19267906361.zip
- SHA256 f73609d837a61d167fb03b2eeda20240957e42c6c68df1d98c93fed06f81cefa
Password
infected
General
- Target 19267906361.zip
- Size 3.8MB
- Sample241031-evdknayjhx
- SHA256 f73609d837a61d167fb03b2eeda20240957e42c6c68df1d98c93fed06f81cefa
- MD5 7e5846d4e3ee5d12e83e0e187774eddb
- SHA1 8019d3cf71c9816c0958dab04a785f751ab5b2e6
- SHA512 8084d37a2c215283cc9cb6b0688c9a1cf047a629c55da083ed0e377b672342e8cff78d963e609b35b61f6c5d4b7d4a39c2abf772408eee4441683a6434d42ae8
- SSDEEP 98304:mx8VQhqP0L9l1RKMkYjFA+w7OGuJAXXOB+1ZJMe2vrprqkN:DWhb9lbKjYjFApOXAXS+rSeSrHN
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Spyagent family
- Spyagent payload 2 IoCs
resource yara_rule static1/unpack001/149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c family_spyagent static1/unpack001/149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c family_spyagent - Requests dangerous framework permissions 9 IoCs
description ioc Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an application to read image files from external storage. android.permission.READ_MEDIA_IMAGES Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to access any geographic locations persisted in the user's shared collection. android.permission.ACCESS_MEDIA_LOCATION
File Explorer
-
19267906361.zip.zip 3.8MB
-
149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c.apk 8.5MB
149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c
- SHA256 149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c
- MD5 a097e2b3ec5496dd18b34c9344b5b231
- SHA1 d92439fcdba8d468b2b6d64d0542c48c41b99abc
- SHA512 45b400ea85aa225dfaeee7c0ad108b3d27b15ab633a003fe8d767df7162544e4a661083041e76587f79f841a36e63e59b55ef8bf3f15848d65d30d21862a83f2
- SSDEEP 196608:JH6fslAGOGD+ZAeZx2S7cRrFXKe+rof8n7DLH:lwslAPTAeZxeFXWr+o
- MD5 SHA1 SHA512 SSDEEP
-
Spyagent payload
Password
infected
com.douyin.softwareapp
com.douyin.softwareapp.MainActivity
android.permission.READ_SMS
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.READ_PHONE_STATE
android.permission.READ_PHONE_NUMBERS
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.FOREGROUND_SERVICE
android.permission.FOREGROUND_SERVICE_DATA_SYNC
android.permission.READ_MEDIA_IMAGES
android.permission.POST_NOTIFICATIONS
android.permission.READ_EXTERNAL_STORAGE
android.permission.ACCESS_MEDIA_LOCATION
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
com.douyin.softwareapp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
com.douyin.softwareapp.MainActivity
android.intent.action.MAIN
com.douyin.softwareapp.LauncherActivity
android.intent.action.MAIN
com.douyin.softwareapp.WebSocketService
com.douyin.softwareapp.WebSocketJobService
com.douyin.softwareapp.NetworkChangeReceiver
android.net.conn.CONNECTIVITY_CHANGE
com.douyin.softwareapp.SmsBroadcastReceiver
android.provider.Telephony.SMS_RECEIVED
com.douyin.softwareapp.BootBroadcastReceiver
android.intent.action.BOOT_COMPLETED
androidx.profileinstaller.ProfileInstallReceiver
androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION