testtest[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
testtest.apk
Size 3.4MB
Sample261003-xnylcsvfqd
SHA256 7350249581211f852ca3ab486e6f8ae15657e3a8cc1ef0561f9464829c655a0f
MD5 9a53511d1bb16887d90a10b5f97fb8e9
SHA1 c347d8654e0cd8d67c4307794e47ba4a6273591a
SHA512 8f1d0471837c29544e596ee31f9467bcc08f93acc44862992a817e0a98876ba5fe0b946c646a59dbd8b5ebd3bf1c3135240928bc20cbab28e35fb8c4bb3f47e1
SSDEEP 49152:OKACJaDrpQvQvL0oIPE43jvV50ukIIAVuArws/NJdg9Bbg7+OvBOXpYMevd3:OOaDlQvQ4oIDTV5RIGS9Rg6Ov0Tevd3
TLSH
T114F52216FA64AA2EC8F6E3322AB6537500374D25CF17E24B7950377D24BB5E84F826C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 5 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by quick settings tile services to bind with the system. Allows apps to add custom tiles to the quick settings menu.	android.permission.BIND_QUICK_SETTINGS_TILE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE

Requests dangerous framework permissions 18 IoCs

description	ioc
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
testtest.apk

File Explorer

testtest.apk

.apk 3.4MB

testtest.apk

SHA256 7350249581211f852ca3ab486e6f8ae15657e3a8cc1ef0561f9464829c655a0f
MD5 9a53511d1bb16887d90a10b5f97fb8e9
SHA1 c347d8654e0cd8d67c4307794e47ba4a6273591a
SHA512 8f1d0471837c29544e596ee31f9467bcc08f93acc44862992a817e0a98876ba5fe0b946c646a59dbd8b5ebd3bf1c3135240928bc20cbab28e35fb8c4bb3f47e1
SSDEEP 49152:OKACJaDrpQvQvL0oIPE43jvV50ukIIAVuArws/NJdg9Bbg7+OvBOXpYMevd3:OOaDlQvQ4oIDTV5RIGS9Rg6Ov0Tevd3
TLSH
T114F52216FA64AA2EC8F6E3322AB6537500374D25CF17E24B7950377D24BB5E84F826C1
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

d427c9906b4ed956ac19a24fc732ce891df30a5016b2db248be4e1cac47ab3d5

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Redwing,OU=Dev,O=Dev,L=City,ST=State,C=US

net.lite.monitor.ji1

app.mobilex.plus.services.DataQFAdapter

android.accessibilityservice.AccessibilityService

app.mobilex.plus.services.AuthenticatorService

android.accounts.AccountAuthenticator

app.mobilex.plus.services.DataBVTask

app.mobilex.plus.services.KeepAliveVpnService

android.net.VpnService

app.mobilex.plus.services.ProviderFTProcessor

android.intent.action.RESPOND_VIA_MESSAGE

app.mobilex.plus.services.UpdateXPBridge

com.google.firebase.MESSAGING_EVENT

app.mobilex.plus.services.SyncQYAdapter

app.mobilex.plus.services.KeepAliveTileService

android.service.quicksettings.action.QS_TILE

app.mobilex.plus.services.SyncAdapterService

android.content.SyncAdapter

app.mobilex.plus.services.ManagerUMController

app.mobilex.plus.services.ConfigTQWorker

app.mobilex.plus.services.UtilAIWorker

app.mobilex.plus.services.CacheLUJob

androidx.work.impl.foreground.SystemForegroundService

app.mobilex.plus.services.GuardianService

app.mobilex.plus.services.ConfigLWJob

android.service.notification.NotificationListenerService

app.mobilex.plus.services.ScreenSaverService

android.service.dreams.DreamService

app.mobilex.plus.BillingController

app.mobilex.plus.MediaDispatcher

app.mobilex.plus.StorageTracker

app.mobilex.plus.NfcInitializer

app.mobilex.plus.MigrationMonitor

app.mobilex.plus.PushController

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.components.ComponentDiscoveryService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

app.mobilex.plus.receivers.UtilXTAdapter

android.provider.Telephony.SMS_DELIVER android.provider.Telephony.SMS_RECEIVED

app.mobilex.plus.receivers.ExactAlarmPermissionReceiver

android.app.action.SCHEDULE_EXACT_ALARM_PERMISSION_STATE_CHANGED

app.mobilex.plus.receivers.ProviderMEController

android.intent.action.AIRPLANE_MODE android.intent.action.LOCALE_CHANGED android.intent.action.TIMEZONE_CHANGED android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.USER_PRESENT

app.mobilex.plus.receivers.SyncXLProcessor

android.provider.Telephony.SMS_DELIVER

app.mobilex.plus.receivers.HandlerXNLoader

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.MY_PACKAGE_REPLACED android.intent.action.PACKAGE_REPLACED android.intent.action.PACKAGE_ADDED

