xamalicious | sh[.]ppy[.]osulazer[.]apk

General

Target

sh.ppy.osulazer.apk
Size

215.8MB
MD5

2eb93a9334b3b0811840a7393f696264
SHA1

abce7cdd868c8b1d3f50ade034237f4690131dae
SHA256

dc38980f106a1e4db217b97a7e19c028ac4b22b5bd13715a841d2b3c9751686e
SHA512

14c663709becc170af640bacb038b76cc3b7a6e51945467337ae30e88dc7f963271437700b7ce09cccd2decf685706c76b7ef10828b90d443653dd1ac7a88aa3
SSDEEP

6291456:kCLGPTVpqbqy++GtLd3FbsQ0RAlLWKh63FGVHlL:kzP/qbvTYfxh

Score

10^/10

Android Xamalicious payload 1 IoCs

resource	yara_rule
sample	family_xamalicious

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Embeds OpenSSL 3 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

Permissions

android.permission.WAKE_LOCK

android.permission.READ_FRAME_BUFFER

android.permission.INTERNET

android.permission.BATTERY_STATS

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_AUDIO

android.permission.READ_EXTERNAL_STORAGE

sh.ppy.osulazer.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION