zen | eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d

General

Target
eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d
Size 615KB
Sample260626-l93xesbs5j
SHA256 eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d
MD5 22819f9b26b081dfb2fcea4162610d0c
SHA1 cef9878bdb52608c848e38b57523415500810375
SHA512 31f39bf07eb7c8ba59a4836960c5ae14ee335d233596d79e0b45357e527d3851e4d741697b66cf9b17285bd06302a49ace77f2f29faba15e66fb2fb7dc0f576c
SSDEEP 12288:uL5zF/09y3h1jXwdAs8WzF/0XyUVLXqIAVMZrXrBfc0i+TncvS:c09y3IAs8S0XyxIwMDQ+TnUS
TLSH
T167D42358A0EC68AEF3089F346F2363191F7086B16A85572E56B43914FCE56C5A1FEF0C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer zen

Malware Config

Signatures

Family: Zen
Zen is an Android trojan that automates fake account creation, first seen in 2013.
trojan infostealer zen

Android Zen payload 2 IoCs

resource	yara_rule
sample	family_zen
static1/unpack001/inject.apk	family_zen

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Untrusted Codesign Signers 3 IoCs

Codesigned file was signed by an untrusted entity.

resource
eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d
unpack001/inject.apk
unpack001/verifycode-debug.apk

File Explorer

eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d

.apk 615KB
inject.apk

.apk 208KB
verifycode-debug.apk

.apk 132KB

eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d

SHA256 eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d
MD5 22819f9b26b081dfb2fcea4162610d0c
SHA1 cef9878bdb52608c848e38b57523415500810375
SHA512 31f39bf07eb7c8ba59a4836960c5ae14ee335d233596d79e0b45357e527d3851e4d741697b66cf9b17285bd06302a49ace77f2f29faba15e66fb2fb7dc0f576c
SSDEEP 12288:uL5zF/09y3h1jXwdAs8WzF/0XyUVLXqIAVMZrXrBfc0i+TncvS:c09y3IAs8S0XyxIwMDQ+TnUS
TLSH
T167D42358A0EC68AEF3089F346F2363191F7086B16A85572E56B43914FCE56C5A1FEF0C
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm

Android Zen payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

15a48d354378e4f51a3c6d0c341463835cc842ca59fc4f5112649e2cd17b8b49

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.lmt.register

inject.apk

SHA256 afd2b00c294cb629b29bb135587615ad9b713c6223486bd29674829c46077066
MD5 d4db1580e351b6f85473f211f4107312
SHA1 865c8d169a277db892a6c6da027e19fabfa53d03
SHA512 0b4c495e795d37a9d2c39f5d788ed76645ecc74e50797bc9e182d3d120086d29818047535c211d1f36b6a98892d901dcf7b07199de4391e3903f871f1ed5c3db
SSDEEP 3072:HO37piNG7OkPzF/OSA/JD6ASWi22ERbQhqXKX24EmioljWm4yEy7o7kN:HOLcNGKkPzF/Ra96ASOQhkedxWmP7+8
TLSH
T1BF2413A961F8B8DDE2049D3CBA4716162B304B759F883B3BA7B871157CF42C059B9E4C
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm

Android Zen payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

369bba490f9122be85ca63b205232d07f48f5a3ed0f0071cb92212802ed810d6

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.lmt.register

verifycode-debug.apk

SHA256 0eadad8a26ba1187ec1522941d3fd216588378c22f238c4ee58f6890bb8c7531
MD5 891c52bec27fd817c4afcbcfdfdb3e39
SHA1 9dc0975930ee6629eecd0bdda5f5526bd07fc0ce
SHA512 81e217b8dc0db1f2e40776b058302f8c006cd84f4781f6e3d7e6c6cb6a648646fe57458edc0383d8b04c17f8a393926761fa3a7a6d479db8624aa4b40b6e4368
SSDEEP 3072:T8oXKmFDTJB/U+s1mY4jfQm90wusoQCWJDsEb3WQQgsK2ud9vZQT:T82KmFFu+s1Scm90NWJNvbsXa9vyT
TLSH
T156D31227EA91E885E65FF735890715FF3ED491582034BBD120E3A430AC0FDD6BEA41A8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android Zen payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

aa479a97cf2d5ac8ebf7d131aa5703203bd3d992906cc4f57f57ca997c6f5fbe

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

ninja.lmt.verifycode

Android Permissions

eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE_STATE

android.permission.DISABLE_KEYGUARD

android.permission.WAKE_LOCK

android.permission.GET_ACCOUNTS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.INTERNET

eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d

File Signature issue

com.lmt.register.RegisterAccessbilityService

com.lmt.register.SuService

com.lmt.register.SuReceiver

inject.apk

File Signature issue

com.lmt.register.RegisterAccessbilityService

com.lmt.register.SuService

com.lmt.register.SuReceiver

verifycode-debug.apk

File Signature issue

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d

File Signature issue

com.lmt.register.RegisterAccessbilityService

com.lmt.register.SuService

com.lmt.register.SuReceiver

inject.apk

File Signature issue

com.lmt.register.RegisterAccessbilityService

com.lmt.register.SuService

com.lmt.register.SuReceiver

verifycode-debug.apk

File Signature issue

Android Permissions

eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d