base[.]apk | Triage

Resubmissions

13/09/2024, 12:28

240913-pngzls1epg 6

13/09/2024, 12:27

240913-pmzs2a1bkj 6

Sharing

Copy URL Twitter E-mail

General

Target

base.apk
Size

32.6MB
MD5

9b7459f4005c2031b97578e5ad0e6035
SHA1

34ae8fb69a229d77a284b1f406bf49969218b15a
SHA256

615217512d8e7d2ee30b1ca309b41998bb5268d2945fbe9ed5e7b25d7beb9257
SHA512

e6bf19ade51822912f6de4b3e896560e754a313259a4141d310b9a2f0ffdc5fd6d0c4e505fe0e3294c5c1f84c0cd6cf4e56f1225ca50905613c85970197a3a24
SSDEEP

393216:OPSHSRTu6yRz6DwksZ0J2C3I5eyHxO+kG81lXQeuxFGr3eV6/NubwWW:OPSHm/s6DLi0J2WyROblNje+LWW

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 5 IoCs

description	ioc
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA

Files

base.apk
.apk android arch:arm

trx.utils.smshook

trx.utils.smshook.MainActivity

Activities

org.autojs.autojs.ui.splash.SplashActivity

android.intent.action.MAIN

org.autojs.autojs.external.shortcut.ShortcutActivity

android.intent.action.MAIN

org.autojs.autojs.external.widget.ScriptWidgetSettingsActivity_

android.appwidget.action.APPWIDGET_CONFIGURE
android.intent.action.CREATE_SHORTCUT

org.autojs.autojs.external.open.EditIntentActivity

android.intent.action.VIEW
android.intent.action.EDIT

org.autojs.autojs.external.open.RunIntentActivity

android.intent.action.VIEW
android.intent.action.EDIT

org.autojs.autojs.external.open.ImportIntentActivity

android.intent.action.VIEW
android.intent.action.EDIT

trx.utils.smshook.MainActivity

android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.DIAL
android.intent.action.DIAL

trx.utils.smshook.SelectImageActivity

android.intent.action.PICK

trx.utils.smshook.ComposeSmsActivity

android.intent.action.SEND
android.intent.action.SENDTO

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

android.intent.action.MAIN

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

android.intent.action.MAIN

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_WIFI_STATE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_EXTERNAL_STORAGE
com.android.launcher.permission.INSTALL_SHORTCUT
com.android.launcher.permission.UNINSTALL_SHORTCUT
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.PACKAGE_USAGE_STATS
android.permission.INSTALL_PACKAGES
android.permission.ACCESS_FINE_LOCATION
android.permission.RECORD_AUDIO
android.permission.READ_PHONE_STATE
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_SETTINGS
android.permission.WRITE_SECURE_SETTINGS
android.permission.READ_PHONE_NUMBERS
android.permission.REORDER_TASKS
android.permission.SEND_SMS
android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.WRITE_SMS
android.permission.RECEIVE_MMS
android.permission.ACCESS_COARSE_LOCATION
com.google.android.c2dm.permission.RECEIVE
android.permission.CAMERA
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

org.autojs.autojs.external.receiver.StaticBroadcastReceiver

trx.utils.smshook.action.CONNECT_TO_AUTOJS_SERVER
trx.utils.smshook.action.DISCONNECT_TO_AUTOJS_SERVER
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
android.intent.action.UID_REMOVED
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.ACTION_SHUTDOWN
android.intent.action.DATE_CHANGED
android.intent.action.DREAMING_STARTED
android.intent.action.DREAMING_STOPPED
android.intent.action.HEADSET_PLUG
android.intent.action.INPUT_METHOD_CHANGED
android.intent.action.LOCALE_CHANGED
android.intent.action.MEDIA_BUTTON
android.intent.action.MEDIA_CHECKING
android.intent.action.MEDIA_MOUNTED
android.intent.action.PACKAGE_FIRST_LAUNCH
android.intent.action.PROVIDER_CHANGED
android.intent.action.WALLPAPER_CHANGED
android.intent.action.USER_UNLOCKED
android.intent.action.USER_PRESENT
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
android.intent.action.PACKAGE_DATA_CLEARED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_RESTARTED

org.autojs.autojs.external.tasker.FireSettingReceiver

com.twofortyfouram.locale.intent.action.FIRE_SETTING

org.autojs.autojs.external.widget.ScriptWidget

android.appwidget.action.APPWIDGET_UPDATE

org.autojs.autojs.timing.TaskReceiver

com.stardust.autojs.action.task

trx.utils.smshook.receive.GeneralReceiver

app.action.set.alarm
app.action.wakeup.from.alarm
trx.utils.smshook.action.start.recording
trx.utils.smshook.action.update.config
trx.utils.smshook.action.send.log
trx.utils.smshook.action.SELECT_CLASH_PROXY
trx.utils.smshook.action.UPDATE_CLASH_CONFIG
trx.utils.smshook.action.UPDATE_APP
trx.utils.smshook.action.ACTION_INSTALL_APP
trx.utils.smshook.action.DISABLE_TOUCH_INPUT
trx.utils.smshook.action.ENABLE_TOUCH_INPUT
trx.utils.smshook.action.UI_DUMP
trx.utils.smshook.action.ENABLE_LOG
trx.utils.smshook.action.DISABLE_LOG
android.intent.action.SIM_STATE_CHANGED
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.REBOOT
android.intent.action.MY_PACKAGE_REPLACED
android.intent.action.MY_PACKAGE_SUSPENDED
android.intent.action.MY_PACKAGE_UNSUSPENDED
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_CHANGED
android.intent.action.PACKAGE_DATA_CLEARED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_RESTARTED

