5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip
- SHA256 fce8f64972cd0d20bc7db18cfd94ca6df68e2e004be28afa042a6ee54eb7922f
Password
infected
General
- Target 5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip
- Size 2.5MB
- Sample260819-tkga5axgnh
- SHA256 fce8f64972cd0d20bc7db18cfd94ca6df68e2e004be28afa042a6ee54eb7922f
- MD5 749b30f6e71c5376c9079cc7586cb425
- SHA1 1a72bdcbdb305386ed1c032603f60060b0bcc670
- SHA512 8a4fe48f0d59897b8a913d565e1c3db01126bf58170fe79384a2d712be3d0647571640538860c7add528765f018e45e56401e591cac339793f694633e3ed973d
- SSDEEP 49152:j8dxKhP/HQBLb4YJh+EdtiN38ZU9JdnxRKtcWzEHk/BDGP0CMzfxHFBXzL14:2QhPULcYJhzvo3FZaWjE/IclLhx4
- TLSH T140C5333381E32A56A4AF7777F62C90CDD1BC8EE83B420E702317A15945997BB462907F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: SLocker
SLocker is an Android ransomware that locks victim screens and encrypts files.
- SLocker payload 1 IoCs
resource yara_rule static1/unpack001/5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk family_slocker_1 - Requests dangerous framework permissions 7 IoCs
description ioc Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps. android.permission.SYSTEM_ALERT_WINDOW Allows an application to read from external storage. android.permission.READ_EXTERNAL_STORAGE Allows an application to write to external storage. android.permission.WRITE_EXTERNAL_STORAGE Allows an application to read the user's contacts data. android.permission.READ_CONTACTS Allows an application to read SMS messages. android.permission.READ_SMS Allows an app to access precise location. android.permission.ACCESS_FINE_LOCATION Required to be able to access the camera device. android.permission.CAMERA - Untrusted Codesign Signers 1 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
File Explorer
-
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.zip.zip 2.5MB
-
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk.apk 2.7MB
5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e.apk
- SHA256 5251a356421340a45c8dc6d431ef8a8cbca4078a0305a87f4fbd552e9fc0793e
- MD5 2ddbc785cd696041c5b0c3bd1a8af552
- SHA1 1269636a5197ee7a1402e406c91177bf6a149652
- SHA512 30e3187fa0c65981ae80f0bfae4ac753020ceb591d9c001a809040fac08795ab2cb04d9a95645a025d15008c4057f14a84826bec86b75453f389ac52d9b8a1e5
- SSDEEP 49152:VPctdtUtD6iJjM2M7xZkQPctdtUtD6yJjM2M7xZkpPctdtUtD62JjM2M7xZknJjj:VP04D6ojkxlP04D64jkx4P04D6sjkxin
- TLSH T18CD51215CA63FCD0DD4A8171B8EF4FDD6A9104E28AF162374672712D7CA35381AEB70A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
SLocker payload
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Password
infected
File Signature issue
Digest
c1a26155de682574d893384a8b6b085c18821046b82231b1f7fd604bcd897fc1
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
C=debugging
Subject
C=debugging
Serial Number
33:3a:0b:9b
Issuer
C=debugging
Timespan
Sep 23, 2016 - Jan 25, 3015
com.XPhantom.id
com.XPhantom.id.MainActivity
android.permission.SYSTEM_ALERT_WINDOW
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.SET_WALLPAPER
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.READ_CONTACTS
android.permission.READ_SMS
android.permission.ACCESS_FINE_LOCATION
android.permission.WAKE_LOCK
android.permission.INTERNET
android.permission.REQUEST_INSTALL_PACKAGE
android.permission.CAMERA
com.XPhantom.id.MainActivity
android.intent.action.MAIN
com.XPhantom.id.MyService
com.XPhantom.id.BootReceiver
android.intent.action.BOOT_COMPLETED
android.intent.action.QUICKBOOT_POWERON