General

  • Target

    Cryptic640.apk

  • Size

    136.3MB

  • MD5

    b5e36b3fcb781eab357f02942e79a463

  • SHA1

    58eb1406611580485ef970c483f5c4c3c6a0fd32

  • SHA256

    e12e769324f4c6f8c8901291b9fee33bc25322b1e4053f683cfb2c1babedb28d

  • SHA512

    d3c5af6ad68bb6f2996cd2e4017d5969e749ca9f8b16800e2c1aca813ae76cb7e2a8879dcaa2c78988fc08f10fa4f38e4953ad7d6715b2972932372fe930f468

  • SSDEEP

    3145728:J8Hy1RCAMLEsstDC6+C6/zbuY7mf/W0o+3XDL6Sp1m37X8BsR+Fdu0i+4zc:J8gR1YEskS/zbuYCtoLSpw37X8AWK+Gc

Malware Config

Signatures

  • Office macro that triggers on suspicious action 1 IoCs

    Office document macro which triggers in special circumstances - often malicious.

  • Requests dangerous framework permissions 5 IoCs

Files

  • Cryptic640.apk
    .apk android arch:arm64

    com.roblox.client

    com.roblox.client.startup.ActivitySplash


Android Permissions

Cryptic640.apk

Permissions

android.permission.BLUETOOTH

android.permission.POST_NOTIFICATIONS

android.permission.VIBRATE

com.android.vending.BILLING

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.READ_CONTACTS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.USE_FULL_SCREEN_INTENT

android.permission.DISABLE_KEYGUARD

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

com.google.android.gms.permission.AD_ID

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

com.huawei.appmarket.service.commondata.permission.GET_COMMON_DATA

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

com.roblox.client.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION