22rioapp[.]apk | Triage™

General

Target
22rioapp.apk
Size 6.5MB
Sample260722-hbmwrsem21
SHA256 231e2d94b67e8e0c6ff9c7d01d6807db1919c294fa30a75a3a032c305baa3f58
MD5 8330666eed5fc1f75242dbd69294c104
SHA1 cda6eb2763b5411b37e3849f59c81e903deb71a0
SHA512 bbf1f3ae6c64d48d9ade97c97f253245425552fbc6dbb284866a5e945952d64347698c61bc38ecf2f5ed9ef9fc1c84ad887923243f734f4af21fe6626f36fc7d
SSDEEP 196608:qxzbDK7H2CvCbbs/UF+VrV8VIZAU38z7R:SzbDKb/vCgUUxVmIZT38z9
TLSH
T114660193F749FC5FC0F7C33286751226600A5E658B83E6835918B3BD5DB7AD04A89EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
22rioapp.apk

File Explorer

22rioapp.apk

.apk 6.5MB

22rioapp.apk

SHA256 231e2d94b67e8e0c6ff9c7d01d6807db1919c294fa30a75a3a032c305baa3f58
MD5 8330666eed5fc1f75242dbd69294c104
SHA1 cda6eb2763b5411b37e3849f59c81e903deb71a0
SHA512 bbf1f3ae6c64d48d9ade97c97f253245425552fbc6dbb284866a5e945952d64347698c61bc38ecf2f5ed9ef9fc1c84ad887923243f734f4af21fe6626f36fc7d
SSDEEP 196608:qxzbDK7H2CvCbbs/UF+VrV8VIZAU38z7R:SzbDKb/vCgUUxVmIZT38z9
TLSH
T114660193F749FC5FC0F7C33286751226600A5E658B83E6835918B3BD5DB7AD04A89EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

68454d9c0399aab0fd1d1a322d971ef9a77048083d06d159e86a0883ff537e32

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Franky Hu,OU=personal,O=Franky Hu,L=Mala,ST=Mala

com.xytcg.k11068.rkhi

Android Permissions

22rioapp.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_WIFI_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.READ_MEDIA_IMAGES

android.permission.INSTALL_PACKAGES

android.permission.CAMERA

com.google.android.gms.permission.AD_ID

android.permission.USE_BIOMETRIC

android.permission.USE_FINGERPRINT

android.permission.POST_NOTIFICATIONS

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_AD_ID

android.permission.ACCESS_ADSERVICES_CUSTOM_AUDIENCE

com.zing.zalo.permission.ACCESS_THIRD_PARTY_APP_AUTHORIZATION

com.xytcg.k11068.rkhi.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_PHONE_STATE

Sharing

General

Malware Config

Signatures

File Explorer

22rioapp.apk

File Signature issue

com.speed.client.CCMainActivity

com.speed.client.CCWebActivity

com.speed.client.third_login.TgLoginActivity

com.facebook.CustomTabActivity

com.facebook.FacebookActivity

com.zing.zalo.zalosdk.oauth.BrowserLoginActivity

com.speed.client.jpush.UserActivity400

androidx.credentials.playservices.HiddenActivity

com.linecorp.linesdk.auth.internal.LineAuthenticationActivity

com.linecorp.linesdk.auth.internal.LineAuthenticationCallbackActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.facebook.CustomTabMainActivity

com.zing.zalo.zalosdk.oauth.OpenAPIActivity

com.zing.zalo.zalosdk.oauth.WebLoginActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.engagelab.privates.common.component.MTCommonActivity

com.speed.client.jpush.UserService

androidx.credentials.playservices.CredentialProviderMetadataHolder

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.blankj.utilcode.util.MessengerUtils$ServerService

com.engagelab.privates.push.platform.google.callback.MTGoogleCallback

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.speed.client.jpush.UserReceiver

com.adjust.sdk.AdjustReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.core.content.FileProvider

com.squareup.picasso.PicassoProvider

com.google.firebase.provider.FirebaseInitProvider

com.facebook.internal.FacebookInitProvider

com.blankj.utilcode.util.UtilsFileProvider

com.engagelab.privates.common.component.MTCommonProvider

com.bugsnag.android.internal.BugsnagContentProvider

com.sensorsdata.analytics.android.sdk.data.SensorsDataContentProvider

Android Permissions

22rioapp.apk