wipelock | 240822-v5kpqa1hlj_pw_infected[.]zip

General

Target

240822-v5kpqa1hlj_pw_infected.zip
Size

527KB
MD5

572d43d300c2b7abd318eec08f853e80
SHA1

691dda9065880afd9173b2d75640aa8b7f7165b2
SHA256

7ed2ab29ba9df89c964c2d36c66d4b51ff1d50ca0ee1320d22edd33b86420724
SHA512

014f61b19d169e28c5290da9e91a3facfac2cea0022c838285e3f190c10a7cb9e2a9618324b0c92d1af3526bc0ff0bd11321b79f716a7d4eb46517cbfd937d18
SSDEEP

12288:6eLvZvsQUvhQ4vKmAGvYetnu8nnMOvjfKBKvB8PLgFhcL:6eLvZvQhQDmZsonMOzG0ir

Score

10^/10

wipelock

Wipelock Android payload 1 IoCs

Processes:

resource	yara_rule
static1/unpack001/WipeLock.apk	family_wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

Processes:

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 8 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS