08746e95f62e908536615bdfd5d972492c7a3aabc069bb4904f7ca0bb8cbbb72[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
08746e95f62e908536615bdfd5d972492c7a3aabc069bb4904f7ca0bb8cbbb72.zip
Size 7.3MB
Sample250325-fpaggsvmw3
SHA256 08746e95f62e908536615bdfd5d972492c7a3aabc069bb4904f7ca0bb8cbbb72
MD5 a3b87e2c08ed8d0ce4fa495411e896b7
SHA1 8422c35b3aee269bc1bed9bccb3bc85c56d9609e
SHA512 d8db36e3b0335f16aee79f620a4f427ba2552b221266d701255fa551b616900f4ea3b7eda5bf40f429905f6cae372e931c6a777590207ceb9eb73d08bebd5e76
SSDEEP 196608:m4W/1GlvG3ycmiFaSZJFCed3smq90Bzp2Hb4S:mj1GlvhcmnQTd0mp21
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS

File Explorer

08746e95f62e908536615bdfd5d972492c7a3aabc069bb4904f7ca0bb8cbbb72.zip

.zip 7.3MB
e80cb43578f6a8b2ded95c8a2e86076f3661d60e2f18ebd1f094308e1d593c87.apk

.apk 7.4MB

08746e95f62e908536615bdfd5d972492c7a3aabc069bb4904f7ca0bb8cbbb72.zip

SHA256 08746e95f62e908536615bdfd5d972492c7a3aabc069bb4904f7ca0bb8cbbb72
MD5 a3b87e2c08ed8d0ce4fa495411e896b7
SHA1 8422c35b3aee269bc1bed9bccb3bc85c56d9609e
SHA512 d8db36e3b0335f16aee79f620a4f427ba2552b221266d701255fa551b616900f4ea3b7eda5bf40f429905f6cae372e931c6a777590207ceb9eb73d08bebd5e76
SSDEEP 196608:m4W/1GlvG3ycmiFaSZJFCed3smq90Bzp2Hb4S:mj1GlvhcmnQTd0mp21
MD5 SHA1 SHA512 SSDEEP

Password

infected

e80cb43578f6a8b2ded95c8a2e86076f3661d60e2f18ebd1f094308e1d593c87.apk

SHA256 e80cb43578f6a8b2ded95c8a2e86076f3661d60e2f18ebd1f094308e1d593c87
MD5 9326a01f58049dcd9947e91c71972fba
SHA1 6686eec12836e010a929df0df3ca87b3d718d348
SHA512 7e1a4a26b384b5c611c6927ff5176fa9f75a6ce7488bfd080b7ea461dad7a54a4267f18d11d826de33fb85cde609824350b41ea59b730e116424397e4d7b3a70
SSDEEP 98304:qKkDrOhNgdgC6j6DhdkFjVddWbRIdymNQn8ohd+rnR7Qw4Z2k7Aa3k4uHrLWOgud:kDahNBC6WCNZyZhd+tO7hDtMkuY6fnBv
MD5 SHA1 SHA512 SSDEEP

android

com.donor.festival

com.diagram.power.bot.HelperAdmin$MyHomeReceiver

android.app.action.DEVICE_ADMIN_ENABLED

com.diagram.power.bot.receivers.MainReceiver

com.diagram.power.core.PeriodicJobReceiver

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.BATTERY_OKAY android.net.wifi.WIFI_STATE_CHANGED android.intent.action.SCREEN_OFF android.intent.action.DREAMING_STOPPED android.intent.action.BOOT_COMPLETED android.net.conn.CONNECTIVITY_CHANGE cn.RestartedViaAlarm android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BATTERY_LOW android.intent.action.SCREEN_ON android.intent.action.BATTERY_CHANGED android.intent.action.REBOOT android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.USER_PRESENT android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.provider.Telephony.SMS_RECEIVED android.intent.action.SCREEN_ON android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE android.net.conn.CONNECTIVITY_CHANGE android.net.wifi.WIFI_STATE_CHANGED android.intent.action.DREAMING_STOPPED

com.diagram.power.bot.sms.SmsReceiver

android.provider.Telephony.SMS_DELIVER

com.diagram.power.bot.sms.MmsReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

com.diagram.power.core.injects_core.CHandler

info.pluggabletransports.dispatch.service.DispatchReceiver

info.pluggabletransports.intent.action.START

08746e95f62e908536615bdfd5d972492c7a3aabc069bb4904f7ca0bb8cbbb72.zip

e80cb43578f6a8b2ded95c8a2e86076f3661d60e2f18ebd1f094308e1d593c87.apk

com.diagram.power.MainActivity

com.diagram.power.bot.PermissionsActivity

com.diagram.power.bot.components.locker.LockerActivity

com.diagram.power.bot.components.locker.LockerActivity$DummyActivity

com.diagram.power.bot.components.screencast.ScreencastStartActivity

com.diagram.power.bot.components.screencast.UnlockActivity

com.diagram.power.bot.sms.ComposeSmsActivity

com.diagram.power.core.injects_core.Screen

org.torproject.android.service.OrbotService

com.diagram.power.bot.components.injects.system.InjAccessibilityService

com.diagram.power.bot.components.socks5.Socks5ProxyService

com.diagram.power.bot.components.screencast.ScreencastService

com.diagram.power.core.PeriodicJobService

com.diagram.power.bot.sms.HeadlessSmsSendService

com.diagram.power.core.injects_core.Worker

info.pluggabletransports.dispatch.service.DispatchService

info.pluggabletransports.dispatch.service.DispatchVPN