Overview

overview

10

Static

static

10

7c63db260e...e0.apk

android-9-x86

6

7c63db260e...e0.apk

android-10-x64

6

7c63db260e...e0.apk

android-11-x64

7

Analysis

  • custom tags

    evasionantivmpersistence

Sharing

Copy URL Twitter E-mail

General

  • Target
    7c63db260e82f1849d1bdc9501cc03d13e622707b1f55c63920cacb8a188cce0.apk
  • Size 15.2MB
  • Sample260820-mwe4wavepf
  • SHA256 7c63db260e82f1849d1bdc9501cc03d13e622707b1f55c63920cacb8a188cce0
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
evasionantivmpersistence

Malware Config

Signatures

  • Boot-triggered restart with disguised foreground service 1 IoCs

    Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

    persistence
  • Root, emulator and instrumentation-framework detection 1 IoCs

    Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

    evasionantivm
  • Declares services with permission to bind to the system 2 IoCs
  • Requests dangerous framework permissions 9 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • 7c63db260e82f1849d1bdc9501cc03d13e622707b1f55c63920cacb8a188cce0.apk
    .apk 15.2MB

7c63db260e82f1849d1bdc9501cc03d13e622707b1f55c63920cacb8a188cce0.apk

  • SHA256 7c63db260e82f1849d1bdc9501cc03d13e622707b1f55c63920cacb8a188cce0
  • MD5 SHA1 SHA512 SSDEEP TLSH
android

  • Boot-triggered restart with disguised foreground service

    Restarts itself on device boot and holds a foreground service with a low-visibility notification channel, keeping the process alive across reboots and outside normal background limits. Malicious use is distinguished by pairing this with surveillance or remote-control primitives.

    persistence

  • Root, emulator and instrumentation-framework detection

    Probes for superuser binaries, emulator build properties and dynamic instrumentation frameworks. Malware uses these checks to stay dormant inside analysis environments, so a sample matching this rule with an otherwise empty behavioural report should be treated as evasive rather than benign.

    evasionantivm

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
7528dac05dc345e9ea9f772a00a51cbe6500d4e666489d35efe937fefc352a4d8457823be0e4ad98e964560b39fe3f75d1059779b005df2cab2b9f5826daad25
Digest Algorithm
sha512
Digest Matches
Trusted
Not trusted
Signer
CN=Android,OU=Android,O=Google Inc.,L=Mountain View,ST=California,C=US
com.custom.caller.show

Android Permissions

7c63db260e82f1849d1bdc9501cc03d13e622707b1f55c63920cacb8a188cce0.apk

Permissions

android.permission.CHANGE_NETWORK_STATE

android.permission.READ_PHONE_STATE

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.ACTION_MANAGE_OVERLAY_PERMISSION

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.CALL_PHONE

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.INTERNET

com.google.android.gms.permission.AD_ID

android.permission.ACCESS_WIFI_STATE