qd04jtgx[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
qd04jtgx.apk
Size 92.9MB
Sample260925-n5v25a1xes
SHA256 b745bf75b69f72e4b984962a558f19e9bcf007848beba1f59e8206aad11e8c99
MD5 68df47067e3e994e59b7010212b1401b
SHA1 ec9578fd5aa4f5cc740f796ea40f1239289c28a2
SHA512 fc16e55f4d19cb58fcc9ec1463fe396aa1fe22832ead5c2232b642c33958de5f7bc27c3f82e6905dee9dc6f25a08a1b74149d2e044419724c97edd78e91de484
SSDEEP 1572864:5ab3gnyoIf124GUVjGd3QiT1OHIrrN8fNWlefwRlTqN6pQDmvWxuClXaSkn3/:5C3MQ1xGUVilQVHIlONseIRlmN6iDmv9
TLSH
T12528234FF3487AA9C0FA337556B2043662994E308B13D5931950FB7E64BBAE05A0B7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by chooser target services to bind with the system. Allows apps to modify targets that handle user actions.	android.permission.BIND_CHOOSER_TARGET_SERVICE
Required by telecom connection services to bind with the system. Allows apps to manage phone call aspects such as call setup and notifications.	android.permission.BIND_TELECOM_CONNECTION_SERVICE

Requests dangerous framework permissions 7 IoCs

description	ioc
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
qd04jtgx.apk

File Explorer

qd04jtgx.apk

.apk 92.9MB

qd04jtgx.apk

SHA256 b745bf75b69f72e4b984962a558f19e9bcf007848beba1f59e8206aad11e8c99
MD5 68df47067e3e994e59b7010212b1401b
SHA1 ec9578fd5aa4f5cc740f796ea40f1239289c28a2
SHA512 fc16e55f4d19cb58fcc9ec1463fe396aa1fe22832ead5c2232b642c33958de5f7bc27c3f82e6905dee9dc6f25a08a1b74149d2e044419724c97edd78e91de484
SSDEEP 1572864:5ab3gnyoIf124GUVjGd3QiT1OHIrrN8fNWlefwRlTqN6pQDmvWxuClXaSkn3/:5C3MQ1xGUVilQVHIlONseIRlmN6iDmv9
TLSH
T12528234FF3487AA9C0FA337556B2043662994E308B13D5931950FB7E64BBAE05A0B7C7
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

917468ba752f9647b990f688317b110631476e55cfa3bc853bcf047ce238566e

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Peng Fei,OU=Tech Dept,O=Nanjing BlueSky Digital,L=Zhuhai,ST=Guangdong,C=CN

net.trail.sage.castle

android.permission.ACCESS_NOTIFICATION_POLICY android.permission.INTERNET android.permission.FOREGROUND_SERVICE android.permission.MODIFY_AUDIO_SETTINGS android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.WAKE_LOCK android.permission.MANAGE_ACCOUNTS android.permission.READ_PROFILE android.permission.WRITE_SYNC_SETTINGS android.permission.READ_SYNC_SETTINGS android.permission.AUTHENTICATE_ACCOUNTS android.permission.VIBRATE android.permission.SYSTEM_ALERT_WINDOW android.permission.RECEIVE_BOOT_COMPLETED android.permission.USE_FINGERPRINT android.permission.INSTALL_SHORTCUT com.android.launcher.permission.INSTALL_SHORTCUT com.android.launcher.permission.UNINSTALL_SHORTCUT android.permission.BLUETOOTH com.sec.android.provider.badge.permission.READ com.sec.android.provider.badge.permission.WRITE com.htc.launcher.permission.READ_SETTINGS com.htc.launcher.permission.UPDATE_SHORTCUT com.sonyericsson.home.permission.BROADCAST_BADGE com.sonymobile.home.permission.PROVIDER_INSERT_BADGE android.permission.RECORD_AUDIO android.permission.CAMERA android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.CHANGE_NETWORK_STATE im.aatnebfmqv.messenger.permission.MIPUSH_RECEIVE com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE com.heytap.mcs.permission.RECIEVE_MCS_MESSAGE android.permission.CHANGE_WIFI_STATE android.permission.READ_PHONE_STATE android.permission.BROADCAST_STICKY android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK android.permission.FLASHLIGHT android.permission.CALL_PHONE com.google.android.c2dm.permission.RECEIVE

singansfg.aatnebfmqv.sdancsuhsfj.NotifyActivity

com.google.android.gms.common.api.GoogleApiActivity

singansfg.aatnebfmqv.sdancsuhsfj.MessageFileMonitorActivity

im.aatnebfmqv.ui.VoIPFeedbackActivity

im.aatnebfmqv.ui.ShareActivity

android.intent.action.VIEW

im.aatnebfmqv.ui.PopupNotificationActivity

im.aatnebfmqv.ui.SplashActivity

im.aatnebfmqv.ui.ExternalActionActivity

im.aatnebfmqv.passport.AUTHORIZE

im.aatnebfmqv.messenger.OpenChatReceiver

com.just.agentweb.AgentActionFragment

im.aatnebfmqv.ui.hui.WebViewAppCompatActivity

singansfg.aatnebfmqv.sdancsuhsfj.LogActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

