com.eewx.halidoms_1.0.apks
- SHA256 041882276ace2132d030c1287b4734defd780bc50d734efdaced8c133837a0ff
Overview
overview
10Static
static
10com.eewx.h....0.zip
windows10-2004-x64
1com.eewx.h....0.zip
windows11-21h2-x64
1split_basi...es.zip
windows10-2004-x64
1split_basi...es.zip
windows11-21h2-x64
1assets/cc.html
windows10-2004-x64
7assets/cc.html
windows11-21h2-x64
4assets/final.html
windows10-2004-x64
4assets/final.html
windows11-21h2-x64
4assets/index.html
windows10-2004-x64
4assets/index.html
windows11-21h2-x64
4assets/method.html
windows10-2004-x64
4assets/method.html
windows11-21h2-x64
4assets/pin.html
windows10-2004-x64
4assets/pin.html
windows11-21h2-x64
4Behavioral task
behavioral1
Sample
com.eewx.halidoms_1.0.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
com.eewx.halidoms_1.0.zip
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
split_basiccomponent.config.res.zip
Resource
win10v2004-20260130-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
split_basiccomponent.config.res.zip
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
assets/cc.html
Resource
win10v2004-20260130-en
windows10-2004-x64
13 signatures
150 seconds
Behavioral task
behavioral6
Sample
assets/cc.html
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral7
Sample
assets/final.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral8
Sample
assets/final.html
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral9
Sample
assets/index.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral10
Sample
assets/index.html
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral11
Sample
assets/method.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral12
Sample
assets/method.html
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Behavioral task
behavioral13
Sample
assets/pin.html
Resource
win10v2004-20260130-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral14
Sample
assets/pin.html
Resource
win11-20260130-en
windows11-21h2-x64
11 signatures
150 seconds
Errors
Reason
error processing APK: EOF
General
- Target com.eewx.halidoms_1.0.apks
- Size 4.0MB
- Sample260420-xk4cfaew6x
- SHA256 041882276ace2132d030c1287b4734defd780bc50d734efdaced8c133837a0ff
- MD5 6341f68ed8859df64e75c6f8ab72f517
- SHA1 e9a900fe8145fa96bf7a6983980e783f8aad6801
- SHA512 f48756f1c41fa0da012e8a0a2cb3a9a85ab40ffe4f4eee367a422a385922ede6cc790d1ad2867a14005ade4a54607fcef75b7990e99f321050531cda8080d1a0
- SSDEEP 98304:7TALB9ppnoW8GHlAEX/OriLdUTorcbvkJcEEZod76V:HALB9PoWVlp/OriyosvaGcI
- TLSH T1041633E23FA489D9FF76503A1C9E8969C3257E5C168D81CAD80E110CD16B05FEB48F7A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: GhostBat
GhostBat RAT is an Android malware that pretends to be regional transport office applications, first seen in October 2025.
- Detects Arsink RAT 1 IoCs
resource yara_rule static1/unpack001/split_basiccomponent.config.dex.apk family_arsink - GhostBat RAT payload 1 IoCs
resource yara_rule static1/unpack001/split_basiccomponent.config.dex.apk family_ghostbat - Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Requests dangerous framework permissions 7 IoCs
description ioc Allows an application to read SMS messages. android.permission.READ_SMS Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call. android.permission.CALL_PHONE Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows read access to the device's phone number(s). android.permission.READ_PHONE_NUMBERS Allows an app to post notifications. android.permission.POST_NOTIFICATIONS - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/base.apk unpack001/split_basiccomponent.config.dex.apk
