Gl_Chrm[.]apk | Triage™

General

Target
Gl_Chrm.apk
Size 18.8MB
Sample260728-wevbxaaf68
SHA256 640b074c2bc8c47930daaf3a20b9105b46523f0917373894ae6d7a6fe55426ce
MD5 f3bc51b8f56d90d2a0d163b9cf1b5e2f
SHA1 32a47f85fe9c5b9eed80e7a82d8387cc1168d8c5
SHA512 2112d64677293b47405d213797d8d75d7fa27882a733fa3cd61bf9b34d2dadf7f01cf58897d60f1582c1ea92e2e94c5c4a6bdb2be581b77f02b6818ff54354ea
SSDEEP 393216:/RavXZ6xIWh3sDNoTfnN53JyzHhXRCQ32WI8VN2WnkUT2V3csj/OH:YvXZ6eyN5KB882W/N2WkFNl2
TLSH
T1B41733927788987BC17D463A08738B6096433C59DAE2A71B3601371C6C772CD1FAEDAD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
Gl_Chrm.apk
unpack001/1_b7e404b6ec.mkv

File Explorer

Gl_Chrm.apk

.apk 18.8MB
1_b7e404b6ec.mkv

.apk 11.0MB

Gl_Chrm.apk

SHA256 640b074c2bc8c47930daaf3a20b9105b46523f0917373894ae6d7a6fe55426ce
MD5 f3bc51b8f56d90d2a0d163b9cf1b5e2f
SHA1 32a47f85fe9c5b9eed80e7a82d8387cc1168d8c5
SHA512 2112d64677293b47405d213797d8d75d7fa27882a733fa3cd61bf9b34d2dadf7f01cf58897d60f1582c1ea92e2e94c5c4a6bdb2be581b77f02b6818ff54354ea
SSDEEP 393216:/RavXZ6xIWh3sDNoTfnN53JyzHhXRCQ32WI8VN2WnkUT2V3csj/OH:YvXZ6eyN5KB882W/N2WkFNl2
TLSH
T1B41733927788987BC17D463A08738B6096433C59DAE2A71B3601371C6C772CD1FAEDAD
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

11e8fd4228822e47bdfed6ee692a45cf0cf87997b3f28efc15f391ca64ef4042f5c5a1ba66ecd8b8f37757baff3c1fa665d6d5c0998cf77f0e39088f1b2ae283

Digest Algorithm

sha512

Digest Matches

Trusted

Not trusted

Signer

CN=Phoenix Mobile Identity 5648,OU=DevOps-299,O=Iron Forge Inc,L=Leipzig,ST=Berlin,C=DE

File Signature issue

Digest

5b97e0a2f53a985af9b6f6788955b742fd70b131c2dbb1765b2c41b4283ed4b2

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,OU=Android,O=Unknown,L=Unknown,ST=Unknown,C=US

com.eqzupczpu.pufvysmbn

1_b7e404b6ec.mkv

SHA256 16ac49155d1ed38b1c65f7dd037e049263556e07e760d3a16d6810e7bf244d1f
MD5 8c678c0ec89077c16be4c6546e4d4ec2
SHA1 4544ee41ac541c1bfba85c26babac48d87642501
SHA512 1afda4b098468b1602f9cd480ce5635c782de076d64781c80ad9fe4e72d4fbbb76c3d51813c7ea15028b1a8a1c115bb542ee828640e87dde2629bd769799c10b
SSDEEP 196608:CFWNrsyN3RmtDNowUf/YnlITVr53BGhq7bL/Pm3zHhXRCQ002WI8JuqnN2fOiQPb:KWh3sDNoTfnN53JyzHhXRCQ32WI8VN2y
TLSH
T177C6333323148C7AE33A563E0C25D6D695423EEDDB20A3AF6512B34D783B6C41F9A535
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

a395104b9280f3def0f2250379f48ed5a98b50627251112629f0287ea298b10e7899a4b5a737fa66246383ee40415a285f9f8d462d10981edd20b5556032485a

Digest Algorithm

sha512

Digest Matches

Trusted

Not trusted

Signer

CN=Delta Integration Agent 4451,OU=Support-696,O=Fern Bridge Partners,L=Utrecht,ST=Utrecht,C=NL

File Signature issue

Digest

2b1e8b403745d01e07164c19a53f5cf33b2f43b2ad88bf9121e7fe03cedf36e5

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,OU=Android,O=Unknown,L=Unknown,ST=Unknown,C=US

com.bexearfpc.dfuxqmtej

com.airtouch.secure.receiver.BootReceiver

android.intent.action.BOOT_COMPLETED

com.airtouch.secure.receiver.LauncherRestoreReceiver

com.airtouch.secure.receiver.SmsStatusReceiver

com.airtouch.secure.receiver.IncomingSmsReceiver

android.provider.Telephony.SMS_RECEIVED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

Gl_Chrm.apk

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SCHEDULE_EXACT_ALARM

android.permission.QUERY_ALL_PACKAGES

android.permission.INTERNET

Gl_Chrm.apk

File Signature issue

File Signature issue

com.eqzupczpu.pufvysmbn.MainActivity

com.eqzupczpu.pufvysmbn.PopupActivity

com.eqzupczpu.pufvysmbn.PopupService

com.eqzupczpu.pufvysmbn.BlockerVpnService

com.eqzupczpu.pufvysmbn.BootReceiver

com.eqzupczpu.pufvysmbn.UnblockReceiver

androidx.startup.InitializationProvider

1_b7e404b6ec.mkv

File Signature issue

File Signature issue

com.airtouch.secure.LaunchActivity

com.airtouch.secure.AccessActivity

com.airtouch.secure.service.CoreSyncService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.airtouch.secure.receiver.BootReceiver

com.airtouch.secure.receiver.LauncherRestoreReceiver

com.airtouch.secure.receiver.SmsStatusReceiver

com.airtouch.secure.receiver.IncomingSmsReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Gl_Chrm.apk

File Signature issue

File Signature issue

com.eqzupczpu.pufvysmbn.MainActivity

com.eqzupczpu.pufvysmbn.PopupActivity

com.eqzupczpu.pufvysmbn.PopupService

com.eqzupczpu.pufvysmbn.BlockerVpnService

com.eqzupczpu.pufvysmbn.BootReceiver

com.eqzupczpu.pufvysmbn.UnblockReceiver

androidx.startup.InitializationProvider

1_b7e404b6ec.mkv

File Signature issue

File Signature issue

com.airtouch.secure.LaunchActivity

com.airtouch.secure.AccessActivity

com.airtouch.secure.service.CoreSyncService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.airtouch.secure.receiver.BootReceiver

com.airtouch.secure.receiver.LauncherRestoreReceiver

com.airtouch.secure.receiver.SmsStatusReceiver

com.airtouch.secure.receiver.IncomingSmsReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Android Permissions

Gl_Chrm.apk