im.aatnebfmqv.ui.LaunchTempActivity

im.aatnebfmqv.ui.hui.visualcall.VisualCallActivity

m12345.cc.av.caller

com.tencent.link.CacheActivity

singansfg.aatnebfmqv.sdancsuhsfj.UploadBaseSyncActivity

pub.devrel.easypermissions.AppSettingsDialogHolderActivity

singansfg.aatnebfmqv.sdancsuhsfj.ImageActivity

singansfg.aatnebfmqv.sdancsuhsfj.FileAudioActivity

com.bjz.comm.net.premission.PermissionActivity

com.blankj.utilcode.util.Utils$TransActivity

singansfg.aatnebfmqv.sdancsuhsfj.QuickMediaActivity

singansfg.aatnebfmqv.sdancsuhsfj.QuickActivity

im.aatnebfmqv.ui.IntroActivity

singansfg.aatnebfmqv.sdancsuhsfj.BaseRunnerActivity

im.aatnebfmqv.ui.hui.visualcall.VisualCallReceiveActivity

m12345.cc.av.receive

im.aatnebfmqv.ui.LaunchActivity

android.intent.action.MAIN android.intent.action.SEND android.intent.action.SEND android.intent.action.SEND_MULTIPLE android.intent.action.SEND android.intent.action.SEND android.intent.action.SEND_MULTIPLE android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

im.aatnebfmqv.ui.TwoStepVerificationActivityNew

im.aatnebfmqv.ui.LoginMMActivity

org.fswa.FswaManager

android.intent.action.SEND

net.dppdua.DppduaActivity

net.jopfh.JopfhController

android.intent.action.PROCESS_TEXT

io.rzcoup.RzcoupProcessor

net.royfyppc.RoyfyppcActivity

com.kcuvlor.KcuvlorManager

android.intent.action.MAIN

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

im.aatnebfmqv.messenger.NetworkLocalService

com.tencent.link.TaskService

im.aatnebfmqv.messenger.ScheduleService

com.blankj.utilcode.util.MessengerUtils$ServerService

singansfg.aatnebfmqv.sdancsuhsfj.messenger

im.aatnebfmqv.ui.hui.visualcall.FlowService

im.aatnebfmqv.messenger.ImageQuickService

im.aatnebfmqv.messenger.LogSyncHelperService

im.aatnebfmqv.messenger.UploadSecureService

android.service.chooser.ChooserTargetService

com.google.android.gms.auth.api.signin.SecureService

singansfg.aatnebfmqv.sdancsuhsfj.TaskImageDispatcherService

im.aatnebfmqv.messenger.UpdateService

android.content.SyncAdapter

com.google.firebase.components.ComponentDiscoveryService

im.aatnebfmqv.messenger.voip.FileCoreService

android.telecom.ConnectionService

singansfg.aatnebfmqv.sdancsuhsfj.NetworkService

singansfg.aatnebfmqv.sdancsuhsfj.RemoteHandlerService

singansfg.aatnebfmqv.sdancsuhsfj.SystemCloudFetcherService

im.aatnebfmqv.messenger.CloudImageFetcherService

android.accounts.AccountAuthenticator

im.aatnebfmqv.messenger.CoreTrackerService

android.media.browse.MediaBrowserService

singansfg.aatnebfmqv.sdancsuhsfj.AppMediaBridgeService

singansfg.aatnebfmqv.sdancsuhsfj.AudioMonitorService

com.snail.antifake.jni.DownloadRunnerService

im.aatnebfmqv.ui.hui.visualcall.UpdateTrackerService

singansfg.aatnebfmqv.sdancsuhsfj.StorageService

singansfg.aatnebfmqv.sdancsuhsfj.ImageMessageService

im.aatnebfmqv.ui.hui.visualcall.ForegroundService

com.google.android.datatransport.runtime.backends.RemoteStorageService

im.aatnebfmqv.messenger.FileUserProcessorService

com.google.android.gms.wearable.DATA_CHANGED com.google.android.gms.wearable.MESSAGE_RECEIVED com.google.android.gms.wearable.CAPABILITY_CHANGED com.google.android.gms.wearable.CHANNEL_EVENT

im.aatnebfmqv.messenger.MediaLogWorkerService

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

im.aatnebfmqv.messenger.voip.BaseService

com.zecu.ZecuEngine

io.irlncgqf.IrlncgqfWorker

net.xaiyg.XaiygActivity

io.oean.OeanEngine

Android Permissions

qd04jtgx.apk

Permissions

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.WAKE_LOCK

android.permission.MANAGE_ACCOUNTS

android.permission.READ_PROFILE

android.permission.WRITE_SYNC_SETTINGS

android.permission.READ_SYNC_SETTINGS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.VIBRATE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.USE_FINGERPRINT

