bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5[.]apk

General

Target
bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5.apk
Size 9.6MB
Sample260818-xtltraah39
SHA256 bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5
MD5 7b4870ec05ebc3d211cf25a435a95159
SHA1 47f801c0638daa0b9858ade1a18ed09f3622e7be
SHA512 3e90a1ad083e44cb03d5342e6b385a56985e5340e00feb4724fc9739cf0e5d85b821a6d587176192ca36ac5f47e29bd617204875dba891ec1c7fe72c090e5c5a
SSDEEP 196608:mcZP1R6AAMFbhF1CO6petB0uDSu1qAnAeNDRh0sZwVsb6S7yCS:mUPCkd9tZD1qeFzPb6S7xS
TLSH
T1A1A62246FF28AD2FC83390330BAA5735714B8D168A8397472958775C29B7AD84F89FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Notification listener abuse for OTP and message theft 2 IoCs

Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

stealer otp banker

resource	yara_rule
sample	ANDROID_NotificationListener_OTP_Theft
sample	ANDROID_NotificationListener_OTP_Theft

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5.apk

File Explorer

bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5.apk

.apk 9.6MB

bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5.apk

SHA256 bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5
MD5 7b4870ec05ebc3d211cf25a435a95159
SHA1 47f801c0638daa0b9858ade1a18ed09f3622e7be
SHA512 3e90a1ad083e44cb03d5342e6b385a56985e5340e00feb4724fc9739cf0e5d85b821a6d587176192ca36ac5f47e29bd617204875dba891ec1c7fe72c090e5c5a
SSDEEP 196608:mcZP1R6AAMFbhF1CO6petB0uDSu1qAnAeNDRh0sZwVsb6S7yCS:mUPCkd9tZD1qeFzPb6S7xS
TLSH
T1A1A62246FF28AD2FC83390330BAA5735714B8D168A8397472958775C29B7AD84F89FC4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Notification listener abuse for OTP and message theft

Binds a notification listener service and reads posted notification content, optionally dismissing notifications afterwards to hide them. This harvests one-time passcodes and private messages without ever requesting SMS permissions, which is why it has largely replaced SMS interception in modern ban

stealer otp banker
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

1aaf12c44fc9e99861151df4f1ee9beaed094b141c4285db34840373f924e179a43b32e33a186902315bb63fbc0eed5a1c22bb141edf458daf7eb36718c279ef

Digest Algorithm

sha512

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Google Inc.,L=Mountain View,ST=California,C=US

com.bring.pressureback.tostability

com.onesignal.FCMBroadcastReceiver

com.google.android.c2dm.intent.RECEIVE

com.onesignal.NotificationDismissReceiver

com.onesignal.BootUpReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON

com.onesignal.UpgradeReceiver

android.intent.action.MY_PACKAGE_REPLACED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.gms.measurement.AppMeasurementReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.yandex.metrica.MetricaEventHandler

com.android.vending.INSTALL_REFERRER

com.yandex.metrica.ConfigurationServiceReceiver

com.yandex.metrica.configuration.service.PLC

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.READ_EXTERNAL_STORAGE

com.bring.pressureback.tostability.permission.C2D_MESSAGE

com.google.android.c2dm.permission.RECEIVE

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.RECEIVE_BOOT_COMPLETED

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

com.anddoes.launcher.permission.UPDATE_COUNT

com.majeur.launcher.permission.UPDATE_BADGE

com.huawei.android.launcher.permission.CHANGE_BADGE

com.huawei.android.launcher.permission.READ_SETTINGS

com.huawei.android.launcher.permission.WRITE_SETTINGS

android.permission.READ_APP_BADGE

com.oppo.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS

me.everything.badger.permission.BADGE_COUNT_READ

me.everything.badger.permission.BADGE_COUNT_WRITE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.gms.permission.AD_ID

android.permission.FOREGROUND_SERVICE

Analysis

Sharing

General

Malware Config

Signatures

File Explorer

bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5.apk

File Signature issue

com.bring.pressureback.tostability.SplashActivity

com.bring.pressureback.tostability.base.BaseMainActivity

com.bring.pressureback.tostability.base.BaseIdeaActivity

com.bring.pressureback.tostability.base.InfoActivity

com.onesignal.NotificationOpenedActivityHMS

com.onesignal.PermissionsActivity

com.onesignal.NotificationOpenedReceiver

com.google.android.gms.common.api.GoogleApiActivity

com.just.agentweb.AgentActionFragment

com.onesignal.HmsMessageServiceOneSignal

com.onesignal.FCMIntentService

com.onesignal.FCMIntentJobService

com.onesignal.FocusDelaySyncService

com.onesignal.FocusDelaySyncJobService

com.onesignal.SyncService

com.onesignal.SyncJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.messaging.FirebaseMessagingService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

com.yandex.metrica.MetricaService

com.yandex.metrica.ConfigurationService

com.yandex.metrica.ConfigurationJobService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

androidx.room.MultiInstanceInvalidationService

com.onesignal.FCMBroadcastReceiver

com.onesignal.NotificationDismissReceiver

com.onesignal.BootUpReceiver

com.onesignal.UpgradeReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

com.yandex.metrica.MetricaEventHandler

com.yandex.metrica.ConfigurationServiceReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.squareup.picasso.PicassoProvider

com.google.firebase.provider.FirebaseInitProvider

androidx.startup.InitializationProvider

androidx.work.impl.WorkManagerInitializer

com.just.agentweb.AgentWebFileProvider

com.download.library.DownloadFileProvider

Android Permissions

bd2126954c6838ab954220d287eb89ede8109a7f942dc9b8b073abdc1bb68be5.apk