FreeYourMusic.zip
- SHA256 ef6f6ef59b2bbe76796102eb683930ca0de8a0a6dea222f97a9c59da5526f270
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
Overview
overview
6Static
static
6FreeYourMu....0.apk
android-9-x86
6FreeYourMu....0.apk
android-10-x64
6FreeYourMu....0.apk
android-11-x64
6config.arm64_v8a.jar
android-9-x86
config.arm64_v8a.jar
android-10-x64
config.arm64_v8a.jar
android-11-x64
config.en.jar
android-9-x86
config.en.jar
android-10-x64
config.en.jar
android-11-x64
config.nl.jar
android-9-x86
config.nl.jar
android-10-x64
config.nl.jar
android-11-x64
config.xxhdpi.jar
android-9-x86
config.xxhdpi.jar
android-10-x64
config.xxhdpi.jar
android-11-x64
Static task
static1
5 signatures
Behavioral task
behavioral1
Sample
FreeYourMusic-9.28.0.apk
Resource
android-x86-arm-20260325-en
android-9-x86
2 signatures
900 seconds
Behavioral task
behavioral2
Sample
FreeYourMusic-9.28.0.apk
Resource
android-x64-20260325-en
android-10-x64
2 signatures
900 seconds
Behavioral task
behavioral3
Sample
FreeYourMusic-9.28.0.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
2 signatures
900 seconds
Behavioral task
behavioral4
Sample
config.arm64_v8a.jar
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
900 seconds
Behavioral task
behavioral5
Sample
config.arm64_v8a.jar
Resource
android-x64-20260325-en
android-10-x64
0 signatures
900 seconds
Behavioral task
behavioral6
Sample
config.arm64_v8a.jar
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
900 seconds
Behavioral task
behavioral7
Sample
config.en.jar
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
900 seconds
Behavioral task
behavioral8
Sample
config.en.jar
Resource
android-x64-20260325-en
android-10-x64
0 signatures
900 seconds
Behavioral task
behavioral9
Sample
config.en.jar
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
900 seconds
Behavioral task
behavioral10
Sample
config.nl.jar
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
900 seconds
Behavioral task
behavioral11
Sample
config.nl.jar
Resource
android-x64-20260325-en
android-10-x64
0 signatures
900 seconds
Behavioral task
behavioral12
Sample
config.nl.jar
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
config.xxhdpi.jar
Resource
android-x86-arm-20260325-en
android-9-x86
0 signatures
900 seconds
Behavioral task
behavioral14
Sample
config.xxhdpi.jar
Resource
android-x64-20260325-en
android-10-x64
0 signatures
900 seconds
Behavioral task
behavioral15
Sample
config.xxhdpi.jar
Resource
android-x64-arm64-20260325-en
android-11-x64
0 signatures
900 seconds
General
- Target FreeYourMusic.zip
- Size 75.9MB
- Sample260604-tzjd2aaz4v
- SHA256 ef6f6ef59b2bbe76796102eb683930ca0de8a0a6dea222f97a9c59da5526f270
- MD5 1a5f6fbe7bcb7f1b98ea6074fd7d1baa
- SHA1 9b1f06302b01f14fc55397a91950ee45b71a9309
- SHA512 e5dbea15208ff75fc308b9232b1038bacbd1aae791541115630a831446ec83b995c536963300ac19548fbd7f0b5961eb34a413cbb59588caa8d6fbd5f6059f9d
- SSDEEP 786432:tLjs6OY+GONwhEtda+2YAZyIiAIbS3K77a428hYxQtPM0ftjdmiT+GiJ:DOYww/ZyIiAIbSa/a428qxmmiTc
- TLSH T11B08CF0AF70D9832D9CE63B89D6B07A0B736B9483753874B2411E268BDA33C55FA53D1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Requests dangerous framework permissions 2 IoCs
description ioc Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM - Codesign digest Mismatch 1 IoCs
File was altered after it was signed.
resource unpack001/config.xxhdpi.apk - Embeds OpenSSL 2 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
resource yara_rule sample embeds_openssl static1/unpack001/config.arm64_v8a.apk embeds_openssl - Insecure Codesign Algorithm 4 IoCs
File was codesigned using an insecure algorithm.
