ransomware2[.]zip | Triage

Sharing

General

Target

ransomware2.zip
Size

1.5MB
MD5

bd4788c7afa5fa203d5766596a666cd6
SHA1

03c163f395ae9eda318a2d124753a433f71bf5cd
SHA256

5cc5882f96d54a18150cab2d494f0ea1e13822e9966cace59356c6eb1ec5a245
SHA512

6718c6e0d743bee00422927b2bbcc7830cc5f10fe5711758ec3eba21385200e19f6455f16a56763008ca1092615f9d84a51080a7047a7c8016a3c95c2ff0e81c
SSDEEP

49152:uQDHl0his9xHySHsiIjyBSSKAAETkQhJeU8CDcceZ:l7l0wQSSHJIjcBAETXhwU8CY

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS

Files

ransomware2.zip
.zip

Password: infected
34d616fef212916b9e2d1c1fd0eb98245bce860cde3e0137578c6e7ac9f16c41.apk
.apk android

com.jadhalno.goplotu

com.jadhalno.goplotu.MainActivity

Activities

com.jadhalno.goplotu.MainActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.READ_PHONE_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.FOREGROUND_SERVICE
android.permission.ACCESS_FINE_LOCATION
android.permission.READ_CONTACTS
android.permission.SEND_SMS
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_BOOT_COMPLETED
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

android.intent.action.BOOT_COMPLETED

Services