spynote | Craxs-main[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

Craxs-main.zip
Size

8.6MB
MD5

4bd0ad7e1d8f02038ccfc1705f82a01e
SHA1

f5bcee5da27799d68d915a79a5c1bfd7c8c9cdde
SHA256

00d6d4bc84d56087dd94795a6765e3039664fc1d6275f38eb13434e9c02f5b3a
SHA512

1d2cb5436ae125176a1fad3883ae1e9616fa076a05aaeffaab08cfbb872e6d107b5b4ebf41ddb29b44f84e6c82b47799dba3cc2e94c58a035c2b69d91dfb6698
SSDEEP

196608:zV6XLmtHNn0uJIuI4/kF/DR/idqCQ/IaVpbunL6SuU7va6S8uthZ0i:ZLPJqh/ioCQ/ppin+4aXvtp

Score

10^/10

spynote

Malware Config

Extracted

Family

spynote

hack3r416-36897.portmap.io:36897

Signatures

Spynote family
spynote

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD

Requests dangerous framework permissions 16 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Files

Craxs-main.zip
.zip
Craxs-main/5G Network.apk
.apk android

busy.badly.quad

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.ʼﾞٴﹶافʾʼقʿ卄ᵢʼᵢـʽˑｊ匕诶ˑˋʾ哦ᐧˉʿىٴلˋˑᴵق工ⁱ下لˎلˏˋﾞ卄ᵎᐧʾˋ匕ق20

Activities

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.ʼﾞٴﹶافʾʼقʿ卄ᵢʼᵢـʽˑｊ匕诶ˑˋʾ哦ᐧˉʿىٴلˋˑᴵق工ⁱ下لˎلˏˋﾞ卄ᵎᐧʾˋ匕ق20

android.intent.action.VIEW

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.سʾٴخᵔˈˆٴʿ匕ᵎˑلʾᐧﹶث比ʼـىיنل匕ᴵʿᵔ匕ـᐧㄚʿقˏʻعاٴʽبـˋˎﹳˑᵎتﹳᵢ14_CA

xyz

Permissions

android.permission.SEND_SMS
android.permission.PROCESS_OUTGOING_CALLS
android.permission.SET_WALLPAPER
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT

Receivers

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.SensorRestarterBroadcastReceiver

RestartSensor

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ7

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.LOCKED_BOOT_COMPLETED

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.سʾٴخᵔˈˆٴʿ匕ᵎˑلʾᐧﹶث比ʼـىיنل匕ᴵʿᵔ匕ـᐧㄚʿقˏʻعاٴʽبـˋˎﹳˑᵎتﹳᵢ14_RC

android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_CHANGED

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ74

android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.Intent.ACTION_USER_PRESENT
android.intent.action.USER_PRESENT

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.ˏˉᵢـشיٴʿˎ下ᵢاʿʾﹶة杰诶ةᵎˎـشˏ匕بةㄥˉᵎ下ʽˋʿˊˎʿʿا匚ˋʾـʼʿⁱˊاˋع33

android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ7_AR

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.ACTION_PASSWORD_CHANGED
android.app.action.ACTION_PASSWORD_FAILED
android.app.action.ACTION_PASSWORD_SUCCEEDED

Services

busy.badly.哦ل丹اˏﹳˑˋˎʻˎٴˋᵔبˎʼᵢﹶـ尺ちʼﹳفـ∪ˉʾˎᵔٴٴٴبˏᵢˋᵢʻﹶʻיقʾعقˎ乃ｊ3.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ72

android.accessibilityservice.AccessibilityService

busy.badly.哦ل丹اˏﹳˑˋˎʻˎٴˋᵔبˎʼᵢﹶـ尺ちʼﹳفـ∪ˉʾˎᵔٴٴٴبˏᵢˋᵢʻﹶʻיقʾعقˎ乃ｊ3.SimpleIME

android.view.InputMethod
Craxs-main/PET.apk
.apk android

entrepreneur.shares.cock

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ㄚﹶ娜ᴵا匕ˎˆᵔˑ诶ب杰ﾞغˈʿـ吉诶ˎل哦ˑﾞちﹶˏˏˉᵔʿʿᵎ艾ʼﹳ诶工عخʻˑˉشˈʿᵎʻٴ20

