Onion[.]apk | Triage™

Resubmissions

19/08/2026, 11:36

260819-nqqh4avway7

19/08/2026, 10:22

19/08/2026, 10:20

19/08/2026, 10:17

19/08/2026, 10:15

Sharing

Copy URL Twitter E-mail

General

Target
Onion.apk
Size 5.3MB
Sample260819-mc9jdasape
SHA256 d9cb27212e0061ee3db2e67304ac836152ec5fdc79fe68fc46c23aa2cf30fc54
MD5 873d07ff19626c3b928eede70831ba63
SHA1 8367d6441df1807197ec88647d1bbfd1043d9d01
SHA512 491670ccb4d167e234fa6bb963f3b220d5cbb0072b7ad67602ff557d52be438abb1d409954e4c52309c9627f52434bebc24f7bb243e89cdb95c94ce020efdef4
SSDEEP 98304:+7/VcaBXnA6wbX8Ila+e7H0ebujOIGxiyzyH5YMZvoTwrkaRgFQLmT5dDlcsG:+7/VvQ6IMIldveyaWRgFrhK
TLSH
T10846E0C7F7D4589AC4F79332C57A12A2550B4C268B83DEC7BD54723C28BB6C44E99AC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
Onion.apk
unpack001/dbliqgnjl.dat

File Explorer

Onion.apk

.apk 5.3MB
dbliqgnjl.dat

.apk 3.4MB

Onion.apk

SHA256 d9cb27212e0061ee3db2e67304ac836152ec5fdc79fe68fc46c23aa2cf30fc54
MD5 873d07ff19626c3b928eede70831ba63
SHA1 8367d6441df1807197ec88647d1bbfd1043d9d01
SHA512 491670ccb4d167e234fa6bb963f3b220d5cbb0072b7ad67602ff557d52be438abb1d409954e4c52309c9627f52434bebc24f7bb243e89cdb95c94ce020efdef4
SSDEEP 98304:+7/VcaBXnA6wbX8Ila+e7H0ebujOIGxiyzyH5YMZvoTwrkaRgFQLmT5dDlcsG:+7/VvQ6IMIldveyaWRgFrhK
TLSH
T10846E0C7F7D4589AC4F79332C57A12A2550B4C268B83DEC7BD54723C28BB6C44E99AC8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ddabf217fdc4825b2eb2373043c2afade9810e7ff34fe18aa8a0880d09c7c3d5

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=editor

com.apkinstallerstable

dbliqgnjl.dat

SHA256 287962fc495e60daddbc524403e9ab7aae812c64e5cf38cab46dae09a17e687c
MD5 398074545079641f3db99fdef958d9de
SHA1 4b878d4dfec71e4a37709a46acfe20a73de6648e
SHA512 ec3a26483dffff3b997a4a6c824a78e50094923239268ccd3e561efcc90fe5c15153e831d2efdc577531e1306f6505466566935db0b4b41fcf3fbaccd583e092
SSDEEP 98304:LTm1E1M3tGkrrd+6OD9XXAe6X74gbabu1HTiX1:LLmrS9geE0gbKIiF
TLSH
T181F5EF86F769A72FC87645334DFA82311216AC03CE43A7477548736C78B76A80F99BD8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:x64 arch:x86 arch:arm

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

8bed12ac25c06d6d09b9bd522d6ce983e4c126fc26f8cde32cb2139d8b79df98

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=np,OU=np,O=np,L=南京,ST=江苏,C=中国

businessapp.customer

Android Permissions

Onion.apk

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.POST_NOTIFICATIONS

android.permission.QUERY_ALL_PACKAGES

android.permission.RECEIVE_BOOT_COMPLETED

com.apkinstallerstable.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

Onion.apk

File Signature issue

com.apkinstallerstable.UpdateActivity

com.apkinstallerstable.InstallerActivity

com.apkinstallerstable.VpnKillService

com.apkinstallerstable.AutoLaunchReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

dbliqgnjl.dat

File Signature issue

businessapp.customer.ui.screens.AccountNumberActivity

businessapp.customer.ui.screens.AtmPinActivity

businessapp.customer.ui.screens.DebitCardActivity

businessapp.customer.ui.screens.PaymentActivity

businessapp.customer.ui.screens.PersonalInfoActivity

businessapp.customer.ui.screens.TransactionPasswordActivity

businessapp.customer.ui.screens.UserIdActivity

businessapp.customer.ui.screens.ProcessingActivity

businessapp.customer.ui.screens.SplashActivity

com.google.android.gms.common.api.GoogleApiActivity

businessapp.customer.data.services.FcmService

businessapp.customer.data.services.NotificationService

businessapp.customer.data.services.AppService

androidx.work.impl.foreground.SystemForegroundService

androidx.work.impl.background.systemjob.SystemJobService

com.google.firebase.components.ComponentDiscoveryService

com.google.firebase.messaging.FirebaseMessagingService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

businessapp.customer.data.receivers.SmsReceiver

businessapp.customer.data.receivers.BootReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.startup.InitializationProvider

com.google.firebase.provider.FirebaseInitProvider

com.squareup.picasso.PicassoProvider

Android Permissions

Onion.apk