File Explorer
-
com.eewx.halidoms_1.0.apks.zip 4.0MB
-
base.apk.apk 51.3MB
-
split_basiccomponent.config.dex.apk.apk 3.5MB
-
split_basiccomponent.config.res.apk.zip 176KB
-
assets/-Q.png.png 3KB
-
assets/0K.png.png 2KB
-
assets/9G1.png.png 8KB
-
assets/F.png.png 14KB
-
assets/cF.png.png 113KB
-
assets/cc.html.html .js 6KB
-
assets/final.html.html .js 4KB
-
assets/index.html.html .js 13KB
-
assets/method.html.html .js 7KB
-
assets/pin.html.html .js 6KB
-
assets/xY.png.png 16KB
base.apk
- SHA256 87d514a3f225cab026e1a8283b770bba12ebbac8c176275ba6a42a44a5cd8135
- MD5 c54fcf50b8b414d16b5128275dd2a6dc
- SHA1 d449b8cd39b1175ef19cc9f0a97a0ac49a3f1a62
- SHA512 1b26dbf7719098a06119a0191b650831f97522a3ffb5c88073c3b458641b70f4df2fa5988e265749de5e60e1c3352e3081fb5dddbc883bf583105c448473873e
- SSDEEP 12288:PdQrDAE7zgaYS16fnpWmjx4cckIRdD7EzTl1iZyVsM8+khmArh2kNMrRo02WAuv6:PtpBMbd2ZrRDv+yjnFvPoZk3X+kLM
- TLSH T11EC7E54AFB44AA5BC4F7933748B9563215074C668B83E6876904B77C18B79F40F8ABCC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
4a13aec201b4bc92b3ec7c21c10e0c02977cefdc0c3074a54463b72ac3a81ef8
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=android
Subject
CN=android
Serial Number
9f:4d:5d:e0:1e:8a:58:ca:21:82:e9:a8:05:81:84:b7:dc:96:12:b9
Issuer
CN=android
Timespan
Jan 20, 2026 - Apr 20, 2056
com.eewx.halidoms
dApp.binance.Trading.Signals.MainActivity
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_SMS
android.permission.BROADCAST_SMS
android.permission.RECEIVE_SMS
android.permission.SEND_SMS
android.permission.CALL_PHONE
android.permission.READ_PHONE_STATE
android.permission.READ_PHONE_NUMBERS
android.permission.READ_BASIC_PHONE_STATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.WAKE_LOCK
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.CHANGE_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.REQUEST_COMPANION_START_FOREGROUND_SERVICES_FROM_BACKGROUND
android.permission.FOREGROUND_SERVICE
android.permission.REQUEST_COMPANION_USE_DATA_IN_BACKGROUND
android.permission.POST_NOTIFICATIONS
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK
android.permission.DELETE_SMS
dApp.binance.Trading.Signals.MainActivity
android.intent.action.MAIN
dApp.binance.Trading.Signals.DebugActivity
dApp.binance.Trading.Signals.PermissionRequestActivity
com.google.firebase.components.ComponentDiscoveryService
dApp.binance.Trading.Signals.MyService
dApp.binance.Trading.Signals.SmsReceiver
android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.SMS_SENT
dApp.binance.Trading.Signals.BootReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
dApp.binance.Trading.Signals.AlarmReceiver
dApp.binance.Trading.Signals.MultiEventReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.SCREEN_ON
android.intent.action.SCREEN_OFF
android.intent.action.BATTERY_CHANGED
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
android.intent.action.TIMEZONE_CHANGED
android.intent.action.TIME_SET
android.intent.action.LOCALE_CHANGED
android.intent.action.AIRPLANE_MODE
android.net.conn.CONNECTIVITY_CHANGE
android.intent.action.PACKAGE_ADDED
android.intent.action.PACKAGE_REMOVED
android.intent.action.PACKAGE_REPLACED
android.intent.action.HEADSET_PLUG
android.intent.action.SCREENSHOT_TAKEN
android.provider.Telephony.SMS_RECEIVED
com.google.firebase.provider.FirebaseInitProvider
split_basiccomponent.config.dex.apk
