HexnodeMDM[.]apk

Sharing

Copy URL Twitter E-mail

General

Target

HexnodeMDM.apk
Size

7.4MB
MD5

927bee78f8282e44ab7515646d5331b2
SHA1

f79f85c81bb405a4fc24fc60a8bee65e76a8bb49
SHA256

0b8d0361a1cf43a00de37fefb701ae9e3d99ebdeda64a884d2732667a870e68f
SHA512

cbe27af48969ceb5e49cbbfc8bbedd641687897944267bad29ac8d77e7a5e3403136deedfbd8b469801e3785973a8c14e7ea3e6a1cb94302df36d084714ac8f8
SSDEEP

196608:cq45xcmOdgISCkcK1zdRtTWbJMi0ki+9sPo+s3k:UV+1SqKNtTWltTsPork

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE

Files

HexnodeMDM.apk
.apk android

com.hexnode.hexnodemdm

com.hexnode.mdm.ui.SplashActivity

Activities

com.hexnode.mdm.PolicyCompliance

android.app.action.ADMIN_POLICY_COMPLIANCE

com.hexnode.mdm.SelectionActivity

android.app.action.GET_PROVISIONING_MODE

com.hexnode.mdm.download_manager.ui.DownloadsActivity

android.intent.action.SEARCH

com.hexnode.mdm.ui.PostProvisioningActivity

android.app.action.PROVISIONING_SUCCESSFUL

com.hexnode.mdm.ui.EnrollValidationActivity

android.intent.action.VIEW

com.hexnode.mdm.ui.SplashActivity

android.intent.action.MAIN

com.hexnode.mdm.ui.LauncherActivity

android.intent.action.MAIN

com.hexnode.mdm.ui.WifiActivity

android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE

Permissions

android.permission.BLUETOOTH
android.permission.BLUETOOTH_ADMIN
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.SCHEDULE_EXACT_ALARM
android.permission.ACCESS_WIFI_STATE
android.permission.UPDATE_DEVICE_STATS
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.WRITE_SETTINGS
android.permission.EXPAND_STATUS_BAR
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.SET_WALLPAPER
android.permission.SET_WALLPAPER_HINTS
android.permission.FOREGROUND_SERVICE
android.permission.INSTALL_PACKAGES
android.permission.REBOOT
android.permission.SHUTDOWN
android.permission.DELETE_PACKAGES
android.permission.DOWNLOAD_WITHOUT_NOTIFICATION
android.permission.GET_ACCOUNTS
android.permission.MANAGE_ACCOUNTS
com.google.android.providers.gsf.permission.READ_GSERVICES
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.CHANGE_NETWORK_STATE
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_BACKGROUND_LOCATION
android.permission.WRITE_CONTACTS
android.permission.READ_CONTACTS
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.PACKAGE_USAGE_STATS
com.samsung.android.knox.permission.KNOX_KIOSK_MODE
android.permission.INTERACT_ACROSS_USERS_FULL
android.permission.CAMERA
com.samsung.android.knox.permission.KNOX_LOCATION
com.samsung.android.knox.permission.KNOX_RESTRICTION_MGMT
com.samsung.android.knox.permission.KNOX_HW_CONTROL
com.samsung.android.knox.permission.KNOX_APP_MGMT
com.samsung.android.knox.permission.KNOX_APN
com.samsung.android.knox.permission.KNOX_BLUETOOTH
com.samsung.android.knox.permission.KNOX_FIREWALL
com.samsung.android.knox.permission.KNOX_WIFI
com.samsung.android.knox.permission.KNOX_CUSTOM_SYSTEM
com.samsung.android.knox.permission.KNOX_SECURITY
com.samsung.android.knox.permission.KNOX_GLOBALPROXY
com.samsung.android.knox.permission.KNOX_PHONE_RESTRICTION
com.sec.enterprise.knox.cloudmdm.smdms.provider.permission.READ
android.permission.QUERY_ALL_PACKAGES
android.permission.READ_PHONE_STATE
android.permission.READ_PHONE_NUMBERS
android.permission.REORDER_TASKS
android.permission.GET_TASKS
android.permission.SYSTEM_ALERT_WINDOW
com.hexnode.hexnodemdm.supportlibclient.SUPPORT_PERMISSION
com.hexnode.browser.CLEAR_DATA_PERMISSION
android.permission.KILL_BACKGROUND_PROCESSES
android.permission.WRITE_SYNC_SETTINGS
com.google.android.c2dm.permission.RECEIVE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.MANAGE_EXTERNAL_STORAGE

