slocker | WannaLocker[.]zip

General

Target
WannaLocker.zip
Size 3.3MB
Sample240803-e5771syalg
SHA256 428b206615925e6f67a74cdc7619ae0f4effad8a295c67f85a29983847aac3d7
MD5 7bb99eaa4f3592073fb39d8ab70cc262
SHA1 0c66c06e60261a6c66e13e37067c5c869569e62b
SHA512 1623b1428fec4b5397ac3d63ef60086627d7b2abfd9eb6de05671c4704dbf360dc7cdd3894e5754daf8b5816fea0b920823a44ee27e733d4a0f74db8bdca9ec5
SSDEEP 98304:BGFp6CkcBG3Dn63zhnrHbPcnJCtkxaEWc:8VBOT+ln7gJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

slocker

SLocker payload 2 IoCs

resource	yara_rule
static1/unpack001/200d8f98c326fc65f3a11dc5ff1951051c12991cc0996273eeb9b71b27bc294d.apk	family_slocker_2
static1/unpack001/36f40d5a11d886a2280c57859cd5f22de2d78c87dcdb52ea601089745eeee494.apk	family_slocker_2

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

WannaLocker.zip

.zip 3.3MB
200d8f98c326fc65f3a11dc5ff1951051c12991cc0996273eeb9b71b27bc294d.apk

.apk 1.8MB
36f40d5a11d886a2280c57859cd5f22de2d78c87dcdb52ea601089745eeee494.apk

.apk 2.0MB

SHA256 428b206615925e6f67a74cdc7619ae0f4effad8a295c67f85a29983847aac3d7
MD5 7bb99eaa4f3592073fb39d8ab70cc262
SHA1 0c66c06e60261a6c66e13e37067c5c869569e62b
SHA512 1623b1428fec4b5397ac3d63ef60086627d7b2abfd9eb6de05671c4704dbf360dc7cdd3894e5754daf8b5816fea0b920823a44ee27e733d4a0f74db8bdca9ec5
SSDEEP 98304:BGFp6CkcBG3Dn63zhnrHbPcnJCtkxaEWc:8VBOT+ln7gJ
MD5 SHA1 SHA512 SSDEEP

Password

infected

SHA256 200d8f98c326fc65f3a11dc5ff1951051c12991cc0996273eeb9b71b27bc294d
MD5 ba03c39ba851c2cb3ac5851b5f029b9c
SHA1 d72ca5ca1e7dc6431c041bfc6d7e3f9bfa39959c
SHA512 b4f6dfe04bbae931905438e6c23c653e0255a7af8c01cdb8d2c1f81c5ace987153550b9cf922bcb29e07ac3477ae7c859d538510c8770a13b5abe0911128d5d8
SSDEEP 49152:x7bFcxrjUIWXUZGlilIy0ywxepey0yDR5y0yzUjtP:xbFcVwXU/lOxeFDIQ
MD5 SHA1 SHA512 SSDEEP

android

Password

infected

com.android.tencent.zdevs.bah

SHA256 36f40d5a11d886a2280c57859cd5f22de2d78c87dcdb52ea601089745eeee494
MD5 8ce42ae8f1206130aeadaa7cad062aca
SHA1 ca2e7c66b9eedf95f51204cea8cd2e13ba2a5d93
SHA512 e7c135a6addd21c26862808eecdc0c1e86f5c667eb000257764be9180982a50da14e18c0e36dfdf143e93f041ab481cbe9b2e39f6f4c3003a666db0bf89ddba9
SSDEEP 49152:q7PtjuZTUx4vhFm8ynE8F4+jVlWC6ec8RwWwUjtZ:SP1uZTpDm8yn549C6J0wWB
MD5 SHA1 SHA512 SSDEEP

android

Password

infected

com.android.tencent.zdevs.bah