xamalicious | e7873a1af0dd823b6b45bad331666c31561d0554f300a539a52859f03d3d4059

Sharing

Copy URL Twitter E-mail

General

Target
e7873a1af0dd823b6b45bad331666c31561d0554f300a539a52859f03d3d4059
Size 85.7MB
Sample240419-cx6m4sec37
SHA256 e7873a1af0dd823b6b45bad331666c31561d0554f300a539a52859f03d3d4059
MD5 0fbf430746e715af26967fc101df7188
SHA1 7c3e1827e2851fd5dad011dd6f4554954144a38c
SHA512 485a1423442c58275d10fc540cac041b8319e78a402c167181380aca71e2b83c24f7b6abbd5c69e2e8d4166308edb4a994c052ca1db0472e5a855acc3ef2cb45
SSDEEP 786432:jZXvO65pqoUOldW+d52BY06gzmc3ImVHZGV453zwXeo8ZTHMlnrAk/90EuKLm:FXW65Y+syDNuVHZ44RVrZHMRAk/90ERm
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

xamalicious

Malware Config

Signatures

Android Xamalicious payload 2 IoCs

resource	yara_rule
sample	family_xamalicious
sample	family_xamalicious

Xamalicious family
xamalicious

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

File Explorer

e7873a1af0dd823b6b45bad331666c31561d0554f300a539a52859f03d3d4059

.apk 85.7MB

e7873a1af0dd823b6b45bad331666c31561d0554f300a539a52859f03d3d4059

SHA256 e7873a1af0dd823b6b45bad331666c31561d0554f300a539a52859f03d3d4059
MD5 0fbf430746e715af26967fc101df7188
SHA1 7c3e1827e2851fd5dad011dd6f4554954144a38c
SHA512 485a1423442c58275d10fc540cac041b8319e78a402c167181380aca71e2b83c24f7b6abbd5c69e2e8d4166308edb4a994c052ca1db0472e5a855acc3ef2cb45
SSDEEP 786432:jZXvO65pqoUOldW+d52BY06gzmc3ImVHZGV453zwXeo8ZTHMlnrAk/90EuKLm:FXW65Y+syDNuVHZ44RVrZHMRAk/90ERm
MD5 SHA1 SHA512 SSDEEP