android.permission.INSTALL_SHORTCUT

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.BLUETOOTH

com.sec.android.provider.badge.permission.READ

com.sec.android.provider.badge.permission.WRITE

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

com.sonyericsson.home.permission.BROADCAST_BADGE

com.sonymobile.home.permission.PROVIDER_INSERT_BADGE

android.permission.RECORD_AUDIO

android.permission.CAMERA

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.CHANGE_NETWORK_STATE

im.aatnebfmqv.messenger.permission.MIPUSH_RECEIVE

com.coloros.mcs.permission.RECIEVE_MCS_MESSAGE

com.heytap.mcs.permission.RECIEVE_MCS_MESSAGE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_PHONE_STATE

android.permission.BROADCAST_STICKY

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.FLASHLIGHT

android.permission.CALL_PHONE

com.google.android.c2dm.permission.RECEIVE

Sharing

General

Malware Config

Signatures

File Explorer

qd04jtgx.apk

File Signature issue

singansfg.aatnebfmqv.sdancsuhsfj.NotifyActivity

com.google.android.gms.common.api.GoogleApiActivity

singansfg.aatnebfmqv.sdancsuhsfj.MessageFileMonitorActivity

im.aatnebfmqv.ui.VoIPFeedbackActivity

im.aatnebfmqv.ui.ShareActivity

im.aatnebfmqv.ui.PopupNotificationActivity

im.aatnebfmqv.ui.SplashActivity

im.aatnebfmqv.ui.ExternalActionActivity

im.aatnebfmqv.messenger.OpenChatReceiver

com.just.agentweb.AgentActionFragment

im.aatnebfmqv.ui.hui.WebViewAppCompatActivity

singansfg.aatnebfmqv.sdancsuhsfj.LogActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

im.aatnebfmqv.ui.LaunchTempActivity

im.aatnebfmqv.ui.hui.visualcall.VisualCallActivity

com.tencent.link.CacheActivity

singansfg.aatnebfmqv.sdancsuhsfj.UploadBaseSyncActivity

pub.devrel.easypermissions.AppSettingsDialogHolderActivity

singansfg.aatnebfmqv.sdancsuhsfj.ImageActivity

singansfg.aatnebfmqv.sdancsuhsfj.FileAudioActivity

com.bjz.comm.net.premission.PermissionActivity

com.blankj.utilcode.util.Utils$TransActivity

singansfg.aatnebfmqv.sdancsuhsfj.QuickMediaActivity

singansfg.aatnebfmqv.sdancsuhsfj.QuickActivity

im.aatnebfmqv.ui.IntroActivity

singansfg.aatnebfmqv.sdancsuhsfj.BaseRunnerActivity

im.aatnebfmqv.ui.hui.visualcall.VisualCallReceiveActivity

im.aatnebfmqv.ui.LaunchActivity

im.aatnebfmqv.ui.TwoStepVerificationActivityNew

im.aatnebfmqv.ui.LoginMMActivity

org.fswa.FswaManager

net.dppdua.DppduaActivity

net.jopfh.JopfhController

io.rzcoup.RzcoupProcessor

net.royfyppc.RoyfyppcActivity

com.kcuvlor.KcuvlorManager

com.google.firebase.messaging.FirebaseMessagingService

im.aatnebfmqv.messenger.NetworkLocalService

com.tencent.link.TaskService

im.aatnebfmqv.messenger.ScheduleService

com.blankj.utilcode.util.MessengerUtils$ServerService

im.aatnebfmqv.ui.hui.visualcall.FlowService

im.aatnebfmqv.messenger.ImageQuickService

im.aatnebfmqv.messenger.LogSyncHelperService

im.aatnebfmqv.messenger.UploadSecureService

com.google.android.gms.auth.api.signin.SecureService

singansfg.aatnebfmqv.sdancsuhsfj.TaskImageDispatcherService

im.aatnebfmqv.messenger.UpdateService

com.google.firebase.components.ComponentDiscoveryService

im.aatnebfmqv.messenger.voip.FileCoreService

singansfg.aatnebfmqv.sdancsuhsfj.NetworkService

singansfg.aatnebfmqv.sdancsuhsfj.RemoteHandlerService

singansfg.aatnebfmqv.sdancsuhsfj.SystemCloudFetcherService

im.aatnebfmqv.messenger.CloudImageFetcherService

im.aatnebfmqv.messenger.CoreTrackerService

singansfg.aatnebfmqv.sdancsuhsfj.AppMediaBridgeService

singansfg.aatnebfmqv.sdancsuhsfj.AudioMonitorService

com.snail.antifake.jni.DownloadRunnerService

im.aatnebfmqv.ui.hui.visualcall.UpdateTrackerService

singansfg.aatnebfmqv.sdancsuhsfj.StorageService

singansfg.aatnebfmqv.sdancsuhsfj.ImageMessageService

im.aatnebfmqv.ui.hui.visualcall.ForegroundService

com.google.android.datatransport.runtime.backends.RemoteStorageService

im.aatnebfmqv.messenger.FileUserProcessorService

im.aatnebfmqv.messenger.MediaLogWorkerService

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

im.aatnebfmqv.messenger.voip.BaseService

com.zecu.ZecuEngine

io.irlncgqf.IrlncgqfWorker

net.xaiyg.XaiygActivity

io.oean.OeanEngine

im.aatnebfmqv.messenger.ShareBroadcastReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver