General

  • Target

    ProtoHax_1.20.81.apk

  • Size

    10.7MB

  • MD5

    27c09c10ab17b1126d8f6c4aa06f5d50

  • SHA1

    e45fc3db7d7da8a2613f22d2337d20044292de4c

  • SHA256

    9cd5d486e1c5d1b342623db5639b6abe7a7d4d48e7fab32ae024eee670bd6f48

  • SHA512

    932e11bcef151909698f2336cbbb4ac42b3abe4a690464dfa1c3b4f79406819642cc649f2e4249e8ed6c36cb59e53ecf846884b1aa6a10c77acc4c8ed8bf21ef

  • SSDEEP

    196608:+nRTySOq2XyUjj9SR+bwBdMSDSJ/DBvc9muzEz3Gn1JZm:+nR32CUjj9SR+bYWKJM2g

Score
6/10

Malware Config

Signatures

  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 2 IoCs

Files

  • ProtoHax_1.20.81.apk
    .apk android arch:arm64 arch:x64

    Password: Infected

    dev.sora.protohax

    dev.sora.protohax.ui.activities.MainActivity


Android Permissions

ProtoHax_1.20.81.apk

Permissions

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.QUERY_ALL_PACKAGES

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.POST_NOTIFICATIONS

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.gms.permission.AD_ID

dev.sora.protohax.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION