Analysis

  • custom tags

    ratspywaretrojan

General

  • Target
    f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk
  • Size 8.6MB
  • Sample260819-ala1ystdjh
  • SHA256 f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10

Malware Config

Signatures

  • Commodity Android RAT builder stub artifacts 1 IoCs

    Contains namespace or class-naming artifacts emitted by off-the-shelf Android RAT builders. These kits generate a fixed package skeleton per campaign, so the stub markers persist across operators and configurations even though the C2 and payload settings differ.

  • Attempts to obfuscate APK file format

    Applies obfuscation techniques to the APK format in order to hinder analysis

  • Declares services with permission to bind to the system 2 IoCs
  • Requests dangerous framework permissions 15 IoCs
  • Untrusted Codesign Signers 2 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk
    .apk 8.6MB
  • base.apk
    .apk 4.2MB

f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk

  • SHA256 f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
b438f9f762c58beb6e3cf4881933d9651106c323c17d3948d5414bae4d8d7e6a
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=kaosiajbr,OU=sjdiiwjs,O=sidiiwhd,L=skdoj,ST=sidiiwh,C=NG
com.verify.weirdnp

Android Permissions

f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk

Permissions

android.permission.BLUETOOTH_CONNECT

android.permission.CAMERA

com.verify.weirdnp_com.google.android.apps.photos.permission.GOOGLE_PHOTOS

android.permission.MANAGE_OWN_CALLS

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_CONTACTS

android.permission.USE_BIOMETRIC

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.WAKE_LOCK

com.verify.weirdnp_com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_ADSERVICES_AD_ID

com.verify.weirdnp_mega.privacy.android.app.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.RECEIVE_BOOT_COMPLETED

com.verify.weirdnp_com.google.android.c2dm.permission.RECEIVE

android.permission.POST_NOTIFICATIONS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.USE_FINGERPRINT

android.permission.FLAG_SHOW_WHEN_LOCKED

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_MEDIA_AUDIO

android.permission.VIBRATE

android.permission.READ_MEDIA_IMAGES

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_NETWORK_STATE

com.verify.weirdnp_com.google.android.gms.permission.AD_ID

com.android.vending.BILLING

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.BLUETOOTH

android.permission.ACCESS_FINE_LOCATION

android.permission.RECORD_AUDIO

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.ACCESS_MEDIA_LOCATION

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_VISUAL_USER_SELECTED

android.permission.FOREGROUND_SERVICE_PHONE_CALL