35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b[.]apk

General

Target
35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk
Size 43.7MB
Sample260825-tccyqsbr21
SHA256 35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b
MD5 ce49a90c0a098e8737e266471d323626
SHA1 41c4ae3e0c26cabaad90f96eaa6a6ab688560b77
SHA512 a7ef1bbc1129ad1701b5e15a208b8b868ddc7edf2d540b68a35427e2eaedf1e76807f1369ca80691a99312c417e25d0914a5f46958acfeea4df7e45a0fc639f1
SSDEEP 786432:mYkcVVbGRRqzSxmxoFV+I2M320poUNZddKWsAdQeizWy/MlaGVq:mJcjGRsWQPM2kNtHQeizWy/I1q
TLSH
T10DA73386F39AF0AEC9B3803B8B7B176413A14C8AC596CA335165F29CDD779805E44FD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Signatures

Detects GOST tunneling tool 4 IoCs

A simple tunneling tool written in Golang

resource	yara_rule
sample	Gost
sample	Gost
sample	Gost
sample	Gost

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Required to be able to access the camera device.	android.permission.CAMERA
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk

File Explorer

35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk

.apk 43.7MB

35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk

SHA256 35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b
MD5 ce49a90c0a098e8737e266471d323626
SHA1 41c4ae3e0c26cabaad90f96eaa6a6ab688560b77
SHA512 a7ef1bbc1129ad1701b5e15a208b8b868ddc7edf2d540b68a35427e2eaedf1e76807f1369ca80691a99312c417e25d0914a5f46958acfeea4df7e45a0fc639f1
SSDEEP 786432:mYkcVVbGRRqzSxmxoFV+I2M320poUNZddKWsAdQeizWy/MlaGVq:mJcjGRsWQPM2kNtHQeizWy/I1q
TLSH
T10DA73386F39AF0AEC9B3803B8B7B176413A14C8AC596CA335165F29CDD779805E44FD8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm arch:x64 arch:arm64 arch:x86

Detects GOST tunneling tool

A simple tunneling tool written in Golang
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

1a4f41882697a85853d5238a63299e2a52d6458028d07eb5eac9262fde937792

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=vpn,OU=vpn,O=vpn,L=vpn,ST=vpn,C=1

com.vpn.lofun

Android Permissions

35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_PHONE_STATE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.NFC

android.permission.CAMERA

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.ACCESS_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_AUDIO

android.permission.READ_MEDIA_VIDEO

android.permission.READ_EXTERNAL_STORAGE

android.permission.CHANGE_WIFI_STATE

android.permission.CALL_PHONE

android.permission.VIBRATE

android.permission.FLASHLIGHT

35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk

File Signature issue

com.shadow.ssrclient.ui.activity.SplashActivity

com.shadow.ssrclient.ui.activity.VPNMainActivity

com.shadow.ssrclient.ui.activity.ScanActivity

com.shadow.ssrclient.ui.activity.WebActivity

com.shadow.ssrclient.ui.activity.ShadowsocksRunnerActivity

com.shadow.ssrclient.ui.activity.LoginActivity

com.tencent.tauth.AuthActivity

com.tencent.connect.common.AssistActivity

com.shadow.ssrclient.wxapi.WXEntryActivity

com.shadow.ssrclient.service.ShadowsocksVpnService

com.snail.antifake.jni.EmulatorCheckService

androidx.core.content.FileProvider

Sharing

General

Malware Config

Signatures

File Explorer

35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk

File Signature issue

com.shadow.ssrclient.ui.activity.SplashActivity

com.shadow.ssrclient.ui.activity.VPNMainActivity

com.shadow.ssrclient.ui.activity.ScanActivity

com.shadow.ssrclient.ui.activity.WebActivity

com.shadow.ssrclient.ui.activity.ShadowsocksRunnerActivity

com.shadow.ssrclient.ui.activity.LoginActivity

com.tencent.tauth.AuthActivity

com.tencent.connect.common.AssistActivity

com.shadow.ssrclient.wxapi.WXEntryActivity

com.shadow.ssrclient.service.ShadowsocksVpnService

com.snail.antifake.jni.EmulatorCheckService

androidx.core.content.FileProvider

Android Permissions

35c8c95c7f72872e733dfd29280df12bfe9950a760d2a346f4be6c2e399e5a4b.apk