Premium_0[.]39[.]2[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
Premium_0.39.2.apk
Size 3.8MB
Sample260825-1nwcsaba32
SHA256 066a15328d08419183c524f45d2cce37f7b3bdfd97904e8902ea52710ca09a15
MD5 d7c7eb45c79fcec822126f2fcae05a66
SHA1 629c6658c98610bcd8c43de63bcc10b0cb9c5a92
SHA512 de09cfa64936c2daa4698cfc1310210d1b392753c1d388de3653987d0b2531d7ed8ea619dbcf81992225c8c018362e2dc018dfc4a143426a4704d1eaa7d02f84
SSDEEP 98304:m2fgqgY86GbdrxaD9K3j81KiupWBdZzbH:4sTGbdSI3jOukLFT
TLSH
T1D116E002AB969F5DC87F81310CAE47603235ED55A743839B642876B86F6BAF40FC53D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
Premium_0.39.2.apk
unpack001/payload.apk

File Explorer

Premium_0.39.2.apk

.apk 3.8MB
payload.apk

.apk 4.0MB

Premium_0.39.2.apk

SHA256 066a15328d08419183c524f45d2cce37f7b3bdfd97904e8902ea52710ca09a15
MD5 d7c7eb45c79fcec822126f2fcae05a66
SHA1 629c6658c98610bcd8c43de63bcc10b0cb9c5a92
SHA512 de09cfa64936c2daa4698cfc1310210d1b392753c1d388de3653987d0b2531d7ed8ea619dbcf81992225c8c018362e2dc018dfc4a143426a4704d1eaa7d02f84
SSDEEP 98304:m2fgqgY86GbdrxaD9K3j81KiupWBdZzbH:4sTGbdSI3jOukLFT
TLSH
T1D116E002AB969F5DC87F81310CAE47603235ED55A743839B642876B86F6BAF40FC53D8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

057959d0dbd86c689ef40fa63cbdfa4d3bcf3f1b3dcf853d88f2c8f033e412fa

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Sonata,OU=Mobile,O=Sonata,L=City,ST=ST,C=RU

com.finclient4215.userapp0204

payload.apk

SHA256 aa41c05f13986d2487a158415c086e6f17526cfb6fa2ce3ad47a0f2e214bf078
MD5 b134f3f41e699c41c78929c4863c7526
SHA1 0588d57b0fe1d62c2e08d6e7b14b7a1aedf6a9f3
SHA512 6982de0de8e689f685b9c50ec6068f1afcc54f31095ed7b44f52504ec878fd4e499f0efc07eafec0f806f9c938382fa0a60416152a2a3b98c4d88602bab3da38
SSDEEP 49152:LOaogyQazKALmi4CPJVIe+hn1I8pKNMjAevDHMubEdFNdAh:LMNQazKALmi7PJVhBCEdFo
TLSH
T15416AE67A6119E61C46E5B3C44B60F55A738AED2FE430307604CB9E86FB35E067CA7C2
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ddce7721d08a5d4486e3a11fa29953fb2097f06f8d23cbe7ed464ecbab1b92c8

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Sonata,OU=Mobile,O=Sonata,L=City,ST=ST,C=RU

