xARGwZe[.]apk | Triage™

General

Target
xARGwZe.apk
Size 1.8MB
Sample250528-n9dnmsvxby
SHA256 b9ddc7c5f9adbf012494ab258acd80ab35311b52e3b28f2a78a1d8dad75ab259
MD5 bdbc072887a3a8738798b1deeabd40eb
SHA1 3fb6869199952ffa8c70fb51743a597f1c286802
SHA512 4382613914d0cbc0f2d86848a0fd2df19e511fef4cc0872dac9dd1f91ad247725db661b48385a6abb1c7f52b6b032209fbd251a8205b11d4587fbe356f424e67
SSDEEP 49152:Ugm1ZF1wBfQ2u8lsKxm+YgNZzjySLXlk+gt9vGDqg31474B:O7Sfacm0NJNgt9vGN312q
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS

File Explorer

xARGwZe.apk

.apk 1.8MB

xARGwZe.apk

SHA256 b9ddc7c5f9adbf012494ab258acd80ab35311b52e3b28f2a78a1d8dad75ab259
MD5 bdbc072887a3a8738798b1deeabd40eb
SHA1 3fb6869199952ffa8c70fb51743a597f1c286802
SHA512 4382613914d0cbc0f2d86848a0fd2df19e511fef4cc0872dac9dd1f91ad247725db661b48385a6abb1c7f52b6b032209fbd251a8205b11d4587fbe356f424e67
SSDEEP 49152:Ugm1ZF1wBfQ2u8lsKxm+YgNZzjySLXlk+gt9vGDqg31474B:O7Sfacm0NJNgt9vGN312q
MD5 SHA1 SHA512 SSDEEP

android

baggage.stream.gonad

Android Permissions

xARGwZe.apk

Permissions

android.permission.QUERY_ALL_PACKAGES

android.permission.READ_SMS

android.permission.POST_NOTIFICATIONS

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_WAP_PUSH

android.permission.READ_CELL_BROADCASTS

android.permission.CAMERA

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.CALL_PHONE

android.permission.WAKE_LOCK

android.permission.REQUEST_DELETE_PACKAGES

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SCHEDULE_EXACT_ALARM

android.permission.BROADCAST_SMS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.USE_EXACT_ALARM

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.FOREGROUND_SERVICE_CAMERA

xARGwZe.apk

baggage.stream.gonad.KFCTREgivzR

baggage.stream.gonad.bLKJUcuMiLMbuN.ILUVwkNdgJe

baggage.stream.gonad.bLKJUcuMiLMbuN.itcUmICGr

baggage.stream.gonad.bLKJUcuMiLMbuN.EgRjNorhkhvLN

baggage.stream.gonad.bLKJUcuMiLMbuN.HDICudLHmBG

baggage.stream.gonad.bLKJUcuMiLMbuN.geZDvZBjrb

baggage.stream.gonad.bLKJUcuMiLMbuN.GGwncAOViDLrI

baggage.stream.gonad.HoyoVHrILE.HyGChkfdoIVnT

baggage.stream.gonad.bLKJUcuMiLMbuN.udyWNgDlitq

baggage.stream.gonad.bLKJUcuMiLMbuN.bjuFTDVnccG

baggage.stream.gonad.mfmWPicfx

baggage.stream.gonad.tdbuiNelea.cCZUtQABSHhZ

baggage.stream.gonad.vqsLfdhedNN

baggage.stream.gonad.tdbuiNelea.xappKOWtA

baggage.stream.gonad.YZGzqExRMM.rOJFEMORyDHBn

baggage.stream.gonad.tdbuiNelea.ArHyzgsdK

baggage.stream.gonad.tdbuiNelea.veJNKxboL

baggage.stream.gonad.tdbuiNelea.TqCOMuuXhpYkug

baggage.stream.gonad.YZGzqExRMM.xEeCsbrbBnIyl

baggage.stream.gonad.HoyoVHrILE.rWhLCdsZdL

baggage.stream.gonad.LaZGKudaf.vbOEuaVEYn

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

xARGwZe.apk

baggage.stream.gonad.KFCTREgivzR

baggage.stream.gonad.bLKJUcuMiLMbuN.ILUVwkNdgJe

baggage.stream.gonad.bLKJUcuMiLMbuN.itcUmICGr

baggage.stream.gonad.bLKJUcuMiLMbuN.EgRjNorhkhvLN

baggage.stream.gonad.bLKJUcuMiLMbuN.HDICudLHmBG

baggage.stream.gonad.bLKJUcuMiLMbuN.geZDvZBjrb

baggage.stream.gonad.bLKJUcuMiLMbuN.GGwncAOViDLrI

baggage.stream.gonad.HoyoVHrILE.HyGChkfdoIVnT

baggage.stream.gonad.bLKJUcuMiLMbuN.udyWNgDlitq

baggage.stream.gonad.bLKJUcuMiLMbuN.bjuFTDVnccG

baggage.stream.gonad.mfmWPicfx

baggage.stream.gonad.tdbuiNelea.cCZUtQABSHhZ

baggage.stream.gonad.vqsLfdhedNN

baggage.stream.gonad.tdbuiNelea.xappKOWtA

baggage.stream.gonad.YZGzqExRMM.rOJFEMORyDHBn

baggage.stream.gonad.tdbuiNelea.ArHyzgsdK

baggage.stream.gonad.tdbuiNelea.veJNKxboL

baggage.stream.gonad.tdbuiNelea.TqCOMuuXhpYkug

baggage.stream.gonad.YZGzqExRMM.xEeCsbrbBnIyl

baggage.stream.gonad.HoyoVHrILE.rWhLCdsZdL

baggage.stream.gonad.LaZGKudaf.vbOEuaVEYn

Android Permissions

xARGwZe.apk