Overview

overview

10

Static

static

10

260607-p8aq2aez9l.apk

android-11-x64

1

client.apk

android-11-x64

1

Resubmissions

10/06/2026, 17:55

260610-whreesdz5v10

10/06/2026, 16:38

260610-t5mnmsew8r10

Sharing

Copy URL Twitter E-mail

General

  • Target
    260607-p8aq2aez9l.bin
  • Size 575KB
  • Sample260610-whreesdz5v
  • SHA256 b0f6d2fc8176356124e502426d7aa7448490556ef68a2f31a78f4dd8af9d1750
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoortrojaninfostealerloki

Malware Config

Signatures

  • Family: Loki

    Loki is a pre-installed Android infostealer that steals device data. It was first seen in 2017.

    backdoortrojaninfostealerloki
  • Android Loki payload 1 IoCs
  • Requests dangerous framework permissions 8 IoCs
  • Insecure Codesign Algorithm 2 IoCs

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 2 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 260607-p8aq2aez9l.bin
    .apk 575KB
  • client.jar
    .apk 51KB

260607-p8aq2aez9l.bin

  • SHA256 b0f6d2fc8176356124e502426d7aa7448490556ef68a2f31a78f4dd8af9d1750
  • MD5 SHA1 SHA512 SSDEEP TLSH
android

  • Android Loki payload

  • Insecure Codesign Algorithm

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
ed9e5fd9652d18d43e05dfa36568609a8f5b5ccf
Digest Algorithm
sha1
Digest Matches
Trusted
Not trusted
Signing Certificate
CN=us
Chains

Jan 1, 0001

com.androidhelper.sdk

Android Permissions

260607-p8aq2aez9l.bin

Permissions

android.permission.SYSTEM_ALERT_WINDOW

android.permission.INTERNET

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.READ_CALL_LOG

android.permission.READ_CONTACTS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.READ_PHONE_STATE

android.permission.GET_TASKS

android.permission.INTERACT_ACROSS_USERS_FULL

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.DOWNLOAD_WITHOUT_NOTIFICATION

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.BROADCAST_STICKY

android.permission.GET_ACCOUNTS

android.permission.WRITE_EXTERNAL_STORAGE

com.android.launcher.permission.INSTALL_SHORTCUT

com.google.android.providers.gsf.permission.READ_GSERVICES