slocker | 5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e[.]zip

General

Target
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip
Size 2.5MB
Sample260808-b7739abb39
SHA256 eadeb5533df2a0ff79daf78bbc0a09f7874f2f1e5ddde8aa6341656775bdd3da
MD5 bee2fe221cf903759b2b6dd976b246df
SHA1 cb53d1eb3b0608be8082b6de62f820c2996ccc3b
SHA512 08cd3af2387bae49c0e08a1becb38d8e8950abf78ebea40fed8b17bd8c783f6e9eecf5c2f0724c0d8f95101bab37db8acfcbbc51733a968865a3668217db3938
SSDEEP 49152:maOaZo6X+1NkSZKzpsCV3SnHViY61JSz29wj8CaCNxO:ma9ZoA8ZZCV3SHViYqZVCg
TLSH
T152C53343852E01E79165DE8DFE183871FF651B80D24066AFFF2F61E2A1BCEA79054722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

ransomware slocker

Malware Config

Signatures

Family: SLocker
SLocker is an Android ransomware that locks victim screens and encrypts files.
ransomware slocker

SLocker payload 1 IoCs

resource	yara_rule
static1/unpack001/5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk	family_slocker_1

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk

File Explorer

5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip

.zip 2.5MB
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk

.apk 2.7MB

5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip

SHA256 eadeb5533df2a0ff79daf78bbc0a09f7874f2f1e5ddde8aa6341656775bdd3da
MD5 bee2fe221cf903759b2b6dd976b246df
SHA1 cb53d1eb3b0608be8082b6de62f820c2996ccc3b
SHA512 08cd3af2387bae49c0e08a1becb38d8e8950abf78ebea40fed8b17bd8c783f6e9eecf5c2f0724c0d8f95101bab37db8acfcbbc51733a968865a3668217db3938
SSDEEP 49152:maOaZo6X+1NkSZKzpsCV3SnHViY61JSz29wj8CaCNxO:ma9ZoA8ZZCV3SHViYqZVCg
TLSH
T152C53343852E01E79165DE8DFE183871FF651B80D24066AFFF2F61E2A1BCEA79054722
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk

SHA256 5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e
MD5 2ddbc785cd696041c5b0c3bd1a8af552
SHA1 1269636a5197ee7a1402e406c91177bf6a149652
SHA512 30e3187fa0c65981ae80f0bfae4ac753020ceb591d9c001a809040fac08795ab2cb04d9a95645a025d15008c4057f14a84826bec86b75453f389ac52d9b8a1e5
SSDEEP 49152:VPctdtUtD6iJjM2M7xZkQPctdtUtD6yJjM2M7xZkpPctdtUtD62JjM2M7xZknJjj:VP04D6ojkxlP04D64jkx4P04D6sjkxin
TLSH
T18CD51215CA63FCD0DD4A8171B8EF4FDD6A9104E28AF162374672712D7CA35381AEB70A
MD5 SHA1 SHA512 SSDEEP TLSH

android

SLocker payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

c1a26155de682574d893384a8b6b085c18821046b82231b1f7fd604bcd897fc1

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

C=debugging

com.XPhantom.id

5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip

5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk

File Signature issue

com.XPhantom.id.MainActivity

com.XPhantom.id.MyService

com.XPhantom.id.BootReceiver

Sharing

General

Malware Config

Signatures

File Explorer

5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip

5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk

File Signature issue

com.XPhantom.id.MainActivity

com.XPhantom.id.MyService

com.XPhantom.id.BootReceiver