093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2.apk
Size 5.0MB
Sample260922-j8mspsty7r
SHA256 093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2
MD5 b4711724f35ba2db50e327682d5587a4
SHA1 b3e0299cf7affa4111032fb2507cc34a97ffedec
SHA512 0b84c29f6f2e788cb98b55475030e97924d68fde31b6acd23796cc1b0392b0b1b75c679436bfc2f99eb569b2d16b7184f0d3251e647053f748675d2d029e64f7
SSDEEP 98304:ol/8Jkbl7DQXG9GRHW1mDH3D1XjZf33IT8PGV8J61wq5aE:G8JkpXQXG9UH3RTZfnIOzqYE
TLSH
T15336015FDE89B965EC1B0475803DAA1790E413DC8F05D02F87ED6AA758E28DC0FD48EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2.apk

File Explorer

093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2.apk

.apk 5.0MB

093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2.apk

SHA256 093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2
MD5 b4711724f35ba2db50e327682d5587a4
SHA1 b3e0299cf7affa4111032fb2507cc34a97ffedec
SHA512 0b84c29f6f2e788cb98b55475030e97924d68fde31b6acd23796cc1b0392b0b1b75c679436bfc2f99eb569b2d16b7184f0d3251e647053f748675d2d029e64f7
SSDEEP 98304:ol/8Jkbl7DQXG9GRHW1mDH3D1XjZf33IT8PGV8J61wq5aE:G8JkpXQXG9UH3RTZfnIOzqYE
TLSH
T15336015FDE89B965EC1B0475803DAA1790E413DC8F05D02F87ED6AA758E28DC0FD48EA
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

dfcdcd181c8a7297b3f876983d6448dbc8aba90d3ee2e115c90ccc32b485f5bc

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

C=86

com.appworks.helper

com.template.shellapp.MainActivity

android.intent.action.MAIN

com.template.shellapp.SettingsActivity

com.template.shellapp.AboutActivity

x.mf.U2SFdrRcs3HhQ

x.mf.TRiljjUdKOpx7

x.iu9

x.mf.K9BdJ0NBrEGoNrw

x.rw9.vdu.h8a

x.mf.Ubn8J8I9oIaTt7

x.mf.D5jhoJ0oK9qLrXRF

x.mf.BJobwQiWkj

com.appworks.helper.mf.action.nxrrv5wxbaq4eaqhrjhlo6cj com.appworks.helper.mf.action.meoblp14ldafhtoqky57y94m

x.atd0

com.appworks.helper.mf.action.e96shnqwqzfb9ysodmwg4ysw com.appworks.helper.mf.action.cy03qb6e19egew71qjr1zgr0

x.fykl8

x.mf.G5RPOxtb97X

x.a5mo.wwk.rc2

x.mf.DTeE9WBMyBHX

x.ath.g87i.ih

x.mf.WG63js50z9

x.d9t2o

x.mf.Q58oJpHknI0g

x.brx4c.daum5.ta

x.pd3x

x.mf.RJsALMVY162kL

x.l27.zvh.c0

x.mf.SjCO7Wy45Z

x.mf.RGpVr0f4aWj7Ea

x.uqi

com.appworks.helper.mf.action.91ftay33oxgo6iatohs71wwk com.appworks.helper.mf.action.u3gyhuywscsnki1i5333gl0u

x.mf.XaqVwVysUsl2o

com.appworks.helper.mf.action.osx1g5183nrrh3b3355gzw4s com.appworks.helper.mf.action.uv94f0iwdegc4omvjzozls06

x.lpgn.mom.aj

x.ma4w7.ojtjo.k3o

x.qza

x.mf.QbIfBBbByR4d

x.mf.LEM4STkZFuu

x.mf.NbHp8oEkcDEK6zo

x.iz7m.pjn.cn

com.appworks.helper.mf.action.cbkxulk1oudcfbj07371xf7w

x.mf.OMEo2HkAwUmT

x.pxcd.n4r.sri

x.bi0

x.mf.WjMhZgzC3dU

x.mf.Y7WNSkVWL4

x.xp7.i0c61.h0

x.mf.OPlCM7w9bI

x.mf.CVfJ9qNXWy

com.appworks.helper.mf.action.1i3u6zfsow0ij5g9u27gljrr com.appworks.helper.mf.action.e7bgd1e12nerrma4lpza4xsh

x.tdhh.bay8y.vo1

x.m531.wq6.p3

x.gj6.ue0a.p5y

x.mf.YzEVR5BAMdBc

x.mf.JzMAS3VKhgS

x.mf.L1ScXr2yN33VmPo

com.appworks.helper.mf.action.ss8xso8xphprtrlictpuk30f

x.mf.RxMA5SLpjA0o3pw

x.mf.LZh7vHqXagB

x.mf.Ez2U2SW0Rs

com.appworks.helper.mf.action.fn7tktthlgi2x1dat00vyf42 com.appworks.helper.mf.action.jm03aqsstwv2jnr1my75rs5i

x.mf.RqT2y59X0yISjNOx

x.boz.y89d.j2

x.mf.EtXWjKplL0MVy5M

x.mf.K0Q5l8AgChPSk

x.mf.L9TmAUPCu8

com.appworks.helper.mf.action.l94hhyki8rd1x7rbwk6pk6me

x.mf.Lj54JUUeO1

x.zpi

x.mf.GhqI6CPxIrb

x.h7m

x.mf.RJywheAeyRGpdYHy

x.xph6

x.mf.XSv7BIazmQr1Un3a

x.w4u

com.appworks.helper.mf.action.art5qcxsr4au4rg1c9vdg9km

x.mf.T5UOC5F0v7I

com.appworks.helper.mf.action.wbgbmqqa8tamvyuv0sperfux

x.mf.HDdtqO5NTIeI1

com.appworks.helper.mf.action.h3r2yraykxut38kqp9hry9ey

x.mf.ZSN4sPv79Mq

x.mf.JGo2m7niFw1FRzud

x.i204.t9cut.gg

x.mf.OwZFZYe9rV2c

x.mf.K6Qpn5acdZeopHF

x.mf.YrCzDFSoYpRe

x.mf.OwKa0ImzoO

x.mf.ASgbL8SdyNn

x.mf.B4WPiDN4g9F

x.szxdu.k1r.op

x.mf.NdjI52aSDpXvqiv

x.mf.XRviuveHFHeld9a

x.mf.Z37P7cNiKCvXIxE

x.mf.KeNE1YxmsnGeaK

x.mf.MBdlePY8zB6

x.mf.NchYixhZU64wyU

x.mf.O0UpkUNu1u7Vt0

x.mf.BSxDBTMIToey

x.mf.WhQ5nB3CaC

x.qlb.snd68.tc

x.mf.SXLB2vemSXC5MG

com.appworks.helper.mf.action.yu73uckw52jjor1lhejya5sl com.appworks.helper.mf.action.wmr0s973ib75p0x13spkt88l

com.template.shellapp.services.SyncService

com.template.shellapp.services.BlockVpnService

android.net.VpnService

x.mf.XqQzZjRCfA2

x.kwq.qixca.e9

x.tucyl.fq0h8.cl7

x.ssnz

x.mf.SFTPR9pyfr5v

x.mf.I6ZCCGDvjc

x.mgp

x.mf.VJKTNXxYfta

x.mf.Qn18P8VtwaTmAKma

x.fgv0h.zjz.cm

x.mf.BI8kcX5Y2Pl

com.appworks.helper.mf.service.action.p19qro0zuob5qlifuekw

x.mf.F2HJ0Z2Hudsq2IH

x.opu9.jynmt.t57

com.appworks.helper.mf.service.action.972n83dt6jpum937comh

x.mf.VaOFAvWXvKWCl

x.e52ao.oq5o.kb

x.mf.QiEES8eBAA

x.mf.MOly4RYn94jvjkY

x.mf.XpzlpKPxXZJrKAmo

x.mf.Bj5B1qn3Kb3oa2bT

x.mf.Ghuu2y8h8Jy1

x.mf.QKmRkqibKVRG1umD

com.appworks.helper.mf.service.action.dabe7sx1okk7ldqo3xjv

x.pq8mq.ck0.h5

com.appworks.helper.mf.service.action.bt09uxvkg5x9g4s1j95d

x.kee.qjv1.akf

com.appworks.helper.mf.service.action.t0ng2uuhc7gbu402xxi8

x.ki3.m0mwi.yb

x.l9p4

x.mf.MBiRfJCo2UNQ37Qb

x.mf.L6wcShGUQeP

x.mf.F7N44PTzGL5E0i

x.n7bgq

x.mf.R3s3hIq75mJJ5U

com.appworks.helper.mf.service.action.89917wbjs8qbj1dugmgn

x.mf.AbStW2QGr8mjcAP

x.mf.DngIbmScchITaab

x.n26

x.mf.Jt2ZMKZXGCWL

com.appworks.helper.mf.service.action.ig07ud0mvrsue0c43ipf

x.mf.LaADvSX9GmjL

x.y6pf.z74g0.qc

x.mf.V1T1HvI3nbUj5tlv

x.mf.D7J5LP5e5NAXFVy5

x.mf.L9SJJez7qIQ3A5

x.mf.T7GsJtHsZy6

x.mf.BqL5WMUwmG1

x.pohn.g560.is

x.mf.VBEB8OxK3Wh67

x.mcrxq.wus3p.g2

x.mf.KH30uP9zqHKypB

com.template.shellapp.CB

com.template.shellapp.receivers.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.MY_PACKAGE_REPLACED

x.r7oej.paqt.m7

x.ez24x.k902.fz

x.mf.G8vLDQvga1

x.mf.MPMVwjqcBl

x.mf.XYH8b0lFX3KQ7yKP

x.mf.V7xNAv3PYiTT27

x.mf.HBIejcaA6rEa6n6

x.attk0.t360.mo

x.mf.EVqeea9snr

x.mf.LUu7zZGA3DZ2T

x.td5.weg.n88

x.mf.Z9A73IEK1a4

x.mf.W5wrWenJ8IW3Z6ha

com.appworks.helper.mf.receiver.action.6jytcnnkibr647dyyn1c

x.l8rt.anw.bpo

x.mf.O5uotpa8VQe

x.mf.T15nb0dzTInIiZiw

android.intent.action.PACKAGE_REMOVED

x.mf.WfqMhsz317

x.mf.CfnW998EGkqJi

x.vpn.mzr0u.xhc

com.appworks.helper.mf.receiver.action.qb6ddxy30ue0whaikshp

x.c62fg.s94.zv

x.mf.GefseMdpS9

x.mf.R9hAT9z9oGflB4c

com.appworks.helper.mf.receiver.action.6w313f2im04sj41kdhev

x.rg4

x.ov1a.r3z.th

x.mf.TOuN8jg8rVU

com.appworks.helper.mf.receiver.action.nl61r65bh9c8ps8601u8

x.mf.AFp0TzfZD4LR

x.mf.ZD86UfPX5SKp5

x.mf.RXvo0yttI2gD

x.mf.YtapwqTDTjnoP

com.appworks.helper.mf.receiver.action.5p12kkmpf2rtlq4unfxv

x.mf.XLJjVb0Ix9gECGZ

Android Permissions

093f0a27b92199fcb1fbbda0d94130593cbc5767ba92cfb02afd30768d2441a2.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.QUERY_ALL_PACKAGES

com.appworks.helper.permission.MF_1HV9KJ8VNASN9TW5WHOSPPYG

com.appworks.helper.permission.MF_W470J41HEYJQ1VYY2RZUISYI

android.permission.SET_WALLPAPER

com.appworks.helper.permission.MF_ZOND9LDJDC1IRJZO2JR2I86X

com.appworks.helper.permission.MF_C6G9HJ3F3SIN6ZLGKFRDL8GC

com.appworks.helper.permission.MF_F1JDT4Z1G28E6N5FUSPUTXPL

android.permission.VIBRATE

android.permission.SET_WALLPAPER_HINTS

com.appworks.helper.permission.MF_NDD8HY9R7I2DV6HOY6Q5HAI3