mobileorder | The China Freedom Trap[.]apk

General

Target
The China Freedom Trap.apk
Size 342KB
Sample240829-3a3wtayann
SHA256 fd99acc504649e8e42687481abbceb71c730f0ab032357d4dc1e95a6ef8bb7ca
MD5 a38e8d70855412b7ece6de603b35ad63
SHA1 92118623c417c7b9c46b99ae71424198327698a8
SHA512 7fb48ed59df753a79a9f42750d71c5cc5aa9a6bca976b83ba72add9ddec1fb50c799b21e874d111bfb414635b1e7f6e9d388867d679a29597f0b912a105c56a4
SSDEEP 6144:HIOn1UQtZOfKr3V33gmAIAM+WubYnmNMbwy9UXKfgWUGl:HImpOfKrF33pdAgubQmNM/SuUC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

mobileorder

Malware Config

Extracted

Family

mobileorder

C2

blackbeekey.com
k7k7.co

Attributes

user_agent
Mozilla/4.0 (compatible; MSIE 5.0; Windows NT; DigExt)

Signatures

Mobileorder family
mobileorder

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA

File Explorer

The China Freedom Trap.apk

.apk 342KB

The China Freedom Trap.apk

SHA256 fd99acc504649e8e42687481abbceb71c730f0ab032357d4dc1e95a6ef8bb7ca
MD5 a38e8d70855412b7ece6de603b35ad63
SHA1 92118623c417c7b9c46b99ae71424198327698a8
SHA512 7fb48ed59df753a79a9f42750d71c5cc5aa9a6bca976b83ba72add9ddec1fb50c799b21e874d111bfb414635b1e7f6e9d388867d679a29597f0b912a105c56a4
SSDEEP 6144:HIOn1UQtZOfKr3V33gmAIAM+WubYnmNMbwy9UXKfgWUGl:HImpOfKrF33pdAgubQmNM/SuUC
MD5 SHA1 SHA512 SSDEEP

android

com.emc.pdf

com.android.core.P

android.intent.action.PHONE_STATE android.intent.action.NEW_OUTGOING_CALL

com.android.core.O

com.android.core.R

android.intent.action.PHONE_STATE android.intent.action.BOOT_COMPLETED android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.PHONE_STATE android.intent.action.NEW_OUTGOING_CALL android.intent.action.DATA_STATE android.intent.action.DATE_CHANGED android.intent.action.SCREEN_OFF android.intent.action.SCREEN_ON android.intent.action.SERVICE_STATE android.intent.action.NEW_OUTGOING_CALL android.intent.action.NEW_OUTGOING_CALL a android.intent.action.MEDIA_MOUNTED android.intent.action.MEDIA_EJECT android.intent.action.MEDIA_UNMOUNTED android.intent.action.MEDIA_SHARED android.intent.action.MEDIA_SCANNER_STARTED android.intent.action.MEDIA_SCANNER_FINISHED android.intent.action.MEDIA_REMOVED android.intent.action.MEDIA_BAD_REMOVAL android.media.SCO_AUDIO_STATE_CHANGED android.media.ACTION_SCO_AUDIO_STATE_UPDATED MMBakchatServiceStart MMBakchatServiceStop com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_REGISTER com.tencent.mm.plugin.openapi.Intent.ACTION_HANDLE_APP_UNREGISTER android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_CHANGED android.intent.action.PACKAGE_REMOVED android.intent.action.PACKAGE_DATA_CLEARED android.intent.action.PACKAGE_INSTALL android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_RESTARTED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.POWER_USAGE_SUMMARY android.intent.action.ACTION_SHUTDOWN

com.android.core.D

android.app.action.DEVICE_ADMIN_ENABLED

Android Permissions

The China Freedom Trap.apk

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.PROCESS_OUTGOING_CALLS

android.intent.action.NEW_OUTGOING_CALL

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_LOGS

android.permission.READ_CALL_LOG

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.RECORD_AUDIO

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.GET_ACCOUNTS

android.permission.MANAGE_ACCOUNTS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.CAMERA

android.permission.CHANGE_WIFI_STATE

android.permission.CHANGE_CONFIGURATION

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.WRITE_SMS

The China Freedom Trap.apk

com.view.open.MainActivity

com.android.core.core

com.android.core.Cj

com.view.open.open

com.android.core.P

com.android.core.O

com.android.core.R

com.android.core.D

android.support.v4.content.FileProvider

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

The China Freedom Trap.apk

com.view.open.MainActivity

com.android.core.core

com.android.core.Cj

com.view.open.open

com.android.core.P

com.android.core.O

com.android.core.R

com.android.core.D

android.support.v4.content.FileProvider

Android Permissions

The China Freedom Trap.apk