badcall_apk | edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195

Target
edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195
Size 314KB
Sample260611-zem5dadv21
SHA256 edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195
MD5 d93b6a5c04d392fc8ed30375be17beb4
SHA1 f862c2899c41a4d1120a7739cdaff561d2490360
SHA512 709931cec37cedf4c5f84f1a2242e48c8465b97217be96a77627a83f317cbb1d0a1a1886955b982b0bf9b92ccf7ab1bef8d782622f81ce1eba337f0530589333
SSDEEP 6144:1c35mQ6aHY0wxxp/2o0uK1uv8q8lY1pr/Cc800a0sdOQypHIKO9kxZ4:+J5Hlwxmo0Tuv8q8i3+c800NsdFyKKOR
TLSH
T1AD64230712BDD092C2A8E872D730C6FB2CBE6646657517038660BE9A9C38DD57DC1FE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan apt lazarus infostealer rat badcall_apk

Malware Config

Signatures

Family: BADCALL
BADCALL is an Android RAT used by the Lazarus Group.
trojan infostealer rat badcall_apk

Android BADCALL payload 1 IoCs

trojan apt lazarus

resource	yara_rule
sample	family_badcall_apk

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195

File Explorer

edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195

.apk 314KB

edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195

SHA256 edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195
MD5 d93b6a5c04d392fc8ed30375be17beb4
SHA1 f862c2899c41a4d1120a7739cdaff561d2490360
SHA512 709931cec37cedf4c5f84f1a2242e48c8465b97217be96a77627a83f317cbb1d0a1a1886955b982b0bf9b92ccf7ab1bef8d782622f81ce1eba337f0530589333
SSDEEP 6144:1c35mQ6aHY0wxxp/2o0uK1uv8q8lY1pr/Cc800a0sdOQypHIKO9kxZ4:+J5Hlwxmo0Tuv8q8i3+c800NsdFyKKOR
TLSH
T1AD64230712BDD092C2A8E872D730C6FB2CBE6646657517038660BE9A9C38DD57DC1FE8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android BADCALL payload

trojan apt lazarus
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

1244bb3aeb3967182f04022aa6300fa1a5641207

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Samsung Cert,OU=DMC,O=Samsung Corporation,L=Suwon City,ST=South Korea,C=KR,1.2.840.113549.1.9.1=#0c16616e64726f69642e6f734073616d73756e672e636f6d

Chains

Jan 1, 0001

com.google.android.apps.store

Android Permissions

edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195

Permissions

android.permission.INTERNET

android.permission.RECORD_AUDIO

android.permission.READ_PHONE_STATE

android.permission.PROCESS_OUTGOING_CALLS

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.SEND_SMS

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.CAMERA

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.INSTALL_PACKAGES

android.permission.DELETE_PACKAGES

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.RECEIVE_BOOT_COMPLETED

edd2aff8fad0c76021adc74fe3cb3cb1a02913a839ad0f2cf31fdea8b5aa8195

File Signature issue

.MainService

com.google.android.apps.store.BroadReceiver