4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9

Sharing

Copy URL Twitter E-mail

General

Target
4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9
Size 16.6MB
Sample260808-earlsazbpg
SHA256 4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9
MD5 0ef3e53ce3d70fffb46045a6616eef2a
SHA1 44cb71b1c453585a07dcca99d99e7bfda0d2b6cc
SHA512 ef42c9a79255fbe653f9b6ff0ede5b6d575c9a67ddfeed922cafdf784a5d7e0a4b70f25233acfc6a93ba3cc729dcee18b059dc80bf566ab993aa2dcf00516e07
SSDEEP 393216:YvZ7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRyVmDmWje80vksqu9mms:kFhPYLe91Ne7NQci7KWCXs
TLSH
T103072311E7A97A87E831903A4656FB3075866C686B02D682791C33FC3B737F04B6A3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 21 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read the user's calendar data.	android.permission.READ_CALENDAR
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Required to be able to advertise to nearby Bluetooth devices.	android.permission.BLUETOOTH_ADVERTISE
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Required to be able to discover and pair nearby Bluetooth devices.	android.permission.BLUETOOTH_SCAN
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9

File Explorer

4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9

.apk 16.6MB

4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9

SHA256 4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9
MD5 0ef3e53ce3d70fffb46045a6616eef2a
SHA1 44cb71b1c453585a07dcca99d99e7bfda0d2b6cc
SHA512 ef42c9a79255fbe653f9b6ff0ede5b6d575c9a67ddfeed922cafdf784a5d7e0a4b70f25233acfc6a93ba3cc729dcee18b059dc80bf566ab993aa2dcf00516e07
SSDEEP 393216:YvZ7YwPwVJAVTFXu9e91NVhJcn7NQr4yVRyVmDmWje80vksqu9mms:kFhPYLe91Ne7NQci7KWCXs
TLSH
T103072311E7A97A87E831903A4656FB3075866C686B02D682791C33FC3B737F04B6A3D5
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

14013a89313e346cb3ce5fcff9c4ef11781a0eefdb8c5de7ad82b79b8c356e1a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=John Mcain,OU=IT,O=liupait,L=Atlanta,ST=Georgia,C=US

com.liupait.tracero

android.permission.CHANGE_WIFI_STATE android.permission.INTERNET android.permission.WRITE_EXTERNAL_STORAGE android.permission.READ_PHONE_STATE android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.ACCESS_COARSE_LOCATION android.permission.MANAGE_ACCOUNTS android.permission.POST_NOTIFICATIONS android.permission.READ_CALENDAR android.permission.RECORD_AUDIO android.permission.READ_EXTERNAL_STORAGE android.permission.FOREGROUND_SERVICE_DATA_SYNC android.permission.FOREGROUND_SERVICE_LOCATION android.permission.FOREGROUND_SERVICE_CAMERA android.permission.FOREGROUND_SERVICE_MICROPHONE android.permission.ACCESS_BACKGROUND_LOCATION android.permission.WRITE_CALL_LOG android.permission.READ_CALL_LOG android.permission.MODIFY_AUDIO_SETTINGS android.permission.READ_CONTACTS android.permission.ACCESS_FINE_LOCATION android.permission.RECEIVE_BOOT_COMPLETED android.permission.CAMERA android.permission.BLUETOOTH android.permission.USE_FULL_SCREEN_INTENT android.permission.ACCESS_NETWORK_STATE android.permission.KILL_BACKGROUND_PROCESSES android.hardware.camera.autofocus android.permission.GET_TASKS android.permission.PROCESS_OUTGOING_CALLS android.permission.FOREGROUND_SERVICE android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION android.permission.BLUETOOTH_ADMIN android.permission.BLUETOOTH_ADVERTISE android.permission.BLUETOOTH_CONNECT android.permission.BLUETOOTH_SCAN android.permission.WAKE_LOCK android.permission.FLASHLIGHT android.permission.BROADCAST_STICKY android.permission.ACCESS_WIFI_STATE android.permission.VOICE_COMMUNICATION android.permission.CAMCORDER android.permission.MANAGE_EXTERNAL_STORAGE android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_VIDEO android.permission.ACCESS_RESTRICTED_SETTINGS android.permission.PACKAGE_USAGE_STATS com.google.android.c2dm.permission.RECEIVE

com.liupait.tracero.services.RemoteRecordingService

com.liupait.tracero.services.AlarmService

com.liupait.tracero.ServerCommunicate

com.liupait.tracero.SetupObserver

com.liupait.tracero.services.InitAddPhoneService

com.liupait.tracero.services.CallRecordingService

com.liupait.tracero.LocationSave

com.liupait.tracero.GetSettings

com.liupait.tracero.services.SocialMediaCall

com.liupait.tracero.services.TrackLocation

com.liupait.tracero.services.TakePicApi21

com.liupait.tracero.services.MyNotificationListener

android.service.notification.NotificationListenerService

com.liupait.tracero.services.StreamService

com.liupait.tracero.services.FileManagerUploadFile

com.liupait.tracero.services.MyAccessibilityService

android.accessibilityservice.AccessibilityService

com.liupait.tracero.services.CommunicationWakefulService

com.liupait.tracero.receivers.MyFirebaseInstanceIDService

com.google.firebase.INSTANCE_ID_EVENT

com.liupait.tracero.services.MyWorkerServerCom

com.liupait.tracero.services.MyFirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.liupait.tracero.UltraComponent_mvziuhptaawqsgsnpxpr

com.liupait.tracero.UltraComponent_odlerohpyfjsnumxeoqf

com.liupait.tracero.UltraComponent_rvchobogqkpzmxelusdq

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.components.ComponentDiscoveryService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

androidx.room.MultiInstanceInvalidationService

com.liupait.tracero.MySetupBoot

android.intent.action.BOOT_COMPLETED android.intent.action.REBOOT android.intent.action.ACTION_BOOT_COMPLETED android.intent.action.ACTION_SHUTDOWN android.intent.action.QUICKBOOT_POWEROFF android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWEROFF com.htc.intent.action.QUICKBOOT_POWERON

com.liupait.tracero.ChangedRingerMode

android.media.RINGER_MODE_CHANGED android.media.VIBRATE_SETTING_CHANGED

com.liupait.tracero.PhoneCallReceiver

android.intent.action.PHONE_STATE android.intent.action.NEW_OUTGOING_CALL

com.liupait.tracero.ScreenChancedReceiver

android.intent.action.USER_PRESENT android.intent.action.SCREEN_ON android.intent.action.SCREEN_OFF

com.liupait.tracero.MyNetworkChangeReceiver

android.net.conn.CONNECTIVITY_CHANGE android.net.wifi.WIFI_STATE_CHANGED

com.liupait.tracero.PackageChangeReceiver

android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_REMOVED

com.liupait.tracero.DeviceAdminSampleReceiver

android.app.action.DEVICE_ADMIN_ENABLED android.app.action.DEVICE_ADMIN_DISABLE_REQUESTED android.app.action.DEVICE_ADMIN_DISABLED

com.liupait.tracero.CalendarChangedReceiver

android.intent.action.PROVIDER_CHANGED

com.liupait.tracero.receivers.StopInternet

com.liupait.tracero.receivers.RestartCom

com.liupait.tracero.receivers.SecretCodeReceiver

android.provider.Telephony.SECRET_CODE

com.liupait.tracero.receivers.CloseWifi

com.liupait.tracero.receivers.StartGps

com.liupait.tracero.receivers.RestartObserver

com.liupait.tracero.receivers.RunClassSettings

com.liupait.tracero.receivers.CloseInternetAndGps

com.liupait.tracero.receivers.StopRecord

com.liupait.tracero.AlarmReceiver

com.liupait.tracero.other.Rec_other

com.liupait.tracero.receivers.MyPlugInControlReceiver

android.intent.action.ACTION_POWER_CONNECTED

com.liupait.tracero.receivers.MySystemCalls

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

com.liupait.tracero.UltraComponent_hteingzruldtzlpwkafc

com.liupait.tracero.UltraComponent_nnmgohqibbomtewmsvhd

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9

Permissions

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_PHONE_STATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.ACCESS_COARSE_LOCATION

android.permission.MANAGE_ACCOUNTS

android.permission.POST_NOTIFICATIONS

android.permission.READ_CALENDAR

android.permission.RECORD_AUDIO

android.permission.READ_EXTERNAL_STORAGE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_LOCATION

android.permission.FOREGROUND_SERVICE_CAMERA

android.permission.FOREGROUND_SERVICE_MICROPHONE

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.WRITE_CALL_LOG

android.permission.READ_CALL_LOG

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.READ_CONTACTS

android.permission.ACCESS_FINE_LOCATION

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.CAMERA

android.permission.BLUETOOTH

android.permission.USE_FULL_SCREEN_INTENT

android.permission.ACCESS_NETWORK_STATE

android.permission.KILL_BACKGROUND_PROCESSES

android.hardware.camera.autofocus

android.permission.GET_TASKS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.BLUETOOTH_ADMIN

