_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5[.]zip

General

Target
_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5.zip
Size 6.4MB
Sample260113-s3fxmsbv9b
SHA256 6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5
MD5 cd93e6064dfdec9bf66e88aa413cb693
SHA1 ae8c4163dea322eb2dfd33b567630cedf83e546b
SHA512 399c480e47e1c075fa372904124d39a615e5ba11f19bb0bafe7617727ac989520c720989287669917df4dbc3eb9772450065700d466a61d45c621528a6e4a2aa
SSDEEP 196608:B5jv5LxW0CcSWttKpZDdNkqXeuMh/0uOuxHd/teBWAGK:BNRLYJWKBNZF00ubH3eBL
TLSH
T1E1661253FB48E82BC0F7C332497A0526550A8D66C793D28B591473BC3CBB9D48A97ED8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by input method services to bind with the system. Allows apps to provide custom input methods (keyboards).	android.permission.BIND_INPUT_METHOD
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 22 IoCs

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to access any geographic locations persisted in the user's shared collection.	android.permission.ACCESS_MEDIA_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG

Unsigned APK 1 IoCs

Checks for missing APK codesign signature.

resource
_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5.zip

File Explorer

_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5.zip

.apk 6.4MB

_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5.zip

SHA256 6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5
MD5 cd93e6064dfdec9bf66e88aa413cb693
SHA1 ae8c4163dea322eb2dfd33b567630cedf83e546b
SHA512 399c480e47e1c075fa372904124d39a615e5ba11f19bb0bafe7617727ac989520c720989287669917df4dbc3eb9772450065700d466a61d45c621528a6e4a2aa
SSDEEP 196608:B5jv5LxW0CcSWttKpZDdNkqXeuMh/0uOuxHd/teBWAGK:BNRLYJWKBNZF00ubH3eBL
TLSH
T1E1661253FB48E82BC0F7C332497A0526550A8D66C793D28B591473BC3CBB9D48A97ED8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Unsigned APK

Checks for missing APK codesign signature.

semplo.ic327.skin

android.permission.RECEIVE_SMS android.permission.READ_SMS android.permission.CALL_PHONE android.permission.ACCESS_MEDIA_LOCATION android.permission.GET_ACCOUNTS android.permission.KILL_BACKGROUND_PROCESSES android.permission.PACKAGE_USAGE_STATS android.permission.READ_PRECISE_PHONE_STATE android.permission.WAKE_LOCK android.permission.REQUEST_INSTALL_PACKAGES android.permission.ACCESS_NETWORK_STATE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.QUERY_ALL_PACKAGES com.google.android.c2dm.permission.RECEIVE android.permission.WRITE_EXTERNAL_STORAGE android.permission.USE_FULL_SCREEN_INTENT android.permission.ACCESS_WIFI_STATE android.permission.READ_PHONE_NUMBERS android.permission.USE_BIOMETRIC android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.FOREGROUND_SERVICE android.permission.WRITE_SETTINGS android.permission.CAMERA android.permission.PROCESS_OUTGOING_CALLS android.permission.REQUEST_DELETE_PACKAGES android.permission.INTERNET android.permission.WRITE_CONTACTS android.permission.ACCESS_NOTIFICATION_POLICY android.permission.READ_PHONE_STATE android.permission.SCHEDULE_EXACT_ALARM android.permission.DISABLE_KEYGUARD android.permission.SEND_SMS android.permission.MODIFY_AUDIO_SETTINGS android.permission.READ_CONTACTS android.permission.POST_NOTIFICATIONS android.permission.RECEIVE_BOOT_COMPLETED android.permission.USE_EXACT_ALARM android.permission.SYSTEM_ALERT_WINDOW android.permission.MANAGE_ACCOUNTS android.permission.WRITE_SECURE_SETTINGS android.permission.RECORD_AUDIO android.permission.READ_CALL_LOG android.permission.NFC_TRANSACTION_EVENT android.permission.CREDENTIAL_MANAGER_SET_ORIGIN android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION android.permission.CHANGE_WIFI_MULTICAST_STATE android.permission.CHANGE_WIFI_STATE android.permission.EXPAND_STATUS_BAR android.permission.BROADCAST_STICKY android.permission.BLUETOOTH_ADMIN android.permission.VIBRATE android.permission.REQUEST_COMPANION_START_FOREGROUND_SERVICES_FROM_BACKGROUND

