xyvpn[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

xyvpn.zip
Size

16.5MB
MD5

cb5d1b031fc656d3cfa5f3df2a59958c
SHA1

ee8c9c0ca3a0f477f2d49b545678190ce1c4699a
SHA256

6245cf0134b75b8169e99c237af0aee575a732e16dec451a240546f5a899d5b8
SHA512

63431f906de24aeefe1705b57fad67a6ced70d5f8be3a69deabb6146cd08817202aa022d411b80a416f01a1baed8e3bef0dc50a02ca1a20aeee5c5eebc1ef622
SSDEEP

393216:hW9p1VKrIjcq/16eGmZRweai7+v7kvnehRzTLUuOx/TB+SM:Q9p1VKvq/gDyRw6HnehRzTYuOFt+SM

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Files

xyvpn.zip
.zip

Password: infected
cc8bdd39a78cd6697af5075dd2081b533fce65ee74879c08c8c1dfa51fde48f9
.zip

Password: infected
com.mate.vpn.apk
.apk android

Password: infected

com.mate.vpn

com.mate.vpn.tool.SplashActivity

Activities

com.mate.vpn.HomeActivity

com.mate.vpn.intent.launch.home.action

com.mate.vpn.tool.SplashActivity

android.intent.action.MAIN

com.mate.vpn.vip.VipActivity

android.intent.action.VIEW

com.github.shadowsocks.UrlImportActivity

android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.POST_NOTIFICATIONS
android.permission.WAKE_LOCK
com.google.android.gms.permission.AD_ID
android.permission.CHANGE_NETWORK_STATE
android.permission.FOREGROUND_SERVICE_SPECIAL_USE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_ADSERVICES_ATTRIBUTION
android.permission.ACCESS_ADSERVICES_AD_ID
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.ACCESS_ADSERVICES_TOPICS
android.permission.FOREGROUND_SERVICE
com.mate.vpn.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Receivers

com.github.shadowsocks.BootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.LOCKED_BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION

Services

com.github.shadowsocks.bg.VpnService

android.net.VpnService

com.blankj.utilcode.util.MessengerUtils$ServerService

com.mate.vpn.messenger
config.ar.apk
.jar
config.arm64_v8a.apk
.jar
config.de.apk
.jar
config.en.apk
.jar
config.es.apk
.jar
config.fr.apk
.jar
config.hi.apk
.jar
config.in.apk
.jar
config.it.apk
.jar
config.ja.apk
.jar
config.ko.apk
.jar
config.pt.apk
.jar
config.ru.apk
.jar
config.th.apk
.jar
config.tr.apk
.jar
config.vi.apk
.jar
config.xhdpi.apk
.jar
config.zh.apk
.jar
icon.png
manifest.json

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

Password: infected

com.mate.vpn

com.mate.vpn.tool.SplashActivity

Activities

com.mate.vpn.HomeActivity

com.mate.vpn.tool.SplashActivity

com.mate.vpn.vip.VipActivity

com.github.shadowsocks.UrlImportActivity

Permissions

Receivers

com.github.shadowsocks.BootReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

Services

com.github.shadowsocks.bg.VpnService

com.blankj.utilcode.util.MessengerUtils$ServerService