464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a.zip
- SHA256 8093d23b925b91d07b79b5e36f5fd8ce67070f660929f1077cfcf51085f5b375
Password
infected
Behavioral task
behavioral1
Sample
base.apk
0 signatures
900 seconds
General
- Target 464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a.zip
- Size 11.9MB
- Sample260729-lnpgxadn3w
- SHA256 8093d23b925b91d07b79b5e36f5fd8ce67070f660929f1077cfcf51085f5b375
- MD5 5fab577863bc4514c202a42489eea5e4
- SHA1 1e4f660c991de2cfe11a65495b16f91bafc89217
- SHA512 8ea9594ef245d8775e547fe0b9ca05052a06a424ccd49259454897eb127b5f1ab215dcb5d3bb64819d4b28b007ef9ac6d31491bee4cf85c5f475f7837ffc92bf
- SSDEEP 196608:+ZT2UYXXJ6xVujbvn5rXJviWLplsU4USx7ipdl+qXrHpEmZl7sRhQ56+SDmJ:+bNqjbv57RiWLpls3976dHrZl7sU3
- TLSH T1E3C6332C772939D55B92A2673963BBF326BF06443F08AF4185C93D47A2C9BE7F14410A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Extracted
Family
-
copybara
C2
-
37.148.161.44
Signatures
- Family: Copybara
Copybara is an Android banking trojan first seen in November 2021.
- Copybara payload 1 IoCs
resource yara_rule static1/unpack002/base.apk family_copybara - Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis
- Declares broadcast receivers with permission to handle system events 1 IoCs
description ioc Required by device admin receivers to bind with the system. Allows apps to manage device administration features. android.permission.BIND_DEVICE_ADMIN - Declares services with permission to bind to the system 1 IoCs
description ioc Required by VPN services to bind with the system. Allows apps to provision VPN services. android.permission.BIND_VPN_SERVICE - Requests dangerous framework permissions 2 IoCs
description ioc Allows an application to request installing packages. android.permission.REQUEST_INSTALL_PACKAGES Allows an app to post notifications. android.permission.POST_NOTIFICATIONS - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a.apk unpack002/base.apk
File Explorer
-
464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a.zip.zip 11.9MB
-
464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a.apk.apk 12.1MB
-
base.apk.apk 8.9MB
464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a.apk
- SHA256 464fee5a6d85370e8764f0e682ef01cf2d9cef3efb7e4bbdf0146a94cc83ff4a
- MD5 298a6d3c18508b7ccab7fde444ddab1c
- SHA1 91320edbb7598d36729ce90ad7f948592d192c53
- SHA512 e42fecc0797ce4027714f8f60487f376330aecb10c3a884258c4518f0d2ad59f1dc4b481d77aacaf9dc696ee16dc98110284ec071943f63702f9186be755c50a
- SSDEEP 393216:G22Cv1A9+RJmJdOtyr+rKqe1Pt/QKwn5hu8:X2CvOFn+uPyh7P
- TLSH T1EDD633061E07F9D5C2B14C73ECC294788CD12F4446CBE4549DAEE9DA28BEBB5D22CB58
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
File Signature issue
Digest
c838fba708394aa664bbf297accc4a7d7e27b573e8258026b9e8d02fd0ff6167
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=np,OU=np,O=np,L=南京,ST=江苏,C=中国
Subject
CN=np,OU=np,O=np,L=南京,ST=江苏,C=中国
Serial Number
04:5f:f9:a3
Issuer
CN=np,OU=np,O=np,L=南京,ST=江苏,C=中国
Timespan
Apr 25, 2021 - Aug 26, 3020
io.smart.evolve
io.smart.evolve.MainActivity
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.INTERNET
android.permission.FOREGROUND_SERVICE
android.permission.POST_NOTIFICATIONS
android.permission.FOREGROUND_SERVICE_DATA_SYNC
io.smart.evolve.MainActivity
android.intent.action.MAIN
io.smart.evolve.InstallerActivity
io.smart.evolve.PermissionObserverService
io.smart.evolve.InternetBlockVpnService
android.net.VpnService
io.smart.evolve.InstallationReceiver
base.apk
- SHA256 7cf365d61e59d5c3dd50295b1d5a0c360da9eba1b4dc00cdc0f1ceee4a5cc412
- MD5 e792fedfd11d56a9ad68e6d407b9a09e
- SHA1 98a5527529198994d91d98e2e51bdd33f4e2a672
- SHA512 a48cece6af266c449ae0a96a663a6bee844054058059df725f2d33a1551aad0033250aa52cd051f4bd8ee9db435bf888da3dcbe6caf26aa908a7779862ba20d5
- SSDEEP 196608:3k0xB/r1wWwPLCLH+QN4ut1eMSCiYfEWNFFimfgSS9NZlJLXCCpmvwmaf:7X1xwPmLH+luHeFgMWNrTgNtPvmvwDf
- TLSH T12796330AB742AB17E17316749D7241DD017A6D18CF575213B6A2323C38F9FC08F6AE9A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Copybara payload
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
File Signature issue
Digest
cd32d4b53bf5c56640f445328363291723709e169c3847a3dc56e4362fa72094
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=Wikimedia Foundation,OU=Mobile,O=Wikimedia Foundation,L=San Francisco,ST=California,C=US
Subject
CN=Wikimedia Foundation,OU=Mobile,O=Wikimedia Foundation,L=San Francisco,ST=California,C=US
Serial Number
57:16:e1:95
Issuer
CN=Wikimedia Foundation,OU=Mobile,O=Wikimedia Foundation,L=San Francisco,ST=California,C=US
Timespan
Aug 11, 2015 - Aug 11, 2115
com.upy2dl.ptroa5
com.upy2dl.ptroa5.main
android.permission.EXPAND_STATUS_BAR
android.permission.QUERY_ALL_PACKAGES
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_PHONE_STATE
android.permission.WRITE_SETTINGS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.INTERNET
android.permission.WAKE_LOCK
android.permission.VIBRATE
android.permission.POST_NOTIFICATIONS
android.permission.READ_PHONE_STATE
android.permission.SYSTEM_ALERT_WINDOW
android.permission.SYSTEM_ERROR_WINDOW
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.CALL_PHONE
android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.FOREGROUND_SERVICE
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK
android.permission.ACCESS_NOTIFICATION_POLICY
com.android.alarm.permission.SET_ALARM
android.permission.USE_FULL_SCREEN_INTENT
android.permission.READ_EXTERNAL_STORAGE
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACTION_MANAGE_OVERLAY_PERMISSION
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.FOREGROUND_SERVICE_LOCATION
android.permission.ACCESS_BACKGROUND_LOCATION
com.upy2dl.ptroa5.main
android.intent.action.MAIN
android.intent.action.SEND
android.intent.action.SENDTO
com.upy2dl.ptroa5.asdsawqe_sq
com.upy2dl.ptroa5.asdsda_edqwewq
com.upy2dl.ptroa5.dasdsa_edwqeq
com.upy2dl.ptroa5.dasdsa_wqewqfh
com.upy2dl.ptroa5.daskj_dasdsa_aa
com.upy2dl.ptroa5.ddsa_ewqiuewq
com.upy2dl.ptroa5.dsadas_dsadsa
com.upy2dl.ptroa5.dsadas_rewq
com.upy2dl.ptroa5.dsadsa_dsadsa
com.upy2dl.ptroa5.dsadsa_tytrpo
com.upy2dl.ptroa5.dsadwq_rewqwe
com.upy2dl.ptroa5.dsdsa_qweqwewq
com.upy2dl.ptroa5.forc_activateacc
com.upy2dl.ptroa5.gfdgfd_gewrtre
com.upy2dl.ptroa5.homescreen
com.upy2dl.ptroa5.perm_writesys
com.upy2dl.ptroa5.wakeupdv
com.dz1pk2moyr33.b4a.objects.NotificationListenerWrapper
android.service.notification.NotificationListenerService
com.upy2dl.ptroa5.asdsa_retop
com.upy2dl.ptroa5.backgroundservice
android.accessibilityservice.AccessibilityService
com.upy2dl.ptroa5.dsadsoper_mnfg
com.upy2dl.ptroa5.dsda_reiwurew
com.upy2dl.ptroa5.dsdas_klfdgfd
com.upy2dl.ptroa5.dsdsaiuewq_wqwe
com.upy2dl.ptroa5.dtrsbnotisuntilactv
com.upy2dl.ptroa5.managerservice
com.upy2dl.ptroa5.mediaprojectionbackservice
com.upy2dl.ptroa5.notificationservice
com.upy2dl.ptroa5.service1
com.upy2dl.ptroa5.service2
com.upy2dl.ptroa5.service3
android.intent.action.RESPOND_VIA_MESSAGE
com.upy2dl.ptroa5.service4
com.upy2dl.ptroa5.starter
com.dz1pk2moyr33.b4a.objects.AdminReceiver2
android.app.action.DEVICE_ADMIN_ENABLED
com.upy2dl.ptroa5.asdsa_retop$asdsa_retop_BR
com.upy2dl.ptroa5.backgroundservice$backgroundservice_BR
com.upy2dl.ptroa5.dsadsoper_mnfg$dsadsoper_mnfg_BR
android.provider.Telephony.SMS_RECEIVED
com.upy2dl.ptroa5.dsda_reiwurew$dsda_reiwurew_BR
com.upy2dl.ptroa5.dsdas_klfdgfd$dsdas_klfdgfd_BR
com.upy2dl.ptroa5.dsdsaiuewq_wqwe$dsdsaiuewq_wqwe_BR
com.upy2dl.ptroa5.dtrsbnotisuntilactv$dtrsbnotisuntilactv_BR
com.upy2dl.ptroa5.managerservice$managerservice_BR
com.upy2dl.ptroa5.mediaprojectionbackservice$mediaprojectionbackservice_BR
com.upy2dl.ptroa5.myreceiver
com.upy2dl.ptroa5.notificationservice$notificationservice_BR
android.intent.action.BOOT_COMPLETED
com.upy2dl.ptroa5.service1$service1_BR
android.provider.Telephony.SMS_DELIVER
com.upy2dl.ptroa5.service2$service2_BR
android.provider.Telephony.WAP_PUSH_DELIVER
com.upy2dl.ptroa5.service3$service3_BR
com.upy2dl.ptroa5.service4$service4_BR
com.upy2dl.ptroa5.startatbootreceiver
android.intent.action.BOOT_COMPLETED