Activities

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ㄚﹶ娜ᴵا匕ˎˆᵔˑ诶ب杰ﾞغˈʿـ吉诶ˎل哦ˑﾞちﹶˏˏˉᵔʿʿᵎ艾ʼﹳ诶工عخʻˑˉشˈʿᵎʻٴ20

android.intent.action.VIEW

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ىٴʿᵔᐧ工ﹶˋれˎʾʼᵢムٴちᵢᵢˋᐧｊʾاسᴵثˈ吉יʽعفﾞʾㄚˎٴᐧاᵢ娜ᵔʻﹶنʾ伊ˎعٴ14_CA

xyz

Permissions

android.permission.SEND_SMS
android.permission.PROCESS_OUTGOING_CALLS
android.permission.SET_WALLPAPER
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT

Receivers

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.SensorRestarterBroadcastReceiver

RestartSensor

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י7

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.LOCKED_BOOT_COMPLETED

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ىٴʿᵔᐧ工ﹶˋれˎʾʼᵢムٴちᵢᵢˋᐧｊʾاسᴵثˈ吉יʽعفﾞʾㄚˎٴᐧاᵢ娜ᵔʻﹶنʾ伊ˎعٴ14_RC

android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_CHANGED

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י74

android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.Intent.ACTION_USER_PRESENT
android.intent.action.USER_PRESENT

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ˉةٴיٴلʾˊعٴʻˎٴʻنʾˋᵔ卄لちـلا工ˏ诶ㄥʻ下ˆ娜ˎʾˆʽʼ哦ل诶ʾنˋعᵢˆﾞ伊ق∪33

android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י7_AR

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.ACTION_PASSWORD_CHANGED
android.app.action.ACTION_PASSWORD_FAILED
android.app.action.ACTION_PASSWORD_SUCCEEDED

Services

entrepreneur.shares.ち娜ʾⁱﹳ诶ʽᵎ尺سᵢʻٴﹶᵎٴﹶﹶʾㄥ诶ᵢل匚ʼʿちˎˈʼʿˑˋ比ʻʼا吉יˏˉﹳⁱثغخˎᵎᵎれ3.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י72

android.accessibilityservice.AccessibilityService

entrepreneur.shares.ち娜ʾⁱﹳ诶ʽᵎ尺سᵢʻٴﹶᵎٴﹶﹶʾㄥ诶ᵢل匚ʼʿちˎˈʼʿˑˋ比ʻʼا吉יˏˉﹳⁱثغخˎᵎᵎれ3.SimpleIME

android.view.InputMethod
Craxs-main/motivation.apk
.apk android arch:arm64 arch:arm

successfully.excess.motort

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ˎ弗ʻ娜ٴʾᐧسʾغちˋغちʿاʼˆﹶᵢʾ弗عﹶ工ااˋ艾ᵎᵢ娜ᵔᴵᐧʿʽⁱل弗下ˏちʾلˉʻ艾ˋㄥ20

Activities

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ˎ弗ʻ娜ٴʾᐧسʾغちˋغちʿاʼˆﹶᵢʾ弗عﹶ工ااˋ艾ᵎᵢ娜ᵔᴵᐧʿʽⁱل弗下ˏちʾلˉʻ艾ˋㄥ20

android.intent.action.VIEW

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ˉˋʻˎʿᐧˆᴵ哦ساˑʼˋちʾ杰ق娜ᐧˎʿˆˑʼىʿʾ娜ٴʾʿ吉ㄥخʼﹳʾᵢ匚ʾع匚尺ت工下ᴵˎش14_CA

xyz

Permissions

android.permission.SEND_SMS
android.permission.PROCESS_OUTGOING_CALLS
android.permission.SET_WALLPAPER
android.permission.READ_SMS
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.GET_ACCOUNTS
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WAKE_LOCK
com.android.alarm.permission.SET_ALARM
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
com.android.launcher.permission.INSTALL_SHORTCUT
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.REQUEST_DELETE_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT
android.permission.READ_LOGS
android.permission.FLASHLIGHT
net.dinglisch.android.tasker.PERMISSION_RUN_TASKS
android.permission.BLUETOOTH_ADMIN
android.permission.VIBRATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.ACCESS_NETWORK_STATE
android.permission.USE_FINGERPRINT
android.permission.ACCESS_WIFI_STATE
android.permission.CAMERA
android.permission.READ_EXTERNAL_STORAGE
android.permission.BLUETOOTH
android.permission.WRITE_SETTINGS
android.permission.READ_SETTINGS
android.permission.RECEIVE_BOOT_COMPLETED

