Overview

overview

10

Static

static

10

8c2e3c0c7f...fc.apk

android-9-x86

10

8c2e3c0c7f...fc.apk

android-10-x64

10

8c2e3c0c7f...fc.apk

android-11-x64

10

Analysis

  • custom tags

    obfuscatedevasion

Sharing

Copy URL Twitter E-mail

General

  • Target
    8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc.apk
  • Size 3.9MB
  • Sample260817-e4lmmatvbx
  • SHA256 8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
obfuscatedevasion

Malware Config

Signatures

  • Runtime string decryption with reflective method dispatch 1 IoCs

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion
  • Declares services with permission to bind to the system 1 IoCs
  • Requests dangerous framework permissions 4 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc.apk
    .apk 3.9MB

8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc.apk

  • SHA256 8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc
  • MD5 SHA1 SHA512 SSDEEP TLSH
android

  • Runtime string decryption with reflective method dispatch

    Combines symmetric decryption or base64 decoding of embedded string tables with reflective class and method resolution, so sensitive API names never appear in plaintext. This defeats naive string-based detection and indicates deliberate anti-analysis engineering.

    obfuscatedevasion

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
4c1c99b475907574bb70cab2bdde2a6dcd5fc2a8fb42fc07385447b3c99724e03d6e974375b77d69228f0038398829042231c49fb2d91ed00309b3bea9a5b1c8
Digest Algorithm
sha512
Digest Matches
Trusted
Not trusted
Signer
CN=Android,OU=Android,O=Google Inc.,L=Mountain View,ST=California,C=US
com.skyclean.clearlite

Android Permissions

8c2e3c0c7fd591f1377e9318fbcfbcae85db4875a2f405b99da46edf9b70eefc.apk

Permissions

android.permission.READ_CONTACTS

android.permission.CHANGE_NETWORK_STATE

com.android.launcher.permission.UNINSTALL_SHORTCUT

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.GET_PACKAGE_SIZE

android.permission.CLEAR_APP_CACHE

android.permission.DELETE_CACHE_FILES

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_EXTERNAL_STORAGE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.GET_TASKS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_NETWORK_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.ACCESS_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_STATE

android.permission.PACKAGE_USAGE_STATS

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE