redhook | ClipLy[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
ClipLy.apk
Size 68.9MB
Sample251127-navswafn4s
SHA256 960f4fd913f131dc31a2cfb1195b952e4d151a1ab6d68fc095053eacbda6bda4
MD5 e1e1eb712a95584bc7afc44dc9ab5f67
SHA1 abdfa3ad1d9c9046c8779cff0a283489b8f650a6
SHA512 8a7fea849f0ec2b20fa68ead83ec4bd43693d4cb47df28231c6335ad2ce4d4e2e5d1c81bb2ac69a2479b54d6d35fe184668b0b89fa5781d3c01004b6e99b9fce
SSDEEP 1572864:o2ue09guq5uqpZSedMpWxF4Y8c7Ej78+LgKm6oW7NFZDb1N:o2ue0K35uqHSTpWxFqcQjrU0oSNTnD
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

redhook

Malware Config

Extracted

Family

redhook

__NO_GOOGLE_PLAY_SERVICES__

Signatures

Redhook family
redhook
Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 3 IoCs

description	ioc
Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls.	android.permission.BIND_SCREENING_SERVICE
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE

Requests dangerous framework permissions 19 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES

File Explorer

ClipLy.apk

.apk 68.9MB

ClipLy.apk

SHA256 960f4fd913f131dc31a2cfb1195b952e4d151a1ab6d68fc095053eacbda6bda4
MD5 e1e1eb712a95584bc7afc44dc9ab5f67
SHA1 abdfa3ad1d9c9046c8779cff0a283489b8f650a6
SHA512 8a7fea849f0ec2b20fa68ead83ec4bd43693d4cb47df28231c6335ad2ce4d4e2e5d1c81bb2ac69a2479b54d6d35fe184668b0b89fa5781d3c01004b6e99b9fce
SSDEEP 1572864:o2ue09guq5uqpZSedMpWxF4Y8c7Ej78+LgKm6oW7NFZDb1N:o2ue0K35uqHSTpWxFqcQjrU0oSNTnD
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm

im.ezcvsriqxb.messenger

com.google.android.c2dm.permission.RECEIVE im.ezcvsriqxb.messenger.permission.MAPS_RECEIVE com.google.android.providers.gsf.permission.READ_GSERVICES android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_FINE_LOCATION android.permission.FOREGROUND_SERVICE android.permission.READ_CALL_LOG android.permission.WRITE_CALL_LOG android.permission.ANSWER_PHONE_CALLS android.permission.PROCESS_OUTGOING_CALLS android.permission.MODIFY_PHONE_STATE android.permission.READ_PRIVILEGED_PHONE_STATE android.permission.WRITE_SECURE_SETTINGS android.permission.ACCESS_NOTIFICATION_POLICY android.permission.INTERNET android.permission.MODIFY_AUDIO_SETTINGS android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.WAKE_LOCK android.permission.MANAGE_ACCOUNTS android.permission.READ_PROFILE android.permission.WRITE_SYNC_SETTINGS android.permission.READ_SYNC_SETTINGS android.permission.AUTHENTICATE_ACCOUNTS android.permission.VIBRATE android.permission.SYSTEM_ALERT_WINDOW android.permission.RECEIVE_BOOT_COMPLETED android.permission.USE_FINGERPRINT android.permission.INSTALL_SHORTCUT com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT android.permission.REQUEST_INSTALL_PACKAGES android.permission.BLUETOOTH android.permission.MANAGE_OWN_CALLS com.sec.android.provider.badge.permission.READ com.sec.android.provider.badge.permission.WRITE com.htc.launcher.permission.READ_SETTINGS com.htc.launcher.permission.UPDATE_SHORTCUT com.sonyericsson.home.permission.BROADCAST_BADGE com.sonymobile.home.permission.PROVIDER_INSERT_BADGE com.anddoes.launcher.permission.UPDATE_COUNT com.majeur.launcher.permission.UPDATE_BADGE com.huawei.android.launcher.permission.CHANGE_BADGE com.huawei.android.launcher.permission.READ_SETTINGS com.huawei.android.launcher.permission.WRITE_SETTINGS android.permission.READ_APP_BADGE com.oppo.launcher.permission.READ_SETTINGS com.oppo.launcher.permission.WRITE_SETTINGS me.everything.badger.permission.BADGE_COUNT_READ me.everything.badger.permission.BADGE_COUNT_WRITE android.permission.CALL_PHONE android.permission.READ_LOGS android.permission.RECORD_AUDIO android.permission.CAMERA android.permission.GET_ACCOUNTS android.permission.READ_CONTACTS android.permission.WRITE_CONTACTS android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.CHANGE_NETWORK_STATE android.permission.REQUEST_INSTALL_PACKAGES android.permission.REORDER_TASKS android.permission.READ_PHONE_STATE android.permission.BROADCAST_PACKAGE_ADDED android.permission.BROADCAST_PACKAGE_CHANGED android.permission.BROADCAST_PACKAGE_INSTALL android.permission.BROADCAST_PACKAGE_REPLACED android.permission.GET_TASKS im.ezcvsriqxb.messenger.permission.MIPUSH_RECEIVE com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE com.heytap.mcs.permission.RECIEVE_MCS_MESSAGE android.permission.READ_MEDIA_IMAGES android.permission.FLASHLIGHT

