xamalicious | com[.]melonloader[.]installer_signed[.]apk

General

Target

com.melonloader.installer_signed.apk
Size

97.2MB
MD5

f5042248585a7627d2aee4cdbe3cceb7
SHA1

cc112baa4e68132cf945cbd43a3e7f04dd1183f9
SHA256

012074928e648f6c483a450d1365c19bf353d8a15ff5968320a2363ce552cc65
SHA512

ed4700c71ece60f338cde7ad5c874f5dd7d6ce6f5ddc1a69668a4418532b4e5e0f406e3757707d5fab78b3ad0f2fbed22cc81afb010ac92e0667f7101108c4fa
SSDEEP

786432:f6HJbuUWws9JG6y4zdNX163IF6wCqfO/jFQ4ewas29Mm8:aJjWNdyMQ3IHpfO/jleg29C

Score

10^/10

xamalicious

Android Xamalicious payload 1 IoCs

Processes:

resource	yara_rule
sample	family_xamalicious

Requests dangerous framework permissions 5 IoCs

Processes:

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_MEDIA_LOCATION

android.permission.FOREGROUND_SERVICE

android.permission.QUERY_ALL_PACKAGES

com.melonloader.installer.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION