55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5[.]bin

General

Target
55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5.bin
Size 561KB
Sample241112-18cfeasern
SHA256 55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5
MD5 b59827e8e7b0528b67ee38d9c4b82a17
SHA1 4fb4b52c1d58a7a109518395273876772f773ed5
SHA512 70b0026865b94799b0c538c6f9188e20fab7de311e96495eccf49554dafc3b75d42e1d47606b0a5098ef572f30fcbbb672097969b501712fc27486f3dc0400a4
SSDEEP 12288:rv2cZPmBcqy5yFcdsntn7caFgywOegGLWLtpiWthiHQJb2yjMZ2Fn3:rv2cZPmBcEZB7c1ywOe5L2iYb2SLn3
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

File Explorer

55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5.bin

.apk 561KB

55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5.bin

SHA256 55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5
MD5 b59827e8e7b0528b67ee38d9c4b82a17
SHA1 4fb4b52c1d58a7a109518395273876772f773ed5
SHA512 70b0026865b94799b0c538c6f9188e20fab7de311e96495eccf49554dafc3b75d42e1d47606b0a5098ef572f30fcbbb672097969b501712fc27486f3dc0400a4
SSDEEP 12288:rv2cZPmBcqy5yFcdsntn7caFgywOegGLWLtpiWthiHQJb2yjMZ2Fn3:rv2cZPmBcEZB7c1ywOe5L2iYb2SLn3
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:x86 arch:x64

com.nevercountry4

Android Permissions

55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5.bin

Permissions

android.permission.BATTERY_STATS

android.permission.READ_EXTERNAL_STORAGE

android.permission.INSTALL_SHORTCUT

android.permission.USE_FINGERPRINT

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.POST_NOTIFICATIONS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.WAKE_LOCK

android.permission.SET_ALARM

android.permission.CALL_PHONE

android.permission.USES_POLICY_FORCE_LOCK

android.permission.VIBRATE

android.permission.REQUEST_COMPANION_RUN_IN_BACKGROUND

android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND

android.permission.REQUEST_DELETE_PACKAGES

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.WRITE_SETTINGS

android.permission.REORDER_TASKS

android.permission.SCHEDULE_EXACT_ALARM

android.permission.QUERY_ALL_PACKAGES

android.permission.READ_PHONE_STATE

55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5.bin

com.nevercountry4.p061d

com.nevercountry4.p016i

com.nevercountry4.p027j

com.nevercountry4.p067p

com.nevercountry4.p019z

com.nevercountry4.p082l

com.nevercountry4.p019l

com.nevercountry4.p017r

com.nevercountry4.p022a

com.nevercountry4.p081e

com.nevercountry4.p050t

com.nevercountry4.p055m

com.nevercountry4.p041h

com.nevercountry4.p059z

com.nevercountry4.p046x

com.nevercountry4.p094a

com.nevercountry4.p043i

com.nevercountry4.p036r

com.nevercountry4.p062j

com.nevercountry4.p027g

com.nevercountry4.p071g

com.nevercountry4.p071s

com.nevercountry4.p044x

com.nevercountry4.p065w

com.nevercountry4.p015e

com.nevercountry4.p057p

com.nevercountry4.p055e

com.nevercountry4.p036q

com.nevercountry4.p086z

com.nevercountry4.p080e

Sharing

General

Malware Config

Signatures

File Explorer

55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5.bin

com.nevercountry4.p061d

com.nevercountry4.p016i

com.nevercountry4.p027j

com.nevercountry4.p067p

com.nevercountry4.p019z

com.nevercountry4.p082l

com.nevercountry4.p019l

com.nevercountry4.p017r

com.nevercountry4.p022a

com.nevercountry4.p081e

com.nevercountry4.p050t

com.nevercountry4.p055m

com.nevercountry4.p041h

com.nevercountry4.p059z

com.nevercountry4.p046x

com.nevercountry4.p094a

com.nevercountry4.p043i

com.nevercountry4.p036r

com.nevercountry4.p062j

com.nevercountry4.p027g

com.nevercountry4.p071g

com.nevercountry4.p071s

com.nevercountry4.p044x

com.nevercountry4.p065w

com.nevercountry4.p015e

com.nevercountry4.p057p

com.nevercountry4.p055e

com.nevercountry4.p036q

com.nevercountry4.p086z

com.nevercountry4.p080e

Android Permissions

55ce04247cd98362cfd010a76c32b61c97ef62b5e6c76ba9b44a2abd24e210d5.bin