revive | C27C87F4B2A0D95A17D11535167445E3FA9DB05470F1CC57C62B39248A54C4FE[.]apk

Resubmissions

01/05/2026, 12:16

260501-pfty7sfs9y

11/08/2022, 15:38

01/08/2022, 13:13

01/08/2022, 13:12

01/08/2022, 12:55

Sharing

Copy URL Twitter E-mail

General

Target
C27C87F4B2A0D95A17D11535167445E3FA9DB05470F1CC57C62B39248A54C4FE.apk
Size 46.1MB
Sample260501-pfty7sfs9y
SHA256 c27c87f4b2a0d95a17d11535167445e3fa9db05470f1cc57c62b39248a54c4fe
MD5 4240473028f88a3ef54f86f1cd387f24
SHA1 29f2ae906a463f10e22c6be7d2676e59916d8aad
SHA512 e9c34255ce9b37dfd22523b1be5e15be441bd514be40dc3da23b032f3a0b05f652c1639f2c05441fadaef804634ee72c4b163325098d5d107e0664e5710a622f
SSDEEP 786432:vDwRxRo6CrERVB9wcYPSJLbZCNiQGKTwcQ3ZigclgC9x7owlsrnJZahUf6lqYylY:LmLC8VB6FaJLdNKTwcQJiBCCDowWTuUq
TLSH
T1B2B7338EF718910FDA7B60319ABB563106530D4AC886DBC355A4B35C1DBBE840F9ABCD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

stealer trojan banker revive

Malware Config

Extracted

Family

revive

http://80.85.153.49:4000

Signatures

Family: Revive
Revive is an Android banking trojan first seen in June 2022.
stealer trojan banker revive

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
C27C87F4B2A0D95A17D11535167445E3FA9DB05470F1CC57C62B39248A54C4FE.apk

File Explorer

C27C87F4B2A0D95A17D11535167445E3FA9DB05470F1CC57C62B39248A54C4FE.apk

.apk 46.1MB

C27C87F4B2A0D95A17D11535167445E3FA9DB05470F1CC57C62B39248A54C4FE.apk

SHA256 c27c87f4b2a0d95a17d11535167445e3fa9db05470f1cc57c62b39248a54c4fe
MD5 4240473028f88a3ef54f86f1cd387f24
SHA1 29f2ae906a463f10e22c6be7d2676e59916d8aad
SHA512 e9c34255ce9b37dfd22523b1be5e15be441bd514be40dc3da23b032f3a0b05f652c1639f2c05441fadaef804634ee72c4b163325098d5d107e0664e5710a622f
SSDEEP 786432:vDwRxRo6CrERVB9wcYPSJLbZCNiQGKTwcQ3ZigclgC9x7owlsrnJZahUf6lqYylY:LmLC8VB6FaJLdNKTwcQJiBCCDowWTuUq
TLSH
T1B2B7338EF718910FDA7B60319ABB563106530D4AC886DBC355A4B35C1DBBE840F9ABCD
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

02ff84c923be652c779575fca51de26242f09b4ef7da37cb972826e2751ea5be

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.bbva

Android Permissions

C27C87F4B2A0D95A17D11535167445E3FA9DB05470F1CC57C62B39248A54C4FE.apk

Permissions

android.permission.INTERNET

android.permission.READ_PHONE_NUMBERS

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_SMS

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

C27C87F4B2A0D95A17D11535167445E3FA9DB05470F1CC57C62B39248A54C4FE.apk

File Signature issue

com.bbva.MainActivity

com.bbva.keylogger

com.bbva.Service

com.bbva.JobWakeUpService

com.bbva.AutoStart

com.bbva.Revive

com.bbva.SmsReciver

expo.modules.filesystem.FileSystemFileProvider