dsk-rabota[.]apk | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
dsk-rabota.apk
Size 5.0MB
Sample261008-g4zwcss19n
SHA256 24afcf9e391553ccb73f58109070af796655ef71f42947445fc5bac489a02ed0
MD5 c1e55d816d0927fd25a3fbe786da1f86
SHA1 0a80de44c9a99ce111b274fa93af017c575dc17b
SHA512 66bb1b6a9da18978309af514862b1f6c50c0194c30d1f221a8325d8b3bb5a9b2d359782509ec737be04c2c14b927311fcf6d251415afea4acbd400d91088a216
SSDEEP 98304:0Hv/iiQITx5Cfg1FyD5P3mCS2se77caiEKbzQ7lA4tM3b79/vRM:0Hn1fTGo18D5P3m0h679y
TLSH
T1A836231E8FCACB27C91EC97C0DD404336197EBEE4A5DE3EB0AE2195737961282947790
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
dsk-rabota.apk

File Explorer

dsk-rabota.apk

.apk 5.0MB

dsk-rabota.apk

SHA256 24afcf9e391553ccb73f58109070af796655ef71f42947445fc5bac489a02ed0
MD5 c1e55d816d0927fd25a3fbe786da1f86
SHA1 0a80de44c9a99ce111b274fa93af017c575dc17b
SHA512 66bb1b6a9da18978309af514862b1f6c50c0194c30d1f221a8325d8b3bb5a9b2d359782509ec737be04c2c14b927311fcf6d251415afea4acbd400d91088a216
SSDEEP 98304:0Hv/iiQITx5Cfg1FyD5P3mCS2se77caiEKbzQ7lA4tM3b79/vRM:0Hn1fTGo18D5P3m0h679y
TLSH
T1A836231E8FCACB27C91EC97C0DD404336197EBEE4A5DE3EB0AE2195737961282947790
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

3d20bdcc02f911062a7317108eb8c920c6ab24311ddd694ec529deb5609fb277

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.mobilex.plus

com.template.shellapp.MainActivity

android.intent.action.MAIN

com.template.shellapp.SettingsActivity

com.template.shellapp.AboutActivity

x.mf.Zk8Pfa5gIV

x.mf.GHWGaayiE7Zv

x.mf.GctzUuUYm6m

x.mf.TCwqMRVnlV7U

x.mf.FGQump8yBGyFvN

x.yhy.xlmie.gqq

x.mf.Y39MXPJanrl36UX

x.mf.DLERjbwH1p

x.mf.EOA58Y9kvNc

x.mf.FfWJOqolLhEvzYs

x.o3ulm.ytudq.c2y

com.mobilex.plus.mf.action.6xkpsvq1h902dla091xxw2uh com.mobilex.plus.mf.action.cwcgysytewqya6i2vqv3gpcy

x.mf.Q7clVffGn21GKs

x.mf.O75tJ0rxM9mR4

x.tsu.u4fj.gvd

x.mf.ByyFgfIppvxb4EYb

x.mf.VAFPqKn426

x.wz8tr

x.mf.XdKowBecj64X

x.mf.FhbCVgCSGsK1Qpt

com.mobilex.plus.mf.action.439jwr87j11qmxhn3m0t45o6

x.e28sj.vrc.ps

x.mf.Rq7uLJWTwFhB69

com.mobilex.plus.mf.action.534iecgxg52o4jfs94oa8cn8 com.mobilex.plus.mf.action.huj2ppc0e1kj1wvjg880zs9a

x.mf.VxNk9kHrxKhnY

x.mf.G0GdWuQJBAK

x.adrz2.j1m.qs

x.mf.MdJ8bhWpr5ZwQS

x.qbc9c

x.mf.FbrBnjPSZEGDGu7X

x.mf.OvLnsJo24vyW

x.mf.P0DudmUMm1Lzp

com.mobilex.plus.mf.action.xsnavw9krpi44fameqddpxkj

x.mf.Q09MjbYlaP

x.mf.GknnmQI66a

x.mf.QdeACdc4l9hhAi

x.mf.VJLzIsmEL5mb

x.mf.BV60cYxe24ENp

x.mf.BFejmLvXtLMTRR

com.mobilex.plus.mf.action.wrhdftqhjf20posb96izdagb com.mobilex.plus.mf.action.ws5exr36y94yv458eet53nuk

