mirai | Servicer[.]apk

General

Target
Servicer.apk
Size 176KB
Sample260929-pp46jazepc
SHA256 d6fc0b707ffbf9249b5c3593559a83dae4cdcc00c2ac1e094fad420a59682c73
MD5 7173d0aed27181e270a0018af03ba262
SHA1 55e6ac5adef0600e8f3ffd232b0c0153a2802d6c
SHA512 1e411c9f025f0278c5beedd785023d4e328b098da5bca2dea7ea6110852b937b69803991525f3c55075c43ed6d00e6ce0b509997ee740a07247eadb8128f58ab
SSDEEP 3072:nN1cRR7EKvupNIoPP4lsRdYgll5+bjcQ8WzZUWyv6nuJUWEgh55Xte/zUx+Td:nN1cRR7fmpNIoIlsRdYgllAcRWPS6iUH
TLSH
T1E304125CE7A84559FAE62B735C9842354920CC82B0D26318EBACF1E5ED3258C8FE07F5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx botnet mirai

Malware Config

Extracted

Family

mirai

C2

idknotherefucku.followz.st
45.131.64.158

Signatures

Family: Mirai
Mirai is a prevalent Linux malware infecting exposed network devices.
botnet mirai

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Servicer.apk

File Explorer

Servicer.apk

.apk 176KB

Servicer.apk

SHA256 d6fc0b707ffbf9249b5c3593559a83dae4cdcc00c2ac1e094fad420a59682c73
MD5 7173d0aed27181e270a0018af03ba262
SHA1 55e6ac5adef0600e8f3ffd232b0c0153a2802d6c
SHA512 1e411c9f025f0278c5beedd785023d4e328b098da5bca2dea7ea6110852b937b69803991525f3c55075c43ed6d00e6ce0b509997ee740a07247eadb8128f58ab
SSDEEP 3072:nN1cRR7EKvupNIoPP4lsRdYgll5+bjcQ8WzZUWyv6nuJUWEgh55Xte/zUx+Td:nN1cRR7fmpNIoIlsRdYgllAcRWPS6iUH
TLSH
T1E304125CE7A84559FAE62B735C9842354920CC82B0D26318EBACF1E5ED3258C8FE07F5
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm

UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

39c297ae938edd2241a6777f37e6b755aa2313fd8025e999acf375164c3d91dc

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.driots.sevice

Android Permissions

Servicer.apk

Permissions

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.WAKE_LOCK

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.POST_NOTIFICATIONS

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

android.permission.READ_SYNC_SETTINGS

android.permission.WRITE_SYNC_SETTINGS

android.permission.AUTHENTICATE_ACCOUNTS

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

Servicer.apk

File Signature issue

com.driots.sevice.TVOptimizer

com.driots.sevice.MuhHeilong

com.driots.sevice.GuardService

com.driots.sevice.PersistentJobService

com.driots.sevice.NotificationKeeperService

com.driots.sevice.UltraPersistenceService

com.driots.sevice.AuthenticatorService

com.driots.sevice.SyncService

com.driots.sevice.BootReceiver

com.driots.sevice.WatchdogReceiver

com.driots.sevice.StubProvider

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

Servicer.apk

File Signature issue

com.driots.sevice.TVOptimizer

com.driots.sevice.MuhHeilong

com.driots.sevice.GuardService

com.driots.sevice.PersistentJobService

com.driots.sevice.NotificationKeeperService

com.driots.sevice.UltraPersistenceService

com.driots.sevice.AuthenticatorService

com.driots.sevice.SyncService

com.driots.sevice.BootReceiver

com.driots.sevice.WatchdogReceiver

com.driots.sevice.StubProvider

Android Permissions

Servicer.apk