dvmap | 220603-hsshksggdm[.]bin

General

Target
220603-hsshksggdm.bin
Size 13.2MB
Sample260424-jd3wfacw5m
SHA256 92f8bcd9e62047b380c76afe772ab0fe12ced53b9702d08c37e98424dbb590ae
MD5 43680d1914f28e14c90436e1d42984e2
SHA1 05b0513cb53b0c5ee4ed55ce68cd694e676d4d2b
SHA512 b99455162a14003ae74abba95f1dc8022033c2a9970ec6e0da1820530e7705dc9dfda933287b7a2799d4a8e6ea63f8c807f7b7205fd91bd9840614d0b0efa64f
SSDEEP 196608:fWw9yUJRnZPzcHNdTSYGl3XuZZmoNCxxnxKSEMKapEs6ZCwEKjML2c3KNAM+:+wQUJRxKTS/bz1xj0abVLb6NAz
TLSH
T10BD63385E6956A22C873D43B42FA1B7656A1DC280247A32708C5B66CCEFFCD44E94FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan dvmap

Malware Config

Signatures

Family: Dvmap
Dvmap is an Android rooting trojan that injects malicious code into system runtime libraries, first seen in 2017.
trojan dvmap

Android Dvmap payload 1 IoCs

resource	yara_rule
sample	family_dvmap

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
220603-hsshksggdm.bin

File Explorer

220603-hsshksggdm.bin

.apk 13.2MB

220603-hsshksggdm.bin

SHA256 92f8bcd9e62047b380c76afe772ab0fe12ced53b9702d08c37e98424dbb590ae
MD5 43680d1914f28e14c90436e1d42984e2
SHA1 05b0513cb53b0c5ee4ed55ce68cd694e676d4d2b
SHA512 b99455162a14003ae74abba95f1dc8022033c2a9970ec6e0da1820530e7705dc9dfda933287b7a2799d4a8e6ea63f8c807f7b7205fd91bd9840614d0b0efa64f
SSDEEP 196608:fWw9yUJRnZPzcHNdTSYGl3XuZZmoNCxxnxKSEMKapEs6ZCwEKjML2c3KNAM+:+wQUJRxKTS/bz1xj0abVLb6NAz
TLSH
T10BD63385E6956A22C873D43B42FA1B7656A1DC280247A32708C5B66CCEFFCD44E94FC9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android Dvmap payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

cfbcc5a8355f66e5d9ed1dd92812dde971ad020b6ba21b9d51026ddc1cb6f7bc

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=c,OU=o,O=l,L=o,ST=u,C=01

com.colourblock.flood

Android Permissions

220603-hsshksggdm.bin

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

220603-hsshksggdm.bin

File Signature issue

com.colourblock.flood.GameActivity

com.colourblock.flood.SettingsActivity

com.colourblock.flood.GameAcceleratorService

com.colourblock.flood.InsRefer

com.colourblock.flood.UserReceiver

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

220603-hsshksggdm.bin

File Signature issue

com.colourblock.flood.GameActivity

com.colourblock.flood.SettingsActivity

com.colourblock.flood.GameAcceleratorService

com.colourblock.flood.InsRefer

com.colourblock.flood.UserReceiver

Android Permissions

220603-hsshksggdm.bin