privateloader | Rubika_3_6_4_fisdufsdf[.]apk

General

Target

Rubika_3_6_4_fisdufsdf.apk
Size

75.4MB
MD5

9199a8d719b7faf5f0a9eb9023d8d0ed
SHA1

bea15654229fc50166d2ae726821c2f18566a7c6
SHA256

8ffa0a39ca498846d2e707e9039cdd6ecfffedd79375f94d21d1dcce46cdfe26
SHA512

d388cf5320c0a1f58f3f8a318bba47ffaaf2a85cd6a1506a700235de3fa12e3f43f18639a8adc183dbfd64964f8340b39df53ae8bc931a02587a6d09a4408afd
SSDEEP

1572864:mX0eKh3tjZu232OvEgwLeScmvUh31nuC+H4/7qInqk:mEh5E2326wa2MhICIfk

Score

10^/10

Malware Config

Signatures

BadBazaar payload 2 IoCs

resource	yara_rule
sample	family_badbazaar
sample	family_badbazaar

Badbazaar family
badbazaar
Privateloader family
privateloader

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT

Files

Rubika_3_6_4_fisdufsdf.apk
.apk android arch:arm64 arch:x64 arch:x86 arch:arm

app.rbmain.a

org.rbmain.ui.LaunchActivity

Activities

org.rbmain.ui.LaunchActivity

android.intent.action.MAIN
android.intent.action.SEND
android.intent.action.SEND
android.intent.action.SEND_MULTIPLE
android.intent.action.SEND
android.intent.action.SEND
android.intent.action.SEND_MULTIPLE
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

org.rbmain.ui.ExternalActionActivity

org.rbmain.passport.AUTHORIZE

org.rbmain.ui.ChatsWidgetConfigActivity

android.appwidget.action.APPWIDGET_CONFIGURE

org.rbmain.ui.ContactsWidgetConfigActivity

android.appwidget.action.APPWIDGET_CONFIGURE

org.rbmain.messenger.GoogleVoiceClientActivity

com.google.android.voicesearch.SEND_MESSAGE_TO_CONTACTS

Permissions

com.google.android.c2dm.permission.RECEIVE
com.google.android.providers.gsf.permission.READ_GSERVICES
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.INTERNET
android.permission.FOREGROUND_SERVICE
android.permission.RECORD_AUDIO
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.WAKE_LOCK
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_CONTACTS
android.permission.VIBRATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.USE_FINGERPRINT
android.permission.USE_BIOMETRIC
android.permission.INSTALL_SHORTCUT
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.CAMERA
android.permission.BLUETOOTH
android.permission.MANAGE_OWN_CALLS
android.permission.USE_FULL_SCREEN_INTENT
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
com.majeur.launcher.permission.UPDATE_BADGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_APP_BADGE
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
me.everything.badger.permission.BADGE_COUNT_READ
me.everything.badger.permission.BADGE_COUNT_WRITE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.BLUETOOTH_CONNECT
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

org.rbmain.messenger.AutoMessageHeardReceiver

org.rbmain.messenger.ACTION_MESSAGE_HEARD

org.rbmain.messenger.NotificationsDisabledReceiver

android.app.action.NOTIFICATION_CHANNEL_BLOCK_STATE_CHANGED

org.rbmain.messenger.AutoMessageReplyReceiver

org.rbmain.messenger.ACTION_MESSAGE_REPLY

org.rbmain.messenger.SmsReceiver

com.google.android.gms.auth.api.phone.SMS_RETRIEVED

org.rbmain.messenger.CallReceiver

android.intent.action.PHONE_STATE

org.rbmain.messenger.MusicPlayerReceiver

org.rbmain.android.musicplayer.close
org.rbmain.android.musicplayer.pause
org.rbmain.android.musicplayer.next
org.rbmain.android.musicplayer.play
org.rbmain.android.musicplayer.previous
android.intent.action.MEDIA_BUTTON
android.media.AUDIO_BECOMING_NOISY

org.rbmain.messenger.voip.VoIPMediaButtonReceiver

android.intent.action.MEDIA_BUTTON

org.rbmain.messenger.AppStartReceiver

org.rbmain.start
android.intent.action.BOOT_COMPLETED

org.rbmain.messenger.RefererReceiver

com.android.vending.INSTALL_REFERRER

org.rbmain.messenger.ChatsWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE

org.rbmain.messenger.ContactsWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Services

org.rbmain.messenger.GcmPushListenerService

com.google.firebase.MESSAGING_EVENT

org.rbmain.messenger.ContactsSyncAdapterService

android.content.SyncAdapter

org.rbmain.messenger.MusicBrowserService

android.media.browse.MediaBrowserService

org.rbmain.messenger.voip.RubikaConnectionService

android.telecom.ConnectionService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

androidx.sharetarget.ChooserTargetServiceCompat

android.service.chooser.ChooserTargetService

Android Permissions

Rubika_3_6_4_fisdufsdf.apk

Permissions

com.google.android.c2dm.permission.RECEIVE

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_CONTACTS

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.USE_FINGERPRINT

android.permission.USE_BIOMETRIC

android.permission.INSTALL_SHORTCUT

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.CAMERA

android.permission.BLUETOOTH

android.permission.MANAGE_OWN_CALLS

android.permission.USE_FULL_SCREEN_INTENT

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

com.anddoes.launcher.permission.UPDATE_COUNT

com.majeur.launcher.permission.UPDATE_BADGE

com.huawei.android.launcher.permission.CHANGE_BADGE

com.huawei.android.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_APP_BADGE

com.oppo.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS

me.everything.badger.permission.BADGE_COUNT_READ

me.everything.badger.permission.BADGE_COUNT_WRITE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.BLUETOOTH_CONNECT

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

app.rbmain.a

org.rbmain.ui.LaunchActivity

Activities

org.rbmain.ui.LaunchActivity

org.rbmain.ui.ExternalActionActivity

org.rbmain.ui.ChatsWidgetConfigActivity

org.rbmain.ui.ContactsWidgetConfigActivity

org.rbmain.messenger.GoogleVoiceClientActivity

Permissions

Receivers

org.rbmain.messenger.AutoMessageHeardReceiver

org.rbmain.messenger.NotificationsDisabledReceiver

org.rbmain.messenger.AutoMessageReplyReceiver

org.rbmain.messenger.SmsReceiver

org.rbmain.messenger.CallReceiver

org.rbmain.messenger.MusicPlayerReceiver

org.rbmain.messenger.voip.VoIPMediaButtonReceiver

org.rbmain.messenger.AppStartReceiver

org.rbmain.messenger.RefererReceiver

org.rbmain.messenger.ChatsWidgetProvider

org.rbmain.messenger.ContactsWidgetProvider

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

Services

org.rbmain.messenger.GcmPushListenerService

org.rbmain.messenger.ContactsSyncAdapterService

org.rbmain.messenger.MusicBrowserService

org.rbmain.messenger.voip.RubikaConnectionService

com.google.firebase.messaging.FirebaseMessagingService

androidx.sharetarget.ChooserTargetServiceCompat

Android Permissions

Rubika_3_6_4_fisdufsdf.apk