SkyVPN[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
SkyVPN.apk
Size 5.1MB
Sample260924-pk26datdmc
SHA256 bb0484c78fab76dc9b94e8e9bf4d48414e2c5442a30923516c86217f57ff54c5
MD5 3ea70b06c9aa86bbf0019fb26625f4c9
SHA1 a345dc388bd9179e4320f898b31b2e9eac13a23c
SHA512 d7f2c5910b360f5b8c02522c7c99d7a0cfbef3a91397c41c7c98a4f5299ad245bd381bb28afe549ecc068182da81a566cee7c48a6b96380ba85aa58f6932f1a4
SSDEEP 98304:BiSPmYDKwqBW9XCV+2lSGs53sTn/nzEE8bmKGurJsevGP67VwPc+SVPMYP:BiyTDKc1oxpPn/nzEdKKGu9xvGiwPD4P
TLSH
T1AE36122FDE4DFAA2CD464070803EA507A8D817DD0D11A00B87CEBA5BA6F785D4FA58DD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
SkyVPN.apk

File Explorer

SkyVPN.apk

.apk 5.1MB

SkyVPN.apk

SHA256 bb0484c78fab76dc9b94e8e9bf4d48414e2c5442a30923516c86217f57ff54c5
MD5 3ea70b06c9aa86bbf0019fb26625f4c9
SHA1 a345dc388bd9179e4320f898b31b2e9eac13a23c
SHA512 d7f2c5910b360f5b8c02522c7c99d7a0cfbef3a91397c41c7c98a4f5299ad245bd381bb28afe549ecc068182da81a566cee7c48a6b96380ba85aa58f6932f1a4
SSDEEP 98304:BiSPmYDKwqBW9XCV+2lSGs53sTn/nzEE8bmKGurJsevGP67VwPc+SVPMYP:BiyTDKc1oxpPn/nzEdKKGu9xvGiwPD4P
TLSH
T1AE36122FDE4DFAA2CD464070803EA507A8D817DD0D11A00B87CEBA5BA6F785D4FA58DD
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

855292a14705fe596ad4b7dbcd480bfbb6936d2d491da2f39250beecbdd4f1ca

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

C=86

com.mobilex.safe

com.template.shellapp.MainActivity

android.intent.action.MAIN

com.template.shellapp.SettingsActivity

com.template.shellapp.AboutActivity

x.hbuiz

x.mf.ZThyydXXSJR

x.mf.GDsS6yO7htbH

x.mf.DHysr3Adu5wI9G

com.mobilex.safe.mf.action.3uot2k2zmo9jhcueprahuqdx com.mobilex.safe.mf.action.jw6x0vykvf04rdzrk3z3s4k5

x.mf.UKSTEbtMTc

com.mobilex.safe.mf.action.j26q9ft2gwk6frtuy0qy9oxu

x.vo6kc.cs7.vz

x.fy6j

x.b5mm.o1pv.wq

x.grz.tlthc.ez1

x.mf.AnrS1sn9zRQ

x.mf.NniK9v96n2dT3X

x.yby.lkl.vqk

x.mf.C0RUenaGxx

x.mf.YyhZyPgobti

com.mobilex.safe.mf.action.r9ro7isfpol9kh9kv6ln4nhb com.mobilex.safe.mf.action.q630t5kti284dwrs24st8y2r

x.mf.TRwSNm2lWxF

x.mf.Nsf6oh4RNNnq

x.z3tu.z3ug.nz9

com.mobilex.safe.mf.action.6wgweobgpyd6v1ewlk63d332 com.mobilex.safe.mf.action.1t4cefw7d0x8ha304m1yonvr

x.mf.MWeLlvk59wJmrA

x.mf.SYj789iBfQDtuOp

x.mf.GwMYBVdCDP7EmBSg

x.mf.QsnXWOyvQIgIO6xF

x.mf.QC1Ga8vRzGqr

x.mf.UDIfBTJN0Rd

x.mf.E5krqOiOBw7bjLi

x.mf.W5hulIzgSQ3S

com.mobilex.safe.mf.action.n00ud2xu8bgssgf8clljmt8i

x.mf.BOO9gOlwonimlv

com.mobilex.safe.mf.action.umtfcg9ab5b3l4je6k373o2b

x.mf.GGlEpdEFyUN

x.mf.LNdisNkaCi

com.mobilex.safe.mf.action.on1drj6m2e39z7lq0uqba0jr

x.mf.LEr8Mt0Eb96jc4b

x.dy3yz.g7f.tp0

x.mf.WyF4LFQvognM

com.mobilex.safe.mf.action.sj1vaa7gn2y4jh1li6fiy26m com.mobilex.safe.mf.action.8qce8ffw1a1wxqlepm786igb

