xamalicious | EasyCheckIO1[.]0[.]1release[.]apk

General

Target
EasyCheckIO1.0.1release.apk
Size 86.7MB
Sample240920-styq4atfkl
SHA256 1a7291753c0db446b15a8eb7859dcfbca3c7a1ea59c9e1ad9c1d4e63f076ccd7
MD5 a0af9919d648747b0430c39d096f3388
SHA1 8f69dad05638a96fa3cab8603445cc208a798d73
SHA512 1ac66f9fbdf86cf6b6280e3e672c5c1361aa866040260d8af1333185775e286c56c896da8a237aec965d490a18e1c662f059702c16531380c00c16b82a6a3e13
SSDEEP 1572864:wJKx0ePMjow6SNNj7TGtOWdzJx2KaOCZlA91Pf3C:wo+eQPZDTGtD4KPCjA3C
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Android Xamalicious payload 1 IoCs

resource	yara_rule
sample	family_xamalicious

Xamalicious family
xamalicious

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE

File Explorer

EasyCheckIO1.0.1release.apk

.apk 86.7MB

EasyCheckIO1.0.1release.apk

SHA256 1a7291753c0db446b15a8eb7859dcfbca3c7a1ea59c9e1ad9c1d4e63f076ccd7
MD5 a0af9919d648747b0430c39d096f3388
SHA1 8f69dad05638a96fa3cab8603445cc208a798d73
SHA512 1ac66f9fbdf86cf6b6280e3e672c5c1361aa866040260d8af1333185775e286c56c896da8a237aec965d490a18e1c662f059702c16531380c00c16b82a6a3e13
SSDEEP 1572864:wJKx0ePMjow6SNNj7TGtOWdzJx2KaOCZlA91Pf3C:wo+eQPZDTGtD4KPCjA3C
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

Android Xamalicious payload

com.companyname.easycheckio

Android Permissions

EasyCheckIO1.0.1release.apk

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

com.companyname.easycheckio.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

EasyCheckIO1.0.1release.apk

microsoft.identity.client.AuthenticationActivity

crc64ed1888fb4925e3b7.AuthenticationAgentActivity

crc64ba438d8f48cf7e75.IntermediateActivity

crc64a593b180c3e7cd9e.MainActivity

crc640a8d9a12ddbf2cf2.EnergySaverBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

mono.MonoRuntimeProvider

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Signatures

File Explorer

EasyCheckIO1.0.1release.apk

microsoft.identity.client.AuthenticationActivity

crc64ed1888fb4925e3b7.AuthenticationAgentActivity

crc64ba438d8f48cf7e75.IntermediateActivity

crc64a593b180c3e7cd9e.MainActivity

crc640a8d9a12ddbf2cf2.EnergySaverBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

mono.MonoRuntimeProvider

androidx.startup.InitializationProvider

Android Permissions

EasyCheckIO1.0.1release.apk