x.cw3mg.wc1.hcz

x.pk91o

x.mf.S4XkH0iiYaC

x.mf.FA6V2dSdrHcX

com.mobilex.plus.mf.action.pd5eogdooidjj2rq5aelpd8r

x.mf.Y9dfbZyuzk18wQL

x.mf.Qn0D2f4BRXs

x.geao.sca5n.t8

x.mf.ANubsz51TW

x.mf.GOu1vqlgQS1

x.mf.HA2sNshY6Q8Owm5h

x.mf.MWoPmber38hJv

x.lb2

x.mf.WLDcKGpx6r50c9r

x.mf.K1nPDDlXnNWnhnMR

x.mf.Inm7nLbdsJu

com.mobilex.plus.mf.action.bigbb2zviohkne0vvl79at5p com.mobilex.plus.mf.action.ge2wz3j5xe4zdj5rb7rao7c5

x.mf.YDEgyadRFUOkM9y

x.mf.UTDTzkWRPdK

x.srra.xmz2w.izp

x.mf.FP3SYctKrW

x.mf.WC9SIjTQ2a

com.mobilex.plus.mf.action.lo6u80ifv3vtky7sualrtk0z com.mobilex.plus.mf.action.bnqow13tu3zlb2qoe4jjy0t3

x.mf.Llm1E69wXitGY

x.mf.ALMwFXIJlyEf7

x.mf.Fhw4vE2QlT

x.r3jnd

com.mobilex.plus.mf.action.j5r0h6y9x87cuhs2f4jgebka com.mobilex.plus.mf.action.x45zez8lk61x2madpvvl6oqt

x.mf.JO8SNGeaDBDc7J

x.ks91q.momnj.wn

x.mf.U66Jh1jA8i

x.qxq.l3d.gko

x.mf.Q5euDyo0jJ

x.eucs.zzd.z3

x.mf.HLBqj2JiUL

x.mf.ZDlOfPRYp3

x.mf.OthR6mkovro

x.mf.SQousHYFhe

com.mobilex.plus.mf.action.in942c8pwo4b2c1qggisulwa com.mobilex.plus.mf.action.q8sfcxvfz0vy8j9zk7rz24lq

x.mf.ZjO5f8AFTF

x.mf.BTVjtWG5ALWzC9kC

x.mf.BHwAY7a08qNa8pme

com.mobilex.plus.mf.action.iuc71ltsfuldf743l75ichhm

x.mf.ZkUxBLHlJxPAZK

x.cz4.nubgk.xxe

x.mf.XmyjZYZ8sbnCK5

x.sb5v

x.mf.DsWxiuL12v

com.mobilex.plus.mf.action.uv5ocveiwhojymh9ni3pqk5p com.mobilex.plus.mf.action.drxe3ma82g9qm6jtieb3s846

x.mf.ZZ7Wus1tn5Vt

com.mobilex.plus.mf.action.3jo3nzw7xb3q94kaj72vqste com.mobilex.plus.mf.action.13wksu47su6fy7pr3lehggr2

x.duv.ichhq.thj

com.mobilex.plus.mf.action.9of3iyyblynqb208odzn8tqq com.mobilex.plus.mf.action.wltsu31dqisomruky2mufd3e

x.mf.HOcxf8jCqesOEn

x.mf.EyTRZ5B3tnEPye6

x.mf.B5grW89GoRYbtL

com.mobilex.plus.mf.action.5nu0sjtuev7v0faf498kryry

x.mf.WnobB1jrV6

x.mf.DXoyjq0XgUax

x.m9rv.amv.x3

com.mobilex.plus.mf.action.1fbeoz1i72f1hp24ya3samas com.mobilex.plus.mf.action.786r5hqjbvjy2ny3mvvpe8xp

