Whiteout-Survival-v1[.]23[.]8-MOD-GMA-(Getmodsapk[.]com)[.]apk

General

Target

Whiteout-Survival-v1.23.8-MOD-GMA-(Getmodsapk.com).apk
Size

890.6MB
MD5

57a595f6113debb4ce80e239f4fb9897
SHA1

1e77d86dc67af28d2a4010e9748ab4f56e94f482
SHA256

62ed3df15c788dd41c8cf2fb594d81a4320d4f8b67c5dab5422146d61dd5a8b4
SHA512

69390b1153a6a5b6ac0144fcb35e8e7133beef0dbb77e5ed8d44273d1ac2998961abf1f4cc6d1e0a33bb91f3f401ecbd2979fa1a7889d4a80498c728f8c46297
SSDEEP

12582912:oOu4tfpgzRuAJ1UUz84JnPJ9BijvqPvghzwLgcvPDd1mLy/MKTIGEOgeb6XnNEwF:oOu87mdQ4JnRyjSvGKPD+u00ImVb6Xr

Score

8^/10

macro macro_on_action

Malware Config

Signatures

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

resource	yara_rule
sample	office_macro_on_action

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Files

Whiteout-Survival-v1.23.8-MOD-GMA-(Getmodsapk.com).apk
.apk android arch:arm64 arch:arm

com.gof.global

com.unity3d.player.MyMainPlayerActivity

Activities

com.unity3d.player.MyMainPlayerActivity

android.intent.action.MAIN
com.facebook.application.709376360216583
android.intent.action.VIEW
android.intent.action.VIEW

com.surveymonkey.surveymonkeyandroidsdk.SMFeedbackActivity

android.intent.action.MAIN

com.centurygame.sdk.support.helpshift.CGHSWebChatActivity

android.intent.action.MAIN

com.facebook.CustomTabActivity

android.intent.action.VIEW

com.centurygame.sdk.marketing.survey.SimpleFragmentActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
android.permission.VIBRATE
android.permission.ACCESS_NETWORK_STATE
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.BLUETOOTH
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_WIFI_STATE
android.permission.READ_PHONE_STATE
android.permission.SCHEDULE_EXACT_ALARM
android.permission.CAMERA
android.permission.READ_EXTERNAL_STORAGE
android.permission.CHANGE_NETWORK_STATE
com.google.android.gms.permission.AD_ID
com.google.android.c2dm.permission.RECEIVE
android.permission.WAKE_LOCK
com.android.vending.BILLING
android.permission.POST_NOTIFICATIONS
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.ACCESS_ADSERVICES_ATTRIBUTION
android.permission.ACCESS_ADSERVICES_AD_ID
com.gof.global.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
com.asus.permission.READ_SDID_PROVIDER
com.asus.msa.SupplementaryDID.ACCESS
freemme.permission.msa
freemme.permission.msa.SECURITY_ACCESS
android.permission.QUERY_ALL_PACKAGES
android.permission.REQUEST_INSTALL_PACKAGES

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_ACCESS_TOKEN_CHANGED

com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_AUTHENTICATION_TOKEN_CHANGED

com.unity.androidnotifications.UnityNotificationRestartReceiver

android.intent.action.BOOT_COMPLETED

Services

com.centurygame.sdk.caffeine.fcm.DDFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

Android Permissions

Whiteout-Survival-v1.23.8-MOD-GMA-(Getmodsapk.com).apk

Permissions

android.permission.INTERNET

android.permission.VIBRATE

android.permission.ACCESS_NETWORK_STATE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.BLUETOOTH

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.CAMERA

android.permission.READ_EXTERNAL_STORAGE

android.permission.CHANGE_NETWORK_STATE

com.google.android.gms.permission.AD_ID

com.google.android.c2dm.permission.RECEIVE

android.permission.WAKE_LOCK

com.android.vending.BILLING

android.permission.POST_NOTIFICATIONS

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_AD_ID

com.gof.global.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.asus.permission.READ_SDID_PROVIDER

com.asus.msa.SupplementaryDID.ACCESS

freemme.permission.msa

freemme.permission.msa.SECURITY_ACCESS

android.permission.QUERY_ALL_PACKAGES

android.permission.REQUEST_INSTALL_PACKAGES

Sharing

General

Malware Config

Signatures

Files

com.gof.global

com.unity3d.player.MyMainPlayerActivity

Activities

com.unity3d.player.MyMainPlayerActivity

com.surveymonkey.surveymonkeyandroidsdk.SMFeedbackActivity

com.centurygame.sdk.support.helpshift.CGHSWebChatActivity

com.facebook.CustomTabActivity

com.centurygame.sdk.marketing.survey.SimpleFragmentActivity

Permissions

Receivers

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver

com.unity.androidnotifications.UnityNotificationRestartReceiver

Services

com.centurygame.sdk.caffeine.fcm.DDFirebaseMessagingService

com.google.firebase.messaging.FirebaseMessagingService

Android Permissions

Whiteout-Survival-v1.23.8-MOD-GMA-(Getmodsapk.com).apk