android.permission.BLUETOOTH_ADVERTISE

android.permission.BLUETOOTH_CONNECT

android.permission.BLUETOOTH_SCAN

android.permission.WAKE_LOCK

android.permission.FLASHLIGHT

android.permission.BROADCAST_STICKY

android.permission.ACCESS_WIFI_STATE

android.permission.VOICE_COMMUNICATION

android.permission.CAMCORDER

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.ACCESS_RESTRICTED_SETTINGS

android.permission.PACKAGE_USAGE_STATS

com.google.android.c2dm.permission.RECEIVE

Sharing

General

Malware Config

Signatures

File Explorer

4fa67785f97e9ba1934b198ed1b0e451c1f7f52822e8a27c96e398631aaa2ba9

File Signature issue

com.liupait.tracero.MainActivity

com.liupait.tracero.RelaunchActivity

com.liupait.tracero.CheckWarnings

com.liupait.tracero.activities.EnableAccesibilityAccess

com.liupait.tracero.BlockAct

com.liupait.tracero.activities.AllowExternalStorage

com.liupait.tracero.AdministratorRightsAdmin

com.liupait.tracero.activities.DisableNotification

com.liupait.tracero.other.Actv_other

com.liupait.tracero.activities.DisableNotificationOld

com.liupait.tracero.activities.PhoneAlreadyRegistered

com.liupait.tracero.activities.ThankYouForRegistering

com.liupait.tracero.activities.EnableNotificationAccess

com.liupait.tracero.activities.Act1

com.liupait.tracero.UltraComponent_nnyghiinggdrawmcheyp

com.liupait.tracero.UltraComponent_cpvxmhqamqrctadzfngm

com.liupait.tracero.UltraComponent_vzbbkvpbtskiiihlmusg

com.liupait.tracero.UltraComponent_veiivkswzjtovgewxozo

org.appspot.apprtc.ui.SettingsActivity

com.liupait.tracero.services.RemoteRecordingService

com.liupait.tracero.services.AlarmService

com.liupait.tracero.ServerCommunicate

com.liupait.tracero.SetupObserver

com.liupait.tracero.services.InitAddPhoneService

com.liupait.tracero.services.CallRecordingService

com.liupait.tracero.LocationSave

com.liupait.tracero.GetSettings

com.liupait.tracero.services.SocialMediaCall

com.liupait.tracero.services.TrackLocation

com.liupait.tracero.services.TakePicApi21

com.liupait.tracero.services.MyNotificationListener

com.liupait.tracero.services.StreamService

com.liupait.tracero.services.FileManagerUploadFile

com.liupait.tracero.services.MyAccessibilityService

com.liupait.tracero.services.CommunicationWakefulService

com.liupait.tracero.receivers.MyFirebaseInstanceIDService

com.liupait.tracero.services.MyWorkerServerCom

com.liupait.tracero.services.MyFirebaseMessagingService

com.liupait.tracero.UltraComponent_mvziuhptaawqsgsnpxpr

com.liupait.tracero.UltraComponent_odlerohpyfjsnumxeoqf

com.liupait.tracero.UltraComponent_rvchobogqkpzmxelusdq

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

androidx.room.MultiInstanceInvalidationService

com.liupait.tracero.MySetupBoot

com.liupait.tracero.ChangedRingerMode

com.liupait.tracero.PhoneCallReceiver

com.liupait.tracero.ScreenChancedReceiver

com.liupait.tracero.MyNetworkChangeReceiver

com.liupait.tracero.PackageChangeReceiver

com.liupait.tracero.DeviceAdminSampleReceiver

com.liupait.tracero.CalendarChangedReceiver

com.liupait.tracero.receivers.StopInternet

com.liupait.tracero.receivers.RestartCom

com.liupait.tracero.receivers.SecretCodeReceiver

com.liupait.tracero.receivers.CloseWifi

com.liupait.tracero.receivers.StartGps

com.liupait.tracero.receivers.RestartObserver

com.liupait.tracero.receivers.RunClassSettings

com.liupait.tracero.receivers.CloseInternetAndGps

com.liupait.tracero.receivers.StopRecord

com.liupait.tracero.AlarmReceiver

com.liupait.tracero.other.Rec_other

com.liupait.tracero.receivers.MyPlugInControlReceiver

com.liupait.tracero.receivers.MySystemCalls

com.liupait.tracero.UltraComponent_hteingzruldtzlpwkafc

com.liupait.tracero.UltraComponent_nnmgohqibbomtewmsvhd

com.google.firebase.iid.FirebaseInstanceIdReceiver