VRTV[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
VRTV.apk
Size 26.2MB
Sample260920-ankceazyhv
SHA256 f3ef3fe882ad9d60fa206a3547a6b1ffb0a0e71c308186b330371bdc0a3bd32c
MD5 1eb35297235da17003ece7e377e17794
SHA1 8c3432c04e54132dd39aa1e82d4a17afc349d7c5
SHA512 ea8de33981f7ac365bae62c0a4b630a4a34cbbdf3c154c02db093e4e6471ececb03c0788e06e85d9177dd7a2da05683cc12a6eefb1697b64f0ce578991a0efe7
SSDEEP 786432:ACxU13dIGikiHm7NCKHaLJm8+ueGTSE0AHJHA/:ACe13dIiiHCAKHKJoHJE0ApHy
TLSH
T173573342E34F9C1FCAF7453287BB160A509A2E968353D7534964B33C29B7AC44E86FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Unsigned APK 4 IoCs

Checks for missing APK codesign signature.

resource
VRTV.apk
unpack001/gwwmwfatxdzyslsdzorru1
unpack001/wsmhajrkvcfdq2
unpack003/scrcpy_server

Untrusted Codesign Signers 3 IoCs

Codesigned file was signed by an untrusted entity.

resource
VRTV.apk
unpack001/gwwmwfatxdzyslsdzorru1
unpack001/wsmhajrkvcfdq2

File Explorer

VRTV.apk

.apk 26.2MB
gwwmwfatxdzyslsdzorru1

.apk 13.2MB
scrcpy_server

.apk 716KB
wsmhajrkvcfdq2

.apk 10.9MB
scrcpy_server

.apk 716KB

VRTV.apk

SHA256 f3ef3fe882ad9d60fa206a3547a6b1ffb0a0e71c308186b330371bdc0a3bd32c
MD5 1eb35297235da17003ece7e377e17794
SHA1 8c3432c04e54132dd39aa1e82d4a17afc349d7c5
SHA512 ea8de33981f7ac365bae62c0a4b630a4a34cbbdf3c154c02db093e4e6471ececb03c0788e06e85d9177dd7a2da05683cc12a6eefb1697b64f0ce578991a0efe7
SSDEEP 786432:ACxU13dIGikiHm7NCKHaLJm8+ueGTSE0AHJHA/:ACe13dIiiHCAKHKJoHJE0ApHy
TLSH
T173573342E34F9C1FCAF7453287BB160A509A2E968353D7534964B33C29B7AC44E86FC9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Unsigned APK

Checks for missing APK codesign signature.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

3bdf93fd897a1a4127d8a882c51727f0c3d505e32e94f1eec12924147106d503

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=editor

cxiw.bhmsxz.izhyxha

gwwmwfatxdzyslsdzorru1

SHA256 32d8f13c97bd8de046cefd97b4717fb7aa7c2f5a90aad79d20621eecfc3b4573
MD5 edad09b2e78e4cb58b3e230f7c8e5781
SHA1 4d01f339913629f0aaf3cacdbecf2188692f6ede
SHA512 eb7fc6460d01e3614ae9a4d315a2e6c5ea5aba0ee8176a52f0bfadc69842f6eb9815073760300d7bc0d46f58842491e83ebfad8ce86649d8844d78ac8b01fc84
SSDEEP 393216:aCG3j+zYnHZCuqvAiTAmFOXEhYpEIVUMe5f/:aCG3rfq1TAyOXV6IVUMe5n
TLSH
T15AD61246F709A83EC4F7833355761626607BCD658743DA876D1C723828B7ADC4B8AEC8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Unsigned APK

Checks for missing APK codesign signature.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

213eee023b1225d101fac41108ef29124dd9075d9e09185b1f19a50d226ba616

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=editor

cobalt.mountain.fighter

cobalt.mountain.fighter.HomeActivity

android.intent.action.MAIN

cobalt.mountain.fighter.Splasher

android.intent.action.MAIN

cobalt.mountain.fighter.HomeSIM

android.intent.action.MAIN

cobalt.mountain.fighter.HomeWallp

android.intent.action.MAIN

cobalt.mountain.fighter.HomeSmsung

android.intent.action.MAIN

cobalt.mountain.fighter.valhalla435znqfbfmyjq26

cobalt.mountain.fighter.kingpind416mjlqj7

cobalt.mountain.fighter.raviney463pewrhf54

cobalt.mountain.fighter.treasure472civdxllksdhwd63

cobalt.mountain.fighter.canyon471gwbjwoyvpb62

cobalt.mountain.fighter.nugget441aqbmkmn32

cobalt.mountain.fighter.breezex424oedea15

cobalt.mountain.fighter.speakit

cobalt.mountain.fighter.jadem419mwstoxojrx10

cobalt.mountain.fighter.orchard454stqjboe45

cobalt.mountain.fighter.zipperc413upvgno4

cobalt.mountain.fighter.Toastit

cobalt.mountain.fighter.rainforest459jtkltp50

cobalt.mountain.fighter.miracle466maxtpcczcc57

cobalt.mountain.fighter.Inputharvest462wyupiyxoviu53

cobalt.mountain.fighter.xenith445tjcwota36

cobalt.mountain.fighter.guitarf456sqdtutcu47

cobalt.mountain.fighter.citadel484nvpkfvnerj75

cobalt.mountain.fighter.firwood479hiqpfcwqddn70

cobalt.mountain.fighter.nova460xwqxkpa51

cobalt.mountain.fighter.harvest462wyupiyxoviu53

cobalt.mountain.fighter.peppera474pyysuyiets65

cobalt.mountain.fighter.xenialh475kmvqoqzt66

cobalt.mountain.fighter.cathedral464frsciknceez55

cobalt.mountain.fighter.action

cobalt.mountain.fighter.maximumf415qeycqpbg6

cobalt.mountain.fighter.justiceq476towq67

com.google.android.gms.common.api.GoogleApiActivity

cobalt.mountain.fighter.alarme

cobalt.mountain.fighter.ALARMS

cobalt.mountain.fighter.lighter469ttauvfohvtw60

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

cobalt.mountain.fighter.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

wsmhajrkvcfdq2

SHA256 849602010341112fd6b56e2bcbd2dd240a40004bb503e3f897a6477578adc2fd
MD5 0b9fb974fbf14b67ccef49a283dca98e
SHA1 65b2fcafb10a89ad2f69458d5057334d6a4cc373
SHA512 dac9a08ae69fd3647b0939db2180e6403bd2da1c289730eca31f587d71667c14b18f21397cd0fdaf2e807881f8efa1de2c92fe659493de1351b614e2ed023981
SSDEEP 196608:eMZirHgMNfvdqkgfBApdPewXsOF+aG+n4gUdg2EgQifVZlw5uM/cXus/fZpol:BZirHgMNHdAApdP96PEIVIieSfEl
TLSH
T182B61246F759E83BC4F7833246761626617BCD658B43D287595C723828B7ACC0F8ABC8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Unsigned APK

Checks for missing APK codesign signature.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9ebfc6eb20e8739057d94e5dcec1b64456d251db99cacb9385b7ab66b708a3fd

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=editor

cobalt.mountain.fighter

cobalt.mountain.fighter.HomeActivity

android.intent.action.MAIN

cobalt.mountain.fighter.Splasher

android.intent.action.MAIN

cobalt.mountain.fighter.HomeSIM

android.intent.action.MAIN

cobalt.mountain.fighter.HomeWallp

android.intent.action.MAIN

cobalt.mountain.fighter.HomeSmsung

android.intent.action.MAIN

cobalt.mountain.fighter.valhalla435znqfbfmyjq26

cobalt.mountain.fighter.kingpind416mjlqj7

cobalt.mountain.fighter.raviney463pewrhf54

cobalt.mountain.fighter.treasure472civdxllksdhwd63

cobalt.mountain.fighter.canyon471gwbjwoyvpb62

cobalt.mountain.fighter.nugget441aqbmkmn32

cobalt.mountain.fighter.breezex424oedea15

cobalt.mountain.fighter.speakit

cobalt.mountain.fighter.jadem419mwstoxojrx10

cobalt.mountain.fighter.orchard454stqjboe45

cobalt.mountain.fighter.zipperc413upvgno4

cobalt.mountain.fighter.Toastit

cobalt.mountain.fighter.rainforest459jtkltp50

cobalt.mountain.fighter.miracle466maxtpcczcc57

cobalt.mountain.fighter.Inputharvest462wyupiyxoviu53

cobalt.mountain.fighter.xenith445tjcwota36

cobalt.mountain.fighter.guitarf456sqdtutcu47

cobalt.mountain.fighter.citadel484nvpkfvnerj75

cobalt.mountain.fighter.firwood479hiqpfcwqddn70

cobalt.mountain.fighter.nova460xwqxkpa51

cobalt.mountain.fighter.harvest462wyupiyxoviu53

cobalt.mountain.fighter.peppera474pyysuyiets65

cobalt.mountain.fighter.xenialh475kmvqoqzt66

cobalt.mountain.fighter.cathedral464frsciknceez55

cobalt.mountain.fighter.action

cobalt.mountain.fighter.maximumf415qeycqpbg6

cobalt.mountain.fighter.justiceq476towq67

com.google.android.gms.common.api.GoogleApiActivity

cobalt.mountain.fighter.alarme

cobalt.mountain.fighter.ALARMS

cobalt.mountain.fighter.lighter469ttauvfohvtw60

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

cobalt.mountain.fighter.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

VRTV.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.POST_NOTIFICATIONS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.QUERY_ALL_PACKAGES

app.pwhs.universalinstaller.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.ENFORCE_UPDATE_OWNERSHIP

android.permission.INTERNET

android.permission.POST_NOTIFICATIONS

cxiw.bhmsxz.izhyxha.permission.PROCESS_PUSH_MSG

cxiw.bhmsxz.izhyxha.permission.PUSH_PROVIDER

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.UPDATE_PACKAGES_WITHOUT_USER_ACTION

Sharing

General

Malware Config

Signatures

File Explorer

VRTV.apk

File Signature issue

cxiw.bhmsxz.izhyxha.tagbmegwxdfeezsnsguf5

cxiw.bhmsxz.izhyxha.dvdwyggnvfzctrrttozuu10

cxiw.bhmsxz.izhyxha.cnwwevbdgboanrcpqozfqom12

cxiw.bhmsxz.izhyxha.splash

cxiw.bhmsxz.izhyxha.HelpActivity

cxiw.bhmsxz.izhyxha.gevexbhgdndyybhlofqbytn11

cxiw.bhmsxz.izhyxha.igpuuwzabjobvtekwpaqhyeb13

cxiw.bhmsxz.izhyxha.agnrdhvkdcuvkyftkglv14

cxiw.bhmsxz.izhyxha.seabreeze432gnmdoxjko23

cxiw.bhmsxz.izhyxha.trdzrkmsolhxowyircauvxfu4

gwwmwfatxdzyslsdzorru1

File Signature issue

cobalt.mountain.fighter.HomeActivity

cobalt.mountain.fighter.Splasher

cobalt.mountain.fighter.HomeSIM

cobalt.mountain.fighter.HomeWallp

cobalt.mountain.fighter.HomeSmsung

cobalt.mountain.fighter.valhalla435znqfbfmyjq26

cobalt.mountain.fighter.kingpind416mjlqj7

cobalt.mountain.fighter.raviney463pewrhf54

cobalt.mountain.fighter.treasure472civdxllksdhwd63

cobalt.mountain.fighter.canyon471gwbjwoyvpb62

cobalt.mountain.fighter.nugget441aqbmkmn32

cobalt.mountain.fighter.breezex424oedea15

cobalt.mountain.fighter.speakit

cobalt.mountain.fighter.jadem419mwstoxojrx10

cobalt.mountain.fighter.orchard454stqjboe45

cobalt.mountain.fighter.zipperc413upvgno4

cobalt.mountain.fighter.Toastit

cobalt.mountain.fighter.rainforest459jtkltp50

cobalt.mountain.fighter.miracle466maxtpcczcc57

cobalt.mountain.fighter.Inputharvest462wyupiyxoviu53

cobalt.mountain.fighter.xenith445tjcwota36

cobalt.mountain.fighter.guitarf456sqdtutcu47

cobalt.mountain.fighter.citadel484nvpkfvnerj75

cobalt.mountain.fighter.firwood479hiqpfcwqddn70

cobalt.mountain.fighter.nova460xwqxkpa51

cobalt.mountain.fighter.harvest462wyupiyxoviu53

cobalt.mountain.fighter.peppera474pyysuyiets65

cobalt.mountain.fighter.xenialh475kmvqoqzt66

cobalt.mountain.fighter.cathedral464frsciknceez55

cobalt.mountain.fighter.maximumf415qeycqpbg6

cobalt.mountain.fighter.justiceq476towq67

com.google.android.gms.common.api.GoogleApiActivity

cobalt.mountain.fighter.dahlia452gaijhmhqn43

cobalt.mountain.fighter.octavei483fiqysiu74

cobalt.mountain.fighter.upliftk418xpmynkep9

cobalt.mountain.fighter.oasisn458rrmqc49

cobalt.mountain.fighter.seabreeze432gnmdoxjko23

cobalt.mountain.fighter.artist433vekiyo24

cobalt.mountain.fighter.harvestd470kqyysfy61

cobalt.mountain.fighter.builder446yyrojrsnp37

cobalt.mountain.fighter.minserv

cobalt.mountain.fighter.orchidf417rapgdsrllm8

cobalt.mountain.fighter.dolphin468kftdmtidojc59

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

cobalt.mountain.fighter.alarme

cobalt.mountain.fighter.lighter469ttauvfohvtw60

cobalt.mountain.fighter.ResetServices

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

scrcpy_server