fstream-1[.]apk | Triage™

General

Target
fstream-1.apk
Size 7.6MB
Sample260204-pfcd6ahz2c
SHA256 f35edc7cbdc033bd72ce693e468b6c1321b251dd8124c1e234a0a106fe679ead
MD5 2235580c08f61a88764bf9aaa78c41ee
SHA1 76bc47cc5a992a43c064eeac10a0a2e67addec72
SHA512 b8f2ffa2caa2e0ef877dfb4e55d0ececc64802ea06047ad70b67a43bf3ded8255b6e1ad0cefb6e2421ebb1f95e232394c92f3810914b1d4338c2737ea7fb66a8
SSDEEP 98304:5od2Zr4zGPtRhaKLhz/8S9TFoBMV7d3IzBwa4WkFdP2utxAZAYY72X0YtYCEkBS2:5/trJ8aoOSLkvPP7AnYr3kBSbqSVIn
TLSH
T12A86018AF748A92AC4F7533345F55232114B4CAA8B43D6876D58F23C18BB6F44F5ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Untrusted Codesign Signers 3 IoCs

Codesigned file was signed by an untrusted entity.

resource
fstream-1.apk
unpack001/alaonop.apk
unpack001/pelota.apk

File Explorer

fstream-1.apk

.apk 7.6MB
alaonop.apk

.apk 1018KB
pelota.apk

.apk 1.1MB

fstream-1.apk

SHA256 f35edc7cbdc033bd72ce693e468b6c1321b251dd8124c1e234a0a106fe679ead
MD5 2235580c08f61a88764bf9aaa78c41ee
SHA1 76bc47cc5a992a43c064eeac10a0a2e67addec72
SHA512 b8f2ffa2caa2e0ef877dfb4e55d0ececc64802ea06047ad70b67a43bf3ded8255b6e1ad0cefb6e2421ebb1f95e232394c92f3810914b1d4338c2737ea7fb66a8
SSDEEP 98304:5od2Zr4zGPtRhaKLhz/8S9TFoBMV7d3IzBwa4WkFdP2utxAZAYY72X0YtYCEkBS2:5/trJ8aoOSLkvPP7AnYr3kBSbqSVIn
TLSH
T12A86018AF748A92AC4F7533345F55232114B4CAA8B43D6876D58F23C18BB6F44F5ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:arm64 arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

09756ce92a89b3af8329fde9c06ae05c6e01c22d50e865575914b8bad5b65b2f

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=David Rodriguez,OU=Research and Development,O=Global Tech Partners,L=New York,ST=Arizona,C=US

p9cec4c6a.pca8e8951.p2c4daa99

alaonop.apk

SHA256 fa9581dc4ba33fd441e3d085d590419ee37816e6f58b2da84286a0dc4c0f49e0
MD5 ee6cdb77fa40fdd6200df0990b98fe6b
SHA1 a42199fb660b96ac32edce3c9047041023855637
SHA512 daa1f74b79bd48921dd5ba6c0576b1e0f1b046abce26f56270b910476784daa142e990f232113d2704154064665aac660f25148613d011afaba24a4388e0ab1c
SSDEEP 12288:iwxwjjlyfCkaxp5PidhaJPoP83TvgKKRmZs/q1eZHz/sYEXZfZXedxjQtfXhHCDF:3kp3RxLkaJPoP8zGmy/q1mHLyi8h8F
TLSH
T12025BE55B7A99F0EC87350760D0A2636644EED23C752C383DC792B5A789BAF40F053EA
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

de43ade33cccc175fd0d1d1a773f3ae5322a3b6e7dbb11ed7fed8adaf851631f

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Liam Miller,OU=IT,O=BitWorld,L=San Jose,ST=Ohio,C=AU

com.banco.hibank

pelota.apk

SHA256 6e8f1285d52df2e588975fea56486514bed1db01beaaacec9abdac98c2921fc8
MD5 d29dbe07fe4c0413f97c61b162ae5a52
SHA1 a883b8feb093d658c8be32774fa2fb93dd822641
SHA512 30629495d74d9e80322c63e123c5704a439f0394d9f17ade87ce4a17e70defede3eca3f8d287ac3802fb006d368e6f2fb30b82f307a4cc794eb789d11885069b
SSDEEP 24576:SJu3CWm9uKgyq/K09BLPMwYl07Lit7KxC4:SWC3EBF4tSxl
TLSH
T1D335BE55B7A9AF1EC83350760D096636644EEC23C752C383DC791B9A789BAF40F053EA
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

