sample[.]zip | Triage

Sharing

General

Target

sample.zip
Size

16.4MB
MD5

4d4cd5deb0f35500f7720c4b9f2fe577
SHA1

f8d01c268390c2b8ee63032c1ac901762419e3c0
SHA256

f233fec5f7b17eb93f88d9b0830a0862fd4da4a8d0bbaea0a6fac11aff79a110
SHA512

5f3acf69f9d4ff7547bd7c71f60eade27c81f77a9e43e2ce6face4c9c10a15cd2112769c2ec90aa259157b3b7238e122691d825ab421b8616e156b3792b0bd7b
SSDEEP

393216:4GmajD4VmpyOInfONrnw715qJ5asgy3bCyOdJXmFeMWzYzAAQ:DmaH4op8s533ZOjmFtmYzi

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Files

sample.zip
.zip

Password: infected
sample.apk
.apk android arch:arm64

Password: infected

com.network.xf1715547471

com.network.xf1715547471.ui.SplashActivity

Activities

com.network.xf1715547471.ui.SplashActivity

android.intent.action.MAIN

com.network.xf1715547471.ui.MainActivity

android.intent.action.SEND
android.service.quicksettings.action.QS_TILE_PREFERENCES

com.network.xf1715547471.ui.TaskerActivity

com.twofortyfouram.locale.intent.action.EDIT_SETTING

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.INTERNET
android.permission.READ_EXTERNAL_STORAGE
android.permission.CAMERA
com.android.vending.BILLING
android.permission.FOREGROUND_SERVICE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.READ_PHONE_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_SETTINGS
com.asus.msa.SupplementaryDID.ACCESS
freemme.permission.msa

Receivers

com.network.xf1715547471.receiver.TaskerReceiver

com.twofortyfouram.locale.intent.action.FIRE_SETTING

Services

com.network.xf1715547471.service.V2RayVpnService

android.net.VpnService

com.network.xf1715547471.service.QSTileService

android.service.quicksettings.action.QS_TILE