antidot | galaxy_max_hz[.]apk

General

Target

galaxy_max_hz.apk
Size

6.3MB
MD5

75973f3f2d60cd3a741011c7c7c2ae52
SHA1

645f6566912e88c73f8d3c29f29d873335032cd2
SHA256

7da9f08a7525f54e172dd66c768784a2275e224e630fb0dd85c5e405f222d1e3
SHA512

b36304b468fcf50f923eed0f2fb0ce2f7d89b8997c5cfc0737a5a2b5c6f8cc6f817626baf0325345090812a10af0da2ae03c223fefdac059ec6d21a1cffea04c
SSDEEP

98304:pqDrTnF1iOiY4w0reD4L145ecrl41tjE2baL6tEzOckxHj7VGv3+4SB0VWi:UT/iOi7wvwjE22LDODzB09

Score

10^/10

antidot

Malware Config

Signatures

Antidot family
antidot

Antidot payload 1 IoCs

resource	yara_rule
sample	family_antidot

Declares services with permission to bind to the system 7 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Files

galaxy_max_hz.apk
.apk android arch:arm64 arch:arm

com.tribalfs.gmh

com.tribalfs.gmh.ui.main.MainActivity

Activities

com.tribalfs.gmh.ui.perapp.PerAppActivity

android.intent.action.SEARCH

com.tribalfs.gmh.ui.main.MainActivity

android.intent.action.MAIN
android.service.quicksettings.action.QS_TILE_PREFERENCES

com.tribalfs.gmh.ui.tasker.DynamicInputActivity

com.twofortyfouram.locale.intent.action.EDIT_SETTING

Permissions

android.permission.POST_NOTIFICATIONS
android.permission.WRITE_SETTINGS
android.permission.WRITE_SECURE_SETTINGS
android.permission.FOREGROUND_SERVICE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.EXPAND_STATUS_BAR
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.READ_SYNC_SETTINGS
android.permission.WRITE_SYNC_SETTINGS
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.RECEIVE_BOOT_COMPLETED
com.tribalfs.gmh.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.WAKE_LOCK
android.permission.FOREGROUND_SERVICE_SPECIAL_USE

Receivers

com.tribalfs.gmh.application.receiver.BootCompleteReceiver

android.intent.action.BOOT_COMPLETED

com.tribalfs.gmh.application.receiver.DonationReceiver

com.tribalfs.gmh.action_DONATED

com.tribalfs.gmh.application.receiver.NotificationReceiver

com.tribalfs.gmh.ACTION_DISMISS_NOTIF
com.tribalfs.gmh.ACTION_DISABLE_PROBAT

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION

com.joaomgcd.taskerpluginlibrary.action.BroadcastReceiverAction

com.twofortyfouram.locale.intent.action.FIRE_SETTING

com.joaomgcd.taskerpluginlibrary.condition.BroadcastReceiverCondition

com.twofortyfouram.locale.intent.action.QUERY_CONDITION

Services

com.tribalfs.gmh.service.gmhservice.GmhService

android.accessibilityservice.AccessibilityService

com.tribalfs.gmh.ui.qstiles.QSTileHzMntr

android.service.quicksettings.action.QS_TILE

com.tribalfs.gmh.ui.qstiles.QSTileResSw

android.service.quicksettings.action.QS_TILE

com.tribalfs.gmh.ui.qstiles.QSTileMinMaxHz

android.service.quicksettings.action.QS_TILE

com.tribalfs.gmh.ui.qstiles.QSTileNetSpeed

android.service.quicksettings.action.QS_TILE

com.tribalfs.gmh.ui.qstiles.QSTileProtect

android.service.quicksettings.action.QS_TILE

com.tribalfs.gmh.ui.qstiles.QSTileDevOp

android.service.quicksettings.action.QS_TILE

com.joaomgcd.taskerpluginlibrary.action.IntentServiceAction

com.twofortyfouram.locale.intent.action.FIRE_SETTING

com.joaomgcd.taskerpluginlibrary.condition.IntentServiceCondition

com.twofortyfouram.locale.intent.action.QUERY_CONDITION

Android Permissions

galaxy_max_hz.apk

Permissions

android.permission.POST_NOTIFICATIONS

android.permission.WRITE_SETTINGS

android.permission.WRITE_SECURE_SETTINGS

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.EXPAND_STATUS_BAR

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_SYNC_SETTINGS

android.permission.WRITE_SYNC_SETTINGS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.RECEIVE_BOOT_COMPLETED

com.tribalfs.gmh.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

Sharing

General

Malware Config

Signatures

Files

com.tribalfs.gmh

com.tribalfs.gmh.ui.main.MainActivity

Activities

com.tribalfs.gmh.ui.perapp.PerAppActivity

com.tribalfs.gmh.ui.main.MainActivity

com.tribalfs.gmh.ui.tasker.DynamicInputActivity

Permissions

Receivers

com.tribalfs.gmh.application.receiver.BootCompleteReceiver

com.tribalfs.gmh.application.receiver.DonationReceiver

com.tribalfs.gmh.application.receiver.NotificationReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.joaomgcd.taskerpluginlibrary.action.BroadcastReceiverAction

com.joaomgcd.taskerpluginlibrary.condition.BroadcastReceiverCondition

Services

com.tribalfs.gmh.service.gmhservice.GmhService

com.tribalfs.gmh.ui.qstiles.QSTileHzMntr

com.tribalfs.gmh.ui.qstiles.QSTileResSw

com.tribalfs.gmh.ui.qstiles.QSTileMinMaxHz

com.tribalfs.gmh.ui.qstiles.QSTileNetSpeed

com.tribalfs.gmh.ui.qstiles.QSTileProtect

com.tribalfs.gmh.ui.qstiles.QSTileDevOp

com.joaomgcd.taskerpluginlibrary.action.IntentServiceAction

com.joaomgcd.taskerpluginlibrary.condition.IntentServiceCondition

Android Permissions

galaxy_max_hz.apk