yes bank 1[.]apk | Triage™

Target
yes bank 1.apk
Size 7.5MB
Sample260724-m8f7psycpg
SHA256 45dd98a69d4501fa3e629e57d22ffa569a44cad6810731ef65bfdb9dc2fdf04b
MD5 369ab7ef4aa28f310afb2d58c7de0387
SHA1 e5a2e583655f6428acbefa88743b25399a3f6253
SHA512 9a4d261f62329a6464b3e2e5ed2ff38e6fee5c269969fdace935e4065758a2b3d0e8e1202d8c8fd3e4ce62ae50b31a4c8382eb519e9247e4ca9c289154589c58
SSDEEP 98304:H8vmq/RtlPmgNqOYU5FjmZFoFQ3dle513U9jeSwUunrh6tij5i6Uw6yetXYEXRRL:3qJ/YU5FKF8H51k9q4urh6IIY6rIGMY
TLSH
T15F863316F8C95E12D5F38376C1728672607EDE21AF0387036A18733E20BF6E4979A5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
yes bank 1.apk

File Explorer

yes bank 1.apk

.apk 7.5MB

yes bank 1.apk

SHA256 45dd98a69d4501fa3e629e57d22ffa569a44cad6810731ef65bfdb9dc2fdf04b
MD5 369ab7ef4aa28f310afb2d58c7de0387
SHA1 e5a2e583655f6428acbefa88743b25399a3f6253
SHA512 9a4d261f62329a6464b3e2e5ed2ff38e6fee5c269969fdace935e4065758a2b3d0e8e1202d8c8fd3e4ce62ae50b31a4c8382eb519e9247e4ca9c289154589c58
SSDEEP 98304:H8vmq/RtlPmgNqOYU5FjmZFoFQ3dle513U9jeSwUunrh6tij5i6Uw6yetXYEXRRL:3qJ/YU5FKF8H51k9q4urh6IIY6rIGMY
TLSH
T15F863316F8C95E12D5F38376C1728672607EDE21AF0387036A18733E20BF6E4979A5D9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

55daa7d2a5db4c2044af5ee47d7b21cd34c5fad4a92a74f260d171a24d105ea6

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=fwc

com.iqu.ximwwiawy

Android Permissions

yes bank 1.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.QUERY_ALL_PACKAGES

android.permission.FOREGROUND_SERVICE

android.permission.WAKE_LOCK

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.POST_NOTIFICATIONS

com.google.android.c2dm.permission.RECEIVE

yes bank 1.apk

File Signature issue

phfj2s.cht0tf

com.iqu.ximwwiawy.MainActivity

com.iqu.ximwwiawy.egsOvD

com.google.android.gms.common.api.GoogleApiActivity

.HostListActivity

.PubkeyListActivity

.GeneratePubkeyActivity

.HostEditorActivity

.PortForwardListActivity

.SettingsActivity

.WizardActivity

.HelpActivity

.HelpTopicActivity

.ColorsActivity

com.lamerman.FileDialog

.ConsoleActivity

com.iqu.ximwwiawy.elEmqCNseAxZMaRyi

com.iqu.ximwwiawy.etuZfqHGaZ

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

sk.vx.connectbot.service.TerminalManager

sk.vx.connectbot.service.AuthAgentService

com.iqu.ximwwiawy.eOIPRu

com.iqu.ximwwiawy.eaJjguJbZToNq

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver