WWVPN[.]apk | Triage™

General

Target
WWVPN.apk
Size 584KB
Sample261005-aqdbwazerd
SHA256 0869a6e66545e555b3489341b5a6e828673a76677c9ef86f4b605afbfd6720ac
MD5 c649935469ee7af7d699955d2d3c7919
SHA1 c8e3ee6bdef4cd3dd925079ec8884c8acb18bc74
SHA512 82a4ee337abad4c96e28182a4ba1b49b97af767e4b68b20ca7d996cab60ffc9e09f7b7e013518f5cc50e21335d90c43047bc2e8846054807bfa5f33a3a28b60d
SSDEEP 12288:Akf1PClJl4vhc2wFvhc2wKNnsNnqoD+/pdJvC4pFkjH8jEjdUC9B:DpvhCvhjNsNqf/pDv7oTSEj79B
TLSH
T124D4F113738499D9D4FAD6BE486B82325133DE309A2783DB5E04F37A5CBA7994B087C4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
WWVPN.apk

File Explorer

WWVPN.apk

.apk 584KB

WWVPN.apk

SHA256 0869a6e66545e555b3489341b5a6e828673a76677c9ef86f4b605afbfd6720ac
MD5 c649935469ee7af7d699955d2d3c7919
SHA1 c8e3ee6bdef4cd3dd925079ec8884c8acb18bc74
SHA512 82a4ee337abad4c96e28182a4ba1b49b97af767e4b68b20ca7d996cab60ffc9e09f7b7e013518f5cc50e21335d90c43047bc2e8846054807bfa5f33a3a28b60d
SSDEEP 12288:Akf1PClJl4vhc2wFvhc2wKNnsNnqoD+/pdJvC4pFkjH8jEjdUC9B:DpvhCvhjNsNqf/pDv7oTSEj79B
TLSH
T124D4F113738499D9D4FAD6BE486B82325133DE309A2783DB5E04F37A5CBA7994B087C4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

ffb539726889ec04a07f4d096effbc54c45fa05a0d68f29b3512f1fb20db3b0d

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=APK Signer,OU=Earth,O=Earth

qsb36kqg.w92wj35.iszs4z3k6

zloy.core.alarm.ServiceMonitorReceiver

zloy.SERVICE_MONITOR

zloy.ServiceRestartReceiver

android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.MY_PACKAGE_REPLACED zloy.RESTART_SERVICE android.provider.action.DEFAULT_SMS_PACKAGE_CHANGED android.intent.action.USER_UNLOCKED android.intent.action.SCREEN_ON android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.MIUI_BATTERY_FEATURE_CHANGE miui.intent.action.POWER_MODE_CHANGED miui.intent.action.OP_AUTO_START android.intent.action.USER_PRESENT com.huawei.intent.action.POWER_MODE_CHANGED huawei.intent.action.POWER_MODE_CHANGED com.oplus.battery.OplusBatteryAction com.coloros.safecenter.intent.action.STARTUP_APP com.oppo.safe.permission.startup.STARTUP_APP com.samsung.android.sm.action.ACTION_REFRESH com.samsung.android.intent.action.SIOP_LEVEL_CHANGED com.vivo.permissionmanager.intent.action.STARTUP_APP com.iqoo.secure.intent.action.STARTUP_APP com.transsion.action.UPDATE_POWER_SAVE_MODE com.transsion.permission.AUTOSTART com.cyin.himgr.autostart.intent.action.ADD

zloy.core.telephony.sms.SmsReceiver

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER

zloy.core.telephony.sms.DeliverySmsReceiver

SMS_DELIVERED SMS_SENT

zloy.core.WapPushReceiver

android.provider.Telephony.WAP_PUSH_DELIVER

zloy.watchdog.WatchdogReceiver

zloy.WATCHDOG_PING

Android Permissions

WWVPN.apk

Permissions

android.permission.A38K2UJAO4RC

android.permission.00OV5VQTVEU

android.permission.NSA7Y9T679KQ

android.permission.QC67GXIHP2

android.permission.5E7YAQ7JV1T

android.permission.S4TDQHWDMCX

android.permission.HX0YCO2NHIK

android.permission.Q6GSVUX1X8QG7

android.permission.5R8WGQ1BKW5R0

android.permission.V0I2FPG0LVS

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.READ_CONTACTS

android.permission.CALL_PHONE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.WAKE_LOCK

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.permission.RECEIVE_WAP_PUSH

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

qsb36kqg.w92wj35.iszs4z3k6.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.POST_NOTIFICATIONS

android.permission.ACCESS_NETWORK_STATE

android.permission.NFC

android.permission.QUERY_ALL_PACKAGES

android.permission.WRITE_SYNC_SETTINGS

android.permission.READ_SYNC_SETTINGS

android.permission.GET_ACCOUNTS

WWVPN.apk

File Signature issue

zloy.NfcActivity

zloy.MainActivity

zloy.core.SmsActivity

qsb36kqg.w92wj35.iszs4z3k6.МΧ且丳丫κ亀丯乙乒جحπ

zloy.core.SmsService

zloy.ForegroundService

zloy.PushNotificationListener

zloy.core.RescueJobService

zloy.sync.StubAuthenticatorService

zloy.sync.SyncService

zloy.core.alarm.ServiceMonitorReceiver

zloy.ServiceRestartReceiver

zloy.core.telephony.sms.SmsReceiver

zloy.core.telephony.sms.DeliverySmsReceiver

zloy.core.WapPushReceiver

zloy.watchdog.WatchdogReceiver

zloy.sync.StubContentProvider

Sharing

General

Malware Config

Signatures

File Explorer

WWVPN.apk

File Signature issue

zloy.NfcActivity

zloy.MainActivity

zloy.core.SmsActivity

qsb36kqg.w92wj35.iszs4z3k6.МΧ且丳丫κ亀丯乙乒جحπ

zloy.core.SmsService

zloy.ForegroundService

zloy.PushNotificationListener

zloy.core.RescueJobService

zloy.sync.StubAuthenticatorService

zloy.sync.SyncService

zloy.core.alarm.ServiceMonitorReceiver

zloy.ServiceRestartReceiver

zloy.core.telephony.sms.SmsReceiver

zloy.core.telephony.sms.DeliverySmsReceiver

zloy.core.WapPushReceiver

zloy.watchdog.WatchdogReceiver

zloy.sync.StubContentProvider

Android Permissions

WWVPN.apk