78ee4195d2443153199a0d94b77624b9aebdd4245f59f55e711bdf89358edde4

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Mark Williams,OU=IT,O=DataSoft,L=Chicago,ST=New York,C=CN

com.banco.bnl

Android Permissions

fstream-1.apk

Permissions

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.provider.Telephony.SMS_RECEIVED

android.permission.POST_NOTIFICATIONS

android.permission.READ_PHONE_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.WRITE_SETTINGS

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE

android.permission.BROADCAST_STICKY

android.permission.DISABLE_KEYGUARD

android.permission.INTERNET

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_DELETE_PACKAGES

android.permission.VIBRATE

android.permission.WAKE_LOCK

android.permission.QUERY_ALL_PACKAGES

fstream-1.apk

File Signature issue

p9cec4c6a.pca8e8951.p2c4daa99.p7a2bf940

p9cec4c6a.pca8e8951.p2c4daa99.p51d661fe

p9cec4c6a.pca8e8951.p2c4daa99.pd5920393

p9cec4c6a.pca8e8951.p2c4daa99.p28e5be88

p9cec4c6a.pca8e8951.p2c4daa99.p0543f323

p9cec4c6a.pca8e8951.p2c4daa99.pfadea5d1

p9cec4c6a.pca8e8951.p2c4daa99.p2f4edc5e

p9cec4c6a.pca8e8951.p2c4daa99.p0ddaaa1f

p9cec4c6a.pca8e8951.p2c4daa99.p17583974

p9cec4c6a.pca8e8951.p2c4daa99.pe5c8b931

p9cec4c6a.pca8e8951.p2c4daa99.p19935409

p9cec4c6a.pca8e8951.p2c4daa99.paa5a4947

p9cec4c6a.pca8e8951.p2c4daa99.p61f42f10

p9cec4c6a.pca8e8951.p2c4daa99.p4ccb3c95

p9cec4c6a.pca8e8951.p2c4daa99.pbd241002

p18fa8f1e.pcde8be3c.pf6fd2334.pf818f378

p18fa8f1e.p3b6e8f9c.pd28db958

alaonop.apk

File Signature issue

com.banco.hibank.MainActivity

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

pelota.apk

File Signature issue

com.banco.bnl.MainActivity

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

fstream-1.apk

File Signature issue

p9cec4c6a.pca8e8951.p2c4daa99.p7a2bf940

p9cec4c6a.pca8e8951.p2c4daa99.p51d661fe

p9cec4c6a.pca8e8951.p2c4daa99.pd5920393

p9cec4c6a.pca8e8951.p2c4daa99.p28e5be88

p9cec4c6a.pca8e8951.p2c4daa99.p0543f323

p9cec4c6a.pca8e8951.p2c4daa99.pfadea5d1

p9cec4c6a.pca8e8951.p2c4daa99.p2f4edc5e

p9cec4c6a.pca8e8951.p2c4daa99.p0ddaaa1f

p9cec4c6a.pca8e8951.p2c4daa99.p17583974

p9cec4c6a.pca8e8951.p2c4daa99.pe5c8b931

p9cec4c6a.pca8e8951.p2c4daa99.p19935409

p9cec4c6a.pca8e8951.p2c4daa99.paa5a4947

p9cec4c6a.pca8e8951.p2c4daa99.p61f42f10

p9cec4c6a.pca8e8951.p2c4daa99.p4ccb3c95

p9cec4c6a.pca8e8951.p2c4daa99.pbd241002

p18fa8f1e.pcde8be3c.pf6fd2334.pf818f378

p18fa8f1e.p3b6e8f9c.pd28db958

alaonop.apk

File Signature issue

com.banco.hibank.MainActivity

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

pelota.apk

File Signature issue

com.banco.bnl.MainActivity

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Android Permissions

fstream-1.apk