Receivers

com.hexnode.mdm.receivers.HexnodeDeviceAdminReceiver

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.PROFILE_PROVISIONING_COMPLETE

com.hexnode.mdm.receivers.AfwReceiver

android.app.action.MANAGED_PROFILE_PROVISIONED

com.hexnode.mdm.receivers.SamsungLicenseReceiver

com.samsung.android.knox.intent.action.LICENSE_STATUS
com.samsung.android.knox.intent.action.KNOX_LICENSE_STATUS

com.hexnode.mdm.receivers.HexnodeWakefulReceiver

com.hexnode.mdm.SYNC_DEVICE

com.hexnode.mdm.receivers.AppEventReceiver

android.intent.action.MY_PACKAGE_REPLACED

com.hexnode.mdm.receivers.TimeChangeReceiver

android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

com.hexnode.mdm.receivers.HexBootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.ACTION_SHUTDOWN
android.intent.action.LOCKED_BOOT_COMPLETED

com.hexnode.mdm.gcm.PushReceiver

pushy.me

me.pushy.sdk.receivers.PushyUpdateReceiver

android.intent.action.PACKAGE_REPLACED

me.pushy.sdk.receivers.PushyBootReceiver

android.intent.action.BOOT_COMPLETED

com.hexnode.mdm.receivers.UMCBroadcastReceiver

com.sec.enterprise.knox.intent.action.LAUNCH_APP
com.sec.enterprise.knox.intent.action.UNENROLL_FROM_UMC

com.hexnode.hexnodemdm.supportlibclient.PreventStartReceiver

com.samsung.android.knox.intent.action.PREVENT_APPLICATION_START

com.samsung.android.knox.IntentConverterReceiver

edm.intent.application.action.prevent.start
edm.intent.application.action.prevent.stop
edm.intent.action.ldap.createacct.result
edm.intent.action.device.inside
edm.intent.action.device.outside
edm.intent.action.device.location.unavailable
com.samsung.edm.intent.action.CERTIFICATE_REMOVED
edm.intent.certificate.action.certificate.failure
com.samsung.edm.intent.action.APPLICATION_FOCUS_CHANGE
edm.intent.action.EMAIL_ACCOUNT_ADD_RESULT
edm.intent.action.EMAIL_ACCOUNT_DELETE_RESULT
com.sec.enterprise.intent.action.BLOCKED_DOMAIN
com.sec.enterprise.intent.action.UPDATE_FOTA_VERSION_RESULT
com.samsung.edm.intent.action.EXCHANGE_CBA_INSTALL_STATUS
android.intent.action.sec.CBA_INSTALL_STATUS
edm.intent.action.EXCHANGE_ACCOUNT_ADD_RESULT
edm.intent.action.EXCHANGE_ACCOUNT_DELETE_RESULT
com.samsung.edm.intent.action.ENFORCE_SMIME_ALIAS_RESULT
edm.intent.action.knox_license.status
edm.intent.action.license.status
com.samsung.edm.intent.event.NTP_SERVER_UNREACHABLE
edm.intent.action.enable.kiosk.mode.result
edm.intent.action.disable.kiosk.mode.result
edm.intent.action.unexpected.kiosk.behavior
com.samsung.edm.intent.action.SIM_CARD_CHANGED
android.intent.action.sec.SIM_CARD_CHANGED
com.samsung.action.knox.certenroll.CEP_CERT_ENROLL_STATUS
com.samsung.action.knox.certenroll.CEP_SERVICE_DISCONNECTED
com.sec.enterprise.knox.intent.action.KNOX_ATTESTATION_RESULT
com.sec.action.NO_USER_ACTIVITY
com.sec.action.USER_ACTIVITY
com.samsung.android.mdm.VPN_BIND_RESULT

com.microsoft.aad.adal.ApplicationReceiver

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_INSTALL

com.google.firebase.messaging.directboot.FirebaseMessagingDirectBootReceiver

com.google.firebase.messaging.RECEIVE_DIRECT_BOOT

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.android.apps.work.dpcsupport.AccountManagementWhitelistEnforcer$ContinuousEnforcer