com.template.shellapp.services.SyncService

com.template.shellapp.services.BlockVpnService

android.net.VpnService

x.bol2d

x.mf.Hi5XyGe0wNdQ

x.mf.Jmk9P9OhJV7GT

x.u2pte

com.mobilex.plus.mf.service.action.mb0vjp219il1ebdchn4p

x.mf.YiRSBKJqySX9

x.mf.GGwCy3Ql8j6d

x.mf.Ou9GrksJXbi1

x.wjs.zhx0.jo

x.mf.BzlZafxISZ7LoRqW

x.mf.BFl3ByokAMLXZ1h

x.mf.DOSgW5Yhyio

x.mf.QPY5rLUQ3XLSqCN

x.zzrvg.thxi1.rrb

x.mf.CpzZtfG7qiZ

x.mf.RWPkox7smBlCPVP

com.mobilex.plus.mf.service.action.4lsyjtv3g3boff2qw26f

x.mf.QuFSYc1JafOtqk

x.mf.HpU1mrsWfBE

x.dcyv.qlb.vm6

x.iu5kl

x.mf.A1oMILGNNbL5t3

x.ljwhq.p8j.ro0

x.mf.Heau0I0qguv4

x.txk0.mkyng.a8x

com.mobilex.plus.mf.service.action.902zsdio3du5j6sov4ge

x.urqk.cl6.s7

x.mf.CKxgaBEaU1TU0

x.mf.HnoEOZbRFX

x.mf.So933gChI5tRRA74

x.mf.W2vx5nqIJNG2gls7

com.mobilex.plus.mf.service.action.pm8d4osfvzqud4gssg6y

x.mf.ETk3FILmBASFU

x.mf.Ty0D69qyJSkOB

x.mf.Xa1QFk9nbYMS

x.mf.ZTiCj2GePYCw

com.mobilex.plus.mf.service.action.bd5exos582lnk1vrow8g

x.mf.Yw8qO4LHkmeS

x.mf.HteOYXQzE8T

x.mf.BurGd6q3R0ECCbRi

x.mf.NHSMETSWxsBHlhLF

x.mf.NkRKwaidKPe68

x.mf.QQ98IJqaJkqIVJr

x.mf.QYB9ykbOEG

x.vpx6a.e7ap.h5m

x.mf.DCbo8njqaJg

x.mf.Ibs2lTX9cfjxsh

com.mobilex.plus.mf.service.action.bpa3aw58t2xih530l4u3

x.mf.BGL99E8MpuqZnwQ

x.qwfht

x.mf.Hp6Dp0V1k5g8

com.template.shellapp.CB

com.template.shellapp.receivers.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.MY_PACKAGE_REPLACED

x.qmeh

x.mf.Cqp02XKAdqwrFm0

x.mf.Q3BbrRvShRIs

x.mf.XKEP1KEDRe4dx

x.mf.UPThBDtJCjs

x.mf.YGSYR0yV43Tm6U

x.mf.Gi6lPfskxMtcN92

x.mf.Ghb3ZIfW2SEL

x.mf.O1th41rFSy89UEg

x.mf.Ih1zPPnw5AeW

x.mf.Zgxcx3haI8L

x.mf.JXlcZClfvqS6LQBA

x.dqbv.t39.bhw

x.tvs.enju9.m9k

x.mf.NH1fpjUVWeSciD52

x.mf.VTZWySYf1BpR

com.mobilex.plus.mf.receiver.action.sf24hrp65m9ttxtjfn3d

x.jrfgo.dkvhl.d9s

x.tiw

x.v6t.nbp8.kzj

x.mf.LNSSd0paNkoJ7e

x.mf.HNZS6aoEjy8eOOh

com.mobilex.plus.mf.receiver.action.wqgjgfhfzvubawqiwyvm

x.mf.C8uv0VzjDQE

x.mf.ErvJSQHt9iG4GG

x.mf.MaQ4tBw3Fntjic

x.mf.QhNglHbhG1DA

x.mf.Hc87y7MQZCTmRH

x.mf.SjcrMpPdnLM

x.mf.LW9BOtBKnjAJ

com.mobilex.plus.mf.receiver.action.tesj3iyvb8uqqdo5pv5f

x.mf.KMcC7rKUiz9B59zz

x.mf.ZWdkyd4WhN

Android Permissions

dsk-rabota.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.QUERY_ALL_PACKAGES

com.mobilex.plus.permission.MF_7N9XCNDSXRYB9X01G4OJX9Y6

com.mobilex.plus.permission.MF_BPW3Q530SNXR02ECXWAMZGBM

com.mobilex.plus.permission.MF_CKJ2R5N3YFIACT8WSBJRTRMQ

com.mobilex.plus.permission.MF_YSPT8ENUC2F6VC4A5HPW5RAJ

com.mobilex.plus.permission.MF_AAI7DVBUB3FYDAYUUUPU1ZZ9

android.permission.NFC

com.mobilex.plus.permission.MF_SDUSC0LKFK0LF0LSFSRJP55P

com.mobilex.plus.permission.MF_E401EDUGLX3E7JPUAZ22LVUP