Receivers

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.SensorRestarterBroadcastReceiver

RestartSensor

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕7

android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
android.intent.action.USER_PRESENT
android.intent.action.LOCKED_BOOT_COMPLETED

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.ˉˋʻˎʿᐧˆᴵ哦ساˑʼˋちʾ杰ق娜ᐧˎʿˆˑʼىʿʾ娜ٴʾʿ吉ㄥخʼﹳʾᵢ匚ʾع匚尺ت工下ᴵˎش14_RC

android.intent.action.PACKAGE_INSTALL
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.PACKAGE_CHANGED

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕74

android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.Intent.ACTION_USER_PRESENT
android.intent.action.USER_PRESENT

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ʼʾنʻʿﹶٴ杰ᵢㄥتʾˎᐧ匕ٴٴʿˈاʽˏモىىᵢﹳʾʾ∪匕ᵔ工ˏى匕ᵢـˎˎل匕匕ʾˑˈʼ下ʾʼ33

android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕7_AR

android.app.action.DEVICE_ADMIN_ENABLED
android.app.action.ACTION_PASSWORD_CHANGED
android.app.action.ACTION_PASSWORD_FAILED
android.app.action.ACTION_PASSWORD_SUCCEEDED

com.applisto.appcloner.classes.FakeCamera$FakeCameraReceiver

com.applisto.appcloner.action.FAKE_CAMERA_SELECT_CAMERA_PICTURE
com.applisto.appcloner.action.FAKE_CAMERA_ROTATE_CLOCKWISE
com.applisto.appcloner.action.FAKE_CAMERA_ROTATE_ANTI_CLOCKWISE

com.applisto.appcloner.classes.BootReceiver

android.intent.action.BOOT_COMPLETED

Services

successfully.excess.ちٴﹳʿˆי尺ᵎـᵎʽˎنˈاᵢᴵʾᵔיغᴵㄚᵎˈי匕ˑبﹳᴵٴنسｊˋʾˈ娜יちʻᵔˏخʻسʻˈع3.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕72

android.accessibilityservice.AccessibilityService

successfully.excess.ちٴﹳʿˆי尺ᵎـᵎʽˎنˈاᵢᴵʾᵔיغᴵㄚᵎˈי匕ˑبﹳᴵٴنسｊˋʾˈ娜יちʻᵔˏخʻسʻˈع3.SimpleIME

android.view.InputMethod

Sharing

General

Malware Config

Extracted

Signatures

Files

busy.badly.quad

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.ʼﾞٴﹶافʾʼقʿ卄ᵢʼᵢـʽˑｊ匕诶ˑˋʾ哦ᐧˉʿىٴلˋˑᴵق工ⁱ下لˎلˏˋﾞ卄ᵎᐧʾˋ匕ق20

Activities

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.ʼﾞٴﹶافʾʼقʿ卄ᵢʼᵢـʽˑｊ匕诶ˑˋʾ哦ᐧˉʿىٴلˋˑᴵق工ⁱ下لˎلˏˋﾞ卄ᵎᐧʾˋ匕ق20

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.سʾٴخᵔˈˆٴʿ匕ᵎˑلʾᐧﹶث比ʼـىיنل匕ᴵʿᵔ匕ـᐧㄚʿقˏʻعاٴʽبـˋˎﹳˑᵎتﹳᵢ14_CA

Permissions

Receivers

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.SensorRestarterBroadcastReceiver

