f2b91a4b3c05ca881dc84aabcc9385f3[.]bin

General

Target

f2b91a4b3c05ca881dc84aabcc9385f3.bin
Size

9.3MB
MD5

7418f4a8e35dd04cc5a0e16b148cd019
SHA1

0f7ab138d4380c5c6d3f9adc0bc832324244e9f1
SHA256

376357f0dc6db9a414e6e4a1d88ab6d1ed79aca6c2baaf706f342a85ad73df68
SHA512

c5d49e5c91f50923d0ad15e3f847c89d58cda629172297623b53fe2fd746dec9100109f117c7becacad366a65fb28f0b8d6c7303f8d3fcd3222ea97cdccfa214
SSDEEP

196608:b+37p6Af4p4W3cLjI0QirtMnHDvC4K74OK8XPzYk+fNSo969xABU1er2u+CR:bq7hc4WsLjIbAN4FOK8XPzYTfV969a8m

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Files

f2b91a4b3c05ca881dc84aabcc9385f3.bin
.zip

Password: infected
fb4fb2ec4875415476fc54dbbda28ff969fa0f369bd2778ef4fccd82eb298f73.apk
.apk android

Password: infected

ir.me.raven

ir.me.raven.MainActivity

Activities

Permissions

android.permission.INTERNET
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.READ_SMS
android.permission.SEND_SMS
android.permission.WRITE_OBB
android.permission.RECEIVE_SMS
android.permission.READ_CONTACTS
android.permission.READ_PHONE_STATE
android.permission.READ_PHONE_NUMBERS
android.permission.WRITE_SETTINGS
android.permission.CALL_PHONE
android.permission.BROADCAST_PACKAGE_REMOVED
android.permission.ACCESS_NETWORK_STATE
android.permission.POST_NOTIFICATIONS
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
ir.me.raven.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Receivers

ir.me.raven.classes.FullyRemovedBroadcastReceiver

android.intent.action.PACKAGE_FULLY_REMOVED
android.intent.action.PACKAGE_REMOVED

ir.me.raven.classes.SmsReceiver

android.provider.Telephony.SMS_RECEIVED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION

Services

ir.me.raven.classes.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

ir.me.raven

ir.me.raven.MainActivity

Activities

Permissions

Receivers

ir.me.raven.classes.FullyRemovedBroadcastReceiver

ir.me.raven.classes.SmsReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.profileinstaller.ProfileInstallReceiver

Services

ir.me.raven.classes.FirebaseMessagingService

com.google.firebase.messaging.FirebaseMessagingService