xamalicious | sh[.]ppy[.]osulazer[.]apk

General

Target

sh.ppy.osulazer.apk
Size

212.7MB
MD5

01c30672ed022cc07fd4b6644b8dc7f8
SHA1

c0a6ce1e42b261b7185f2124c48228e056de58f3
SHA256

5673c3ce997296de547a114b09b2018bd81e7ddf21cfcc390e0effb4ebfbd876
SHA512

783b5b9195c881c75c6026139e779c8d7f8d84bdf22af80c37c5d95acfbdbe50e774b8209defe80cd2d729fe7202eab96e5199d6e14725a6b36610f9666bd7bf
SSDEEP

6291456:3CLa+VJqnq+IqGqQx4bN0CQ0RRlg9xh6FFGVHY:3l6qnBMmLOvY

Score

10^/10

xamalicious

Android Xamalicious payload 1 IoCs

Processes:

resource	yara_rule
sample	family_xamalicious

Requests dangerous framework permissions 3 IoCs

Processes:

description	ioc
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Permissions

android.permission.WAKE_LOCK

android.permission.READ_FRAME_BUFFER

android.permission.INTERNET

android.permission.BATTERY_STATS

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_AUDIO

android.permission.READ_EXTERNAL_STORAGE

sh.ppy.osulazer.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION