qcojes[.]apk | Triage™

General

Target
qcojes.apk
Size 8.5MB
Sample240926-ssk4lsxcrc
SHA256 58911b7dbc485fb5e8bc3967de002ab5cb898023223d7a41e5dd7e1a074e40b1
MD5 df2e25512953821661b4ab8a5688a9c8
SHA1 7f60852fef126e5fd8e71266a65ed153b6094d40
SHA512 a9d57579442311c693af3c4c5fecb4ef8cd4d68c2ddbb4a6734eb892ba6e5cca58fa4468f07a47da7433d2329a75d948696a652341fb05be30e4a448eb61c127
SSDEEP 196608:G1mTS0d6slb4lDlPUfTDfu/cggd0CRCYSIB2euR2kSdr4l:G8d6slb4lJPuTDfu/cICR9B21R2P4l
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by autofill services to bind with the system. Allows apps to autofill information in forms.	android.permission.BIND_AUTOFILL_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls.	android.permission.BIND_SCREENING_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

qcojes.apk

.apk 8.5MB
dogexuzo

.apk 9.7MB

qcojes.apk

SHA256 58911b7dbc485fb5e8bc3967de002ab5cb898023223d7a41e5dd7e1a074e40b1
MD5 df2e25512953821661b4ab8a5688a9c8
SHA1 7f60852fef126e5fd8e71266a65ed153b6094d40
SHA512 a9d57579442311c693af3c4c5fecb4ef8cd4d68c2ddbb4a6734eb892ba6e5cca58fa4468f07a47da7433d2329a75d948696a652341fb05be30e4a448eb61c127
SSDEEP 196608:G1mTS0d6slb4lDlPUfTDfu/cggd0CRCYSIB2euR2kSdr4l:G8d6slb4lJPuTDfu/cICR9B21R2P4l
MD5 SHA1 SHA512 SSDEEP

android

com.wafukizifi.server

dogexuzo

SHA256 5c6d278d5791748650065233697419a744a1d12f50960dd56b9f86b59dd052c7
MD5 ed1dd47ee8ea4b6bb0d06837c5e96d70
SHA1 1bce41dfb97da1cd4cd51026df78d33c78bb66be
SHA512 df139dffe6aea4d05a03ba1bd7e9352f02f1e6914c427219a209d6fbc7150bc757ab8aa41c4ee2f3542f2c3c99183b5e6947145652dee9b7e078649035aac4eb
SSDEEP 98304:Fmv/Hh3MT/Jfr+c/byhZMzYWV2ieSyeTgnrSsVo/KrL1QeWLn4H:Fmvfh3c/JfrZbyhZrWEYErSslQeon4H
MD5 SHA1 SHA512 SSDEEP

android

com.xusayu.platform

com.xusayu.platform.jIHcvciye

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER

com.xusayu.platform.upngxkxxwdqkctt

android.provider.Telephony.WAP_PUSH_DELIVER

com.xusayu.platform.hMRPJNLNwV

android.intent.action.BOOT_COMPLETED android.intent.action.PHONE_STATE

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

qcojes.apk

Permissions

android.permission.QUERY_ALL_PACKAGES

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.REQUEST_COMPANION_START_FOREGROUND_SERVICES_FROM_BACKGROUND

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

com.wafukizifi.server.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.CREDENTIAL_MANAGER_SET_ORIGIN

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_INSTALL_PACKAGES

Sharing

General

Malware Config

Signatures

File Explorer

qcojes.apk

com.wafukizifi.server.tPXlgyKKAOycBL

com.wafukizifi.server.KVmIgkNzoyhYna

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

dogexuzo

com.xusayu.platform.OPWEGJDMerd

com.xusayu.platform.FkuMpRxcBWwpGY

com.xusayu.platform.xyBBDkRvHNtjpQL

com.xusayu.platform.GfFLNiSv

com.xusayu.platform.chcjfjctcb

com.xusayu.platform.zplvkzrnqosnf

com.xusayu.platform.NjLjDFWq

com.xusayu.platform.bYcLTzNe

com.xusayu.platform.OGMgHALIQypQdiJ

com.xusayu.platform.AyqvLxKScAzAEnSA

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.xusayu.platform.jIHcvciye

com.xusayu.platform.upngxkxxwdqkctt

com.xusayu.platform.hMRPJNLNwV

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Android Permissions

qcojes.apk