android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

Services

com.hexnode.mdm.remote.RemoteControlService

com.hexnode.hexnodemdm.IRemoteControl

com.hexnode.mdm.gcm.FcmListenerService

com.google.firebase.MESSAGING_EVENT

com.hexnode.mdm.service.NotificationListenerServices

android.service.notification.NotificationListenerService

com.hexnode.mdm.service.HexVpnService

android.net.VpnService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.android.apps.work.dpcsupport.ManagedConfigurationsProxy

com.android.vending.dpc.APPLICATION_RESTRICTIONS_PROXY

Android Permissions

HexnodeMDM.apk

Permissions

android.permission.BLUETOOTH

android.permission.BLUETOOTH_ADMIN

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.SCHEDULE_EXACT_ALARM

android.permission.ACCESS_WIFI_STATE

android.permission.UPDATE_DEVICE_STATS

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.WRITE_SETTINGS

android.permission.EXPAND_STATUS_BAR

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SET_WALLPAPER

android.permission.SET_WALLPAPER_HINTS

android.permission.FOREGROUND_SERVICE

android.permission.INSTALL_PACKAGES

android.permission.REBOOT

android.permission.SHUTDOWN

android.permission.DELETE_PACKAGES

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION

android.permission.GET_ACCOUNTS

android.permission.MANAGE_ACCOUNTS

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.CHANGE_NETWORK_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.WRITE_CONTACTS

android.permission.READ_CONTACTS

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.PACKAGE_USAGE_STATS

com.samsung.android.knox.permission.KNOX_KIOSK_MODE

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.CAMERA

com.samsung.android.knox.permission.KNOX_LOCATION

com.samsung.android.knox.permission.KNOX_RESTRICTION_MGMT

com.samsung.android.knox.permission.KNOX_HW_CONTROL

com.samsung.android.knox.permission.KNOX_APP_MGMT

com.samsung.android.knox.permission.KNOX_APN

com.samsung.android.knox.permission.KNOX_BLUETOOTH

com.samsung.android.knox.permission.KNOX_FIREWALL

com.samsung.android.knox.permission.KNOX_WIFI

com.samsung.android.knox.permission.KNOX_CUSTOM_SYSTEM

com.samsung.android.knox.permission.KNOX_SECURITY

com.samsung.android.knox.permission.KNOX_GLOBALPROXY

com.samsung.android.knox.permission.KNOX_PHONE_RESTRICTION

Sharing

General

Malware Config

Signatures

Files

com.hexnode.hexnodemdm

com.hexnode.mdm.ui.SplashActivity

Activities

com.hexnode.mdm.PolicyCompliance

com.hexnode.mdm.SelectionActivity

com.hexnode.mdm.download_manager.ui.DownloadsActivity

com.hexnode.mdm.ui.PostProvisioningActivity

com.hexnode.mdm.ui.EnrollValidationActivity

com.hexnode.mdm.ui.SplashActivity

com.hexnode.mdm.ui.LauncherActivity

com.hexnode.mdm.ui.WifiActivity

Permissions

Receivers

com.hexnode.mdm.receivers.HexnodeDeviceAdminReceiver

com.hexnode.mdm.receivers.AfwReceiver

com.hexnode.mdm.receivers.SamsungLicenseReceiver

com.hexnode.mdm.receivers.HexnodeWakefulReceiver

com.hexnode.mdm.receivers.AppEventReceiver

com.hexnode.mdm.receivers.TimeChangeReceiver

com.hexnode.mdm.receivers.HexBootReceiver

com.hexnode.mdm.gcm.PushReceiver

me.pushy.sdk.receivers.PushyUpdateReceiver

me.pushy.sdk.receivers.PushyBootReceiver

com.hexnode.mdm.receivers.UMCBroadcastReceiver

com.hexnode.hexnodemdm.supportlibclient.PreventStartReceiver

com.samsung.android.knox.IntentConverterReceiver

com.microsoft.aad.adal.ApplicationReceiver

com.google.firebase.messaging.directboot.FirebaseMessagingDirectBootReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

com.google.android.apps.work.dpcsupport.AccountManagementWhitelistEnforcer$ContinuousEnforcer

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

Services

com.hexnode.mdm.remote.RemoteControlService

com.hexnode.mdm.gcm.FcmListenerService

com.hexnode.mdm.service.NotificationListenerServices

com.hexnode.mdm.service.HexVpnService

com.google.firebase.messaging.FirebaseMessagingService

com.google.android.apps.work.dpcsupport.ManagedConfigurationsProxy

Android Permissions

HexnodeMDM.apk