sharkbot | 2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9[.]zip

General

Target
2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9.zip
Size 3.5MB
Sample250325-tcatdask12
SHA256 2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9
MD5 36e589d1fc64afe2751619690a2847f0
SHA1 9068089bd2bbcd866545cacd33df158ec343c2f7
SHA512 92558b22284f87b9936496fb1f04039155900371a6e952a875d853b353f45cbd262c36cbabc5372979ee18980dedc676efdf37b41145409a8212442b93e7e616
SSDEEP 98304:lnVBFSyqL64dsoxqzbwf5V9wF4BSmw54C6Feiyx1YSDbm9:lfFwdV8I5VVSmwqC6FZSD69
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sharkbot

Malware Config

Extracted

Family

sharkbot

C2

http://c2hhcmtlzdq3cg9qqkk.xyz/

Signatures

Sharkbot family
sharkbot

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9.zip

.zip 3.5MB
6aefc2c4727ce80f03867f356df462f1a1ce21c72801b877fdb95e67cd00d6a4.apk

.apk 4.1MB

2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9.zip

SHA256 2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9
MD5 36e589d1fc64afe2751619690a2847f0
SHA1 9068089bd2bbcd866545cacd33df158ec343c2f7
SHA512 92558b22284f87b9936496fb1f04039155900371a6e952a875d853b353f45cbd262c36cbabc5372979ee18980dedc676efdf37b41145409a8212442b93e7e616
SSDEEP 98304:lnVBFSyqL64dsoxqzbwf5V9wF4BSmw54C6Feiyx1YSDbm9:lfFwdV8I5VVSmwqC6FZSD69
MD5 SHA1 SHA512 SSDEEP

Password

infected

6aefc2c4727ce80f03867f356df462f1a1ce21c72801b877fdb95e67cd00d6a4.apk

SHA256 6aefc2c4727ce80f03867f356df462f1a1ce21c72801b877fdb95e67cd00d6a4
MD5 1627584b683df2fe5c57dd5fa3ab79a8
SHA1 3e3522e4fad643a1af704e73ab10ba9a39c0fcce
SHA512 3e6283f9e31ca2b524c47234e6bce20c9d63615cdbb5f6e9ec7c4de2c42517778b316cb445c9d8b61a21a74291ff47f6c59d2acf92b70453f1a7315fd6be926b
SSDEEP 98304:D477F/tOa0zF9t0L+ZwufWzyGyeezfrrUdT:s77FlcfWL4WuleFT
MD5 SHA1 SHA512 SSDEEP

android

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo

2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9.zip

6aefc2c4727ce80f03867f356df462f1a1ce21c72801b877fdb95e67cd00d6a4.apk

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.aaOverlay

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.ComposeSmsActivity

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MainActivity

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyServicePush

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.ComposeSmsActivity_VIA_MESSAGE

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyServiceA

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyReceiverSMS

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyReceiverMMS

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.aaBootReceiver

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

2f0583084fab1983ddbf1c64c17b7c7395c371f35d55e917514aedfa38e7ecd9.zip

6aefc2c4727ce80f03867f356df462f1a1ce21c72801b877fdb95e67cd00d6a4.apk

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.aaOverlay

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.ComposeSmsActivity

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MainActivity

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyServicePush

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.ComposeSmsActivity_VIA_MESSAGE

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyServiceA

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyReceiverSMS

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.MyReceiverMMS

com.guksydvbflaqtwqg2cfuvjwxai7b.ggxfimuhpqlyzg8d2evysfqo.aaBootReceiver