MessageSync[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MessageSync.apk
Size 33.2MB
Sample260710-gylrjset4j
SHA256 53a10faee7bd38048b0fa143a67b2003685a887acb2e942e7946c94f00219297
MD5 0755b10d767b9b7887ab95662cb44350
SHA1 b974efc999455400fbdd2caf0013d0d748fcead0
SHA512 2485be340945fe9b9aa8ae5b9197aa48b29a678fe7c954571d9e5ce9c4daef7bd3f64b7fab47d4e18078c00db29759a23eb5aa77ca8b1925b72cf96327fdd6b9
SSDEEP 393216:ItYdyUkkPb7O+by31mBSUsv2htQEXEP4PhhZnjF03J9Ceq8:ItTk2+q1mBSUpQGzjF03meP
TLSH
T11977CF86F9535D64C8A9A83091BF8332B739381D8383A7175595F634BDBB2C06F99BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by in-call services to bind with the system. Allows apps to handle aspects of phone calls while they are in progress.	android.permission.BIND_INCALL_SERVICE

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
MessageSync.apk

File Explorer

MessageSync.apk

.apk 33.2MB

MessageSync.apk

SHA256 53a10faee7bd38048b0fa143a67b2003685a887acb2e942e7946c94f00219297
MD5 0755b10d767b9b7887ab95662cb44350
SHA1 b974efc999455400fbdd2caf0013d0d748fcead0
SHA512 2485be340945fe9b9aa8ae5b9197aa48b29a678fe7c954571d9e5ce9c4daef7bd3f64b7fab47d4e18078c00db29759a23eb5aa77ca8b1925b72cf96327fdd6b9
SSDEEP 393216:ItYdyUkkPb7O+by31mBSUsv2htQEXEP4PhhZnjF03J9Ceq8:ItTk2+q1mBSUpQGzjF03meP
TLSH
T11977CF86F9535D64C8A9A83091BF8332B739381D8383A7175595F634BDBB2C06F99BC0
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

431a5d05ddde7ded3090768d51b56c1672f263d9630ee64bf47ef01067b92755

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=SoftwarePlus Phone,O=SoftwarePlus Tech,C=US

app.softwareplus.phone

app.softwareplus.phone.telephony.SmsReceiver

android.provider.Telephony.SMS_DELIVER

app.softwareplus.phone.telephony.SmsReceivedReceiver

android.provider.Telephony.SMS_RECEIVED

app.softwareplus.phone.telephony.MmsWapReceivedReceiver

android.provider.Telephony.WAP_PUSH_RECEIVED

app.softwareplus.phone.telephony.MmsWapPushReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

app.softwareplus.phone.telephony.MmsDownloadedReceiver

app.softwareplus.phone.telephony.SmsSentReceiver

app.softwareplus.phone.telephony.MmsSentStatusReceiver

app.softwareplus.phone.telephony.SmsDeliveryReceiver

app.softwareplus.phone.notify.MessageReplyReceiver

app.softwareplus.phone.notify.CallBackReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.gms.measurement.AppMeasurementReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

MessageSync.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.POST_NOTIFICATIONS

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.CALL_PHONE

android.permission.ANSWER_PHONE_CALLS

android.permission.MANAGE_OWN_CALLS

android.permission.READ_CALL_LOG

android.permission.WRITE_CALL_LOG

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.permission.READ_SMS

android.permission.RECORD_AUDIO

android.permission.FOREGROUND_SERVICE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE_PHONE_CALL

android.permission.WAKE_LOCK

android.permission.USE_FULL_SCREEN_INTENT

android.permission.BLUETOOTH

android.permission.BLUETOOTH_CONNECT

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.USE_BIOMETRIC

android.permission.USE_FINGERPRINT

com.google.android.c2dm.permission.RECEIVE

com.google.android.gms.permission.AD_ID

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_AD_ID

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

app.softwareplus.phone.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

MessageSync.apk

File Signature issue

app.softwareplus.phone.MainActivity

app.softwareplus.phone.MessagesActivity

app.softwareplus.phone.PhoneActivity

app.softwareplus.phone.feature.incall.InCallActivity

com.google.firebase.appdistribution.impl.InstallActivity

com.google.firebase.appdistribution.impl.SignInResultActivity

com.google.firebase.appdistribution.impl.FeedbackActivity

com.google.firebase.appdistribution.impl.TakeScreenshotAndStartFeedbackActivity

com.clerk.api.sso.SSOManagerActivity

com.clerk.api.sso.SSOReceiverActivity

androidx.credentials.playservices.controllers.identityauth.HiddenActivity

androidx.credentials.playservices.controllers.identitycredentials.IdentityCredentialApiHiddenActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.google.android.play.core.common.PlayCoreDialogWrapperActivity

app.softwareplus.phone.telephony.PhoneInCallService

app.softwareplus.phone.telephony.CallForegroundService

app.softwareplus.phone.feature.companion.CompanionKeepAliveService

app.softwareplus.phone.telephony.PhoneFcmService

app.softwareplus.phone.telephony.HeadlessSmsSendService

com.google.firebase.components.ComponentDiscoveryService

androidx.credentials.playservices.CredentialProviderMetadataHolder

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.sessions.SessionLifecycleService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

app.softwareplus.phone.telephony.SmsReceiver

app.softwareplus.phone.telephony.SmsReceivedReceiver

app.softwareplus.phone.telephony.MmsWapReceivedReceiver

app.softwareplus.phone.telephony.MmsWapPushReceiver

app.softwareplus.phone.telephony.MmsDownloadedReceiver

app.softwareplus.phone.telephony.SmsSentReceiver

app.softwareplus.phone.telephony.MmsSentStatusReceiver

app.softwareplus.phone.telephony.SmsDeliveryReceiver

app.softwareplus.phone.notify.MessageReplyReceiver

app.softwareplus.phone.notify.CallBackReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.core.content.FileProvider

com.google.firebase.appdistribution.impl.FirebaseAppDistributionFileProvider

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

com.klinker.android.send_message.MmsFileProvider

Android Permissions

MessageSync.apk