25345544835[.]zip | Triage™

Target
25345544835.zip
Size 158KB
Sample260702-b7glasay61
SHA256 75bed436ef84468ca27062a283243b83e0d9747ee59f6aaccde7f60c16295cdd
MD5 d67c00d251ad184a240c773f57fd8391
SHA1 60dcfe302266e3365b2e57271007e2daeb9b5952
SHA512 3cf2f9a3586017e2b97a5407ed2c88f289b12c8d04357e7dc86877f9d4f20fcef2cea342d076d5b329b70d0f17c46acc38350fdae02481b4cbceb432824d4318
SSDEEP 3072:ycvTqQQFphsQ/gLodCPdERC48Wx21Xoqt1WS6RCLfJpWJv4O/gf:yymvpv/IoAPKRn8Wx21bt1mc7Jpm4ag
TLSH
T187F3121B4815A0E7F7FBBE9C378161224A1F230658471117B872675D6B7CBC23DAB88E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/0c333047d22bb7147f5f95bd8562f96eb5326321fb269dcc889465e7c455bc73

SHA256 75bed436ef84468ca27062a283243b83e0d9747ee59f6aaccde7f60c16295cdd
MD5 d67c00d251ad184a240c773f57fd8391
SHA1 60dcfe302266e3365b2e57271007e2daeb9b5952
SHA512 3cf2f9a3586017e2b97a5407ed2c88f289b12c8d04357e7dc86877f9d4f20fcef2cea342d076d5b329b70d0f17c46acc38350fdae02481b4cbceb432824d4318
SSDEEP 3072:ycvTqQQFphsQ/gLodCPdERC48Wx21Xoqt1WS6RCLfJpWJv4O/gf:yymvpv/IoAPKRn8Wx21bt1mc7Jpm4ag
TLSH
T187F3121B4815A0E7F7FBBE9C378161224A1F230658471117B872675D6B7CBC23DAB88E
MD5 SHA1 SHA512 SSDEEP TLSH

Password

SHA256 0c333047d22bb7147f5f95bd8562f96eb5326321fb269dcc889465e7c455bc73
MD5 80883531ffb3dd964d1f3a05d39a1cc0
SHA1 f8d3010b2381763018cca23a0d396d0f1dda47b4
SHA512 2dd74293d4a66b34391679a4443c2384803484ead97fde0ae68756468b7b7dded93a855896cdf215a96dc453d30d208e07da8842a9abd624e35f18504b76a2f4
SSDEEP 3072:Ogo7P4JADj2Z8VMQBsPrXrLc3LDwPjSJGg+lcwgndWSOEIZnNOoy:k7gUaL9D4EvgndWT5N7y
TLSH
T1B804F191B6FE4651FB7E973CCB3C948A06393E89CE00A31F7565728C0D726C35E61A26
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

Digest

4a2b5cf06741a0e05fd42e88b89f8d45cac9c3d7885c3313d0aff8b2c811ed20

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.dtyqef.rgvw.qipsu