xamalicious | EZFNLauncherV2[.]apk

General

Target

EZFNLauncherV2.apk
Size

38.1MB
MD5

147e6b26aa1f252bf912c7a1c3a01cb6
SHA1

2cf8e0ccb43311f5885d95bc0188462077a9f77d
SHA256

af6985992d674ac664c07a659515de10eae7ecade0183fda28ac46bb83bcc425
SHA512

89a72e52c0b739bdde18c80aef5ab162cad73f88a077429d3aff34c7d84ae7206949d5145acede4ff3359d324323fece006230a70064380e1878b3020172e89b
SSDEEP

786432:/Ym2d67A9Ls3unQn1SxlMTpxABB9F5d3fHQ62G3Zu3V0u/U1S2G:3Tn1SvMNxABB9vdx3ZgygUhG

Score

10^/10

xamalicious

Android Xamalicious payload 1 IoCs

Processes:

resource	yara_rule
sample	family_xamalicious

Requests dangerous framework permissions 4 IoCs

Processes:

description	ioc
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.QUERY_ALL_PACKAGES

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

com.ezfn.launcher.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION