wipelock | projectss7658[.]zip

Sharing

Copy URL Twitter E-mail

Reason

error processing APK: strconv.ParseInt: parsing "0x7fffffff": invalid syntax

General

Target
projectss7658.zip
Size 67.0MB
Sample260628-vcsjvsaw2p
SHA256 917eec78ccb45e014df6f3319ca04dba3a2dac13377640baa9f90dd37bd5df23
MD5 8d95968da4da01ad461b49884d7c3414
SHA1 e0b452984a2e7a8d991f1091227460c220eed13b
SHA512 07dd89c30d76c866197f32e757a1404ebd117b08dd7296cd324fc6d70a3749d01bfd9abae0c888209403f5b52136c2e9c84b922e5160f0782c70a99c4a5e309a
SSDEEP 1572864:kjiBpTZ1SQcCD3Voc3Q+jobV5WtkLKIAtwNc8pUooWdpdzrybm2hjJ7x7:km31SQnRF25YkQ18pUovd/fB2hV7x7
TLSH
T14CF73370D0DE8EE4B2DF604285D08C012F5D96A403B575F3B96683B4E1EDEAE4E619EC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

trojan infostealer wipelock rat arsink

Malware Config

Signatures

Family: Arsink
Arsink is an Android RAT first seen in 2026.
rat arsink
Family: Wipelock
Wipelock is an Android trojan with multiple capabilities, such as wiping data, reading and sending SMS messages without the victim's knowledge.
trojan infostealer wipelock

Detects Arsink RAT 1 IoCs

resource	yara_rule
static1/unpack001/my horror.apk	family_arsink

Wipelock Android payload 1 IoCs

resource	yara_rule
static1/unpack001/Elite.apk	family_wipelock

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
unpack001/Gargoyle_Flying_Monster_Sim_3D-1.0.0.apk

Insecure Codesign Algorithm 2 IoCs

File was codesigned using an insecure algorithm.

resource
unpack001/Elite.apk
unpack001/Gargoyle_Flying_Monster_Sim_3D-1.0.0.apk

Untrusted Codesign Signers 7 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/Elite.apk
unpack001/Gargoyle_Flying_Monster_Sim_3D-1.0.0.apk
unpack001/kingo-root-4-5-8.apk
unpack001/kingroot-5-4-0.apk
unpack002/hk
unpack001/mtk-easy-su-2-2-1.apk
unpack001/my horror.apk

File Explorer

projectss7658.zip

.zip 67.0MB
Elite.apk

.apk 533KB
Gargoyle_Flying_Monster_Sim_3D-1.0.0.apk

.apk 48.4MB
kingo-root-4-5-8.apk

.apk 4.9MB
kingroot-5-4-0.apk

.apk 11.0MB
hk

.apk 140KB
mtk-easy-su-2-2-1.apk

.apk 4.6MB
my horror.apk

.apk 1.0MB

projectss7658.zip

SHA256 917eec78ccb45e014df6f3319ca04dba3a2dac13377640baa9f90dd37bd5df23
MD5 8d95968da4da01ad461b49884d7c3414
SHA1 e0b452984a2e7a8d991f1091227460c220eed13b
SHA512 07dd89c30d76c866197f32e757a1404ebd117b08dd7296cd324fc6d70a3749d01bfd9abae0c888209403f5b52136c2e9c84b922e5160f0782c70a99c4a5e309a
SSDEEP 1572864:kjiBpTZ1SQcCD3Voc3Q+jobV5WtkLKIAtwNc8pUooWdpdzrybm2hjJ7x7:km31SQnRF25YkQ18pUovd/fB2hV7x7
TLSH
T14CF73370D0DE8EE4B2DF604285D08C012F5D96A403B575F3B96683B4E1EDEAE4E619EC
MD5 SHA1 SHA512 SSDEEP TLSH

Elite.apk

SHA256 fcee982b3d0e1601b40078d98df03503668aec7542721f921ae8248bc3cec3a1
MD5 9f01767647e2e72f446d374bbcb20c53
SHA1 f6b1adcd7723b525418a05bcede5c671366d7ab3
SHA512 4b9dc2dc08f015ed96a3ce30978994314d3edca84348eb62e7cb65d4d5477f179c44c80cc0a67863bc119555d0217f57681d047ce98ec405bd5eeaf2da8280ed
SSDEEP 12288:kjRH6+O//n3tKpSsM+1HA+x283ecVS3EVqPlR6i0Ci3jM34D9Z:kN6+ONjstg38OOS3EW6i0C+M3SZ
TLSH
T145C423A4D2EDF583C9BBA73487654247D53777A268201B0016DCB837E4AFB644F42B2B
MD5 SHA1 SHA512 SSDEEP TLSH

android

Wipelock Android payload
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

31fe3137b594c4b75602a3186c4f805537ac3f83

Digest Algorithm

sha1

Digest Matches

Trusted

Not trusted

Signing Certificate

CN=Android Debug,O=Android,C=US

Chains

Jan 1, 0001

com.elite

Gargoyle_Flying_Monster_Sim_3D-1.0.0.apk

SHA256 ca9a6ee5f7a1fb40a8093baa7617ac806ff3877d0e69268a044780677be6a07d
MD5 d881fca1fade4a08c036a4805dd6c3b9
SHA1 221906ec94ed7e153fc2f11e57ad9308203c1cf3
SHA512 ace259efd45556003aafbebbd3d4b4e6b779c1c6194614a2cfeaeba0457125a867dc24f57268f3f8b4da6a9775536b3d9269a5bb242d97bf25f7c979fc746918
SSDEEP 1572864:fVnTRAsoWXvf5BVIqf4r36WYYh4Cq9h2/fcI5Ls:fVnTKsoqBvJK6WX4hLiXs
TLSH
T17CB73342F288F402C5F3CA3756F9263A2A5ACD254B87D7531841BB75A1BFFC44B46AC8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:x86

Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

6adafaa14b5871b056cc2de74d075c682440f34b

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

O=Wild Animals Life

Chains

Jan 1, 0001

com.wildanimalslife.gargoylesimualator

com.oneaudience.unity.OneAudienceUnityActivity

android.intent.action.MAIN

com.unity3d.player.UnityPlayerNativeActivity

com.adcolony.sdk.AdColonyInterstitialActivity

com.adcolony.sdk.AdColonyAdViewActivity

com.heyzap.sdk.ads.MediationTestActivity

com.heyzap.sdk.ads.HeyzapInterstitialActivity

com.heyzap.sdk.ads.HeyzapIncentivizedActivity

com.fyber.unity.ads.OfferWallUnityActivity

com.tapjoy.TJAdUnitActivity

com.tapjoy.TJContentActivity

com.tapjoy.mraid.view.ActionHandler

com.tapjoy.mraid.view.Browser

com.unity3d.ads.adunit.AdUnitActivity

com.unity3d.ads.adunit.AdUnitSoftwareActivity

com.vungle.publisher.VideoFullScreenAdActivity

com.vungle.publisher.MraidFullScreenAdActivity

com.google.android.gms.ads.purchase.InAppPurchaseActivity

com.google.android.gms.common.api.GoogleApiActivity

com.wildanimalslife.gargoylesimualator.OutOpenedCreativesAct

com.wildanimalslife.gargoylesimualator.Jar_DebugIgnoredActivity

com.google.android.gms.ads.AdActivity

com.mopub.mobileads.MoPubActivity

com.mopub.mobileads.MraidActivity

com.mopub.common.MoPubBrowser

com.mopub.mobileads.MraidVideoPlayerActivity

com.mopub.mod.mobileads.MoPubActivity

com.mopub.mod.mobileads.MraidActivity

com.mopub.mod.common.MoPubBrowser

com.mopub.mod.mobileads.MraidVideoPlayerActivity

com.inmobi.androidsdk.IMBrowserActivity

com.smaato.soma.interstitial.InterstitialActivity

com.adsdk.sdk.banner.InAppWebView

com.adsdk.sdk.video.RichMediaActivity

com.adsdk.sdk.mraid.MraidBrowser

com.aerserv.sdk.view.ASVastInterstitialActivity

com.aerserv.sdk.view.ASWebviewInterstitialActivity

com.mobvista.sdk.core.ad.AdActivity

com.arellomobile.android.push.PushWebview

com.arellomobile.android.push.MessageActivity

com.arellomobile.android.push.PushHandlerActivity

com.adcash.mobileads.AdcashInterstitialActivity

org.nexage.sourcekit.mraid.MRAIDBrowser

com.facebook.ads.InterstitialAdActivity

com.nativex.monetization.activities.InterstitialActivity

com.nativex.videoplayer.VideoActivity

com.chartboost.sdk.CBImpressionActivity

com.mdotm.android.view.MdotMActivity

com.applovin.adview.AppLovinInterstitialActivity

com.applovin.adview.AppLovinConfirmationActivity

com.avocarrot.androidsdk.VideoActivity

com.appnext.ads.interstitial.InterstitialActivity

com.appnext.ads.fullscreen.FullscreenActivity

com.flurry.android.FlurryFullscreenTakeoverActivity

com.amazon.device.ads.AdActivity

com.supersonicads.sdk.controller.ControllerActivity

com.supersonicads.sdk.controller.InterstitialActivity

com.supersonicads.sdk.controller.OpenUrlActivity

com.fyber.ads.interstitials.InterstitialActivity

com.yandex.mobile.ads.AdActivity

com.revmob.FullscreenActivity

com.purplebrain.adbuddiz.sdk.AdBuddizActivity

com.apptracker.android.module.AppModuleActivity

com.millennialmedia.internal.MMActivity

com.millennialmedia.internal.MMIntentWrapperActivity

com.startapp.android.publish.ads.list3d.List3DActivity

com.startapp.android.publish.adsCommon.activities.OverlayActivity

com.startapp.android.publish.adsCommon.activities.FullScreenActivity

io.display.sdk.DioActivity

io.display.sdk.DioTranslucentActivity

io.display.sdk.device.PermissionsHandler

kingo-root-4-5-8.apk

SHA256 0ee670fda6b4e5c8daee28aa6e46522649a039ba0178d21e09f894398ea0169a
MD5 3a4597419a8f64c6928e8b0f21a90e24
SHA1 a7b4f077831c2f5f6ccad5a4db372e066da96ea4
SHA512 72db62cadd27654f17f65875732080864372e26504bc75e715ac0257baccdc686cfbd8f1f2059ee46ee5974151e83fdb786a8e773b2e16b58519dc151eb7682f
SSDEEP 98304:7MEniyhxulMOTtcvj/qwX2zqhAJr1/T3b4rrTjDuDO9pMQ2AI52K5UeY8zYF:7XniyhxWdavjiwmGkNT4XXcfGeoF
TLSH
T1AF3612A2F24CF527C87BC03342A58776468A8C65970AF7462855B37C8DFBFD85A81BC4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

27709bf0d5552abf1c0a8a5098e27ced47dcd02c2814cfc6d3a6917d4f1ebb71

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Kingo,OU=www.kingoapp.com,O=www.kingoapp.com,L=BEIJING,ST=BEIJING,C=86

com.kingo.root

kingroot-5-4-0.apk

SHA256 e86b598451ce4a4d356eb0c2ed13c2ea550bbf57e2dc5616bbe909353e9275c8
MD5 d249eba55ddcac91d851bfe09730e49f
SHA1 121cbe46408fc796845c259756bb78005d4ab9ef
SHA512 006ed6826795cd4fed3ebb44031e59c9eba448e574fe97f35dcdf74b6135366e15d3cba350578b78861d7fc1a9cdb21ad072a2ee70417c423fa82878080da680
SSDEEP 196608:HUSgp0VpQYB1t5qudbZbLogSf6L19n5Q4aXW1uPzh25WoTSkgtZV4TLWqgdrIsUV:HTq0VpH3dpLkC19n5Qk1iwWMSkcz6ZKA
TLSH
T160C6120AFB9CF929C477E03797A34673B0994C686706E6531A44F52C28F7DD04B8AEC9
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:mips arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

aa25937e3c8687631173066792116dad253fa62544e2ff99ab753e2d9c6bcce7

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=kingroot,OU=kingroot工作室,O=kingroot工作室,L=Beijing,ST=Beijing,C=CN

hk

SHA256 2b940125721797cd63a0f26eb219cb9799d33da4c9695c1854867f21e747c7d6
MD5 65bfdb1a9cbacec1b6620db9b4648aa7
SHA1 b50a7a2e52a4f5740eca53f3160a70a3262f28d8
SHA512 807b0d6b2216b93a5e0b2de1a9f3903bc34e93765d6c08e35f5c84458a02caca3239ab8bf310fa73e174406d24bdeba0e28a272c6d6d2e42785bbac45db08364
SSDEEP 3072:xvscCp1OvcutEfTNAfJ6HwhpUJuxfvyhyxMYnXrVOXCPqayFfLenl:xvzCpaXzf9WcfETYnXroGUFfLel
TLSH
T182E31299A7C12283E3C78375EDA113309A96A29842B9D8B33F7731B9C213BC54D5F818
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

0bdb8c3b92af98c3db6f0aad09b0ad7711680c91a9de3f58199e8b67edbd055c

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.kingroot.hook

mtk-easy-su-2-2-1.apk

SHA256 9cc91ba2742dbbf87480ce125b752b55f5bb88f678a789bbbf70c0224fd9530c
MD5 26230cdcd869460212331e7098a89efc
SHA1 d44b229963c362477bbfe97a0bc04e2959b7677c
SHA512 c3f01e7501209cce75060360448ea061a2aeb941bd2100bb994b3a13d74ef681f88c988d8561903a866a2119d7644dce60d5a84c78f1ad9a9d3822e72d873fe1
SSDEEP 98304:WEGHyE5PtV78zA0zY7CnZeotsMRoUTT2mNEj5QKw5LGFr+DHt:b6tV78XY7oZtsM7TKNNQKwJN
TLSH
T1A226F186FB54A93FC47741334BAA5235326A8D168E82D747384C376C28B76EC4F99BC4
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

4704f520f26233f2bfb088e2a680b769ad8911ca27dc357abb0855165b099377

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Jeovane Santos,O=Bem Servir,L=Porto Seguro,ST=Bahia

juniojsv.mtk.easy.su

my horror.apk

SHA256 3f7271e2b821c4e3c5c3fa2f82f0ed98269cad8c1c56314f37f92d861f9e1bd7
MD5 2655760e728c9cafa09f6e30e129770d
SHA1 fd375a88758bb15d49fade163f7bb0e7fdc6b5f9
SHA512 0d3bb286846748232e28f87f64f52549fc99e0f529d7fc296684c0f821738d5ca971208286386bea71ce7fc23f868d476c82d3a4ea7eedf347b87332415bd6cb
SSDEEP 12288:NFPSDHTYchZzKX3UJJ7mDpPGjyHNHxy3Ay9nqWQQs5RUNcjpbzFrx/2D2dVnGPKV:6DscTzK30jGxKnkN/leD2Hs/yYhMESfR
TLSH
T1A7253347B36D59D5E84324BDC2B124DAFCA29D565B6CCFC3A44AF3B0D2F842A112235E
MD5 SHA1 SHA512 SSDEEP TLSH

android

Detects Arsink RAT
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

b38215b237057ec4a77ef5d7ec92b4e1231ab01021af49c8f3d43498de8a3c28

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.my.newproject10

Sharing

Errors

General

Malware Config

Signatures

File Explorer

projectss7658.zip

Elite.apk

File Signature issue

com.elite.MainActivity

com.elite.LockScreen

com.elite.UninstallAdminDevice

com.elite.IntentServiceClass

com.elite.AdminReciever

com.elite.SMSReceiver

com.elite.BootReceiver

com.elite.AlarmReceiver

Gargoyle_Flying_Monster_Sim_3D-1.0.0.apk

File Signature issue

com.oneaudience.unity.OneAudienceUnityActivity

com.unity3d.player.UnityPlayerNativeActivity

com.adcolony.sdk.AdColonyInterstitialActivity

com.adcolony.sdk.AdColonyAdViewActivity

com.heyzap.sdk.ads.MediationTestActivity

com.heyzap.sdk.ads.HeyzapInterstitialActivity

com.heyzap.sdk.ads.HeyzapIncentivizedActivity

com.fyber.unity.ads.OfferWallUnityActivity

com.tapjoy.TJAdUnitActivity

com.tapjoy.TJContentActivity

com.tapjoy.mraid.view.ActionHandler

com.tapjoy.mraid.view.Browser

com.unity3d.ads.adunit.AdUnitActivity

com.unity3d.ads.adunit.AdUnitSoftwareActivity

com.vungle.publisher.VideoFullScreenAdActivity

com.vungle.publisher.MraidFullScreenAdActivity

com.google.android.gms.ads.purchase.InAppPurchaseActivity

com.google.android.gms.common.api.GoogleApiActivity

com.wildanimalslife.gargoylesimualator.OutOpenedCreativesAct

com.wildanimalslife.gargoylesimualator.Jar_DebugIgnoredActivity

com.google.android.gms.ads.AdActivity

com.mopub.mobileads.MoPubActivity

com.mopub.mobileads.MraidActivity

com.mopub.common.MoPubBrowser

com.mopub.mobileads.MraidVideoPlayerActivity

com.mopub.mod.mobileads.MoPubActivity

com.mopub.mod.mobileads.MraidActivity

com.mopub.mod.common.MoPubBrowser

com.mopub.mod.mobileads.MraidVideoPlayerActivity

com.inmobi.androidsdk.IMBrowserActivity

com.smaato.soma.interstitial.InterstitialActivity

com.adsdk.sdk.banner.InAppWebView

com.adsdk.sdk.video.RichMediaActivity

com.adsdk.sdk.mraid.MraidBrowser

com.aerserv.sdk.view.ASVastInterstitialActivity

com.aerserv.sdk.view.ASWebviewInterstitialActivity

com.mobvista.sdk.core.ad.AdActivity

com.arellomobile.android.push.PushWebview

com.arellomobile.android.push.MessageActivity

com.arellomobile.android.push.PushHandlerActivity

com.adcash.mobileads.AdcashInterstitialActivity

org.nexage.sourcekit.mraid.MRAIDBrowser

com.facebook.ads.InterstitialAdActivity

com.nativex.monetization.activities.InterstitialActivity

com.nativex.videoplayer.VideoActivity

com.chartboost.sdk.CBImpressionActivity

com.mdotm.android.view.MdotMActivity

com.applovin.adview.AppLovinInterstitialActivity

com.applovin.adview.AppLovinConfirmationActivity

com.avocarrot.androidsdk.VideoActivity

com.appnext.ads.interstitial.InterstitialActivity

com.appnext.ads.fullscreen.FullscreenActivity

com.flurry.android.FlurryFullscreenTakeoverActivity

com.amazon.device.ads.AdActivity

com.supersonicads.sdk.controller.ControllerActivity

com.supersonicads.sdk.controller.InterstitialActivity

com.supersonicads.sdk.controller.OpenUrlActivity

com.fyber.ads.interstitials.InterstitialActivity

com.yandex.mobile.ads.AdActivity

com.revmob.FullscreenActivity

com.purplebrain.adbuddiz.sdk.AdBuddizActivity