wolfrat | 61dfaa65fb3e148edfae1fc9b99a2b34

General

Target
61dfaa65fb3e148edfae1fc9b99a2b34
Size 921KB
Sample240517-w18rescf66
SHA256 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1
MD5 61dfaa65fb3e148edfae1fc9b99a2b34
SHA1 bedf953c50d79ba298c86a7deee107ea10d96484
SHA512 5f3d21ffb8891e72022a20a6db204db6210009034dd5d7889a47a00f8ee49a5482d193257e1fafb49061b76e5f8156365b4c08d7e4f74202c3d568bdd11495c6
SSDEEP 12288:79aQbj/HE3nwjTcRothXLG7QPKP1yUYa+X/Inux5MdKHHQMVmHtpU53Hg8Hx:ZLTk3G4RorGwKPUaIInuxOKHHsU53HFR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

wolfrat

Malware Config

Extracted

Family

wolfrat

C2

https://ponethus.com

Signatures

Wolfrat family
wolfrat

Requests dangerous framework permissions 17 IoCs

description	ioc
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS

File Explorer

61dfaa65fb3e148edfae1fc9b99a2b34

.apk 921KB

61dfaa65fb3e148edfae1fc9b99a2b34

SHA256 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1
MD5 61dfaa65fb3e148edfae1fc9b99a2b34
SHA1 bedf953c50d79ba298c86a7deee107ea10d96484
SHA512 5f3d21ffb8891e72022a20a6db204db6210009034dd5d7889a47a00f8ee49a5482d193257e1fafb49061b76e5f8156365b4c08d7e4f74202c3d568bdd11495c6
SSDEEP 12288:79aQbj/HE3nwjTcRothXLG7QPKP1yUYa+X/Inux5MdKHHQMVmHtpU53Hg8Hx:ZLTk3G4RorGwKPUaIInuxOKHHsU53HFR
MD5 SHA1 SHA512 SSDEEP

android

com.android.playup

Android Permissions

61dfaa65fb3e148edfae1fc9b99a2b34

Permissions

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_CALL_LOG

android.permission.CAPTURE_AUDIO_OUTPUT

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_INTERNAL_STORAGE

android.permission.QUICKBOOT_POWERON

android.permission.INTERNET

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.GET_ACCOUNTS

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_CONTACTS

android.permission.ACCESS_FINE_LOCATION

android.permission.GET_TASKS

android.permission.WAKE_LOCK

android.permission.CALL_PHONE

android.permission.SEND_SMS

android.permission.WRITE_SETTINGS

android.permission.READ_PHONE_STATE

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.PROCESS_OUTGOING_CALLS

android.permission.RECEIVE_SMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_LOGS

android.permission.ACCESS_SUPERUSER

android.permission.READ_FRAME_BUFFER

android.permission.ACCESS_COARSE_LOCATION

android.permission.GRANT_RUNTIME_PERMISSIONS

android.permission.WRITE_SECURE_SETTINGS

android.permission.PACKAGE_USAGE_STATS

android.permission.DUMP

android.permission.GET_APP_OPS_STATS

61dfaa65fb3e148edfae1fc9b99a2b34

com.connect.Drodian

com.connect.Dialog

com.connect.CameraView

com.connect.VideoView

com.connect.ScreenCaptureImageActivity

com.connect.ScreenRecorderActivity

com.connect.MyService

com.connect.RecordService

com.connect.MediaRecorderService

com.connect.PhoneRecordService

com.connect.CaptureService

com.serenegiant.service.ScreenRecorderService

com.connect.ServiceReceiver

com.connect.PhoneReceiver

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

61dfaa65fb3e148edfae1fc9b99a2b34

com.connect.Drodian

com.connect.Dialog

com.connect.CameraView

com.connect.VideoView

com.connect.ScreenCaptureImageActivity

com.connect.ScreenRecorderActivity

com.connect.MyService

com.connect.RecordService

com.connect.MediaRecorderService

com.connect.PhoneRecordService

com.connect.CaptureService

com.serenegiant.service.ScreenRecorderService

com.connect.ServiceReceiver

com.connect.PhoneReceiver

Android Permissions

61dfaa65fb3e148edfae1fc9b99a2b34