resource unpack001/config.arm64_v8a.apk unpack001/config.en.apk unpack001/config.nl.apk unpack001/config.xxhdpi.apk - Untrusted Codesign Signers 4 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/config.arm64_v8a.apk unpack001/config.en.apk unpack001/config.nl.apk unpack001/config.xxhdpi.apk
File Explorer
-
FreeYourMusic.zip.zip 75.9MB
-
FreeYourMusic-9.28.0.apk.apk 47.3MB
-
config.arm64_v8a.apk.jar 25.5MB
-
config.en.apk.jar 56KB
-
config.nl.apk.jar 32KB
-
config.xxhdpi.apk.jar 3.0MB
FreeYourMusic-9.28.0.apk
- SHA256 895bb96539fc78094ba44a562a35824e66693341c9ccb6c80a0235cddbf5f860
- MD5 41b889dc2e76cd385c6b127b9ee3ea65
- SHA1 7f55bbb017bfec95efb9ada66753651d3fe78575
- SHA512 b3ff7bc43dbfbafd434c5f46e3cca2e2e836f3431eca7db9d96ce3b09c4748e6b91358d37b97771d267fc9939b23178401a580236fc5f225c0bda02ed11cd971
- SSDEEP 786432:GLjs6OY+GONwhEtda+2YAZyIiAIbS3K77a428Q:yOYww/ZyIiAIbSa/a428Q
- TLSH T1A1B7CF16F7025931DAAF833169BB4B246B33AD99374B4B4B2054B2B87CB32C49FD52C5
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
File Signature issue
Digest
eac7fb013644472d2569f4a5d5333c82f7ea86fc13ccffb26e97095737d8db3e
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Subject
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Serial Number
57:59:71:eb
Issuer
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Timespan
Jun 9, 2016 - Jun 3, 2041
com.freeyourmusic.stamp
com.freeyourmusic.stamp.MainActivity
com.android.vending.BILLING
android.permission.INTERNET
android.permission.POST_NOTIFICATIONS
android.permission.WAKE_LOCK
com.freeyourmusic.stamp.permission.C2D_MESSAGE
android.permission.VIBRATE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
com.google.android.c2dm.permission.RECEIVE
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
com.majeur.launcher.permission.UPDATE_BADGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_APP_BADGE
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
me.everything.badger.permission.BADGE_COUNT_READ
me.everything.badger.permission.BADGE_COUNT_WRITE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
com.google.android.gms.permission.AD_ID
android.permission.ACCESS_ADSERVICES_ATTRIBUTION
android.permission.ACCESS_ADSERVICES_AD_ID
android.permission.FOREGROUND_SERVICE
com.freeyourmusic.stamp.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.SCHEDULE_EXACT_ALARM
com.freeyourmusic.stamp.MainActivity
android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.VIEW
com.apple.android.sdk.authentication.StartAuthenticationActivity
com.apple.android.sdk.authentication.SDKUriHandlerActivity
com.proyecto26.inappbrowser.ChromeTabsManagerActivity
com.onesignal.notifications.activities.NotificationOpenedActivityHMS
android.intent.action.VIEW
com.onesignal.notifications.activities.NotificationOpenedActivity
com.onesignal.notifications.activities.NotificationOpenedActivityAndroid22AndOlder
com.onesignal.core.activities.PermissionsActivity
com.facebook.FacebookActivity
com.facebook.CustomTabMainActivity
com.facebook.CustomTabActivity
android.intent.action.VIEW
com.google.android.gms.auth.api.signin.internal.SignInHubActivity
com.android.billingclient.api.ProxyBillingActivity
com.android.billingclient.api.ProxyBillingActivityV2
com.google.android.gms.common.api.GoogleApiActivity
com.jakewharton.processphoenix.ProcessPhoenix
com.google.android.play.core.common.PlayCoreDialogWrapperActivity
com.google.firebase.components.ComponentDiscoveryService
com.wix.reactnativenotifications.core.ProxyService
com.wix.reactnativenotifications.fcm.FcmInstanceIdListenerService
com.google.firebase.MESSAGING_EVENT
com.google.firebase.INSTANCE_ID_EVENT
