wipelock | ستنغراي الاصلي (2)[.]apk

Target
ستنغراي الاصلي (2).apk
Size 549KB
Sample260514-sa8rysgs71
SHA256 d6c670c7a27105f082108d89c6d6b983bdeba6cef36d357b2c4c2bfbc4189aab
MD5 dc98efd71997adb619bfc6e09b3df258
SHA1 50d0d722d4af4a863a19749dd7ef680c67662aa2
SHA512 1903987f5cd074bb672cf335442178a0820bce6e02dc5a04bbbd894c2048bcb068c85e6cefd3663bd0505a20c0651dcfcbb60760f2c5744e344af6f7a627ade7
SSDEEP 12288:pVH6+G//njU81lWGiZrqCx5cVS3EVqPlR6i0Ci3jM34D9I:pd6+GQ81lseCPOS3EW6i0C+M3SI
TLSH
T13BC4237DC6FC95CBD9E7AE308724035FC97BA7A894206B4914DCAC219CF7B618B81217
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer wipelock

Malware Config

Signatures

Family: Wipelock
Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.
trojan infostealer wipelock

Wipelock Android payload 1 IoCs

resource	yara_rule
sample	family_wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ستنغراي الاصلي (2).apk

File Explorer

ستنغراي الاصلي (2).apk

.apk 549KB

ستنغراي الاصلي (2).apk

SHA256 d6c670c7a27105f082108d89c6d6b983bdeba6cef36d357b2c4c2bfbc4189aab
MD5 dc98efd71997adb619bfc6e09b3df258
SHA1 50d0d722d4af4a863a19749dd7ef680c67662aa2
SHA512 1903987f5cd074bb672cf335442178a0820bce6e02dc5a04bbbd894c2048bcb068c85e6cefd3663bd0505a20c0651dcfcbb60760f2c5744e344af6f7a627ade7
SSDEEP 12288:pVH6+G//njU81lWGiZrqCx5cVS3EVqPlR6i0Ci3jM34D9I:pd6+GQ81lseCPOS3EW6i0C+M3SI
TLSH
T13BC4237DC6FC95CBD9E7AE308724035FC97BA7A894206B4914DCAC219CF7B618B81217
MD5 SHA1 SHA512 SSDEEP TLSH

android

Wipelock Android payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

e5fd3f5e6ba8a7bbd7b5da95778df6ea5d3e9c3fc85c0f30690823427d4c297e

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.scott.fnaf2

Android Permissions

ستنغراي الاصلي (2).apk

Permissions

android.permission.GET_TASKS

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_SMS

android.permission.WRITE_SMS

android.permission.READ_CONTACTS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_SETTINGS

android.permission.WAKE_LOCK

ستنغراي الاصلي (2).apk

File Signature issue

com.elite.MainActivity

com.elite.LockScreen

com.elite.UninstallAdminDevice

com.elite.IntentServiceClass

com.elite.AdminReciever

com.elite.SMSReceiver

com.elite.BootReceiver

com.elite.AlarmReceiver