antidot | tivi[.]bg[.]apk

General

Target

tivi.bg.apk
Size

11.0MB
MD5

5560db2a375361470c85eecffd0c4613
SHA1

b380d9f5a80d5787dcc4bf6ff393dd597286344c
SHA256

2e67d4c4c12ab161c8bc351fc4d9b8a256fb75a0c7172dfd07a313789704ca41
SHA512

14bd617869f1c610d41fa984b6d4d16af0d40ff3b0aeea694061ccfb907500a89ec982dcd9e057c0ce148f5f009fa85efdeb37637d9074e6c4bd630f87f6c676
SSDEEP

196608:aEiUVRPSNi+/FxHCcv1Dyv3LY+8piLril1TxXzg5ernWheKt:3VRQppQvt8pO+nXzqheKt

Score

10^/10

antidot

Antidot payload 1 IoCs

Processes:

resource	yara_rule
sample	family_antidot

Requests dangerous framework permissions 6 IoCs

Processes:

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

com.android.providers.tv.permission.WRITE_EPG_DATA

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECORD_AUDIO

android.permission.SYSTEM_ALERT_WINDOW

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.FOREGROUND_SERVICE

com.android.providers.tv.permission.READ_EPG_DATA

wl.tivi.bg.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION