cb30908ee763adb9fad9824d4e5e401ec5e05b126836703cfda9ed172f3e1907[.]zip

General

Target

cb30908ee763adb9fad9824d4e5e401ec5e05b126836703cfda9ed172f3e1907.zip
Size

6.8MB
MD5

1f3739be1365dbb3c9a3fdc4f6b33a2e
SHA1

56e6acf00a2b5e0a2a289fe693097811ee95a912
SHA256

28bc780f45c9759dcdecfe9026ec96a84a8f347a29f5807165a7751c7bea454a
SHA512

3a54d3c2caf8d6f9c2151e75e62d2ded774b12e5e219b4a2a325db6f5e832066e9f6d5b13ee495d1d9f44078e4710379c580ed239cbe2a4587f0182787fcb195
SSDEEP

196608:kkmvcqfoSfKUK3uiARBU3g+9mYSA9qTd+5HjmahCnNoDSWPbo:kknSfK6HJ+9mjAyKDmoCNGDo

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker.	android.permission.READ_MEDIA_VISUAL_USER_SELECTED

Files

cb30908ee763adb9fad9824d4e5e401ec5e05b126836703cfda9ed172f3e1907.zip
.zip

Password: infected
cb30908ee763adb9fad9824d4e5e401ec5e05b126836703cfda9ed172f3e1907.apk
.apk android arch:arm64 arch:arm arch:x86 arch:x64

Password: infected

y7y15.aicyo.q6fty

g1s31o.cxz5_v.oue3w6.ab2ae5.z95swh

Activities

g1s31o.cxz5_v.oue3w6.ab2ae5.z95swh

com.goFirewall
android.intent.action.VIEW

g1s31o.cxz5_v.oue3w6.ab2ae5.zld2eq

android.intent.action.SENDTO
android.intent.action.VIEW

Permissions

android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_PRIVILEGED_PHONE_STATE
android.permission.READ_PHONE_STATE
android.permission.READ_PHONE_NUMBERS
android.permission.READ_SMS
android.permission.RECEIVE_SMS
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_MEDIA_IMAGES
android.permission.READ_MEDIA_VISUAL_USER_SELECTED
android.permission.GET_PACKAGES
android.permission.QUERY_ALL_PACKAGES
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.WAKE_LOCK
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
y7y15.aicyo.q6fty.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Receivers

g1s31o.cxz5_v.oue3w6.yrd2z3.cogrer

android.provider.Telephony.WAP_PUSH_RECEIVED
android.provider.Telephony.WAP_PUSH_DELIVER

g1s31o.cxz5_v.oue3w6.yrd2z3.ls2qdp

android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.WAP_PUSH_RECEIVED
android.provider.Telephony.SMS_DELIVER

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION

Services

g1s31o.cxz5_v.oue3w6.w49lxk.gznbdj

android.intent.action.RESPOND_VIA_MESSAGE

Sharing

General

Malware Config

Signatures

Files

Password: infected

Password: infected

y7y15.aicyo.q6fty

g1s31o.cxz5_v.oue3w6.ab2ae5.z95swh

Activities

g1s31o.cxz5_v.oue3w6.ab2ae5.z95swh

g1s31o.cxz5_v.oue3w6.ab2ae5.zld2eq

Permissions

Receivers

g1s31o.cxz5_v.oue3w6.yrd2z3.cogrer

g1s31o.cxz5_v.oue3w6.yrd2z3.ls2qdp

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

Services

g1s31o.cxz5_v.oue3w6.w49lxk.gznbdj