copybara | db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c[.]apk

General

Target
db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk
Size 9.6MB
Sample260729-gvr46aysdy
SHA256 db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c
MD5 c95cd77f0a88b3f74a794d735f547e3b
SHA1 216414ab01a1fee5a056c3fb2fc167744002d5e6
SHA512 1e64ea334f24358dc52f7949d5e6da39b7018fcd6168c39ed1d7649548e22eab44c4dd37c932c40632fd065ffe048baf69d8b3f7065d2c1b1aa83475acf968e0
SSDEEP 196608:OjnYBnjbs1wWwPLCLH+QN4ut1eMS4pOvoQ8Y5QrlHDazK8zlv3FKzre3hmggk:ljo1xwPmLH+luHeF4pOvH8Y5Qrxa7JPN
TLSH
T18DA63382B3495F5AD9636E318D61925841322D1CCFA399177646B33C38FEED18F12FA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer copybara

Malware Config

Extracted

Family

copybara

C2

37.148.161.44

Signatures

Family: Copybara
Copybara is an Android banking trojan first seen in November 2021.
banker trojan infostealer copybara

Copybara payload 1 IoCs

resource	yara_rule
sample	family_copybara

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk

File Explorer

db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk

.apk 9.6MB

db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk

SHA256 db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c
MD5 c95cd77f0a88b3f74a794d735f547e3b
SHA1 216414ab01a1fee5a056c3fb2fc167744002d5e6
SHA512 1e64ea334f24358dc52f7949d5e6da39b7018fcd6168c39ed1d7649548e22eab44c4dd37c932c40632fd065ffe048baf69d8b3f7065d2c1b1aa83475acf968e0
SSDEEP 196608:OjnYBnjbs1wWwPLCLH+QN4ut1eMS4pOvoQ8Y5QrlHDazK8zlv3FKzre3hmggk:ljo1xwPmLH+luHeF4pOvH8Y5Qrxa7JPN
TLSH
T18DA63382B3495F5AD9636E318D61925841322D1CCFA399177646B33C38FEED18F12FA2
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Copybara payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

6407509a9fec6f5bdcba0092dc3ffe7e1ba12010fec065277d7d1ef9fc0614b5

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Wikimedia Foundation,OU=Mobile,O=Wikimedia Foundation,L=San Francisco,ST=California,C=US

com.oupplf.hjxwoz

Android Permissions

db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk

Permissions

android.permission.EXPAND_STATUS_BAR

android.permission.QUERY_ALL_PACKAGES

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WRITE_SETTINGS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.POST_NOTIFICATIONS

android.permission.READ_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.SYSTEM_ERROR_WINDOW

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CALL_PHONE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.ACCESS_NOTIFICATION_POLICY

com.android.alarm.permission.SET_ALARM

android.permission.USE_FULL_SCREEN_INTENT

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.FOREGROUND_SERVICE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk

File Signature issue

com.oupplf.hjxwoz.main

com.oupplf.hjxwoz.asdsawqe_sq

com.oupplf.hjxwoz.asdsda_edqwewq

com.oupplf.hjxwoz.dasdsa_edwqeq

com.oupplf.hjxwoz.dasdsa_wqewqfh

com.oupplf.hjxwoz.daskj_dasdsa_aa

com.oupplf.hjxwoz.ddsa_ewqiuewq

com.oupplf.hjxwoz.dsadas_dsadsa

com.oupplf.hjxwoz.dsadas_rewq

com.oupplf.hjxwoz.dsadsa_dsadsa

com.oupplf.hjxwoz.dsadsa_tytrpo

com.oupplf.hjxwoz.dsadwq_rewqwe

com.oupplf.hjxwoz.dsdsa_qweqwewq

com.oupplf.hjxwoz.forc_activateacc

com.oupplf.hjxwoz.gfdgfd_gewrtre

com.oupplf.hjxwoz.homescreen

com.oupplf.hjxwoz.perm_writesys

com.oupplf.hjxwoz.wakeupdv

com.evwj4rpg8h2o.b4a.objects.NotificationListenerWrapper

com.oupplf.hjxwoz.asdsa_retop

com.oupplf.hjxwoz.backgroundservice

com.oupplf.hjxwoz.dsadsoper_mnfg

com.oupplf.hjxwoz.dsda_reiwurew

com.oupplf.hjxwoz.dsdas_klfdgfd

com.oupplf.hjxwoz.dsdsaiuewq_wqwe

com.oupplf.hjxwoz.dtrsbnotisuntilactv

com.oupplf.hjxwoz.managerservice

com.oupplf.hjxwoz.mediaprojectionbackservice

com.oupplf.hjxwoz.notificationservice

com.oupplf.hjxwoz.service1

com.oupplf.hjxwoz.service2

com.oupplf.hjxwoz.service3

com.oupplf.hjxwoz.service4

com.oupplf.hjxwoz.starter

com.evwj4rpg8h2o.b4a.objects.AdminReceiver2

com.oupplf.hjxwoz.asdsa_retop$asdsa_retop_BR

com.oupplf.hjxwoz.backgroundservice$backgroundservice_BR

com.oupplf.hjxwoz.dsadsoper_mnfg$dsadsoper_mnfg_BR

com.oupplf.hjxwoz.dsda_reiwurew$dsda_reiwurew_BR

com.oupplf.hjxwoz.dsdas_klfdgfd$dsdas_klfdgfd_BR

com.oupplf.hjxwoz.dsdsaiuewq_wqwe$dsdsaiuewq_wqwe_BR

com.oupplf.hjxwoz.dtrsbnotisuntilactv$dtrsbnotisuntilactv_BR

com.oupplf.hjxwoz.managerservice$managerservice_BR

com.oupplf.hjxwoz.mediaprojectionbackservice$mediaprojectionbackservice_BR

com.oupplf.hjxwoz.myreceiver

com.oupplf.hjxwoz.notificationservice$notificationservice_BR

com.oupplf.hjxwoz.service1$service1_BR

com.oupplf.hjxwoz.service2$service2_BR

com.oupplf.hjxwoz.service3$service3_BR

com.oupplf.hjxwoz.service4$service4_BR

com.oupplf.hjxwoz.startatbootreceiver

com.oupplf.hjxwoz.starter$starter_BR

com.oupplf.hjxwoz.httputils2service

androidx.core.content.FileProvider

Android Permissions

db2c9949fae4e779f1d988d38b67ed9b3612dbf11c1159c791093aeef9cdab2c.apk