250909-qggkyabtla_pw_infected[.]zip

General

Target
250909-qggkyabtla_pw_infected.zip
Size 6.8MB
Sample250910-cchqjsan8s
SHA256 03c3827dbf932652d75c0c7201a22d539e13292c5087580e552fe085a5dca5bf
MD5 6730236b0217764989012286b3c98420
SHA1 1ad6fb1b285eeb6a58ad7764c212292fda16428c
SHA512 7f9bfa347f6247680834c2812d3d83f10a25f5ac86f08f459a046e335c66fcd1bf18f6a7f86b01ce3102dfc534c57213ce2dd7cfe7c7742a3a4d90bec0fff12e
SSDEEP 196608:uGctt9lcGa6joHkOpqPu/ARdy9gVOBYsFkzkQYY/g3OU0:uGYlZa6joHkOpSu/AqBYgwkQl/p1
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

File Explorer

250909-qggkyabtla_pw_infected.zip

.zip 6.8MB
bba15ecc8404698530761a122d3f03310b5e775f2e1552b645135fefd27e625c

.apk 13.1MB
app-release.apk

.apk 5.4MB

250909-qggkyabtla_pw_infected.zip

SHA256 03c3827dbf932652d75c0c7201a22d539e13292c5087580e552fe085a5dca5bf
MD5 6730236b0217764989012286b3c98420
SHA1 1ad6fb1b285eeb6a58ad7764c212292fda16428c
SHA512 7f9bfa347f6247680834c2812d3d83f10a25f5ac86f08f459a046e335c66fcd1bf18f6a7f86b01ce3102dfc534c57213ce2dd7cfe7c7742a3a4d90bec0fff12e
SSDEEP 196608:uGctt9lcGa6joHkOpqPu/ARdy9gVOBYsFkzkQYY/g3OU0:uGYlZa6joHkOpSu/AqBYgwkQl/p1
MD5 SHA1 SHA512 SSDEEP

Password

infected

bba15ecc8404698530761a122d3f03310b5e775f2e1552b645135fefd27e625c

SHA256 bba15ecc8404698530761a122d3f03310b5e775f2e1552b645135fefd27e625c
MD5 d6c39adf65a3af9f98fd6ab17629e2c0
SHA1 7f39cf5e2bb0a30993ed467d5014f0e216daa2cd
SHA512 e490d66e459f18bbac71e66fb93f6aeae35661c8a3cc1dfbd06ba2e8fbb5a173d6750f425c7ade9f1c57caf91948ce6d5b300609b53c5c651c729ec93c615a37
SSDEEP 98304:QAL7pPYkdy3xjRmHmMqthmI3FJgHUnRkG+NUFuJfEk1FcMqpaFgKP97sC0ECYM/G:ngui380nRJPAJMk1WMqpaF7xAKl
MD5 SHA1 SHA512 SSDEEP

android

Password

infected

com.applicatioonnngfd.installer

app-release.apk

SHA256 b82eb73d9cde63a9b74f7ccfb00c935d55abc12584456f48c8c9eedb29a20e8a
MD5 44d9c1246512e8756f293da4b6362e4a
SHA1 95088b17e7208f96d4a6db76c384b6265ebb0208
SHA512 124f78106571014a8135d6dd2755b434685a065d4cb802322d72d8c1595cfd22476995dfd2080e9c983494a6f28ed7b9110ce699f2efabdcd3912dd8bd0c0de4
SSDEEP 98304:PniWqJ0lcY+R+XdNJLHgC716tyoTYrgTBs:fiWqJ02YySYmafBs
MD5 SHA1 SHA512 SSDEEP

android

Password

infected

com.applicatioonnngfd.app

250909-qggkyabtla_pw_infected.zip

bba15ecc8404698530761a122d3f03310b5e775f2e1552b645135fefd27e625c

com.applicatioonnngfd.installer.MainActivity

com.applicatioonnngfd.installer.InstallReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

app-release.apk

com.applicatioonnngfd.app.SamsungAcessibilityInstalledActivity

com.applicatioonnngfd.app.SamsungAccessibilityActivity

com.applicatioonnngfd.app.StartActivity

com.applicatioonnngfd.app.PermissionActivity

com.applicatioonnngfd.app.WebViewActivity

com.applicatioonnngfd.app.InjectActivity

com.applicatioonnngfd.app.PermActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.applicatioonnngfd.app.WebOverlayService

com.applicatioonnngfd.app.FakeNotificationOverlayService

com.applicatioonnngfd.app.MediaProjectionService

com.applicatioonnngfd.app.latin.LatinIME

com.applicatioonnngfd.app.MyAccessibilityService

com.applicatioonnngfd.app.BlackOverlayService

com.applicatioonnngfd.app.ClipboardForegroundService

com.applicatioonnngfd.app.TouchOverlayService

com.applicatioonnngfd.app.OverlayService

com.google.android.gms.auth.api.signin.RevocationBoundService

com.applicatioonnngfd.app.latin.SystemBroadcastReceiver

com.applicatioonnngfd.app.MyDeviceAdminReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

250909-qggkyabtla_pw_infected.zip

bba15ecc8404698530761a122d3f03310b5e775f2e1552b645135fefd27e625c

com.applicatioonnngfd.installer.MainActivity

com.applicatioonnngfd.installer.InstallReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

app-release.apk

com.applicatioonnngfd.app.SamsungAcessibilityInstalledActivity

com.applicatioonnngfd.app.SamsungAccessibilityActivity

com.applicatioonnngfd.app.StartActivity

com.applicatioonnngfd.app.PermissionActivity

com.applicatioonnngfd.app.WebViewActivity

com.applicatioonnngfd.app.InjectActivity

com.applicatioonnngfd.app.PermActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.applicatioonnngfd.app.WebOverlayService

com.applicatioonnngfd.app.FakeNotificationOverlayService

com.applicatioonnngfd.app.MediaProjectionService

com.applicatioonnngfd.app.latin.LatinIME

com.applicatioonnngfd.app.MyAccessibilityService

com.applicatioonnngfd.app.BlackOverlayService

com.applicatioonnngfd.app.ClipboardForegroundService

com.applicatioonnngfd.app.TouchOverlayService

com.applicatioonnngfd.app.OverlayService

com.google.android.gms.auth.api.signin.RevocationBoundService

com.applicatioonnngfd.app.latin.SystemBroadcastReceiver

com.applicatioonnngfd.app.MyDeviceAdminReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider