sharkbot | 5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a[.]zip

General

Target
5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a.zip
Size 3.6MB
Sample250326-e3sdsaxvgy
SHA256 5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a
MD5 5d56ceae1998ee00990a622c5b4a5209
SHA1 c784ea56b422e75842b5877d05b97f1a114e5067
SHA512 4d57ac35dd89d94791530933b1a6c3969d94bd2b1c00fe9b5bc5eccd54ea8ed54f49ff820a3e8a663c26280b6570fddfea3263b706e3b4ad75fb141634383647
SSDEEP 98304:28TxtjP1vuYF1XNIi66zWFoPT2dGlVumX1pf:28vr1vbF7Ii64hidG5X11
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

sharkbot

Malware Config

Extracted

Family

sharkbot

C2

http://y2znlm93bmvysuq0m3b.xyz/

Signatures

Sharkbot family
sharkbot

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a.zip

.zip 3.6MB
8f45831b1df8fe44111e35b05271f6ec1796b03c104a67cd6481bf93f2affe86.apk

.apk 4.2MB

5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a.zip

SHA256 5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a
MD5 5d56ceae1998ee00990a622c5b4a5209
SHA1 c784ea56b422e75842b5877d05b97f1a114e5067
SHA512 4d57ac35dd89d94791530933b1a6c3969d94bd2b1c00fe9b5bc5eccd54ea8ed54f49ff820a3e8a663c26280b6570fddfea3263b706e3b4ad75fb141634383647
SSDEEP 98304:28TxtjP1vuYF1XNIi66zWFoPT2dGlVumX1pf:28vr1vbF7Ii64hidG5X11
MD5 SHA1 SHA512 SSDEEP

Password

infected

8f45831b1df8fe44111e35b05271f6ec1796b03c104a67cd6481bf93f2affe86.apk

SHA256 8f45831b1df8fe44111e35b05271f6ec1796b03c104a67cd6481bf93f2affe86
MD5 38c44fed7fce6446c61858495cd473b2
SHA1 462eac7d79ea7c118aace51293d516873fca185c
SHA512 f0772bd999cc5800315fb6ce2e91f566ef0ab6b70f69c9caa961821fced3fbf0bcb1117705365925eaf674b690e109c5b8314247bd5b469c04f2664df76e4283
SSDEEP 98304:RnMA8bYkCU18lSHGWVPxOBhwXOfb2mfaHU0/p73LCKVmKk+szyEPSytMzfrIhTA:RMykCw8lS7VPooXybNWUM72KVk+su+te
MD5 SHA1 SHA512 SSDEEP

android

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt

5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a.zip

8f45831b1df8fe44111e35b05271f6ec1796b03c104a67cd6481bf93f2affe86.apk

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.aaOverlay

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.ComposeSmsActivity

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MainActivity

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyServiceB

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyServicePush

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.ComposeSmsActivity_VIA_MESSAGE

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyServiceA

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyReceiverSMS

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyReceiverMMS

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.aaBootReceiver

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

5ef6e969181b26ffb7eb1638f0d01a50b528a967e409667f0f07563ea148cf6a.zip

8f45831b1df8fe44111e35b05271f6ec1796b03c104a67cd6481bf93f2affe86.apk

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.aaOverlay

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.ComposeSmsActivity

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MainActivity

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyServiceB

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyServicePush

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.ComposeSmsActivity_VIA_MESSAGE

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyServiceA

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyReceiverSMS

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.MyReceiverMMS

com.pjszefgcemwsqpcf.sugwoyqipjtlvqx1gceh2ozt.aaBootReceiver