trx.utils.smshook.receive.TaskReceiver

trx.utils.smshook.action.task.dispatch
trx.utils.smshook.action.return.task
trx.utils.smshook.action.back.to.trx
trx.utils.smshook.action.create.task
trx.utils.smshook.action.report.progress
trx.utils.smshook.action.task.stop

trx.utils.smshook.receive.SmsReceiver

android.provider.Telephony.SMS_DELIVER
android.provider.Telephony.SMS_RECEIVED_ACTION

trx.utils.smshook.receive.MmsReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

com.evernote.android.job.v14.PlatformAlarmReceiver

com.evernote.android.job.v14.RUN_JOB
net.vrallev.android.job.v14.RUN_JOB

com.evernote.android.job.JobBootReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.htc.intent.action.QUICKBOOT_POWERON
android.intent.action.MY_PACKAGE_REPLACED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

Services

org.autojs.autojs.external.tile.LayoutBoundsTile

android.service.quicksettings.action.QS_TILE

org.autojs.autojs.external.tile.LayoutHierarchyTile

android.service.quicksettings.action.QS_TILE

com.stardust.notification.NotificationListenerService

android.service.notification.NotificationListenerService

com.stardust.autojs.core.accessibility.AccessibilityService

android.accessibilityservice.AccessibilityService

trx.utils.smshook.service.NotificationObserverService

android.service.notification.NotificationListenerService

trx.utils.smshook.service.HeadlessSmsSendService

android.intent.action.RESPOND_VIA_MESSAGE

trx.utils.smshook.service.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.evernote.android.job.gcm.PlatformGcmService

com.google.android.gms.gcm.ACTION_TASK_READY

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

Android Permissions

base.apk

Permissions

android.permission.ACCESS_WIFI_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.PACKAGE_USAGE_STATS

android.permission.INSTALL_PACKAGES

android.permission.ACCESS_FINE_LOCATION

android.permission.RECORD_AUDIO

android.permission.READ_PHONE_STATE

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.READ_PHONE_NUMBERS

android.permission.REORDER_TASKS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.RECEIVE_MMS

android.permission.ACCESS_COARSE_LOCATION

com.google.android.c2dm.permission.RECEIVE

android.permission.CAMERA

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Resubmissions

Sharing

General

Malware Config

Signatures

Files

trx.utils.smshook

trx.utils.smshook.MainActivity

Activities

org.autojs.autojs.ui.splash.SplashActivity

org.autojs.autojs.external.shortcut.ShortcutActivity

org.autojs.autojs.external.widget.ScriptWidgetSettingsActivity_

org.autojs.autojs.external.open.EditIntentActivity

org.autojs.autojs.external.open.RunIntentActivity

org.autojs.autojs.external.open.ImportIntentActivity

trx.utils.smshook.MainActivity

trx.utils.smshook.SelectImageActivity

trx.utils.smshook.ComposeSmsActivity

androidx.test.core.app.InstrumentationActivityInvoker$BootstrapActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyActivity

androidx.test.core.app.InstrumentationActivityInvoker$EmptyFloatingActivity

Permissions

Receivers

org.autojs.autojs.external.receiver.StaticBroadcastReceiver

org.autojs.autojs.external.tasker.FireSettingReceiver

org.autojs.autojs.external.widget.ScriptWidget

org.autojs.autojs.timing.TaskReceiver

trx.utils.smshook.receive.GeneralReceiver

trx.utils.smshook.receive.TaskReceiver

trx.utils.smshook.receive.SmsReceiver

trx.utils.smshook.receive.MmsReceiver

com.evernote.android.job.v14.PlatformAlarmReceiver

com.evernote.android.job.JobBootReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

Services

org.autojs.autojs.external.tile.LayoutBoundsTile

org.autojs.autojs.external.tile.LayoutHierarchyTile

com.stardust.notification.NotificationListenerService

com.stardust.autojs.core.accessibility.AccessibilityService

trx.utils.smshook.service.NotificationObserverService

trx.utils.smshook.service.HeadlessSmsSendService

trx.utils.smshook.service.FirebaseMessagingService

com.evernote.android.job.gcm.PlatformGcmService

com.google.firebase.messaging.FirebaseMessagingService

Android Permissions

base.apk