8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba[.]apk

General

Target
8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk
Size 3.3MB
Sample260817-e2yjeatapc
SHA256 8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba
MD5 0be21ed38f88c3bf697a3bcd6b223eb7
SHA1 da6e3303184c21a5bbda6db09dba07147d244ba2
SHA512 6130452648c06f7922a3f5e9edfa30d75974d05440b3584fd1a71837aaa457c129ea0bd0fecd8b1414b86d861211771d597c3f2a4ffe84a9d50d1a287172e120
SSDEEP 98304:7/xf/WckkVxWjynY89+uAt4jGPIy0Yh9B7DMC:p/CiXAtUGg095DMC
TLSH
T1A8F533117F2E4506DEB40B318999C31AC52D5FA8EF4E669F6330338354B2EE65B074EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Android dropper: runtime DEX/class loading of a staged payload 1 IoCs

Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

dropper loader

resource	yara_rule
sample	ANDROID_Dropper_RuntimeDexLoad

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk

File Explorer

8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk

.apk 3.3MB

8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk

SHA256 8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba
MD5 0be21ed38f88c3bf697a3bcd6b223eb7
SHA1 da6e3303184c21a5bbda6db09dba07147d244ba2
SHA512 6130452648c06f7922a3f5e9edfa30d75974d05440b3584fd1a71837aaa457c129ea0bd0fecd8b1414b86d861211771d597c3f2a4ffe84a9d50d1a287172e120
SSDEEP 98304:7/xf/WckkVxWjynY89+uAt4jGPIy0Yh9B7DMC:p/CiXAtUGg095DMC
TLSH
T1A8F533117F2E4506DEB40B318999C31AC52D5FA8EF4E669F6330338354B2EE65B074EA
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android dropper: runtime DEX/class loading of a staged payload

Sample resolves and loads executable code at runtime via DexClassLoader/InMemoryDexClassLoader combined with reflection and asset or network payload retrieval. Legitimate apps rarely need in-memory DEX loading; this is the standard staging mechanism for Android droppers evading store review.

dropper loader
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9f3257dcc6fb083eef4374b943a5833adabed176e7c44240dde29989212ad07c

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.car.cloth

com.sdktools.android.bot.HelperAdmin$MyHomeReceiver

android.app.action.DEVICE_ADMIN_ENABLED

com.sdktools.android.bot.receivers.MainReceiver

android.intent.action.BOOT_COMPLETED

com.sdktools.android.core.PeriodicJobReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.BATTERY_OKAY android.net.wifi.WIFI_STATE_CHANGED android.intent.action.SCREEN_OFF android.intent.action.DREAMING_STOPPED android.net.conn.CONNECTIVITY_CHANGE cn.RestartedViaAlarm android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BATTERY_LOW android.intent.action.SCREEN_ON android.intent.action.BATTERY_CHANGED android.intent.action.REBOOT android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.USER_PRESENT android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.provider.Telephony.SMS_RECEIVED android.intent.action.SCREEN_ON android.intent.action.EXTERNAL_APPLICATIONS_AVAILABLE android.net.conn.CONNECTIVITY_CHANGE android.net.wifi.WIFI_STATE_CHANGED android.intent.action.DREAMING_STOPPED

com.sdktools.android.bot.sms.SmsReceiver

android.provider.Telephony.SMS_DELIVER

com.sdktools.android.bot.sms.MmsReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

com.sdktools.android.core.injects_core.CHandler

info.pluggabletransports.dispatch.service.DispatchReceiver

info.pluggabletransports.intent.action.START

Android Permissions

8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk

Permissions

android.permission.CHANGE_WIFI_STATE

android.permission.READ_SMS

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.FOREGROUND_SERVICE

android.permission.WRITE_SMS

android.permission.RECEIVE_SMS

android.permission.QUICKBOOT_POWERON

android.permission.WRITE_SETTINGS

android.permission.WAKE_LOCK

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.INTERNET

android.permission.DISABLE_KEYGUARD

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.ACCESS_WIFI_STATE

android.permission.RECORD_AUDIO

android.permission.REORDER_TASKS

android.permission.GET_TASKS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.SEND_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECEIVE_LAUNCH_BROADCASTS

android.permission.REQUEST_DELETE_PACKAGES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CAPTURE_VIDEO_OUTPUT

com.google.android.gms.permission.ACTIVITY_RECOGNITION

android.permission.BLUETOOTH

android.permission.SYSTEM_ALERT_WINDOW

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.VIBRATE

android.permission.READ_CONTACTS

android.permission.QUERY_ALL_PACKAGES

android.permission.ACCESS_COARSE_LOCATION

android.permission.CALL_PHONE

8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk

File Signature issue

com.sdktools.android.MainActivity

com.sdktools.android.bot.PermissionsActivity

com.sdktools.android.bot.components.locker.LockerActivity

com.sdktools.android.bot.components.locker.LockerActivity$DummyActivity

com.sdktools.android.bot.components.screencast.ScreencastStartActivity

com.sdktools.android.bot.components.screencast.UnlockActivity

com.sdktools.android.bot.sms.ComposeSmsActivity

com.sdktools.android.core.injects_core.Screen

org.torproject.android.service.OrbotService

com.sdktools.android.bot.components.commands.NLService

com.sdktools.android.bot.components.injects.system.InjAccessibilityService

com.sdktools.android.bot.components.socks5.Socks5ProxyService

com.sdktools.android.bot.components.screencast.ScreencastService

com.sdktools.android.core.PeriodicJobService

com.sdktools.android.bot.sms.HeadlessSmsSendService

com.sdktools.android.core.injects_core.Worker

info.pluggabletransports.dispatch.service.DispatchService

info.pluggabletransports.dispatch.service.DispatchVPN

com.sdktools.android.bot.HelperAdmin$MyHomeReceiver

com.sdktools.android.bot.receivers.MainReceiver

com.sdktools.android.core.PeriodicJobReceiver

com.sdktools.android.bot.sms.SmsReceiver

com.sdktools.android.bot.sms.MmsReceiver

com.sdktools.android.core.injects_core.CHandler

info.pluggabletransports.dispatch.service.DispatchReceiver

android.support.v4.content.FileProvider

Analysis

Sharing

General

Malware Config

Signatures

File Explorer

8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk

File Signature issue

com.sdktools.android.MainActivity

com.sdktools.android.bot.PermissionsActivity

com.sdktools.android.bot.components.locker.LockerActivity

com.sdktools.android.bot.components.locker.LockerActivity$DummyActivity

com.sdktools.android.bot.components.screencast.ScreencastStartActivity

com.sdktools.android.bot.components.screencast.UnlockActivity

com.sdktools.android.bot.sms.ComposeSmsActivity

com.sdktools.android.core.injects_core.Screen

org.torproject.android.service.OrbotService

com.sdktools.android.bot.components.commands.NLService

com.sdktools.android.bot.components.injects.system.InjAccessibilityService

com.sdktools.android.bot.components.socks5.Socks5ProxyService

com.sdktools.android.bot.components.screencast.ScreencastService

com.sdktools.android.core.PeriodicJobService

com.sdktools.android.bot.sms.HeadlessSmsSendService

com.sdktools.android.core.injects_core.Worker

info.pluggabletransports.dispatch.service.DispatchService

info.pluggabletransports.dispatch.service.DispatchVPN

com.sdktools.android.bot.HelperAdmin$MyHomeReceiver

com.sdktools.android.bot.receivers.MainReceiver

com.sdktools.android.core.PeriodicJobReceiver

com.sdktools.android.bot.sms.SmsReceiver

com.sdktools.android.bot.sms.MmsReceiver

com.sdktools.android.core.injects_core.CHandler

info.pluggabletransports.dispatch.service.DispatchReceiver

android.support.v4.content.FileProvider

Android Permissions

8c2a2324ad2210b46b74c9addd35c14c96da10052e97b205071ab59a8b1b17ba.apk