f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk
- SHA256 f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Behavioral task
behavioral1
Sample
f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk
Resource
android-x86-arm-20260325-en
Behavioral task
behavioral2
Sample
base.apk
Resource
android-x64-arm64-20260325-en
Contains namespace or class-naming artifacts emitted by off-the-shelf Android RAT builders. These kits generate a fixed package skeleton per campaign, so the stub markers persist across operators and configurations even though the C2 and payload settings differ.
| resource | yara_rule |
|---|---|
| static1/unpack001/base.apk | ANDROID_CommodityRAT_BuilderStub |
Applies obfuscation techniques to the APK format in order to hinder analysis
| description | ioc |
|---|---|
| Required by accessibility services to bind with the system. Allows apps to access accessibility features. | android.permission.BIND_ACCESSIBILITY_SERVICE |
| Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device. | android.permission.BIND_NOTIFICATION_LISTENER_SERVICE |
| description | ioc |
|---|---|
| Required to be able to connect to paired Bluetooth devices. | android.permission.BLUETOOTH_CONNECT |
| Required to be able to access the camera device. | android.permission.CAMERA |
| Allows an application to read the user's contacts data. | android.permission.READ_CONTACTS |
| Allows an application to request installing packages. | android.permission.REQUEST_INSTALL_PACKAGES |
| Allows an app to access approximate location. | android.permission.ACCESS_COARSE_LOCATION |
| Allows an app to post notifications. | android.permission.POST_NOTIFICATIONS |
| Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. | android.permission.SYSTEM_ALERT_WINDOW |
| Allows an application to read audio files from external storage. | android.permission.READ_MEDIA_AUDIO |
| Allows an application to read image files from external storage. | android.permission.READ_MEDIA_IMAGES |
| Allows an application a broad access to external storage in scoped storage. | android.permission.MANAGE_EXTERNAL_STORAGE |
| Allows an app to access precise location. | android.permission.ACCESS_FINE_LOCATION |
| Allows an application to record audio. | android.permission.RECORD_AUDIO |
| Allows an application to access any geographic locations persisted in the user's shared collection. | android.permission.ACCESS_MEDIA_LOCATION |
| Allows an application to read video files from external storage. | android.permission.READ_MEDIA_VIDEO |
| Allows an application to read image or video files from external storage that a user has selected via the permission prompt photo picker. | android.permission.READ_MEDIA_VISUAL_USER_SELECTED |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| f633b69b4028f9cde42c72b796d3cafb525d935b9ab71a68cc4e74993de7fa03.apk |
| unpack001/base.apk |
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Commodity Android RAT builder stub artifacts
Contains namespace or class-naming artifacts emitted by off-the-shelf Android RAT builders. These kits generate a fixed package skeleton per campaign, so the stub markers persist across operators and configurations even though the C2 and payload settings differ.
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
android.permission.BLUETOOTH_CONNECT
android.permission.CAMERA
com.verify.weirdnp_com.google.android.apps.photos.permission.GOOGLE_PHOTOS
android.permission.MANAGE_OWN_CALLS
android.permission.CHANGE_NETWORK_STATE
android.permission.READ_CONTACTS
android.permission.USE_BIOMETRIC
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.WAKE_LOCK
com.verify.weirdnp_com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.FOREGROUND_SERVICE_DATA_SYNC
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_ADSERVICES_AD_ID
com.verify.weirdnp_mega.privacy.android.app.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.RECEIVE_BOOT_COMPLETED
com.verify.weirdnp_com.google.android.c2dm.permission.RECEIVE
android.permission.POST_NOTIFICATIONS
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.USE_FINGERPRINT
android.permission.FLAG_SHOW_WHEN_LOCKED
android.permission.ACCESS_ADSERVICES_ATTRIBUTION
android.permission.SYSTEM_ALERT_WINDOW
android.permission.READ_MEDIA_AUDIO
android.permission.VIBRATE
android.permission.READ_MEDIA_IMAGES
android.permission.MODIFY_AUDIO_SETTINGS
android.permission.FOREGROUND_SERVICE
android.permission.ACCESS_NETWORK_STATE
com.verify.weirdnp_com.google.android.gms.permission.AD_ID
com.android.vending.BILLING
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.BLUETOOTH
android.permission.ACCESS_FINE_LOCATION
android.permission.RECORD_AUDIO
android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK
android.permission.ACCESS_MEDIA_LOCATION
android.permission.READ_MEDIA_VIDEO
android.permission.READ_MEDIA_VISUAL_USER_SELECTED
android.permission.FOREGROUND_SERVICE_PHONE_CALL