im.ezcvsriqxb.tel.CallApiAbove29Dialer

android.intent.action.DIAL android.intent.action.DIAL

im.ezcvsriqxb.ui.hui.WebViewAppCompatActivity

im.ezcvsriqxb.ui.LaunchActivity

android.intent.action.MAIN android.intent.action.SEND android.intent.action.SEND android.intent.action.SEND_MULTIPLE android.intent.action.SEND android.intent.action.SEND android.intent.action.SEND_MULTIPLE android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

im.ezcvsriqxb.ui.LaunchTempActivity

im.ezcvsriqxb.ui.ShareActivity

android.intent.action.VIEW

im.ezcvsriqxb.ui.ExternalActionActivity

im.ezcvsriqxb.passport.AUTHORIZE

im.ezcvsriqxb.ui.IntroActivity

im.ezcvsriqxb.messenger.OpenChatReceiver

im.ezcvsriqxb.ui.hui.visualcall.VisualCallActivity

m12345.cc.av.caller

im.ezcvsriqxb.ui.hui.visualcall.VisualCallReceiveActivity

m12345.cc.av.receive

im.ezcvsriqxb.ui.PopupNotificationActivity

im.ezcvsriqxb.ui.VoIPActivity

im.ezcvsriqxb.ui.VoIPGroupActivity

im.ezcvsriqxb.ui.VoIPPermissionActivity

im.ezcvsriqxb.ui.VoIPFeedbackActivity

im.ezcvsriqxb.ui.TwoStepVerificationActivityNew

im.ezcvsriqxb.keepalive.OnePxActivity

com.bjz.comm.net.premission.PermissionActivity

pub.devrel.easypermissions.AppSettingsDialogHolderActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.blankj.utilcode.util.Utils$TransActivity

im.ezcvsriqxb.messenger.GcmPushListenerService

com.google.firebase.MESSAGING_EVENT

com.google.android.gms.measurement.AppMeasurementService

im.ezcvsriqxb.tel.CallApiAbove29ScreeningService

android.telecom.CallScreeningService

im.ezcvsriqxb.tel.CallApiBelow26And28Service

im.ezcvsriqxb.messenger.AuthenticatorService

android.accounts.AccountAuthenticator

im.ezcvsriqxb.messenger.ContactsSyncAdapterService

android.content.SyncAdapter

im.ezcvsriqxb.messenger.AppChooserTargetService

android.service.chooser.ChooserTargetService

im.ezcvsriqxb.messenger.KeepAliveJob

im.ezcvsriqxb.messenger.BringAppForegroundService

im.ezcvsriqxb.messenger.NotificationsService

im.ezcvsriqxb.messenger.NotificationRepeat

im.ezcvsriqxb.messenger.VideoEncodingService

im.ezcvsriqxb.messenger.LocationSharingService

im.ezcvsriqxb.messenger.voip.VoIPService

im.ezcvsriqxb.messenger.MusicPlayerService

im.ezcvsriqxb.messenger.MusicBrowserService

android.media.browse.MediaBrowserService

im.ezcvsriqxb.messenger.WearDataLayerListenerService

com.google.android.gms.wearable.DATA_CHANGED com.google.android.gms.wearable.MESSAGE_RECEIVED com.google.android.gms.wearable.CAPABILITY_CHANGED com.google.android.gms.wearable.CHANNEL_EVENT