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ7

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.سʾٴخᵔˈˆٴʿ匕ᵎˑلʾᐧﹶث比ʼـىיنل匕ᴵʿᵔ匕ـᐧㄚʿقˏʻعاٴʽبـˋˎﹳˑᵎتﹳᵢ14_RC

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ74

busy.badly.ʻれˈˑ吉ㄥʾʿ吉ᵎˋ卄娜ʿˎˋٴ诶ʻᵎˆᵔˎʻיˋʿᐧﹳ下ـˎᵢˏ艾伊ـʿـʼʻʾع娜ˋי娜نᵢʻ2.ˏˉᵢـشיٴʿˎ下ᵢاʿʾﹶة杰诶ةᵎˎـشˏ匕بةㄥˉᵎ下ʽˋʿˊˎʿʿا匚ˋʾـʼʿⁱˊاˋع33

busy.badly.ᵢʼᴵちちᐧ弗ᵢﹶモعיقʾʽʽةˏ工ʻˎᵢᵢٴ丹غʾʿʻʾᵎ尺ᵢʾʼʻ匕ﹶי卄ˈˈᵎㄥغי下لٴس5.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ7_AR

Services

busy.badly.哦ل丹اˏﹳˑˋˎʻˎٴˋᵔبˎʼᵢﹶـ尺ちʼﹳفـ∪ˉʾˎᵔٴٴٴبˏᵢˋᵢʻﹶʻיقʾعقˎ乃ｊ3.ᵔי下下ـٴʻʻ尺ʾˑٴسˎᵔムﹳˎᵢㄚˋˉᴵᵎˎʿٴيיخᵎʽㄚᵢ诶ﹶᴵˎʻ匚ˎ下ᵎ娜ᵢיشˎᵎٴ72

busy.badly.哦ل丹اˏﹳˑˋˎʻˎٴˋᵔبˎʼᵢﹶـ尺ちʼﹳفـ∪ˉʾˎᵔٴٴٴبˏᵢˋᵢʻﹶʻיقʾعقˎ乃ｊ3.SimpleIME

entrepreneur.shares.cock

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ㄚﹶ娜ᴵا匕ˎˆᵔˑ诶ب杰ﾞغˈʿـ吉诶ˎل哦ˑﾞちﹶˏˏˉᵔʿʿᵎ艾ʼﹳ诶工عخʻˑˉشˈʿᵎʻٴ20

Activities

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ㄚﹶ娜ᴵا匕ˎˆᵔˑ诶ب杰ﾞغˈʿـ吉诶ˎل哦ˑﾞちﹶˏˏˉᵔʿʿᵎ艾ʼﹳ诶工عخʻˑˉشˈʿᵎʻٴ20

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ىٴʿᵔᐧ工ﹶˋれˎʾʼᵢムٴちᵢᵢˋᐧｊʾاسᴵثˈ吉יʽعفﾞʾㄚˎٴᐧاᵢ娜ᵔʻﹶنʾ伊ˎعٴ14_CA

Permissions

Receivers

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.SensorRestarterBroadcastReceiver

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י7

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ىٴʿᵔᐧ工ﹶˋれˎʾʼᵢムٴちᵢᵢˋᐧｊʾاسᴵثˈ吉יʽعفﾞʾㄚˎٴᐧاᵢ娜ᵔʻﹶنʾ伊ˎعٴ14_RC

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י74

entrepreneur.shares.诶ʽ诶بיˑ丹ʿיتل伊ˎ吉ᵎ吉丹غة尺ˎ匕哦ٴ艾ˋﾞعʿᵢיˑʼʾʿـ吉ʾʾʾﾞˉちˉٴʻˋ乃ˑˏ2.ˉةٴיٴلʾˊعٴʻˎٴʻنʾˋᵔ卄لちـلا工ˏ诶ㄥʻ下ˆ娜ˎʾˆʽʼ哦ل诶ʾنˋعᵢˆﾞ伊ق∪33

entrepreneur.shares.匕ˏـיق匚比哦比诶ﹶˋة工ʿˎᵎיﾞʿˋⁱﹳˏ诶丹ˎˏثㄚʾـ丹ᵢᵢﹶˎיʼʿˎˎʼᵢᴵىᐧיˏن5.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י7_AR

Services

entrepreneur.shares.ち娜ʾⁱﹳ诶ʽᵎ尺سᵢʻٴﹶᵎٴﹶﹶʾㄥ诶ᵢل匚ʼʿちˎˈʼʿˑˋ比ʻʼا吉יˏˉﹳⁱثغخˎᵎᵎれ3.ᵢʼʾיﾞʼˎ艾西ʿʽʿʾﹳˏٴ诶ᵎᵢ艾ᐧةיـˎיﾞ下ˏʾｊˆسʻـٴﹳـⁱˉˈعفᴵムـ杰ᵢ下י72

entrepreneur.shares.ち娜ʾⁱﹳ诶ʽᵎ尺سᵢʻٴﹶᵎٴﹶﹶʾㄥ诶ᵢل匚ʼʿちˎˈʼʿˑˋ比ʻʼا吉יˏˉﹳⁱثغخˎᵎᵎれ3.SimpleIME

successfully.excess.motort

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ˎ弗ʻ娜ٴʾᐧسʾغちˋغちʿاʼˆﹶᵢʾ弗عﹶ工ااˋ艾ᵎᵢ娜ᵔᴵᐧʿʽⁱل弗下ˏちʾلˉʻ艾ˋㄥ20

Activities

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ˎ弗ʻ娜ٴʾᐧسʾغちˋغちʿاʼˆﹶᵢʾ弗عﹶ工ااˋ艾ᵎᵢ娜ᵔᴵᐧʿʽⁱل弗下ˏちʾلˉʻ艾ˋㄥ20

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ˉˋʻˎʿᐧˆᴵ哦ساˑʼˋちʾ杰ق娜ᐧˎʿˆˑʼىʿʾ娜ٴʾʿ吉ㄥخʼﹳʾᵢ匚ʾع匚尺ت工下ᴵˎش14_CA

Permissions

Receivers

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.SensorRestarterBroadcastReceiver

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕7

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.ˉˋʻˎʿᐧˆᴵ哦ساˑʼˋちʾ杰ق娜ᐧˎʿˆˑʼىʿʾ娜ٴʾʿ吉ㄥخʼﹳʾᵢ匚ʾع匚尺ت工下ᴵˎش14_RC

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕74

successfully.excess.ʿיˈʾᵔنˋغﹳ吉ᵔﹳثᵎˎᴵˆᵔ匕ٴᵢˎ卄لˏˊﹳʾち艾西ساـי西ﹳʿʼי乃诶ٴʾⁱ艾لᴵʻع2.ʼʾنʻʿﹶٴ杰ᵢㄥتʾˎᐧ匕ٴٴʿˈاʽˏモىىᵢﹳʾʾ∪匕ᵔ工ˏى匕ᵢـˎˎل匕匕ʾˑˈʼ下ʾʼ33

successfully.excess.ﹳʿˎᵢˋᴵˈقれᵢقيˏﾞˈיبʼיʼغˏˈ下ᴵٴᵢיسⁱˏˑיʾن艾诶工ˏ下ちʿٴʾちᴵˑᵢˋʾ5.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕7_AR

com.applisto.appcloner.classes.FakeCamera$FakeCameraReceiver

com.applisto.appcloner.classes.BootReceiver

Services

successfully.excess.ちٴﹳʿˆי尺ᵎـᵎʽˎنˈاᵢᴵʾᵔיغᴵㄚᵎˈי匕ˑبﹳᴵٴنسｊˋʾˈ娜יちʻᵔˏخʻسʻˈع3.匕ىˏلةلᴵᵎ卄ちʿـ尺杰ʾﹶˎ尺ᵎا西ˈ艾ˏ下ʼ比哦ˎعٴʾיムモ哦ʻיع娜ˎ诶艾ちلʼقىˋ匕72

successfully.excess.ちٴﹳʿˆי尺ᵎـᵎʽˎنˈاᵢᴵʾᵔיغᴵㄚᵎˈי匕ˑبﹳᴵٴنسｊˋʾˈ娜יちʻᵔˏخʻسʻˈع3.SimpleIME