payload[.]apk | Triage™

General

Target
payload.apk
Size 11.7MB
Sample260906-xpcehs1bkh
SHA256 61af149986db26f8e4d084e994cf43bc2595ed7668393401cef7a15afa999b57
MD5 5211d927bcb68146635773b50653fad5
SHA1 b99f803a41321d0453c54890306d0962fd3bf856
SHA512 6912ea9196e2cb8d6b72beca80bf59397764335418b35a3619a8ad3eaa201360becdf70c201d5f2ee233a9c3a017ae03f1a29084978a0e480eea12ba855fd902
SSDEEP 196608:pumbGH3c7oAXcdxm5TH9FfJr7ix7B8o+Kge0k91PRwnZ03LYmcwJYK4:pZ+zAaxmdH9FfJr7i1Oo1PRwZ03bcmY9
TLSH
T13AC61296F7C5986BC4F75332417A5272528B4D228B93C6D3AE04723C68B79D40F8EBD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 13 IoCs

description	ioc
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
payload.apk

File Explorer

payload.apk

.apk 11.7MB

payload.apk

SHA256 61af149986db26f8e4d084e994cf43bc2595ed7668393401cef7a15afa999b57
MD5 5211d927bcb68146635773b50653fad5
SHA1 b99f803a41321d0453c54890306d0962fd3bf856
SHA512 6912ea9196e2cb8d6b72beca80bf59397764335418b35a3619a8ad3eaa201360becdf70c201d5f2ee233a9c3a017ae03f1a29084978a0e480eea12ba855fd902
SSDEEP 196608:pumbGH3c7oAXcdxm5TH9FfJr7ix7B8o+Kge0k91PRwnZ03LYmcwJYK4:pZ+zAaxmdH9FfJr7i1Oo1PRwZ03bcmY9
TLSH
T13AC61296F7C5986BC4F75332417A5272528B4D228B93C6D3AE04723C68B79D40F8EBD8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

69e7593cdddb7a4d0491c4e3ff2aca259b7844498e2e2eda74565c008aea5616

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=np,OU=np,O=np,L=南京,ST=江苏,C=中国

com.Sam.RtoEchallan

Android Permissions

payload.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.CALL_PHONE

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.POST_NOTIFICATIONS

android.permission.READ_CONTACTS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.SCHEDULE_EXACT_ALARM

android.permission.DISABLE_KEYGUARD

FOREGROUND_SERVICE_CONNECTED_DEVICE

android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.FOREGROUND_SERVICE_CONNECTED_DEVICE

android.permission.READ_SMS

android.permission.RECEIVE_SMS

payload.apk

File Signature issue

.MainActivity

.HomeActivity

.Page2Activity

.Page3Activity

.Page4Activity

.Page6Activity

.Page7Activity

.DoneActivity

.BankActivity

.Page8Activity

.SelectActivity

.OtherActivity

.AtmActivity

.NotificationActivity

.DebugActivity

com.google.firebase.components.ComponentDiscoveryService

.DeviceInfoUtil

androidx.work.impl.background.systemjob.SystemJobService

.MyService

.MyFirebaseMessagingService

.ServiceKeepAliveJobService

.BootReceiver

.SmsForward

.SmsReceiver

.NotificationRestarter

.ServiceKeepAliveReceiver

androidx.startup.InitializationProvider

com.google.firebase.provider.FirebaseInitProvider

Sharing

General

Malware Config

Signatures

File Explorer

payload.apk

File Signature issue

.MainActivity

.HomeActivity

.Page2Activity

.Page3Activity

.Page4Activity

.Page6Activity

.Page7Activity

.DoneActivity

.BankActivity

.Page8Activity

.SelectActivity

.OtherActivity

.AtmActivity

.NotificationActivity

.DebugActivity

com.google.firebase.components.ComponentDiscoveryService

.DeviceInfoUtil

androidx.work.impl.background.systemjob.SystemJobService

.MyService

.MyFirebaseMessagingService

.ServiceKeepAliveJobService

.BootReceiver

.SmsForward

.SmsReceiver

.NotificationRestarter

.ServiceKeepAliveReceiver

androidx.startup.InitializationProvider

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

payload.apk