com.wix.reactnativenotifications.fcm.FcmInstanceIdRefreshHandlerService
com.onesignal.notifications.services.HmsMessageServiceOneSignal
com.huawei.push.action.MESSAGING_EVENT
com.onesignal.core.services.SyncJobService
com.google.android.gms.auth.api.signin.RevocationBoundService
com.google.firebase.messaging.FirebaseMessagingService
com.google.firebase.MESSAGING_EVENT
com.google.android.gms.measurement.AppMeasurementService
com.google.android.gms.measurement.AppMeasurementJobService
androidx.work.impl.background.systemalarm.SystemAlarmService
androidx.work.impl.background.systemjob.SystemJobService
androidx.work.impl.foreground.SystemForegroundService
androidx.room.MultiInstanceInvalidationService
com.google.android.datatransport.runtime.backends.TransportBackendDiscovery
com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService
com.transistorsoft.tsbackgroundfetch.FetchJobService
com.amazon.device.iap.ResponseReceiver
com.amazon.inapp.purchasing.NOTIFY
com.onesignal.notifications.receivers.FCMBroadcastReceiver
com.google.android.c2dm.intent.RECEIVE
com.onesignal.notifications.receivers.NotificationDismissReceiver
com.onesignal.notifications.receivers.BootUpReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON
com.onesignal.notifications.receivers.UpgradeReceiver
android.intent.action.MY_PACKAGE_REPLACED
com.google.firebase.iid.FirebaseInstanceIdReceiver
com.google.android.c2dm.intent.RECEIVE
com.google.android.gms.measurement.AppMeasurementReceiver
com.facebook.CurrentAccessTokenExpirationBroadcastReceiver
com.facebook.sdk.ACTION_CURRENT_ACCESS_TOKEN_CHANGED
com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver
com.facebook.sdk.ACTION_CURRENT_AUTHENTICATION_TOKEN_CHANGED
androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy
android.intent.action.ACTION_POWER_CONNECTED
android.intent.action.ACTION_POWER_DISCONNECTED
androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy
android.intent.action.BATTERY_OKAY
android.intent.action.BATTERY_LOW
androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy
android.intent.action.DEVICE_STORAGE_LOW
android.intent.action.DEVICE_STORAGE_OK
androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy
android.net.conn.CONNECTIVITY_CHANGE
androidx.work.impl.background.systemalarm.RescheduleReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.TIME_SET
android.intent.action.TIMEZONE_CHANGED
androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver
androidx.work.impl.background.systemalarm.UpdateProxies
androidx.work.impl.diagnostics.DiagnosticsReceiver
androidx.work.diagnostics.REQUEST_DIAGNOSTICS
androidx.profileinstaller.ProfileInstallReceiver
androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION
com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver
com.transistorsoft.tsbackgroundfetch.FetchAlarmReceiver
com.transistorsoft.tsbackgroundfetch.BootReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.MY_PACKAGE_REPLACED
androidx.core.content.FileProvider
com.reactnativecommunity.webview.RNCWebViewFileProvider
io.invertase.firebase.app.ReactNativeFirebaseAppInitProvider
com.imagepicker.ImagePickerProvider
com.oblador.performance.StartTimeProvider
cl.json.RNShareFileProvider
com.google.firebase.provider.FirebaseInitProvider
com.facebook.internal.FacebookInitProvider
io.sentry.android.core.SentryInitProvider
io.sentry.android.core.SentryPerformanceProvider
androidx.startup.InitializationProvider
config.arm64_v8a.apk
- SHA256 0e4997fcb77bfc1f68c5db5b7e06317e96161c190612d77e601772b5b2e81499
- MD5 cf5d98ec9a88bcfa032c07b381513324
- SHA1 e283f9b937f185654eddf225abebef219afba685
- SHA512 1afe1f2df2068562b5656065025f0a07794bd78957ac2ef4e18f74f463e6eb98ecdffc794cf7cd52c04cd08861426db0c0a511de319de57e6baf16e27dae06d5
