app[.]apk | Triage™

General

Target
app.apk
Size 48.7MB
Sample260729-ll84jadm8w
SHA256 27bedbbb5ac5e690e020b1992929806932069ed344b9eff4f3001d667cc042de
MD5 ef6b2212e2c246a69e35a1e8d7f86b26
SHA1 a79eb6f9c496f83721efc9b7905719b1c455f210
SHA512 7136e55f385e538a2e2e3ac489056cc37b8c42b71e5c2c3ce25d648f3201b2ac698ee295f14b04668f4101852ff6273b95b82268a40ff3a10d303c1d67bd6383
SSDEEP 393216:Uf/RgBqRZUi1aWbWjsKono5bpWu8qYsuatIvMFl3v2iPMKzNhd0V2G8hf1/Air4v:Uf/Rg2/WjRIPuLffpPNNnrQQYRlqq3Ko
TLSH
T196B7E002F6155078F97AEC74825E9432E92C3C4D8223926B2F9D7A14B7377E09F2DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
app.apk

File Explorer

app.apk

.apk 48.7MB

app.apk

SHA256 27bedbbb5ac5e690e020b1992929806932069ed344b9eff4f3001d667cc042de
MD5 ef6b2212e2c246a69e35a1e8d7f86b26
SHA1 a79eb6f9c496f83721efc9b7905719b1c455f210
SHA512 7136e55f385e538a2e2e3ac489056cc37b8c42b71e5c2c3ce25d648f3201b2ac698ee295f14b04668f4101852ff6273b95b82268a40ff3a10d303c1d67bd6383
SSDEEP 393216:Uf/RgBqRZUi1aWbWjsKono5bpWu8qYsuatIvMFl3v2iPMKzNhd0V2G8hf1/Air4v:Uf/Rg2/WjRIPuLffpPNNnrQQYRlqq3Ko
TLSH
T196B7E002F6155078F97AEC74825E9432E92C3C4D8223926B2F9D7A14B7377E09F2DB91
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

02d8ec86a5840aa2e61568d02b1d707d2d13d456fba2c655831880c02b3341b9

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=USM,OU=USM,O=USM,L=Unknown,ST=Unknown,C=US

com.tradenation.app

Android Permissions

app.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.RECORD_AUDIO

android.permission.CAMERA

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_PHONE_CALL

android.permission.FOREGROUND_SERVICE_MICROPHONE

android.permission.WAKE_LOCK

android.permission.MANAGE_OWN_CALLS

android.permission.POST_NOTIFICATIONS

android.permission.USE_FULL_SCREEN_INTENT

android.permission.SYSTEM_ALERT_WINDOW

com.google.android.c2dm.permission.RECEIVE

com.tradenation.app.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

app.apk

File Signature issue

com.tradenation.app.MainActivity

com.tradenation.app.IncomingCallActivity

com.tradenation.app.CallAnswerActionActivity

com.tradenation.app.NativeCallActivity

com.google.android.gms.common.api.GoogleApiActivity

com.tradenation.app.ScreenCaptureService

com.tradenation.app.CallForegroundService

com.tradenation.app.CallSessionService

com.tradenation.app.RemotePointerOverlayService

com.tradenation.app.TradeConnectionService

com.tradenation.app.TradeMessagingService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.tradenation.app.CallNotificationDismissReceiver

com.tradenation.app.CallAnswerActionReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

app.apk

File Signature issue

com.tradenation.app.MainActivity

com.tradenation.app.IncomingCallActivity

com.tradenation.app.CallAnswerActionActivity

com.tradenation.app.NativeCallActivity

com.google.android.gms.common.api.GoogleApiActivity

com.tradenation.app.ScreenCaptureService

com.tradenation.app.CallForegroundService

com.tradenation.app.CallSessionService

com.tradenation.app.RemotePointerOverlayService

com.tradenation.app.TradeConnectionService

com.tradenation.app.TradeMessagingService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.tradenation.app.CallNotificationDismissReceiver

com.tradenation.app.CallAnswerActionReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

Android Permissions

app.apk