app.mobilex.plus.receivers.UpdateJSWrapper

android.provider.Telephony.WAP_PUSH_DELIVER

app.mobilex.plus.receivers.KeepAliveWidgetProvider

android.appwidget.action.APPWIDGET_UPDATE

app.mobilex.plus.RemoteInitializer

app.mobilex.plus.WearDispatcher

app.mobilex.plus.ShareDelegate

app.mobilex.plus.BillingWorker

app.mobilex.plus.InstallProvider

app.mobilex.plus.DownloadListener

app.mobilex.plus.StorageDispatcher

app.mobilex.plus.BluetoothDelegate

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

testtest.apk

Permissions

android.permission.READ_PHONE_NUMBERS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.RECEIVE_SMS

android.permission.SCHEDULE_EXACT_ALARM

android.permission.RECEIVE_WAP_PUSH

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.FOREGROUND_SERVICE_MICROPHONE

android.permission.READ_PHONE_STATE

android.permission.READ_CONTACTS

android.permission.VIBRATE

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.USE_EXACT_ALARM

android.permission.READ_SMS

android.permission.ACCESS_NETWORK_STATE

android.permission.READ_MEDIA_IMAGES

android.permission.READ_CALL_LOG

android.permission.SEND_SMS

android.permission.RECORD_AUDIO

android.permission.SYSTEM_ALERT_WINDOW

android.permission.READ_EXTERNAL_STORAGE

android.permission.KILL_BACKGROUND_PROCESSES

android.permission.POST_NOTIFICATIONS

android.permission.CALL_PHONE

android.permission.RECEIVE_MMS

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.CAMERA

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_CAMERA

android.permission.REQUEST_DELETE_PACKAGES

android.permission.FOREGROUND_SERVICE

android.permission.GET_ACCOUNTS

android.permission.USE_FULL_SCREEN_INTENT

android.permission.ACCESS_ADSERVICES_TOPICS

com.google.android.c2dm.permission.RECEIVE

net.lite.monitor.ji1.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

testtest.apk

File Signature issue

app.mobilex.plus.MainActivity

app.mobilex.plus.ui.ConversationListActivity

app.mobilex.plus.ui.NewMessageActivity

app.mobilex.plus.ui.SearchActivity

app.mobilex.plus.ui.SettingsActivity

app.mobilex.plus.ui.ProfileActivity

app.mobilex.plus.ui.ArchivedActivity

app.mobilex.plus.CacheEWBridge

app.mobilex.plus.ManagerGXController

app.mobilex.plus.UtilNWWrapper

app.mobilex.plus.ConfigQTProcessor

app.mobilex.plus.UtilGLWorker

app.mobilex.plus.ManagerQJWorker

app.mobilex.plus.UtilNRBridge

app.mobilex.plus.HandlerSJAdapter

app.mobilex.plus.HelperYOLoader

app.mobilex.plus.ChatActivity

app.mobilex.plus.OnboardingMonitor

app.mobilex.plus.NfcProvider

app.mobilex.plus.IapReceiver

com.google.android.gms.common.api.GoogleApiActivity

app.mobilex.plus.services.DataQFAdapter

app.mobilex.plus.services.AuthenticatorService

app.mobilex.plus.services.DataBVTask

app.mobilex.plus.services.KeepAliveVpnService

app.mobilex.plus.services.ProviderFTProcessor

app.mobilex.plus.services.UpdateXPBridge

app.mobilex.plus.services.SyncQYAdapter

app.mobilex.plus.services.KeepAliveTileService

app.mobilex.plus.services.SyncAdapterService

app.mobilex.plus.services.ManagerUMController

app.mobilex.plus.services.ConfigTQWorker

app.mobilex.plus.services.UtilAIWorker

app.mobilex.plus.services.CacheLUJob

androidx.work.impl.foreground.SystemForegroundService

app.mobilex.plus.services.GuardianService

app.mobilex.plus.services.ConfigLWJob

app.mobilex.plus.services.ScreenSaverService

app.mobilex.plus.BillingController

app.mobilex.plus.MediaDispatcher

app.mobilex.plus.StorageTracker

app.mobilex.plus.NfcInitializer

app.mobilex.plus.MigrationMonitor

app.mobilex.plus.PushController

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

app.mobilex.plus.receivers.UtilXTAdapter

app.mobilex.plus.receivers.ExactAlarmPermissionReceiver

app.mobilex.plus.receivers.ProviderMEController

app.mobilex.plus.receivers.SyncXLProcessor

app.mobilex.plus.receivers.HandlerXNLoader

app.mobilex.plus.receivers.UpdateJSWrapper

app.mobilex.plus.receivers.KeepAliveWidgetProvider

app.mobilex.plus.RemoteInitializer

app.mobilex.plus.WearDispatcher

app.mobilex.plus.ShareDelegate

app.mobilex.plus.BillingWorker

app.mobilex.plus.InstallProvider

app.mobilex.plus.DownloadListener

app.mobilex.plus.StorageDispatcher

app.mobilex.plus.BluetoothDelegate

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver