General

  • Target

    signalplus_released.apk

  • Size

    79.1MB

  • Sample

    240712-myfs7aselg

  • MD5

    76351b5e3b9487b0b39759dbfea5f0c9

  • SHA1

    19e5cf2e8eed73ee614b668bc1dbdda01e058c0c

  • SHA256

    549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0

  • SHA512

    0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7

  • SSDEEP

    1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb

Malware Config

Extracted

Family

badbazaar

C2

https://signalplus.org:4332/api/

https://signalplus.org:4332/api/QRCode?imei=

Targets

    • Target

      signalplus_released.apk

    • Size

      79.1MB

    • MD5

      76351b5e3b9487b0b39759dbfea5f0c9

    • SHA1

      19e5cf2e8eed73ee614b668bc1dbdda01e058c0c

    • SHA256

      549d726fe2b775cfdd1304c2d689dfd779731336a3143225dc3c095440f69ed0

    • SHA512

      0f858b36e47012737de9ca88399a4f95740f6ffc3639b5134aa418ccee441af905f1e503775fb741cd3def7931db18b517a8b2f07c4f0576f8f79ff9fb3f3fa7

    • SSDEEP

      1572864:U/u4rrAgdZh87ZlyFLSnI8LcejgNtwQYpxtIwTJSzslunYuTAO:UOIeZBI8LHUUxlT4YlSjTb

    • Loads dropped Dex/Jar

      Runs executable file dropped to the device during analysis.

    • Acquires the wake lock

    • Makes use of the framework's foreground persistence service

      Application may abuse the framework's foreground service to continue running in the foreground.

    • Queries information about active data network

MITRE ATT&CK Mobile v15

Tasks