net.south.seven.StartActivity
android.intent.action.MAIN
General
-
Target
924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420.apk
-
Size
6.8MB
-
MD5
f07b8cc1e331ec181031a0d90fbffb85
-
SHA1
f31c67ccc0d1867db1fbc43762fcf83746a408c2
-
SHA256
924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420
-
SHA512
e2fdf39bdc5b3861b3185a575470e5612ec9a99047c2ef1ab499415872d007e6acf54b4e4fe155f27b905a6e8feb58bb44479b5080c5cf31266dded1541e3520
-
SSDEEP
196608:WqZSQeHQfzcTK77FMQ+V+Y4Bz/JdLdJ3bh3IwNdn:/ZsHK0EJEv4h/9thz7n
Score
10/10
Malware Config
Extracted
Path
res/layout/activity_main.xml
Family
filecoder
Ransom Note
Current State Information
Your personal documents and files on this device have just been crypted.The origion files have been completely deleted and will only be recovered by following the steps described below.
Document Decryption Operation Guide
1. To obtain the key which will decrypt files,you need to pay the amount of Bitcoin you see at the top of the screen.
2. After the payment is completed, open %s and enter the userid below, you will get the decryption key.
3. Paste the decryption key in the key inputbox below and click the decrypt button.Reboot the phone,all files will be successfully decrypted.
Decrypt
Key:
paste your key here...
Useful Information
UserID:
BTC addr:
16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy
!!!Do not delete this APP,or your files will not be back forever!!!
Wallets
16KQjht4ePZxxGPr3es24VQyMYgR9UEkFy
Signatures
-
Filecoder family
-
Requests dangerous framework permissions 4 IoCs
Files
-
924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420.apk
net.south.seven
net.south.seven.StartActivity
Android Permissions
924e8a1c0d7fba2b069b5ce514c45d0835c474a4ce146263cd1d27d405904420.apk
Permissions
android.permission.SET_WALLPAPER
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_CONTACTS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.SEND_SMS
android.permission.INTERNET