x.xftp

com.mobilex.safe.mf.action.pc7f0onrifd0gl3gtok6f7t4

x.mf.XGbbrMsBqXrE

com.mobilex.safe.mf.action.qj3u0alpievbvcbwlffkz2zl com.mobilex.safe.mf.action.x6ti3al96x9fek6a2apw33ov

x.mf.CQeZkL5kz3oEEC3

x.mf.B7uqjQEQfs

com.mobilex.safe.mf.action.k7ckq6zwce5hnx9os2oz6l6o

x.yxud.f31.io

x.mf.WxFdUZNPthgoL

x.mf.Y0BeKNp8497Qq

x.mf.XQKJPF429Jc

x.mf.DH73eJea40

x.ntl.a2di.ix

x.mf.SQOSS6UpdfkBS

x.mf.X9CljD32ocgmW4E

x.mf.G8rwdlRnBKM

x.mf.Wp9Y6ikq8Lo

com.mobilex.safe.mf.action.8pnvfnyh02j56c5dhyfwg58p

x.mf.RpOqEvIhvfUDfv

x.mf.ZqJJT7MrenpvA

x.mf.HnyQuE9Yd4

com.mobilex.safe.mf.action.j9v2gksaf74bf8m32eyvurwx com.mobilex.safe.mf.action.5cyzb54q9k1tnnp843a2qpzo

x.mf.Z1FTaMe2YaNHOpi

x.wwf4h.wztg.oq

x.hw3.g8y0.cal

x.mf.TYERBjBpNXr2

x.mf.KNmEwTynv3

x.mf.VD14uh8D943oi

x.mf.MzLmjNRW9Kxoki

x.mf.XeUQYAObAKug5rZ

x.kjj

x.mf.XNruRkJAdi4

x.mf.L41folBhPc7

x.mf.WkzkLxTc88LYN

com.mobilex.safe.mf.action.mk774symnn67x0fq4j2jsgfn com.mobilex.safe.mf.action.h4cgq2si6xzkmtcnmhgjjimj

x.alxi9.jnpq.we

x.lgvi.ozdk7.vu

x.mf.A0xi1nE16AA3

com.mobilex.safe.mf.action.3n6dr9ro58llc5sterj2pqtd

x.mf.XuK2IFB0XAG9eTQ

x.fuqqf.zrcwl.yk

x.mf.N5EIRolOISjc7t

x.mf.BZVLJx1YGBU5J2kV

x.mf.X0fmklVbykRgb3a0

x.xjb8.s7v8r.a0

x.mf.NrZYS4LOJRLyBD

x.mf.Ddy6leeq8NmUVg

x.mf.Z6s5MqqtBpM8Zamp

x.g181

com.mobilex.safe.mf.action.yjjkk7usvyf0hksgrnzv2yjb

x.ri41y

x.mf.RuzL4EKCgW

x.mf.BC58vhj6uUEOYQ

com.mobilex.safe.mf.action.05zt8taufdy6915ap3g86nfa

x.mf.ZWjKJzYtHWoa7

com.mobilex.safe.mf.action.5euxp5gf8xx35v7tfj8clmbz com.mobilex.safe.mf.action.luv8ksf7lykj3luqlxk6nkbs

x.mf.BpwwjJ2b9uk

x.mf.I3iiddyoEqzeh0aA

x.jcg0h.fbz0.lgl

x.elxrr.baoi.mg

x.mf.VL80e4PNcMiOUk

x.mf.HVdO4kMxnaUFjif

x.mf.NpCAuTgCc2fzrk7

x.mf.RlBRS5LaCdzvlB

com.template.shellapp.services.SyncService

com.template.shellapp.services.BlockVpnService

android.net.VpnService

x.mf.RrAUjLTXNFYVkOPX

x.mf.PfP1iReG0QuiUu

x.mf.Y7EoDMUSSHe

x.mf.N0Vb7D2cSiG

x.mf.DHTPil3UqsGmhXXG

com.mobilex.safe.mf.service.action.zm279sw8vtq3gsterw31

x.erg.r3e.kiq

x.mf.LvMoogKdDgNQo

x.mf.Rq8nVhVUf8Kd

com.mobilex.safe.mf.service.action.7pasecfstsob6elkob8c

x.lcd.a3cb.bg

com.mobilex.safe.mf.service.action.hmmt7c2tew8cbgfigg0o

x.mf.BtdAR5fq34

x.mf.Me4mz0Xw079

com.mobilex.safe.mf.service.action.m5b6i2z9pop85u6b7bf3

x.mf.COEF0YoYMOJ

x.mf.BixFX92tPgmIbeb2

x.eltab.a7yph.tt

x.mf.K4q3ibe29zaSv

x.mf.UkeeQVj1LNOhGT

com.mobilex.safe.mf.service.action.gj8duvpy95z1dky8arie

x.mf.V4BD6wZMAR

x.mf.AuYl1pMHHu

x.mf.MgV4LKnHXo

x.qflw.wzk.w5

x.pxhl.ipa9.ay

x.mf.BE57ykc6ZmyMC

x.mf.DhkkRmH1C8n

x.mf.FvUAUSwY6R

x.mf.SwHVQJOrDDBAc

x.mf.W0nGX0NupvL

x.mf.UrSka1h5qrk0rWpR

com.mobilex.safe.mf.service.action.ivdt6djka9abfqd4c1qd

x.mf.KHYnkEeSPQy

x.mf.Of2bCCbmmzgQ

x.mf.MyWQYiuHIei5aL

x.mf.S4OdCxQN0z

x.tlfe.r5o.ro

x.mf.ZJcnUJMWP4

com.mobilex.safe.mf.service.action.dn097yhqpte9tvq3bxvm

x.s6wvg

x.mf.TgQcDOe0ia0Yv

x.mf.ENShYIG9nQoRBE

x.bq94t.iao10.ukw

x.mf.N93vNfstmdbb

x.mf.Tora2F7vmcbNqBSu

x.mf.Y6Y0aCedimzB3

x.mf.ZJakWxc2E7Y

x.oytc7

com.mobilex.safe.mf.service.action.m7e9jt61lysqqxk33d8c

x.d7r.mydf.fjs

x.mf.GjaGCvTvs9P

x.mf.Pr0rRAlY75h

com.template.shellapp.CB

com.template.shellapp.receivers.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.MY_PACKAGE_REPLACED

x.mf.Q7vc2WyycpWQ5YM

x.srz

x.mf.H5aZUV9nKlkIV11

com.mobilex.safe.mf.receiver.action.d4zkdbso8lqd4hhyctvb

x.mf.MmWiRmvYYYNR

x.kiy

x.sht14

x.mf.PE6cpFmFSBZK8

x.epq.vfnur.oo4

x.mf.MVqBRIcxxI6

x.mf.F4P3eOwTL4IRf

x.mf.L94PbABsKtg4wq

com.mobilex.safe.mf.receiver.action.zdznf2qkh45ffnj1jnzz

x.mf.NqixVj5jp4b

com.mobilex.safe.mf.receiver.action.gvt3pza3qk3p6fqo4kn4

x.mf.KyiHFqCQ1jgLjL

x.mf.PwGXOSybUsSGV

com.mobilex.safe.mf.receiver.action.qsq9834agh27lxvvq5mi

x.mf.YPwfpN32MqAQD

com.mobilex.safe.mf.receiver.action.j4faodisfp5x05v7m5th

x.mf.Ve7yA2IoLN3Pa

x.cuyn6

x.k06.txs30.y1

com.mobilex.safe.mf.receiver.action.rwhqiguhbk5qoupvrj6e

x.shbgt.jh5h.sx

x.mf.YDkLfljDHUNRxC4

x.mf.QJ8eXwoYrYQL4y

x.mf.Pk1J8O4X52gwdCRw

x.mf.FU2hVkVgCLEz

android.intent.action.BATTERY_LOW

x.mf.Kk8cNrIjz9

x.mf.PSN04KNAzo

x.mf.PHQ1quN7fRnXU

x.mf.AIEJ3JJJISM

x.ks4mk.byb.oge

x.mf.I1GD2gakum

x.mf.Xm17Ppaq29I

Android Permissions

SkyVPN.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.QUERY_ALL_PACKAGES

com.mobilex.safe.permission.MF_INGAC12FI118JA9U6BBA244T

com.mobilex.safe.permission.MF_9AGALDE7P60K3UTIGZ8A6S9X

android.permission.EXPAND_STATUS_BAR

android.permission.SYSTEM_ALERT_WINDOW

com.mobilex.safe.permission.MF_BWXVANFEOG9B6X7R9090HH3X

com.mobilex.safe.permission.MF_VJRUE5O9MUNLBEI6XJ5Q0F4C

com.mobilex.safe.permission.MF_S2JXG94S521MBNQMW22YEH89