android arch:arm arch:arm64

Android Xamalicious payload

com.uhg.mobile.health4me

com.uhg.mobile.health4me.SecureMessagingActivity

com.uhg.mobile.health4me.ContactUsComposeActivity

crc641b1c91776503e649.VirtualVisitsActivity

crc641b1c91776503e649.BaseActivityActionBarActivity

crc641b1c91776503e649.BaseActivityBottomTabsActionBarActivity

crc641b1c91776503e649.BaseActivityNoActionBarActivity

crc641b1c91776503e649.EstimateDrugCostActivity

crc641b1c91776503e649.EstimateDrugCostDetailsActivity

crc641b1c91776503e649.EstimateDrugCostFinalActivity

crc641b1c91776503e649.EstimateDrugCostSearchActivity

crc641b1c91776503e649.IDCardActivity

crc641b1c91776503e649.IDCardAddActivity

crc641b1c91776503e649.IDCardFullViewActivity

crc641b1c91776503e649.TalkWithUsActivity

crc641b1c91776503e649.NurseLineActivity

crc641b1c91776503e649.FinancialBalancesActivity

crc641b1c91776503e649.FinancialBalancesDetailActivity

crc641b1c91776503e649.PharmacyFilterActivity

crc641b1c91776503e649.PharmacySearchDetailActivity

crc641b1c91776503e649.MemberPlanActivity

crc641b1c91776503e649.MedicationDrawerActivity

crc641b1c91776503e649.LoginActivity

android.intent.action.MAIN android.intent.action.VIEW

crc641b1c91776503e649.ClaimsSubmitAddPhotosGlobalActivity

crc641b1c91776503e649.MainActivity

crc641b1c91776503e649.GlobalMemberWebViewActivity

crc641b1c91776503e649.ClaimsSummaryActivity

crc641b1c91776503e649.ClaimsFilterActivity

crc641b1c91776503e649.ClaimDetailsActivity

crc641b1c91776503e649.ClaimsSubmitNewActivity

crc641b1c91776503e649.PoliciesWebviewActivity

crc641b1c91776503e649.PHDAddDeviceActivity

crc641b1c91776503e649.PHDStepsActivity

crc641b1c91776503e649.PHDChangeDeviceActivity

crc641b1c91776503e649.EmergencyWebViewActivity

crc641b1c91776503e649.MomsOnTheMoveInfoActivity

crc641b1c91776503e649.DestinationIntelligenceWebActivity

crc641b1c91776503e649.Download_Destination_Intelligence_Activity

crc641b1c91776503e649.MainSearchActivity

crc641b1c91776503e649.FindCareActivity

crc641b1c91776503e649.FindCareFilterActivity

crc641b1c91776503e649.FindCareDetailActivity

crc641b1c91776503e649.ScheduleCallBackActivity

crc641b1c91776503e649.ContactUsComposeActivity

crc641b1c91776503e649.GlobalMemberRetakePhotoActivity

crc641b1c91776503e649.AddNewScriptOrderConfirmActivity

crc641b1c91776503e649.GlobalMemberAddnewSriptActivity

com.uhg.mobile.health4me.SettingsActivity

crc641b1c91776503e649.MomsOnTheMoveOrdersActivity

crc641b1c91776503e649.MomsOnTheMoveCreateActivity

crc641b1c91776503e649.ClaimDetailsCreateNoteActivity

crc641b1c91776503e649.FinancialAccountTypeWebViewActivity

com.uhg.mobile.health4me.PillIdentifierActivity

com.uhg.mobile.health4me.PillResultsActivity

crc641b1c91776503e649.CCSecureMessagingComposeActivity

crc641b1c91776503e649.CCSecureMessagingFolderSelectionActivity

crc641b1c91776503e649.MomsOntheMoveCreateMomActivity

crc641b1c91776503e649.MomsOnTheMoveCreateBabyActivity

crc641b1c91776503e649.MomsOnTheMoveOrdersDetailActivity

crc641b1c91776503e649.InstamedWebViewActivity

crc641b1c91776503e649.PharmacyPDFActivity

crc641b1c91776503e649.RequestPayActivity

crc641b1c91776503e649.MomsDeliveryActivity

crc641b1c91776503e649.MomsECommerceWebViewActivity

crc641b1c91776503e649.NotificationsPlaceHolderActivity

crc641b1c91776503e649.MomsOnTheMoveThankYouActivity

crc641b1c91776503e649.NonSecureNotificationActivity

crc641b1c91776503e649.PHDConnectDeviceActivity

crc641b1c91776503e649.PlanDisclosureWebViewActivity

crc641b1c91776503e649.BasicWebViewActivity

crc641b1c91776503e649.UnauthenticatedProviderSearchActivity

crc641b1c91776503e649.RecommendedLinksActivity

crc641b1c91776503e649.CSHandbookActivity

crc641b1c91776503e649.CnSViewAllCoveragesActivity

crc641b1c91776503e649.TermsofUseActivity

crc641b1c91776503e649.UnsecuredBaseActivityActionBarActivity

crc641b1c91776503e649.UnsecuredIDCardActivity

crc641b1c91776503e649.NonSecureNotificationDetailActivity

crc641b1c91776503e649.InstructionalActivity

crc641b1c91776503e649.GapsInCareNotificationDetailActivity

crc641b1c91776503e649.CCSecureMessagingDetailActivity

crc641b1c91776503e649.ChangePCPActivity

com.uhg.mobile.health4me.CommunicationPreferencesActivity

com.uhg.mobile.health4me.OffersandProgramsActivity

crc641b1c91776503e649.CommunicationPrefsActivity

crc641b1c91776503e649.ClaimsReimbursementActivity

crc641b1c91776503e649.ClaimsReimbursementDetailActivity

com.uhg.mobile.health4me.GESpecDrugCenterOfExcellencePrg

crc641b1c91776503e649.EnISubmitClaimActivity

crc641b1c91776503e649.EnIEnterClaimDetailsActivity

crc641b1c91776503e649.AMActivity

crc641b1c91776503e649.ContactInfoActivity

crc641b1c91776503e649.ClaimPictureActivity

crc641b1c91776503e649.EnIRetakePhotoActivity

com.uhg.mobile.health4me.VisionInfoActivity

com.uhg.mobile.health4me.BillingActivity

com.uhg.mobile.health4me.EditCreditCardActivity

com.uhg.mobile.health4me.EditAddressActivity

com.uhg.mobile.health4me.AddCreditCardActivity

crc641b1c91776503e649.MedCabInstructionsActivity

crc641b1c91776503e649.NewAppMessageActivity

crc641b1c91776503e649.MotionDetailsActivity

crc641b1c91776503e649.ChatHelpFragment

crc64e29d86f7233f43c0.HealthRecordInformationActivity

crc64e29d86f7233f43c0.IHRFilterActivity

crc646381768cdbd8c7ea.CustomizeDashboardActivity

crc64bb6163491c616d2c.ClickToChatActivity

crc64bb6163491c616d2c.InitChatScreenActivity

crc6480997b3ef81bf9b2.ZxingActivity

com.optum.healthsafeid.Activities.HSIDLoginActivity

com.optum.healthsafeid.Activities.HSIDRegisterActivity

com.optum.healthsafeid.Activities.HSIDAccountRecoveryActivity

com.optum.healthsafeid.Activities.HSIDLearnAboutHSIDActivity

com.optum.healthsafeid.Activities.HSIDLegalWebViewActivity

com.optum.healthsafeid.Activities.TestSplashScreenActivity

com.optum.healthsafeid.Activities.HSIDSetupEnviromentActivity

com.google.android.gms.common.api.GoogleApiActivity

com.optum.securemessaging.ui.activity.SecureMessagingActivity

com.optum.securemessaging.ui.activity.FolderSelectionActivity

com.optum.securemessaging.ui.activity.MessageComposeActivity

Android Permissions

e7873a1af0dd823b6b45bad331666c31561d0554f300a539a52859f03d3d4059

Permissions

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.ACCESS_NETWORK_STATE

com.uhg.mobile.health4me.permission.MAPS_RECEIVE

com.google.android.c2dm.permission.RECEIVE

com.uhg.mobile.health4me.permission.C2D_MESSAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.INTERNET

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.WAKE_LOCK

android.permission.USE_FINGERPRINT

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE