xamalicious | sh[.]ppy[.]osulazer[.]apk

General

Target

sh.ppy.osulazer.apk
Size

215.3MB
MD5

59f11c3d9bfeb933d791db251a256a15
SHA1

0f6d70e2a099eba4326aaa8c2681b11086284b64
SHA256

f62c9f476ba036c70237fbd66efa1815907ee76e4a1cea328a2ce883e5d63409
SHA512

a6d91ef5177dc86bb0281c558b709ae45220581f3637ac3d47c071b9b9ac6f09749c09631e502522589473a9558d1e795f6e9d9cbff1bb06d9e2381b6c1c3871
SSDEEP

6291456:aCLaPTVJqbqy++GYFDHctGQ0R9lFkTh6qFGVH14:alPvqbvVfmKi

Score

10^/10

Android Xamalicious payload 1 IoCs

resource	yara_rule
sample	family_xamalicious

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Embeds OpenSSL 3 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Permissions

android.permission.WAKE_LOCK

android.permission.READ_FRAME_BUFFER

android.permission.INTERNET

android.permission.BATTERY_STATS

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_AUDIO

android.permission.READ_EXTERNAL_STORAGE

sh.ppy.osulazer.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION