APPCLONER_FINAL[𝗛𝗔𝗕𝗜𝗕𝗜™][.]apk

Sharing

Copy URL Twitter E-mail

General

Target
APPCLONER_FINAL[𝗛𝗔𝗕𝗜𝗕𝗜™].apk
Size 52.9MB
Sample260916-k46wfswtbw
SHA256 a69d44ea89400d9fa3cdb764f73ae00358af73cf9384153a86ffea1adc57a359
MD5 2de1c07c404c68e33b52c6a4347db88a
SHA1 d2adf29af5647eb2207232510ae88ff11bd9395c
SHA512 cf3a781c6a937d65afad21446eadc5220d3b84e91d640c44ac16c63accf91c05272517f67fd645b2af10ad5180e71789354b55bf24ca6065ac29fda3e945811c
SSDEEP 1572864:77/6oEUOpU+hjcjOPc0J8S1ak5+UHi2/mu2GTZqcvirHn1oCeFoe:/REHCM06NJP1X+misScOnTc
TLSH
T1AAC73326C1CCE84FC07FA63105673746C68D819C0902FA653A6A92593FEFD46EB71E4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
APPCLONER_FINAL[𝗛𝗔𝗕𝗜𝗕𝗜™].apk

File Explorer

APPCLONER_FINAL[𝗛𝗔𝗕𝗜𝗕𝗜™].apk

.apk 52.9MB

APPCLONER_FINAL[𝗛𝗔𝗕𝗜𝗕𝗜™].apk

SHA256 a69d44ea89400d9fa3cdb764f73ae00358af73cf9384153a86ffea1adc57a359
MD5 2de1c07c404c68e33b52c6a4347db88a
SHA1 d2adf29af5647eb2207232510ae88ff11bd9395c
SHA512 cf3a781c6a937d65afad21446eadc5220d3b84e91d640c44ac16c63accf91c05272517f67fd645b2af10ad5180e71789354b55bf24ca6065ac29fda3e945811c
SSDEEP 1572864:77/6oEUOpU+hjcjOPc0J8S1ak5+UHi2/mu2GTZqcvirHn1oCeFoe:/REHCM06NJP1X+misScOnTc
TLSH
T1AAC73326C1CCE84FC07FA63105673746C68D819C0902FA653A6A92593FEFD46EB71E4E
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

251dc1671ebb81842d72b2d78c8fb2a26a79b545f884c96e38bf9ebaa672463e

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.applisto.appcloner

com.applisto.appcloner.activity.StartActivity

android.intent.action.MAIN android.intent.action.MAIN

com.applisto.appcloner.activity.CalculatorActivity

android.intent.action.MAIN android.intent.action.MAIN

com.applisto.appcloner.activity.MyOnboardingActivity

com.applisto.appcloner.activity.MainActivity

android.intent.action.VIEW android.intent.action.VIEW

com.applisto.appcloner.activity.ApkFileActivity

android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

com.applisto.appcloner.activity.SettingsActivity

com.applisto.appcloner.activity.UpdateActivity

com.applisto.appcloner.activity.RootInstallerActivity

com.applisto.appcloner.activity.RestartAppActivity

com.applisto.appcloner.activity.MasterPasswordActivity

com.applisto.appcloner.activity.HtmlEditorActivity

com.applisto.appcloner.activity.CodeEditorActivity

com.applisto.appcloner.activity.XmlDiffCodeEditorActivity

com.applisto.appcloner.activity.ManifestXmlDiffCodeEditorActivity

com.applisto.appcloner.activity.CustomCodeEditorActivity

com.applisto.appcloner.activity.WebViewCustomScriptEditorActivity

com.applisto.appcloner.activity.FridaScriptEditorActivity

com.applisto.appcloner.activity.CustomBuildPropsFileActivity

com.applisto.appcloner.activity.AppTranslatorActivity

com.applisto.appcloner.activity.WebBrowserActivity

com.applisto.appcloner.activity.ApkWebBrowserActivity

com.applisto.appcloner.activity.PurchaseWebBrowserActivity

com.applisto.appcloner.activity.AppsActivity

com.applisto.appcloner.activity.DevicesActivity

com.applisto.appcloner.activity.PreferencesEditorActivity

com.applisto.appcloner.activity.ManageBlockedHostsActivity

com.applisto.appcloner.activity.ManageBlockedNotificationsActivity

com.applisto.appcloner.activity.LayoutInspectorActivity

com.applisto.appcloner.activity.PlacePickerActivity

com.applisto.appcloner.activity.SpoofLocationActivity

com.applisto.appcloner.activity.QrCodeScannerActivity

com.applisto.appcloner.activity.TakePhotoActivity

com.applisto.appcloner.activity.UncaughtExceptionActivity

com.applisto.appcloner.activity.CopyTextActivity

com.applisto.appcloner.activity.WebViewUrlEditorActivity

com.applisto.appcloner.activity.LoadingActivity

com.applisto.appcloner.activity.IdentifyDeviceActivity

com.applisto.appcloner.service.vpn.SocksVpnServiceActivity

com.applisto.appcloner.api.Tasker$PerformActionActivity

com.twofortyfouram.locale.intent.action.EDIT_SETTING

com.applisto.appcloner.api.Tasker$GetCustomValueActivity

com.twofortyfouram.locale.intent.action.EDIT_SETTING

com.applisto.appcloner.api.Tasker$SetCustomValueActivity

com.twofortyfouram.locale.intent.action.EDIT_SETTING

com.applisto.appcloner.activity.AudioRecordingActivity

com.nbsp.materialfilepicker.ui.FilePickerActivity

util.ClearActivityStackActivity

util.RequestPermissionsActivity

com.android.billingclient.api.ProxyBillingActivity

com.android.billingclient.api.ProxyBillingActivityV2

com.google.android.gms.common.api.GoogleApiActivity

com.applisto.appcloner.api.NewIdentityReceiver

com.applisto.appcloner.api.action.NEW_IDENTITY

com.applisto.appcloner.api.LaunchCloneReceiver

com.applisto.appcloner.api.action.LAUNCH_CLONE

com.applisto.appcloner.api.ExportImportAppDataReceiver

com.applisto.appcloner.api.action.EXPORT_APP_DATA com.applisto.appcloner.api.action.IMPORT_APP_DATA

com.applisto.appcloner.api.ToggleAirplaneModeReceiver

com.applisto.appcloner.api.action.TOGGLE_AIRPLANE_MODE

com.applisto.appcloner.dialog.WriteNfcTagDialog$NfcBroadcastReceiver

com.applisto.appcloner.install.PackageManagerInstallerStatusReceiver

com.applisto.appcloner.AppUpdatedReceiver

android.intent.action.MY_PACKAGE_REPLACED

com.applisto.appcloner.util.wirelessadb.WirelessDebuggingHelper$PairingCodeReceiver

com.applisto.appcloner.service.http.RestartReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.MY_PACKAGE_REPLACED

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.joaomgcd.taskerpluginlibrary.action.BroadcastReceiverAction

com.twofortyfouram.locale.intent.action.FIRE_SETTING

com.joaomgcd.taskerpluginlibrary.condition.BroadcastReceiverCondition

com.twofortyfouram.locale.intent.action.QUERY_CONDITION

Android Permissions

APPCLONER_FINAL[𝗛𝗔𝗕𝗜𝗕𝗜™].apk

Permissions

android.permission.POST_NOTIFICATIONS

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.USE_FINGERPRINT

android.permission.USE_BIOMETRIC

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.ENFORCE_UPDATE_OWNERSHIP

android.permission.VIBRATE

com.android.vending.BILLING

android.permission.NFC

android.permission.WAKE_LOCK

android.permission.ACCESS_FINE_LOCATION

android.permission.CAMERA

com.applisto.appcloner.permission.DEFAULT

com.android.launcher.permission.INSTALL_SHORTCUT

android.permission.SYSTEM_ALERT_WINDOW

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECORD_AUDIO

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.READ_PHONE_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_COARSE_LOCATION

com.applisto.appcloner.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.android.vending.CHECK_LICENSE

Sharing

General

Malware Config

Signatures

File Explorer

APPCLONER_FINAL[𝗛𝗔𝗕𝗜𝗕𝗜™].apk

File Signature issue

com.applisto.appcloner.activity.StartActivity

com.applisto.appcloner.activity.CalculatorActivity

com.applisto.appcloner.activity.MyOnboardingActivity

com.applisto.appcloner.activity.MainActivity

com.applisto.appcloner.activity.ApkFileActivity

com.applisto.appcloner.activity.SettingsActivity

com.applisto.appcloner.activity.UpdateActivity

com.applisto.appcloner.activity.RootInstallerActivity

com.applisto.appcloner.activity.RestartAppActivity

com.applisto.appcloner.activity.MasterPasswordActivity

com.applisto.appcloner.activity.HtmlEditorActivity

com.applisto.appcloner.activity.CodeEditorActivity

com.applisto.appcloner.activity.XmlDiffCodeEditorActivity

com.applisto.appcloner.activity.ManifestXmlDiffCodeEditorActivity

com.applisto.appcloner.activity.CustomCodeEditorActivity

com.applisto.appcloner.activity.WebViewCustomScriptEditorActivity

com.applisto.appcloner.activity.FridaScriptEditorActivity

com.applisto.appcloner.activity.CustomBuildPropsFileActivity

com.applisto.appcloner.activity.AppTranslatorActivity

com.applisto.appcloner.activity.WebBrowserActivity

com.applisto.appcloner.activity.ApkWebBrowserActivity

com.applisto.appcloner.activity.PurchaseWebBrowserActivity

com.applisto.appcloner.activity.AppsActivity

com.applisto.appcloner.activity.DevicesActivity

com.applisto.appcloner.activity.PreferencesEditorActivity

com.applisto.appcloner.activity.ManageBlockedHostsActivity

com.applisto.appcloner.activity.ManageBlockedNotificationsActivity

com.applisto.appcloner.activity.LayoutInspectorActivity

com.applisto.appcloner.activity.PlacePickerActivity

com.applisto.appcloner.activity.SpoofLocationActivity

com.applisto.appcloner.activity.QrCodeScannerActivity

com.applisto.appcloner.activity.TakePhotoActivity

com.applisto.appcloner.activity.UncaughtExceptionActivity

com.applisto.appcloner.activity.CopyTextActivity

com.applisto.appcloner.activity.WebViewUrlEditorActivity

com.applisto.appcloner.activity.LoadingActivity

com.applisto.appcloner.activity.IdentifyDeviceActivity

com.applisto.appcloner.service.vpn.SocksVpnServiceActivity

com.applisto.appcloner.api.Tasker$PerformActionActivity

com.applisto.appcloner.api.Tasker$GetCustomValueActivity

com.applisto.appcloner.api.Tasker$SetCustomValueActivity

com.applisto.appcloner.activity.AudioRecordingActivity

com.nbsp.materialfilepicker.ui.FilePickerActivity

util.ClearActivityStackActivity

util.RequestPermissionsActivity

com.android.billingclient.api.ProxyBillingActivity

com.android.billingclient.api.ProxyBillingActivityV2

com.google.android.gms.common.api.GoogleApiActivity

com.applisto.appcloner.PersistenceService

com.applisto.appcloner.InstallService

com.applisto.appcloner.service.AppClonerService

com.applisto.appcloner.service.vpn.SocksAccessibilityService

com.applisto.appcloner.service.vpn.SocksVpnService

com.applisto.appcloner.service.http.AppClonerHttpServerService

com.applisto.appcloner.service.audio.AudioRecordingService

androidx.camera.core.impl.MetadataHolderService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.joaomgcd.taskerpluginlibrary.action.IntentServiceAction

com.joaomgcd.taskerpluginlibrary.condition.IntentServiceCondition

com.applisto.appcloner.api.NewIdentityReceiver

com.applisto.appcloner.api.LaunchCloneReceiver

com.applisto.appcloner.api.ExportImportAppDataReceiver

com.applisto.appcloner.api.ToggleAirplaneModeReceiver

com.applisto.appcloner.dialog.WriteNfcTagDialog$NfcBroadcastReceiver

com.applisto.appcloner.install.PackageManagerInstallerStatusReceiver

com.applisto.appcloner.AppUpdatedReceiver

com.applisto.appcloner.util.wirelessadb.WirelessDebuggingHelper$PairingCodeReceiver

com.applisto.appcloner.service.http.RestartReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.joaomgcd.taskerpluginlibrary.action.BroadcastReceiverAction

com.joaomgcd.taskerpluginlibrary.condition.BroadcastReceiverCondition