slocker | Лучшее_приложение_для_тебя_я_не_вру_чувак[.]apk

General

Target
Лучшее_приложение_для_тебя_я_не_вру_чувак.apk
Size 2.5MB
Sample260523-vb15lsd17k
SHA256 2891e3fecd23c8e367561c9dc1b00a3dc3fa7669e8370faf2acbce21a9365e0a
MD5 db141d957fa8f6582043f07264c89721
SHA1 9dc31fd4f145b0e02cb9d3cf078ea90ad7f2fe4f
SHA512 c30406d3f6790d511ae2f18687877e2a2cb928b53087205d4c498cf9d3a07497e0e2585c3b67f059e559a5b7bf08d84a54fe6ae00a975b104e321c92e24c0991
SSDEEP 49152:K0mRYlXpw0vSWLJmRYlXpw0vJWLrmRYlXpw0vzWLUmRYlXpw0vEWLi:KVYlXp/vBLWYlXp/voLkYlXp/vSL1Ylo
TLSH
T158C523F6B7E2C674E638D37E819941A870ECF1DA408F5DF0EA608C1B119F9691CE91E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware slocker

Malware Config

Signatures

Family: SLocker
SLocker is an Android ransomware that locks victim screens and encrypts files.
ransomware slocker

SLocker payload 1 IoCs

resource	yara_rule
sample	family_slocker_1

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Лучшее_приложение_для_тебя_я_не_вру_чувак.apk

File Explorer

Лучшее_приложение_для_тебя_я_не_вру_чувак.apk

.apk 2.5MB

Лучшее_приложение_для_тебя_я_не_вру_чувак.apk

SHA256 2891e3fecd23c8e367561c9dc1b00a3dc3fa7669e8370faf2acbce21a9365e0a
MD5 db141d957fa8f6582043f07264c89721
SHA1 9dc31fd4f145b0e02cb9d3cf078ea90ad7f2fe4f
SHA512 c30406d3f6790d511ae2f18687877e2a2cb928b53087205d4c498cf9d3a07497e0e2585c3b67f059e559a5b7bf08d84a54fe6ae00a975b104e321c92e24c0991
SSDEEP 49152:K0mRYlXpw0vSWLJmRYlXpw0vJWLrmRYlXpw0vzWLUmRYlXpw0vEWLi:KVYlXp/vBLWYlXp/voLkYlXp/vSL1Ylo
TLSH
T158C523F6B7E2C674E638D37E819941A870ECF1DA408F5DF0EA608C1B119F9691CE91E4
MD5 SHA1 SHA512 SSDEEP TLSH

android

SLocker payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

53b39e589bf779bfafb7043252b332639332a45691e37246f8fb75ce1eabe526

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

dhfudfdfhfduxfuxfhfdujj.dtjdjgdtjdtjgudtdudtudtuudtjtdtdu.shdsfhhsfsfhsfhsrrhshsrshsrhhrsrhsrhsrhshsdhrsfssfhshrsfhsfh

Android Permissions

Лучшее_приложение_для_тебя_я_не_вру_чувак.apk

Permissions

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SET_WALLPAPER

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.ACCESS_FINE_LOCATION

android.permission.WAKE_LOCK

android.permission.INTERNET

android.permission.REQUEST_INSTALL_PACKAGE

android.permission.CAMERA

Лучшее_приложение_для_тебя_я_не_вру_чувак.apk

File Signature issue

com.termuxhackers.id.MainActivity

com.termuxhackers.id.MyService

com.termuxhackers.id.BootReceiver

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Лучшее_приложение_для_тебя_я_не_вру_чувак.apk

File Signature issue

com.termuxhackers.id.MainActivity

com.termuxhackers.id.MyService

com.termuxhackers.id.BootReceiver

Android Permissions

Лучшее_приложение_для_тебя_я_не_вру_чувак.apk