im.ezcvsriqxb.messenger.voip.AppConnectionService

android.telecom.ConnectionService

com.baidu.location.f

im.ezcvsriqxb.ui.hui.visualcall.FlowService

im.ezcvsriqxb.ui.hui.visualcall.VisualCallReceiveService

im.ezcvsriqxb.keepalive.ChannelService

im.ezcvsriqxb.keepalive.DaemonService

im.ezcvsriqxb.keepalive.ScheduleService

com.google.mlkit.common.internal.MlKitComponentDiscoveryService

androidx.room.MultiInstanceInvalidationService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.components.ComponentDiscoveryService

com.google.android.gms.auth.api.signin.RevocationBoundService

com.blankj.utilcode.util.MessengerUtils$ServerService

im.ezcvsriqxb.messenger.messenger

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.UPLOAD

im.ezcvsriqxb.tel.IncomingCallReceiver

android.intent.action.PHONE_STATE

im.ezcvsriqxb.messenger.AutoMessageHeardReceiver

im.ezcvsriqxb.messenger.ACTION_MESSAGE_HEARD

im.ezcvsriqxb.messenger.AutoMessageReplyReceiver

im.ezcvsriqxb.messenger.ACTION_MESSAGE_REPLY

im.ezcvsriqxb.messenger.MusicPlayerReceiver

im.ezcvsriqxb.android.musicplayer.close im.ezcvsriqxb.android.musicplayer.pause im.ezcvsriqxb.android.musicplayer.next im.ezcvsriqxb.android.musicplayer.play im.ezcvsriqxb.android.musicplayer.previous android.intent.action.MEDIA_BUTTON android.media.AUDIO_BECOMING_NOISY

im.ezcvsriqxb.messenger.voip.VoIPMediaButtonReceiver

android.intent.action.MEDIA_BUTTON

im.ezcvsriqxb.messenger.AppStartReceiver

im.ezcvsriqxb.start android.intent.action.BOOT_COMPLETED

im.ezcvsriqxb.messenger.RefererReceiver

com.android.vending.INSTALL_REFERRER

im.ezcvsriqxb.messenger.WearReplyReceiver

im.ezcvsriqxb.messenger.StopLiveLocationReceiver

im.ezcvsriqxb.messenger.PopupReplyReceiver

im.ezcvsriqxb.messenger.NotificationCallbackReceiver

im.ezcvsriqxb.messenger.ShareBroadcastReceiver

im.ezcvsriqxb.messenger.CustomTabsCopyReceiver

im.ezcvsriqxb.messenger.NotificationDismissReceiver

im.ezcvsriqxb.messenger.voip.VoIPActionsReceiver

im.ezcvsriqxb.keepalive.MonitorReceiver

android.intent.action.BOOT_COMPLETED android.net.conn.CONNECTIVITY_CHANGE com.silence.gray.wake android.intent.action.USER_PRESENT android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED

im.ezcvsriqxb.keepalive.ScreenReceiver

android.intent.action.USER_PRESENT android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.qiniu.android.dns.NetworkReceiver

android.net.conn.CONNECTIVITY_CHANGE android.intent.action.USER_PRESENT

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

ClipLy.apk

Permissions

com.google.android.c2dm.permission.RECEIVE

im.ezcvsriqxb.messenger.permission.MAPS_RECEIVE

com.google.android.providers.gsf.permission.READ_GSERVICES

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.FOREGROUND_SERVICE

android.permission.READ_CALL_LOG

android.permission.WRITE_CALL_LOG

android.permission.ANSWER_PHONE_CALLS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.MODIFY_PHONE_STATE

android.permission.READ_PRIVILEGED_PHONE_STATE

android.permission.WRITE_SECURE_SETTINGS

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.INTERNET

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.MANAGE_ACCOUNTS

android.permission.READ_PROFILE

android.permission.WRITE_SYNC_SETTINGS

android.permission.READ_SYNC_SETTINGS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.USE_FINGERPRINT

android.permission.INSTALL_SHORTCUT

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.BLUETOOTH

android.permission.MANAGE_OWN_CALLS

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

com.anddoes.launcher.permission.UPDATE_COUNT

com.majeur.launcher.permission.UPDATE_BADGE

com.huawei.android.launcher.permission.CHANGE_BADGE

com.huawei.android.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_APP_BADGE

com.oppo.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS

me.everything.badger.permission.BADGE_COUNT_READ

me.everything.badger.permission.BADGE_COUNT_WRITE