com.qiwiwallet293.cardid2878

com.sonata.mobile.VFMarbleActivity

android.intent.action.SENDTO

com.sonata.mobile.MainActivity

io.buffer.enroll.north.ips.DropperBeaconActivity

com.internal.c2.metric.dpen.NCommandHandshakeActivity

com.sonata.mobile.panel.index.fecwm.XUploadSmsActivity

com.internal.c2.umbra.kbagb.PayloadFleetActivity

com.sonata.mobile.remote.cobalt.zwv.BeaconUtilActivity

com.support.knack.fqy.PZOtstukDropperActivity

com.sonata.mobile.otstuk.cobalt.cswep.DeviceC2Activity

com.runtime.cipher.wnmv.HROutboxPresenceActivity

com.metrics.truss.vwau.SChannelEnrollActivity

com.framework.metric.wpa.KEnrollPresenceActivity

org.service.panel.anchor.xfvbd.CBeaconAdminActivity

com.metrics.relay.opedbt.GArchiveImplantActivity

com.sonata.mobile.ops.helix.ipohg.WFleetChannelActivity

com.sonata.mobile.exfil.delta.imao.NImplantHandshakeActivity

com.internal.ivory.xud.CGHandshakeArchiveActivity

org.util.relay.oah.FAWebhookEnrollActivity

com.cache.ridge.qmifle.HDUnityActivity

io.parcel.marble.ahoc.OPLotusClientActivity

com.framework.probe.dsbbb.OTUmbraHostActivity

com.support.probe.unw.WQuotaActivity

org.util.sync.jpr.FFProbeGateActivity

org.service.orbit.uoys.UYVectorManagerActivity

com.support.umbra.enky.NNexusActivity

org.service.delta.hnez.RZDeltaActivity

com.platform.quota.cecjpw.TQueryActivity

com.internal.epoch.dnwvsw.RNexusWorkerActivity

com.cache.frame.bbplwr.RRelayHelperActivity

com.cache.buffer.wipvue.OVectorProviderActivity

io.parcel.epoch.iam.RModuleHubActivity

com.metrics.index.wck.HAProbeActivity

com.runtime.orbit.vptsr.ZKnackActivity

com.runtime.router.sgfdx.HZOpalManagerActivity

com.support.valve.hjnx.VIndexActivity

com.metrics.quota.ltewk.UCipherActivity

com.framework.token.jyfbcj.TFrameActivity

net.anchor.relay.gkngy.HHZephyrManagerActivity

com.cache.kernel.jtnt.ERouterActivity

com.internal.anchor.pizay.XHHavenActivity

com.platform.kernel.ytrwxe.KMQueryJobActivity

net.anchor.valve.qrct.XWIvoryActivity

com.sonata.mobile.GUSignalService

com.sonata.mobile.EDLedgerService

android.intent.action.RESPOND_VIA_MESSAGE

com.runtime.widget.hzotc.BootstrapOutboxService

com.platform.quartz.yip.GLC2ImplantService

com.internal.c2.probe.qwffv.EnrollDropperService

com.sonata.mobile.sync.token.nub.PDeviceEnrollService

com.cache.sms.willow.zjza.YSAgentUploadService

com.sonata.mobile.sync.epoch.lvk.FPresenceProviderService

com.sonata.mobile.fleet.xenon.qcad.XTelegramWebhookService

com.sonata.mobile.ops.flux.agxmz.VBeaconDeviceService

com.sonata.mobile.panel.xenon.jnl.BootstrapTelegramService

io.buffer.enroll.parcel.mov.ETArchiveStoreService

io.buffer.shard.lwf.HOTelegramExfilService

com.sonata.mobile.secure.knack.kvr.DropperVaultService

com.internal.c2.ridge.nju.DQEnrollHeartbeatService

io.parcel.truss.cete.YC2ExfilService

net.anchor.willow.fwn.VSecretsUploadService

com.sonata.mobile.secure.orbit.xbmmj.ZWPresenceChannelService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.sonata.mobile.ZEBridgeGateReceiver

android.provider.Telephony.SMS_DELIVER

com.sonata.mobile.KShardReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

com.sonata.mobile.GOUmbraPoolReceiver

android.provider.action.DEFAULT_SMS_PACKAGE_CHANGED

com.sonata.mobile.ERTokenHostReceiver

com.sonata.mobile.YNexusGateReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON

com.sonata.mobile.BZephyrReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.USER_UNLOCKED android.intent.action.MY_PACKAGE_REPLACED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON

com.sonata.mobile.BVXenonCoreReceiver

com.sonata.mobile.VLayerHubReceiver

com.sonata.mobile.fleet.unity.vrgg.AdminTelegramReceiver

com.sonata.mobile.exfil.token.sth.QCC2AdminReceiver

com.internal.ember.soeuym.KAArchiveTunnelReceiver

com.cache.sms.flux.wfkp.C2WebhookReceiver

com.runtime.vector.qup.USmsTelegramReceiver

com.support.marble.hrfxin.CommandExfilReceiver

io.buffer.enroll.sync.uziv.HandshakeUploadReceiver

com.sonata.mobile.remote.metric.wvt.ArchiveRelayReceiver

com.sonata.mobile.sync.layer.iyf.SSecretsC2Receiver

com.sonata.mobile.remote.anchor.gus.SyncPresenceReceiver

com.sonata.mobile.exfil.parcel.dzm.TelegramVaultReceiver

com.sonata.mobile.exfil.signal.qewaw.LZWebhookSmsReceiver

com.sonata.mobile.exfil.epoch.eyfx.ArchiveExfilReceiver

io.buffer.enroll.willow.hwf.VaultHandshakeReceiver

com.sonata.mobile.panel.widget.cfm.SLOtstukAdminReceiver

com.framework.graph.bhf.KSmsOutboxReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

Premium_0.39.2.apk

Permissions

android.permission.REQUEST_INSTALL_PACKAGES

com.finclient4215.userapp0204.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

Premium_0.39.2.apk

File Signature issue

com.sonata.dropper.MainActivity

com.sonata.dropper.InstallStatusReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

payload.apk

File Signature issue

com.sonata.mobile.VFMarbleActivity

com.sonata.mobile.MainActivity

io.buffer.enroll.north.ips.DropperBeaconActivity

com.internal.c2.metric.dpen.NCommandHandshakeActivity

com.sonata.mobile.panel.index.fecwm.XUploadSmsActivity

com.internal.c2.umbra.kbagb.PayloadFleetActivity

com.sonata.mobile.remote.cobalt.zwv.BeaconUtilActivity

com.support.knack.fqy.PZOtstukDropperActivity

com.sonata.mobile.otstuk.cobalt.cswep.DeviceC2Activity

com.runtime.cipher.wnmv.HROutboxPresenceActivity

com.metrics.truss.vwau.SChannelEnrollActivity

com.framework.metric.wpa.KEnrollPresenceActivity

org.service.panel.anchor.xfvbd.CBeaconAdminActivity

com.metrics.relay.opedbt.GArchiveImplantActivity

com.sonata.mobile.ops.helix.ipohg.WFleetChannelActivity

com.sonata.mobile.exfil.delta.imao.NImplantHandshakeActivity

com.internal.ivory.xud.CGHandshakeArchiveActivity

org.util.relay.oah.FAWebhookEnrollActivity

com.cache.ridge.qmifle.HDUnityActivity

io.parcel.marble.ahoc.OPLotusClientActivity

com.framework.probe.dsbbb.OTUmbraHostActivity

com.support.probe.unw.WQuotaActivity

org.util.sync.jpr.FFProbeGateActivity

org.service.orbit.uoys.UYVectorManagerActivity

com.support.umbra.enky.NNexusActivity

org.service.delta.hnez.RZDeltaActivity

com.platform.quota.cecjpw.TQueryActivity

com.internal.epoch.dnwvsw.RNexusWorkerActivity

com.cache.frame.bbplwr.RRelayHelperActivity

com.cache.buffer.wipvue.OVectorProviderActivity

io.parcel.epoch.iam.RModuleHubActivity

com.metrics.index.wck.HAProbeActivity

com.runtime.orbit.vptsr.ZKnackActivity

com.runtime.router.sgfdx.HZOpalManagerActivity

com.support.valve.hjnx.VIndexActivity

com.metrics.quota.ltewk.UCipherActivity

com.framework.token.jyfbcj.TFrameActivity

net.anchor.relay.gkngy.HHZephyrManagerActivity

com.cache.kernel.jtnt.ERouterActivity

com.internal.anchor.pizay.XHHavenActivity

com.platform.kernel.ytrwxe.KMQueryJobActivity

net.anchor.valve.qrct.XWIvoryActivity

com.sonata.mobile.GUSignalService

com.sonata.mobile.EDLedgerService

com.runtime.widget.hzotc.BootstrapOutboxService

com.platform.quartz.yip.GLC2ImplantService

com.internal.c2.probe.qwffv.EnrollDropperService

com.sonata.mobile.sync.token.nub.PDeviceEnrollService

com.cache.sms.willow.zjza.YSAgentUploadService

com.sonata.mobile.sync.epoch.lvk.FPresenceProviderService

com.sonata.mobile.fleet.xenon.qcad.XTelegramWebhookService

com.sonata.mobile.ops.flux.agxmz.VBeaconDeviceService

com.sonata.mobile.panel.xenon.jnl.BootstrapTelegramService

io.buffer.enroll.parcel.mov.ETArchiveStoreService

io.buffer.shard.lwf.HOTelegramExfilService

com.sonata.mobile.secure.knack.kvr.DropperVaultService

com.internal.c2.ridge.nju.DQEnrollHeartbeatService

io.parcel.truss.cete.YC2ExfilService

net.anchor.willow.fwn.VSecretsUploadService

com.sonata.mobile.secure.orbit.xbmmj.ZWPresenceChannelService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.sonata.mobile.ZEBridgeGateReceiver

com.sonata.mobile.KShardReceiver

com.sonata.mobile.GOUmbraPoolReceiver