task4[.]zip | Triage

General

Target

task4.zip
Size

3.3MB
MD5

0609443040ffc1a30ed7e8e0abeef241
SHA1

90a008a9672ad6586fa2d05fd758213c67c8de72
SHA256

0ac0ae3565029ec9eb983e381168ed5911c6fd8c03d311b02aaeed100fb75d5e
SHA512

120f1699719ab80a938ec5e3d716eaeb1960197666bd026500b1034fc150d1b71840631d6ea216aa9aac8fdf5cdcf888b825a8acff0fe000885a5c6abca2408d
SSDEEP

98304:y/KnJ5y79XuWSI7Q66x5d+iFCRnc9Lt+Htq/:eKJ5u9X3qd5FCRRNU

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Files

task4.zip
.zip

Password: infected
task4.apk
.apk android

Password: infected

com.agoxgljzqbdi.gwuaspmli

com.agoxgljzqbdi.gwuaspmli.MainActivity

Activities

com.agoxgljzqbdi.gwuaspmli.ComposeSmsActivity

android.intent.action.SEND
android.intent.action.SENDTO

com.agoxgljzqbdi.gwuaspmli.MainActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.FOREGROUND_SERVICE
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.SYSTEM_ALERT_WINDOW
android.permission.ACTION_MANAGE_OVERLAY_PERMISSION
android.permission.SEND_SMS
android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_MMS
android.permission.WAKE_LOCK
android.permission.QUERY_ALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.QUICKBOOT_POWERON
android.permission.STATE_CHANGE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.BROADCAST_PACKAGE_ADDED

Receivers

com.agoxgljzqbdi.gwuaspmli.receiverSMS

android.provider.Telephony.SMS_DELIVER
android.provider.Telephony.SMS_RECEIVED

com.agoxgljzqbdi.gwuaspmli.receiverMMS

android.provider.Telephony.WAP_PUSH_DELIVER

com.agoxgljzqbdi.gwuaspmli.bootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.net.wifi.WIFI_STATE_CHANGED
android.net.wifi.STATE_CHANGE
android.intent.action.ACTION_SCREEN_ON
android.intent.action.SCREEN_ON
android.intent.action.PACKAGE_ADDED

Services

com.agoxgljzqbdi.gwuaspmli.servicePush

android.service.notification.NotificationListenerService

com.agoxgljzqbdi.gwuaspmli.ComposeSmsActivity_VIA_MESSAGE

android.intent.action.RESPOND_VIA_MESSAGE

com.agoxgljzqbdi.gwuaspmli.serviceLoop

android.accessibilityservice.AccessibilityService

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

com.agoxgljzqbdi.gwuaspmli

com.agoxgljzqbdi.gwuaspmli.MainActivity

Activities

com.agoxgljzqbdi.gwuaspmli.ComposeSmsActivity

com.agoxgljzqbdi.gwuaspmli.MainActivity

Permissions

Receivers

com.agoxgljzqbdi.gwuaspmli.receiverSMS

com.agoxgljzqbdi.gwuaspmli.receiverMMS

com.agoxgljzqbdi.gwuaspmli.bootReceiver

Services

com.agoxgljzqbdi.gwuaspmli.servicePush

com.agoxgljzqbdi.gwuaspmli.ComposeSmsActivity_VIA_MESSAGE

com.agoxgljzqbdi.gwuaspmli.serviceLoop