.INTERNET

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.c2dm.permission.RECEIVE

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12

com.st.launcher.lite.LiteActivity

com.st.launcher.lite.MainActivity

com.st.launcher.lite.DummyActivity

com.st.launcher.lite.SettingsActivity

com.st.launcher.lite.kustomsupport.AutoFinishTransparentActivity

com.st.launcher.lite.appdraw.PageActivity

com.google.android.gms.common.api.GoogleApiActivity

com.st.launcher.lite.LiteLauncherServices

com.st.launcher.lite.MessagingService

com.st.launcher.lite.dataprovider.AppProvider

com.st.launcher.lite.dataprovider.ContactsProvider

com.st.launcher.lite.dataprovider.SettingsProvider

com.st.launcher.lite.dataprovider.ShortcutsProvider

com.st.launcher.lite.notification.NotificationListener

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.messaging.FirebaseMessagingService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

androidx.room.MultiInstanceInvalidationService

com.st.launcher.lite.LiteLauncherReceiver

com.st.launcher.lite.broadcast.LocaleChangedReceiver

com.st.launcher.lite.broadcast.IncomingCallHandler

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.st.launcher.lite.kustomsupport.Kustom5SecsProvider

com.squareup.picasso.PicassoProvider

com.google.firebase.provider.FirebaseInitProvider

androidx.work.impl.WorkManagerInitializer

com.crashlytics.android.CrashlyticsInitProvider

Android Permissions

ae56c32ca785a39cd513c3b69d4d31aff6969fbe87ddc6606002e1cdcfe49b12