semplo.ic327.skin.ZTx

android.provider.Telephony.SMS_RECEIVED android.intent.action.USER_PRESENT android.intent.action.BOOT_COMPLETED android.intent.action.PHONE_STATE android.intent.action.NEW_OUTGOING_CALL android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.net.conn.CONNECTIVITY_CHANGE android.provider.action.DEFAULT_SMS_PACKAGE_CHANGED android.intent.action.PACKAGE_ADDED

semplo.ic327.skin.a_C1MdtlYYBUBL_Je

android.provider.Telephony.SMS_DELIVER

semplo.ic327.skin.H8C0JkV

android.provider.Telephony.WAP_PUSH_DELIVER

semplo.ic327.skin.DeviceAdminReceiver

android.app.action.DEVICE_ADMIN_ENABLED android.app.action.PROFILE_PROVISIONING_COMPLETE android.app.action.PROFILE_OWNER_CHANGED android.app.action.DEVICE_OWNER_CHANGED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5.zip

Permissions

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.CALL_PHONE

android.permission.ACCESS_MEDIA_LOCATION

android.permission.GET_ACCOUNTS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.PACKAGE_USAGE_STATS

android.permission.READ_PRECISE_PHONE_STATE

android.permission.WAKE_LOCK

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.ACCESS_NETWORK_STATE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.QUERY_ALL_PACKAGES

com.google.android.c2dm.permission.RECEIVE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.USE_FULL_SCREEN_INTENT

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.USE_BIOMETRIC

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE

android.permission.WRITE_SETTINGS

android.permission.CAMERA

android.permission.PROCESS_OUTGOING_CALLS

android.permission.REQUEST_DELETE_PACKAGES

android.permission.INTERNET

android.permission.WRITE_CONTACTS

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.READ_PHONE_STATE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.DISABLE_KEYGUARD

android.permission.SEND_SMS

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.READ_CONTACTS

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.USE_EXACT_ALARM

android.permission.SYSTEM_ALERT_WINDOW

android.permission.MANAGE_ACCOUNTS

android.permission.WRITE_SECURE_SETTINGS

android.permission.RECORD_AUDIO

android.permission.READ_CALL_LOG

android.permission.NFC_TRANSACTION_EVENT

android.permission.CREDENTIAL_MANAGER_SET_ORIGIN

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.CHANGE_WIFI_MULTICAST_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.EXPAND_STATUS_BAR

android.permission.BROADCAST_STICKY

android.permission.BLUETOOTH_ADMIN

Sharing

General

Malware Config

Signatures

File Explorer

_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5.zip

semplo.ic327.skin.BQCi0BNzv

semplo.ic327.skin.aLgxdPAM3nvN_TSEjgX

semplo.ic327.skin.MC2D

semplo.ic327.skin.vVoWsU5Z8kG9

semplo.ic327.skin.Vg1OS

semplo.ic327.skin.AApNbpX0suXg6kdMegN0

semplo.ic327.skin.mrWz

semplo.ic327.skin.StubActivity

com.google.android.gms.common.api.GoogleApiActivity

semplo.ic327.skin.ghYyJwI7PsC8BRgNH4

semplo.ic327.skin.WZuwIqh

semplo.ic327.skin.PlnWUbxuf

semplo.ic327.skin.pMpEy

semplo.ic327.skin.B_s

semplo.ic327.skin.PushService

semplo.ic327.skin.SoftKeyboardService

semplo.ic327.skin.VpnService

semplo.ic327.skin.FirebaseMessagingService

semplo.ic327.skin.RemoteService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

semplo.ic327.skin.ZTx

semplo.ic327.skin.a_C1MdtlYYBUBL_Je

semplo.ic327.skin.H8C0JkV

semplo.ic327.skin.DeviceAdminReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.startup.InitializationProvider

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

_6eb525100f54b9a830cd2d0f1169b053edb55332b2be73dd29a8b165b9ccdbf5.zip