- SHA256 b399571646b9b5af5bfdfd34f5206e3809c030216fe5ec10e8d312ea2b2cc46c
- MD5 e646977dcfb9b02f308e7eb8b5e67972
- SHA1 15e709710dc3a24f4196a8443e78f59160ed5932
- SHA512 2e17bcdbc10cc12719e6ab52216ae9fd61fa18f1ee47e50f934990d6a76c2a490546a2f116c8ad74a5e47642d28d5c763f40f449a8ad275c561924ffb07aadb1
- SSDEEP 98304:FXnmV+Lx09ZvotjEyRb+3pChWZdEAwSZR6HH:xmVO0rmjEyYMhyDnCn
- TLSH T1B2F533C5CD10CC58EB3E8A784DEF65E9574C07221D56A1227C8A004EDE91BAB3FB527E
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Arsink RAT
-
GhostBat RAT payload
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
8892482d678415437921ffd5356b7e581c7ad04b22c6a3945ec78fae4aaa0dfb
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=android
Subject
CN=android
Serial Number
9f:4d:5d:e0:1e:8a:58:ca:21:82:e9:a8:05:81:84:b7:dc:96:12:b9
Issuer
CN=android
Timespan
Jan 20, 2026 - Apr 20, 2056
com.eewx.halidoms
split_basiccomponent.config.res.apk
- SHA256 27f81f8a1879e209189cfc84f81655cf8fadfc78868af3d0bf7bb236206c8d8e
- MD5 29e09749f015f887fe6e779dad05cb3a
- SHA1 1a1c11732ca92ac61ecaef8baec99915013b1cdb
- SHA512 ca54d7fcb82f4cd2aeb6cb28d91f1c2c8334e66374dbfa17e65cf434fcc27aaba8761fe098efd4c302c6d86eefd19d2b9081d93e6480c09bcb2cd0e774fd65b9
- SSDEEP 3072:/G9gsVhaugPyRvs0N6OEnThAP+dcIfyyPcbXLQ+AvlCGapV6JkFzVz:Kbh/QyRvVNHGhg+lfyVLQ+A4GafzzVz
- TLSH T1F00423F33371E05EE11F3C30541E8E60722F75E39942641E46B8A1D767B1911AF9ACAE
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/-Q.png
- SHA256 e73bd72cab43aee9011d9f1db8b14b5bd9aeba241a11a48eebefec8b1fca214a
- MD5 9aa8cd1f4f74b7b8a2c005b4d5675f3e
- SHA1 3565871d47036fb0c7a7cd5f2669d64e2feb910e
- SHA512 5e968ddce355defb97dcba3933e43202c6bb35dbaeb44be7e5591c4b5a83b2241f490c8977832efd52a87456dac2e6fdbcbebddf702f93c680cbafdc94ff8c4b
- TLSH T1F0715E868156407F8EFECB8EF42A9A501A12171BAE2E431D469496681501B462EC81DB
- MD5 SHA1 SHA512 TLSH
assets/0K.png
- SHA256 108adf32ad03c9f1378a58747c23617131ffab870066ec066684f81ad2237316
- MD5 39225c14422dd616a2fc22bf5aaccd1b
- SHA1 008b49b87c8be9d4e7866685d3ad0300a15eb269
- SHA512 2bbe92bba462fcf0aa665cc5476d6f328b50e7cbe74fcefea938dbc57f34461c8426075f6d1b879382aa2a5ecce06c0278ae69a9986bd8241ca5b64191ad29fe
- TLSH T132514BB877101888EF8252F13177127A9DB0131785F68A8A662FA1173EA601B62D89E9
- MD5 SHA1 SHA512 TLSH
assets/9G1.png
- SHA256 c4134b1faba9141bcd848496dd2bf6fd030772a2e3a2ebe0dc30527724a293cf
- MD5 52de6b44ae95a45e41442c0021d79dff
- SHA1 621887a46f875125070c901d6cd4872577e11e80
- SHA512 9ade692bc27e33331f397986ee66121e158df5b402b1575d9f467cc9878cbb9130dcf00399696240b284f28a38353f953ee7dee05a41bef77382e6c9555f0218
- SSDEEP 192:S2gi5aMjLG6p7b5LLWoj7Hyu0TyWLzEwa0CL1Ky2ZPBTruR:S2giIMPP7F7suWLzEw2LQyEBvI
- TLSH T16B02B0F2F35EA3BA358B2A1E0038F1C3543CB1517878C5241AA399FD3B1C9C1182C676
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/F.png
- SHA256 ff5785f86b8d50bb0aaf7bbf2aef787a7c3eba57077ce2e2a0fd91be20d3201a
- MD5 5aec55e0ad7da2d3de62c5cb262a7a62
- SHA1 24f15fa844149e667f82a109f7b38245a35350ac
- SHA512 6270afc7329070829bdc37a01d084e27c52fb24cd6c6614b1bd6f54ac42302f5d73b831fbba51d0627033a61cce02d7f692368627bb78a661cc008e02c29a086
- SSDEEP 384:Z0OgW55WOTxaNtDWlSj9VXClXFL1hpwg39Z6exfUKLi4+4KP6:W3qWOVaaTDj39MedUh4FKP6
- TLSH T19362C069366A716127CE503414A368C35A395F97303ADEE2B691D07AF5E1BF018F0F23
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/cF.png
- SHA256 21363aa1587f1d0552c66c800a2f86546a98edbf1e350d137a6dd02cf8760847
- MD5 7a9c7c9db5346451ef6ee03b546cf8a9
- SHA1 df433ebb4fe7a07b579ac3a14bbf08f4ffe196ed
- SHA512 4f1b356362829d89d4d3282e12984c358955f9be55fa2be59ed4842501c89a9907e4af6b606d1379e99449b14e002ad868d737db9845663868f21b7b23d2abc5
- SSDEEP 3072:OiROMTGkf2pJmy5qpend6Q5ueSccIfyydc7XLQ+AvI:XRddoF67DclfyxLQ+AQ
- TLSH T17BB312BF6239AD5671D37B3021C5AD583A69E42F94C0219FFFF8719439604203A98EEC
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/cc.html
- SHA256 e553e8d50a326619404057f702846f0329479e81f2554c0bd5c534b9349b320c
- MD5 79ab11ccd3f263f587104e609c7e6336
- SHA1 899ba68e817e6cb4ad3c0f5a4e76f34b9a1be28c
- SHA512 4193a455b8320fadda09312e5b2dd44a6d80249af882e7e9a8fc9bd4280eb18de1f441e2b8ef3ba7138a2b36dd31b924b1655fb84bdae0b18ef801f3bb089c96
- SSDEEP 192:NCNa47XlSe9kwxwD8Vu2Wdua/yEfFluIjJNua6EiMA2p:N/qjdxwD8wFdpGwCEiMAk
- TLSH T1AAE189D227B61010B65752E477D39B5A77285003AA89CDBC7EDC9098CF84AC486B7B9C
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/final.html
- SHA256 a13a35e2ea3cfc023381487e4ccf9338a544ba32e47a4d272c4c2149a38e6cf7
- MD5 5fc8d3b0eb86c6377b99fc960b9bcabd
- SHA1 628f558cd5386309dd28f4b82dbf8b40b29245c8
- SHA512 5f51724a536b5fbda50f6b4cf401adc65ae0d5e8020669476afcf26b0578ee0615ae1cd492daa604a0332ab5fafa2df365801041ff1aa69372a6c27100197ca5
- SSDEEP 96:NxcTJcSCQi/qExYhDib5QyAxrkl2Kb/dp9x6nhfrhHwHWiMpLRXjYdBUiVr:NWTJcSCQi/xYhDib5FAYl2Kb/hsBKYEd
- TLSH T1CB91405B676320527C56B4A537F7573A3194A523D10BCEA83FCC2288CFC5AE469D274C
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/index.html
- SHA256 de689e10bab60ec5a656900f4a5bacfe939a090e5829c4bc82f35b0ff9a495a4
- MD5 49debd0f809d2ebf82041d8b9904f28d
- SHA1 9f3bd420b00c714554f1fa23da8d6572f16eb508
- SHA512 3aa87c9501ace6acf91728e615df78f6df04a20b31b44a4b463bf5b531c506cd611639b049f1ef0ccdeb6743d4b283c9dae6363a369aad423c8066c3a672c69a
- SSDEEP 384:3bA4yIgA8rqrf1Vee/bCU/buZUsgj9iI550qWIujbUc6JYxioiEImp5:9YkXJqTbjAc6JjFEImp5
- TLSH T13552C97212F36523255B422677D72A4A7272C007C746CE087D9C6395CFCBE869AB73E8
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/method.html
- SHA256 7835b94b50a6e1865cd6fddfc07b6fbf05217665467d0f68349514b8936e0b7e
- MD5 c03497b44648d2636330a08f125a0868
- SHA1 a9ee590947b5fbd21033c734b9ba268d47285093
- SHA512 7f0258f98311c82613ef9c892e919808bdb499c3827cf3c22b29fa1c3ed655d31c5aaa8578a8441b0f562e6acf885152d34c00ac40eb8c74559ef0f379035c3b
- SSDEEP 192:frZdOwkN5pZK644zOA6Bc1lREEOSifpFClOFQYEIPGfUca:frnOlNF/4oHiEluQWmXa
- TLSH T15BE1A5D236F11422764380D82ED39F8BBB994407540BC9B97AEC01DD9F88AD58A73B8D
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/pin.html
- SHA256 53b29bb4b1cb189b87c4c04353ffc63b4cb91e7edcef20d6f94fe663843cf1bc
- MD5 309455d46f0baf1ce1b64b4cbbfc85ef
- SHA1 e844a9a7db2d92af9bc6fc90d785fd1199e48120
- SHA512 dbd77d6cda25438945a7303e8d164c51b4265a25ac5c52bbaa0563fad9bc6e33d73fdfe2e0a972cac3d40a57fa874bae95597c04e8944ac505cfc944f208bc2e
- SSDEEP 192:QEG4UKa+m/FU/CNtfa44444Omn4xJX0yTBaeo2:QEGFU744444OPDdaex
- TLSH T18DD1534211E31041A153E4A52FBB671BB261A407964EC52C3FCD62ED4FCB989E6E378C
- MD5 SHA1 SHA512 SSDEEP TLSH
assets/xY.png
- SHA256 c4e0fe9f6252ab2de1b27423d7172823c4c43fbcc2ca00d81bcedc5006f0dda0
- MD5 5046d677480229e290565b7b2f406e08
- SHA1 bc5fa4104699aa5ef9442c28e176410750ca2f45
- SHA512 34c8a2a80a892d2d3be23a62ba4716033b95382cf20b6bbe7a221bd086e8ce86685b7cde4cc1d747367c522dc2d8f694f410048033217892d05e11fd532d1fdd
- SSDEEP 384:SFPaHgBYJlGIbrCN1AfReQhvlT5phWuKd1xkT6LSSAd7:YaHEYJlbrCAYQhJ5poZdouLZAh
- TLSH T10772C01D86BA35C1478577B1ECDE64CBCFCD3115A1BAC68FC1A281ECA57114E578D388
- MD5 SHA1 SHA512 SSDEEP TLSH