xamalicious | UMPSA ADAB_3[.]2[.]0_apkcombo[.]com[.]apk

General

Target
UMPSA ADAB_3.2.0_apkcombo.com.apk
Size 79.6MB
Sample240602-p63c9sch5z
SHA256 00a73ec14da4b3b9024cba47edf24c6ac168427baec95d3367bf4a9d08090ad7
MD5 8dde3cd9e2f57024c9fd09e94cc352d2
SHA1 8ca24e13fe957b087c57d0e719e959398c0038d9
SHA512 6a99e89fa364ecbb258249062e50b657d942d77abc47743d1ed8ea236d71689439347283580955e8733cbbece167a6d7fc568e843331ea80fe46be43b273dd0e
SSDEEP 1572864:fXDpWss8xYjf34pjZ9V2r3em+XzNsOC4zhvrhu:7ZxYz34pjZA+XzTRVI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Android Xamalicious payload 1 IoCs

resource	yara_rule
sample	family_xamalicious

Xamalicious family
xamalicious

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

File Explorer

UMPSA ADAB_3.2.0_apkcombo.com.apk

.apk 79.6MB

UMPSA ADAB_3.2.0_apkcombo.com.apk

SHA256 00a73ec14da4b3b9024cba47edf24c6ac168427baec95d3367bf4a9d08090ad7
MD5 8dde3cd9e2f57024c9fd09e94cc352d2
SHA1 8ca24e13fe957b087c57d0e719e959398c0038d9
SHA512 6a99e89fa364ecbb258249062e50b657d942d77abc47743d1ed8ea236d71689439347283580955e8733cbbece167a6d7fc568e843331ea80fe46be43b273dd0e
SSDEEP 1572864:fXDpWss8xYjf34pjZ9V2r3em+XzNsOC4zhvrhu:7ZxYz34pjZA+XzTRVI
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm

Android Xamalicious payload

my.edu.ump.adab

Android Permissions

UMPSA ADAB_3.2.0_apkcombo.com.apk

Permissions

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_MEDIA_LOCATION

android.permission.CAMERA

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.WRITE_SECURE_SETTINGS

android.permission.WRITE_SETTINGS

android.permission.READ_EXTERNAL_STORAGE

UMPSA ADAB_3.2.0_apkcombo.com.apk

crc6406cd8aedc104d7b7.MainActivity

crc64a0e0a82d0db9a07d.IntermediateActivity

crc64a0e0a82d0db9a07d.WebAuthenticatorIntermediateActivity

crc6480997b3ef81bf9b2.ZxingActivity

com.google.android.gms.common.api.GoogleApiActivity

crc64396a3fe5f8138e3f.KeepAliveService

crc64a0e0a82d0db9a07d.BatteryBroadcastReceiver

crc64a0e0a82d0db9a07d.EnergySaverBroadcastReceiver

crc64a0e0a82d0db9a07d.ConnectivityBroadcastReceiver

crc643f46942d9dd1fff9.PowerSaveModeBroadcastReceiver

xamarin.essentials.fileProvider

mono.MonoRuntimeProvider

Sharing

General

Malware Config

Signatures

File Explorer

UMPSA ADAB_3.2.0_apkcombo.com.apk

crc6406cd8aedc104d7b7.MainActivity

crc64a0e0a82d0db9a07d.IntermediateActivity

crc64a0e0a82d0db9a07d.WebAuthenticatorIntermediateActivity

crc6480997b3ef81bf9b2.ZxingActivity

com.google.android.gms.common.api.GoogleApiActivity

crc64396a3fe5f8138e3f.KeepAliveService

crc64a0e0a82d0db9a07d.BatteryBroadcastReceiver

crc64a0e0a82d0db9a07d.EnergySaverBroadcastReceiver

crc64a0e0a82d0db9a07d.ConnectivityBroadcastReceiver

crc643f46942d9dd1fff9.PowerSaveModeBroadcastReceiver

xamarin.essentials.fileProvider

mono.MonoRuntimeProvider

Android Permissions

UMPSA ADAB_3.2.0_apkcombo.com.apk