17957542646[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

17957542646.zip
Size

2.0MB
MD5

9884c15ed9d4f2c7653183783fcce9da
SHA1

87bd7687c0da6c10917ab6f854f56fc3330dc413
SHA256

b2ecaa3c871b11657cedb1ac58752dbe04158d2d29e39ee35091357e8cd8198b
SHA512

d56feb9a39755e08e1a5c95af0aa4d446ce1f8872a9ade0b25a7eff2b60a98da4e4c8e2841c943c4799ee8b79daaba8b05c50165761b07a0d59f979f72dd69fd
SSDEEP

49152:AL7XCA6xqNti1bEZpBVjuzqOtuApkS03ARi9QUiH9OZal:27XkqWdEJEttzpkS03AcIPl

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Files

17957542646.zip
.zip

Password: infected
e6b812fdd058d54c0b60fb1fb5e7ca4c85abcd58408b857eadcce28167709ede
.apk android

Password: infected

com.vddvodhuoqulhjsmxxy.apndfcxhiksgjef

com.vddvodhuoqulhjsmxxy.apndfcxhiksgjef.MainActivity

Activities

com.vddvodhuoqulhjsmxxy.apndfcxhiksgjef.MainActivity

android.intent.action.CHOOSER
android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.QUERY_ALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.FOREGROUND_SERVICE
android.permission.WAKE_LOCK

Receivers

com.vddvodhuoqulhjsmxxy.apndfcxhiksgjef.Receiver.ScreenReceiver

android.intent.action.USER_PRESENT
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF

com.vddvodhuoqulhjsmxxy.apndfcxhiksgjef.Service.InstallerRestarterService

restartinstallerservice

com.vddvodhuoqulhjsmxxy.apndfcxhiksgjef.Receiver.PhoneStateReceiver

android.intent.action.PHONE_STATE
android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.SMS_DELIVER

Services

com.vddvodhuoqulhjsmxxy.apndfcxhiksgjef.Service.AccessibilityControllerService

android.accessibilityservice.AccessibilityService