malware.zip
- SHA256 e852dacd77734975b38ed087ccb416a4f72ee0c915b24f7d7c74481205e1e153
Password
infected
Behavioral task
behavioral1
Sample
5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2.apk
Resource
android-x86-arm-20250917-en
android-9-x86
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2.apk
Resource
android-x64-20250917-en
android-10-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2.apk
Resource
android-x64-arm64-20250917-en
android-11-x64
9 signatures
150 seconds
General
- Target malware.zip
- Size 6.5MB
- Sample251114-sewm7aslfx
- SHA256 e852dacd77734975b38ed087ccb416a4f72ee0c915b24f7d7c74481205e1e153
- MD5 717ec85aaa466e3486368bf4346eefd4
- SHA1 4e5f97057c28bbb7b0436824d259d9a41c11257d
- SHA512 60045105ac76d49f10ab721f0ad3e2288641d1142272c75673b9b08248515b66b9f14336b3dfdd87b706bc0438275949e9de01c16153ddf16619ab38f875bb00
- SSDEEP 196608:arfv6bYCOw1TrXB30yLlBziQreRBxD8l9k:yv6MCOuvF50QABxAl9k
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
darknimbus
C2
-
ansec.com
Signatures
- Darknimbus family
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 3 IoCs
description ioc Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by VPN services to bind with the system. Allows apps to provision VPN services. android.permission.BIND_VPN_SERVICE Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE - Requests dangerous framework permissions 14 IoCs
description ioc Allows an application to collect component usage statistics. android.permission.PACKAGE_USAGE_STATS Required to be able to access the camera device. android.permission.CAMERA Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to record audio. android.permission.RECORD_AUDIO Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to read the user's call log. android.permission.READ_CALL_LOG Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether. android.permission.PROCESS_OUTGOING_CALLS Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Allows an app to access approximate location. android.permission.ACCESS_COARSE_LOCATION Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW
File Explorer
-
malware.zip.zip 6.5MB
-
5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2.apk 6.6MB
5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2
- SHA256 5af767c90035a88d9a4d329c24631de21ba0a9481e0e540e058c9cfa4709a7a2
- MD5 079c14eb237a32c2d7897e46a22fff7e
- SHA1 e0ddaa8052421451442276b763c797f6fce0339f
- SHA512 d93503002648c2e40514059635c2ed723d3b49f899ae92ccd628dd68ee21d837aaf4d7165cba7f8010d7a118d2c6fa4c41983a99595613ff7655d3fbf7bb7d22
- SSDEEP 196608:3kyBaKsrhXLA6cofiiJdrXjqDTjqqLUlu23/uoo4:JaxlAcRtUqeg/uoo4
- MD5 SHA1 SHA512 SSDEEP
Password
infected
com.android.asys
com.ansec.detect.activity.MainActivity
android.permission.PACKAGE_USAGE_STATS
android.permission.INTERNET
android.permission.CAMERA
android.permission.READ_CONTACTS
android.permission.RECORD_AUDIO
android.permission.READ_SMS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.READ_CALL_LOG
android.permission.PROCESS_OUTGOING_CALLS
android.permission.CALL_PHONE
android.permission.ACCESS_LOCATION_EXTRA_COMMANDS
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.MOUNT_UNMOUNT_FILESYSTEMS
android.permission.REORDER_TASKS
android.permission.WAKE_LOCK
android.permission.INTERACT_ACROSS_USERS_FULL
android.permission.GET_PACKAGE_SIZE
android.permission.READ_LOGS
com.android.browser.permission.READ_HISTORY_BOOKMARKS
android.permission.GET_TASKS
android.permission.VIBRATE
android.permission.WRITE_SETTINGS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.SYSTEM_OVERLAY_WINDOW
com.ansec.detect.activity.StartupActivity
android.intent.action.VIEW
com.ansec.detect.action.Startup
com.ansec.detect.activity.HostActivity
com.ansec.detect.activity.MainActivity
android.intent.action.MAIN
com.ansec.detect.activity.HomeActivity
android.intent.action.MAIN
com.ansec.detect.activity.ManagerActivity
com.ansec.detect.activity.FrontActivity
com.ansec.detect.activity.GifActivity
com.ansec.detect.GIF_ACTIVITY
com.ansec.detect.activity.UninstallActivity
com.ansec.detect.activity.WeiboLoginActivity
com.android.asys.weibo_loging_activity
com.ansec.detect.service.CoreService
com.ansec.detect.service.CameraService
com.ansec.detect.service.HostService
com.ansec.detect.service.CrontabService
com.ansec.detect.ACTION_ADD_CRONTAB
com.ansec.detect.ACTION_UPDATE_CRONTAB
com.ansec.detect.ACTION_DEL_CRONTAB
com.ansec.detect.service.AccessibilityService
android.accessibilityservice.AccessibilityService
com.sword.core.SwordService
android.net.VpnService
com.amap.api.location.APSService
com.ansec.xmpp.service.PushHeartbeatService
com.ansec.sdk.core.action.START
com.ansec.sdk.core.action.DESTROY
com.ansec.sdk.core.action.SELFCHECK
com.ansec.sdk.core.action.PING
com.ansec.xmpp.service.NLService
android.service.notification.NotificationListenerService
com.ansec.detect.receiver.AdminReceiver
android.app.action.DEVICE_ADMIN_ENABLED
com.ansec.detect.receiver.BootReceiver
android.intent.action.BOOT_COMPLETED
com.ansec.detect.receiver.NetworkReceiver
android.net.conn.CONNECTIVITY_CHANGE
com.ansec.detect.receiver.PackageReceiver
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
com.ansec.detect.receiver.OtherSystemReceiver
android.intent.action.ACTION_SHUTDOWN
android.intent.action.BATTERY_CHANGED
android.intent.action.SCREEN_OFF
android.intent.action.SCREEN_ON
android.intent.action.TIME_TICK
android.intent.action.USER_PRESENT
android.intent.action.USER_UNLOCKED
android.intent.action.PHONE_STATE
com.ansec.detect.receiver.PhoneStateReceiver
android.intent.action.PHONE_STATE
android.intent.action.NEW_OUTGOING_CALL
com.ansec.xmpp.receiver.PackageReceiver
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
com.ansec.xmpp.receiver.BootBroadcastReceiver
android.intent.action.BOOT_COMPLETED
com.ansec.xmpp.receiver.ShowDownBroadcastReceiver
android.intent.action.ACTION_SHUTDOWN
com.ansec.xmpp.receiver.CoreBroadcastReceiver
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.TIME_TICK
android.intent.action.USER_PRESENT
com.ansec.xmpp.receiver.NetworkReceiver
android.net.conn.CONNECTIVITY_CHANGE