General

  • Target

    vpn3000.apk

  • Size

    11.8MB

  • MD5

    25b615ad17a2c229cd2693a8124c2ab1

  • SHA1

    116d18de7432390ca4b00d815e3319b58ae7d373

  • SHA256

    3277e4ffaa712e938996baa02f765a82c804924dd3bd10f7a1467644770772da

  • SHA512

    08dc1960b08e1a9a40803f876a44061e3c72de0dfdf799cd038c96c5cd6fb0d7d865cf8f162ae82d1cd12f30b37a0781f98a1db31dfde20c42e4cbd0e08c7189

  • SSDEEP

    196608:EUcpeW0suT9yoqBwU00wrlya9NqlpuQsdzWc7yi0U56n521Cec58UxAMxlBD4K9c:E6Io0wr0acl22xR5CCwAfR4K9VO

Score
6/10

Malware Config

Signatures

  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 1 IoCs

Files

  • vpn3000.apk
    .apk android arch:arm64 arch:arm arch:x86 arch:x64

    com.gi.vpn

    com.gi.vpn.MainActivity


Android Permissions

vpn3000.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.POST_NOTIFICATIONS

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

com.google.android.gms.permission.AD_ID

android.permission.ACCESS_ADSERVICES_AD_ID

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_TOPICS

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE