wipelock | Angry birds transformers[.]apk

Target
Angry birds transformers.apk
Size 573KB
Sample260511-1bzvfaev8j
SHA256 40e158e077a3bd18e57df47a70d553668365a61195cb3233eca09f21a4abcf90
MD5 237d1bb819efac39957685ed58f1ecbc
SHA1 c87509d23b607c5bfea367efdd1066ab39ac5770
SHA512 6dab4c005152e2a1c0889bff78bcb1fe24593c4eb43b380b633b09af9d40e06618d07b689bf177b1735c117d272955654648409db83c66a747d813d37137d1a4
SSDEEP 12288:gjRH6+O//n3tKpSsM+1HA+Aslv8rScVS3EVqPlR6i0Ci3jM34D9KVs:gN6+ONjstgUd8+OS3EW6i0C+M3Sb
TLSH
T1C8C42358D3DEF182C9BBD73547A44257D5BA7792B4202B0525CCB833E0EBB648B8172B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer wipelock

Malware Config

Signatures

Family: Wipelock
Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.
trojan infostealer wipelock

Wipelock Android payload 1 IoCs

resource	yara_rule
sample	family_wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Angry birds transformers.apk

File Explorer

Angry birds transformers.apk

.apk 573KB

Angry birds transformers.apk

SHA256 40e158e077a3bd18e57df47a70d553668365a61195cb3233eca09f21a4abcf90
MD5 237d1bb819efac39957685ed58f1ecbc
SHA1 c87509d23b607c5bfea367efdd1066ab39ac5770
SHA512 6dab4c005152e2a1c0889bff78bcb1fe24593c4eb43b380b633b09af9d40e06618d07b689bf177b1735c117d272955654648409db83c66a747d813d37137d1a4
SSDEEP 12288:gjRH6+O//n3tKpSsM+1HA+Aslv8rScVS3EVqPlR6i0Ci3jM34D9KVs:gN6+ONjstgUd8+OS3EW6i0C+M3Sb
TLSH
T1C8C42358D3DEF182C9BBD73547A44257D5BA7792B4202B0525CCB833E0EBB648B8172B
MD5 SHA1 SHA512 SSDEEP TLSH

android

Wipelock Android payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

c4c356c3cc3bf1d25908a9fbf77d0ea27eddea1fff559155dcc3392256663436

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.rovio.angrybirdstransformers

Android Permissions

Angry birds transformers.apk

Permissions

android.permission.GET_TASKS

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.READ_CONTACTS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_SETTINGS

android.permission.WAKE_LOCK

Angry birds transformers.apk

File Signature issue

com.elite.MainActivity

com.elite.LockScreen

com.elite.UninstallAdminDevice

com.elite.IntentServiceClass

com.elite.AdminReciever

com.elite.SMSReceiver

com.elite.BootReceiver

com.elite.AlarmReceiver