- SSDEEP 393216:4D2GzikYjFu6eX3xhd+Iz+ukn4kY/uTtPHs0fW7CJjUGmiT0NpGiVE:AQtPM0ftjdmiT+Gii
- TLSH T151477D4EF64CA827DDC674FC8E4F06D2B53AB9041650C0AB3C17C34AEE477DA1A667A1
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
ca21d4a9a86f8faffd85e6b3c9fb65c41e8a34a6
Digest Algorithm
sha1
Digest Matches
Trusted
Not trusted
Signing Certificate
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Chains
Jan 1, 0001
Subject
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Serial Number
57:59:71:eb
Issuer
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Timespan
Jun 9, 2016 - Jun 3, 2041
config.en.apk
- SHA256 686a3aea09ff367c22e60f8271d3884a31d6f1d3c2010795b846b59cfbeb62bb
- MD5 bd85eba3f046d22f502dcd1a154921c8
- SHA1 94640ed221b7de50bf166c5e6b8ba7f48bdee99b
- SHA512 d9e4c5a9ccb7a333fdf08b6c50bceb6dd51b04d7a7680eafb5a8319240d23b13579da27c949c5b26e9cdcfeafa6b817c0b7d725e74c198e4f29559342e61cef7
- SSDEEP 384:sNjZBoqbFlSBIosOMuXrdADshgA5C1piZ8wIp5gSnHYeHYL/b79HZ7OpV15x:sN9BBFkOoRdishgA5C1pslcL
- TLSH T14C43A206BB01561FCD7B05356C978150193ABE03DE469A07E9B0721C2ABB7E28F963F8
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
ed173bf6b9ca25cb1e6c460372dd4e7e62a7ad8e
Digest Algorithm
sha1
Digest Matches
Trusted
Not trusted
Signing Certificate
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Chains
Jan 1, 0001
Subject
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Serial Number
57:59:71:eb
Issuer
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Timespan
Jun 9, 2016 - Jun 3, 2041
config.nl.apk
- SHA256 8658c51fd31252715fa8b0e6ac6a1289319400028454ffc40390dc584671406c
- MD5 f9c5b0ace6392cffed7a812562ca2288
- SHA1 8b4d6805eb85b51ea1fdb444e3ffe86ceb4dba58
- SHA512 af6158741d8343a44fca307a602da03e891a169abaf058ba87bb58c0e7dc4ed1deab08d90d69f53c1cf4b79838c1fdecf1cf8c3744a883d2c4af9e4c3c56c2f2
- SSDEEP 384:7SVyprmyqm5yWyshgAvw1pp5td/beTOmv/IlHlrpVS8v8vOU1gh:7SE9m8yWyshgAvw1pudyE8v8vOU1gh
- TLSH T1E9E22B0ABC85AA13CD7F45749CABD1665A3A4F044D42DE05AAA0720C2AF77D357DB3CC
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
7931b0ecf28f7a5bd9c47187aa3d1510ec204fef
Digest Algorithm
sha1
Digest Matches
Trusted
Not trusted
Signing Certificate
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Chains
Jan 1, 0001
Subject
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Serial Number
57:59:71:eb
Issuer
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Timespan
Jun 9, 2016 - Jun 3, 2041
config.xxhdpi.apk
- SHA256 4df9b95a1db664ea8cbc589e58c40369d853ab08024fbf00c1200e08fece1660
- MD5 10443096153fc26548de059599a77caf
- SHA1 4010060fb04bb930ff5436367f5e54040feb1f57
- SHA512 89de78e826de24a31d05b3294fa7b4fc4c3edbc40a8e41e6c37c5dbb49e4759c81cf423acce5d76ad861155549b2d32c04f22453df77afb0ab6fd6ee39cc1df2
- SSDEEP 49152:Y6iIMQ4Xiopt9KtET8FS4Ceyxvqfi0qSYOFFLX9Pr1c6juUfN9cAjajOfmjSf2tQ:YlHNpTKOupyAfiDSHW65n+joF
- TLSH T176E53372D2BE6039D92BC93BEA790BE24C853CD6683057115A89F6D80FBEAC04515FF4
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Codesign digest Mismatch
File was altered after it was signed.
-
Embeds OpenSSL
Embeds OpenSSL, may be used to circumvent TLS interception.
-
Insecure Codesign Algorithm
File was codesigned using an insecure algorithm.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
1be4ca563d5a418e182e4ea6ff88ba37463f38bb
Digest Algorithm
sha1
Digest Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Chains
Jan 1, 0001
Subject
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Serial Number
57:59:71:eb
Issuer
CN=Lukasz Nowak,OU=Development,O=STAMP Software LTD,L=London,ST=Great Britain,C=GB
Timespan
Jun 9, 2016 - Jun 3, 2041