copybara | 7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412[.]apk

General

Target
7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk
Size 8.9MB
Sample260729-gvtmzsysdz
SHA256 7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412
MD5 e792fedfd11d56a9ad68e6d407b9a09e
SHA1 98a5527529198994d91d98e2e51bdd33f4e2a672
SHA512 a48cece6af266c449ae0a96a663a6bee844054058059df725f2d33a1551aad0033250aa52cd051f4bd8ee9db435bf888da3dcbe6caf26aa908a7779862ba20d5
SSDEEP 196608:3k0xB/r1wWwPLCLH+QN4ut1eMSCiYfEWNFFimfgSS9NZlJLXCCpmvwmaf:7X1xwPmLH+luHeFgMWNrTgNtPvmvwDf
TLSH
T12796330AB742AB17E17316749D7241DD017A6D18CF575213B6A2323C38F9FC08F6AE9A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

banker trojan infostealer copybara

Malware Config

Extracted

Family

copybara

C2

37.148.161.44

Signatures

Family: Copybara
Copybara is an Android banking trojan first seen in November 2021.
banker trojan infostealer copybara

Copybara payload 1 IoCs

resource	yara_rule
sample	family_copybara

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk

File Explorer

7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk

.apk 8.9MB

7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk

SHA256 7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412
MD5 e792fedfd11d56a9ad68e6d407b9a09e
SHA1 98a5527529198994d91d98e2e51bdd33f4e2a672
SHA512 a48cece6af266c449ae0a96a663a6bee844054058059df725f2d33a1551aad0033250aa52cd051f4bd8ee9db435bf888da3dcbe6caf26aa908a7779862ba20d5
SSDEEP 196608:3k0xB/r1wWwPLCLH+QN4ut1eMSCiYfEWNFFimfgSS9NZlJLXCCpmvwmaf:7X1xwPmLH+luHeFgMWNrTgNtPvmvwDf
TLSH
T12796330AB742AB17E17316749D7241DD017A6D18CF575213B6A2323C38F9FC08F6AE9A
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Copybara payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

cd32d4b53bf5c56640f445328363291723709e169c3847a3dc56e4362fa72094

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Wikimedia Foundation,OU=Mobile,O=Wikimedia Foundation,L=San Francisco,ST=California,C=US

com.upy2dl.ptroa5

Android Permissions

7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk

Permissions

android.permission.EXPAND_STATUS_BAR

android.permission.QUERY_ALL_PACKAGES

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_PHONE_STATE

android.permission.WRITE_SETTINGS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.POST_NOTIFICATIONS

android.permission.READ_PHONE_STATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.SYSTEM_ERROR_WINDOW

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CALL_PHONE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.ACCESS_NOTIFICATION_POLICY

com.android.alarm.permission.SET_ALARM

android.permission.USE_FULL_SCREEN_INTENT

android.permission.READ_EXTERNAL_STORAGE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.FOREGROUND_SERVICE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

Resubmissions

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk

File Signature issue

com.upy2dl.ptroa5.main

com.upy2dl.ptroa5.asdsawqe_sq

com.upy2dl.ptroa5.asdsda_edqwewq

com.upy2dl.ptroa5.dasdsa_edwqeq

com.upy2dl.ptroa5.dasdsa_wqewqfh

com.upy2dl.ptroa5.daskj_dasdsa_aa

com.upy2dl.ptroa5.ddsa_ewqiuewq

com.upy2dl.ptroa5.dsadas_dsadsa

com.upy2dl.ptroa5.dsadas_rewq

com.upy2dl.ptroa5.dsadsa_dsadsa

com.upy2dl.ptroa5.dsadsa_tytrpo

com.upy2dl.ptroa5.dsadwq_rewqwe

com.upy2dl.ptroa5.dsdsa_qweqwewq

com.upy2dl.ptroa5.forc_activateacc

com.upy2dl.ptroa5.gfdgfd_gewrtre

com.upy2dl.ptroa5.homescreen

com.upy2dl.ptroa5.perm_writesys

com.upy2dl.ptroa5.wakeupdv

com.dz1pk2moyr33.b4a.objects.NotificationListenerWrapper

com.upy2dl.ptroa5.asdsa_retop

com.upy2dl.ptroa5.backgroundservice

com.upy2dl.ptroa5.dsadsoper_mnfg

com.upy2dl.ptroa5.dsda_reiwurew

com.upy2dl.ptroa5.dsdas_klfdgfd

com.upy2dl.ptroa5.dsdsaiuewq_wqwe

com.upy2dl.ptroa5.dtrsbnotisuntilactv

com.upy2dl.ptroa5.managerservice

com.upy2dl.ptroa5.mediaprojectionbackservice

com.upy2dl.ptroa5.notificationservice

com.upy2dl.ptroa5.service1

com.upy2dl.ptroa5.service2

com.upy2dl.ptroa5.service3

com.upy2dl.ptroa5.service4

com.upy2dl.ptroa5.starter

com.dz1pk2moyr33.b4a.objects.AdminReceiver2

com.upy2dl.ptroa5.asdsa_retop$asdsa_retop_BR

com.upy2dl.ptroa5.backgroundservice$backgroundservice_BR

com.upy2dl.ptroa5.dsadsoper_mnfg$dsadsoper_mnfg_BR

com.upy2dl.ptroa5.dsda_reiwurew$dsda_reiwurew_BR

com.upy2dl.ptroa5.dsdas_klfdgfd$dsdas_klfdgfd_BR

com.upy2dl.ptroa5.dsdsaiuewq_wqwe$dsdsaiuewq_wqwe_BR

com.upy2dl.ptroa5.dtrsbnotisuntilactv$dtrsbnotisuntilactv_BR

com.upy2dl.ptroa5.managerservice$managerservice_BR

com.upy2dl.ptroa5.mediaprojectionbackservice$mediaprojectionbackservice_BR

com.upy2dl.ptroa5.myreceiver

com.upy2dl.ptroa5.notificationservice$notificationservice_BR

com.upy2dl.ptroa5.service1$service1_BR

com.upy2dl.ptroa5.service2$service2_BR

com.upy2dl.ptroa5.service3$service3_BR

com.upy2dl.ptroa5.service4$service4_BR

com.upy2dl.ptroa5.startatbootreceiver

com.upy2dl.ptroa5.starter$starter_BR

com.upy2dl.ptroa5.httputils2service

androidx.core.content.FileProvider

Android Permissions

7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412.apk