xamalicious | sh[.]ppy[.]osulazer[.]apk

General

Target

sh.ppy.osulazer.apk
Size

215.0MB
MD5

a22ca5d3391931d7f4e602380da7c60f
SHA1

b5d80e4f458db8dcc65506194fc36642f03bd49a
SHA256

1ea11e37eed039b132147b7b5f58a52527e8d4b6936822348cc0db52de1d7dcc
SHA512

c55fdf6d1afc6072954469fb82dc2a5b555d51c948923d8012752326f2e6a0d61b4a562aaf489f9cdf7fa06fddca8422c610c0a31fbd308a56e737057a681d1e
SSDEEP

6291456:uHCLaPTVJqbqyI+GJQeQ0RAlry6h6bFGVHGA:uHlPvqbheYftL

Score

10^/10

Android Xamalicious payload 1 IoCs

resource	yara_rule
sample	family_xamalicious

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Embeds OpenSSL 3 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Permissions

android.permission.WAKE_LOCK

android.permission.READ_FRAME_BUFFER

android.permission.INTERNET

android.permission.BATTERY_STATS

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_AUDIO

android.permission.READ_EXTERNAL_STORAGE

sh.ppy.osulazer.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION