dropper.apk
- SHA256 6a32c6deb3d68301b677c7d8cb3d1b533032f838a9d1d1e517d6bf2c39e472eb
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
update.apk
Resource
android-x64-arm64-20260325-en
android-11-x64
3 signatures
150 seconds
General
- Target dropper.apk
- Size 9.2MB
- Sample260706-pr4msaa16q
- SHA256 6a32c6deb3d68301b677c7d8cb3d1b533032f838a9d1d1e517d6bf2c39e472eb
- MD5 2353ff11db7382808750ba12d93a5933
- SHA1 efe9a808a9290c97f4290b4855e056d4cfb3e130
- SHA512 23eaac3d0bbe03017616f67aa2bb04a91d926e3d6f4a1738e6e2407ef5158d1348f07d6f72b8a098c4ecfcbd747ae8a5901dc8c378181937e9536e98f5a4aa45
- SSDEEP 196608:uMF0N2GgWNZpH7offSpHHxgB8jp9Pn0tl/SFilSbI0xw02Ce:u40N2GRNb0fIHRJj/kl/SsSbbw02Ce
- TLSH T104A63311E5BF8891600886B423517EE8C59A3AE47733A55F22C4D7E9296CCBCF8F8D35
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares services with permission to bind to the system 4 IoCs
description ioc Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. android.permission.BIND_NOTIFICATION_LISTENER_SERVICE Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by accessibility services to bind with the system. Allows apps to access accessibility features. android.permission.BIND_ACCESSIBILITY_SERVICE Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls. android.permission.BIND_SCREENING_SERVICE - Requests dangerous framework permissions 16 IoCs
description ioc Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device. android.permission.READ_PHONE_STATE Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES Allows applications to use exact alarm APIs. android.permission.SCHEDULE_EXACT_ALARM Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows the app to answer an incoming phone call. android.permission.ANSWER_PHONE_CALLS Allows an application to read or write the system settings. android.permission.WRITE_SETTINGS Allows an application to monitor incoming MMS messages. android.permission.RECEIVE_MMS Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to receive SMS messages. android.permission.RECEIVE_SMS Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP. android.permission.TURN_SCREEN_ON Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application a broad access to external storage in scoped storage. android.permission.MANAGE_EXTERNAL_STORAGE Allows an app to post notifications. android.permission.POST_NOTIFICATIONS Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to send SMS messages. android.permission.SEND_SMS Allows an application to read SMS messages. android.permission.READ_SMS - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/update.apk
File Explorer
-
dropper.apk.zip 9.2MB
-
update.apk.apk 13.0MB
update.apk
- SHA256 890ecea4ebe4fea692ad36adf02abeb37c181cb7bdb6122cd52d9aaafe7d6cf3
- MD5 1e2812e17d950099c496b7c756b5abbc
- SHA1 1e64ec113364e37d7a95976dd611779058580994
- SHA512 549158e5e209144c47c678987775e2526b4e27643fe25e0b1b246603edc8fa814be641d773bb0a9b665351afa81a40468bf0aebb2a8092cf1325025460b1c096
- SSDEEP 196608:6sGvZeY8juQgY9/XzKk47nKoBSRuJMC4WPsUl111QlCO/y2:dY8juQtKDBJJMCVsU7PQlfy2
- TLSH T1B6D6D051B7054A32C4AE623379BB4720BB3AAE8DD2835B472508B3787C771D47B663C9
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
File Signature issue
Digest
115574d1610b7f41aad2939b75c33e447ef33f266155700819cd4f233128b89d
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
O=j4velin development
Subject
O=j4velin development
Serial Number
65:17:d4:f6
Issuer
O=j4velin development
Timespan
Sep 16, 2016 - Aug 23, 2116
com.yzr.pij
com.yzr.pij.MainActivity
android.permission.READ_PHONE_STATE
android.permission.QUERY_ALL_PACKAGES
android.permission.USE_BIOMETRIC
android.permission.VIBRATE
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.USE_FULL_SCREEN_INTENT
android.permission.SCHEDULE_EXACT_ALARM
android.permission.READ_CONTACTS
android.permission.FOREGROUND_SERVICE_DATA_SYNC
android.permission.ANSWER_PHONE_CALLS
android.permission.WRITE_SETTINGS
android.permission.WRITE_SMS
android.permission.RECEIVE_MMS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
com.yzr.pij.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.RECEIVE_SMS
android.permission.USE_EXACT_ALARM
android.permission.TURN_SCREEN_ON
android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION
android.permission.SYSTEM_ALERT_WINDOW
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.POST_NOTIFICATIONS
android.permission.ACCESS_NOTIFICATION_POLICY
android.permission.ACCESS_NETWORK_STATE
android.permission.FOREGROUND_SERVICE_SPECIAL_USE
android.permission.USE_FINGERPRINT
android.permission.FOREGROUND_SERVICE
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.READ_EXTERNAL_STORAGE
android.permission.SEND_SMS
android.permission.READ_SMS
com.yzr.pij.pIXNY
com.yzr.pij.DJRqFHu
com.yzr.pij.MainActivity
android.intent.action.SENDTO
android.intent.action.MAIN
com.yzr.pij.BPqtGY
com.yzr.pij.SDbuwF
com.yzr.pij.wmiwtkIB
com.yzr.pij.ojMSnG
com.yzr.pij.yXRsYi
com.yzr.pij.bsCgF
com.yzr.pij.ZGLUw
android.intent.action.RESPOND_VIA_MESSAGE
com.yzr.pij.ThhietMO
android.service.notification.NotificationListenerService
com.yzr.pij.iwtZlB
android.accessibilityservice.AccessibilityService
com.yzr.pij.OGxvEh
android.accessibilityservice.AccessibilityService
com.yzr.pij.NpLBHo
android.telecom.CallScreeningService
com.yzr.pij.iDYrvXeR
com.yzr.pij.SQpeGy
com.yzr.pij.INSTALL_RESULT
com.yzr.pij.cEObkH
com.yzr.pij.RlbEtNC
android.provider.Telephony.SMS_RECEIVED
android.provider.Telephony.SMS_DELIVER
com.yzr.pij.pMLEoNB
android.intent.action.PHONE_STATE
com.yzr.pij.XslvYC
android.provider.Telephony.WAP_PUSH_DELIVER
com.yzr.pij.SmsChangeReceiver
android.provider.Telephony.ACTION_DEFAULT_SMS_PACKAGE_CHANGED
com.yzr.pij.JMCcQ
SMS_SENT
SMS_DELIVERED
androidx.profileinstaller.ProfileInstallReceiver
androidx.profileinstaller.action.INSTALL_PROFILE
androidx.profileinstaller.action.SKIP_FILE
androidx.profileinstaller.action.SAVE_PROFILE
androidx.profileinstaller.action.BENCHMARK_OPERATION