coreprotector[.]org_sample[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
coreprotector.org_sample.bin
Size 4.8MB
Sample261010-tmalcsxtdz
SHA256 00ad39e539d63dc56073d8970925fc8fffc6cc0f45849b73430a569f14266e04
MD5 38e866c38d6afc5b640f7fd8dc317b06
SHA1 14132a80177936638e4d55c3a11035e43df552fa
SHA512 1455433f21913b82aa396ffc3cd515af75d311e83b4d8ac32731f8ecd756c3f3625e9e65bebb57545e26535c1caeee0461c76fa09245e05d4e6943173f26518a
SSDEEP 98304:Wibg4QOVpQdMjwT5YQFdvjts8ftRrm55T:Wik4DV8XTLvg5T
TLSH
T12136AE46E7501D2AC8FE827A28B74B2023765D41D7839747210CB6686FB77E91F8DBC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 4 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by call screening services to bind with the system. Allows apps to filter and manage incoming phone calls.	android.permission.BIND_SCREENING_SERVICE

Requests dangerous framework permissions 27 IoCs

description	ioc
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Required to be able to connect to paired Bluetooth devices.	android.permission.BLUETOOTH_CONNECT
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access location in the background.	android.permission.ACCESS_BACKGROUND_LOCATION
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write and read the user's call log data.	android.permission.WRITE_CALL_LOG
Allows the app to answer an incoming phone call.	android.permission.ANSWER_PHONE_CALLS
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
coreprotector.org_sample.bin

File Explorer

coreprotector.org_sample.bin

.apk 4.8MB

coreprotector.org_sample.bin

SHA256 00ad39e539d63dc56073d8970925fc8fffc6cc0f45849b73430a569f14266e04
MD5 38e866c38d6afc5b640f7fd8dc317b06
SHA1 14132a80177936638e4d55c3a11035e43df552fa
SHA512 1455433f21913b82aa396ffc3cd515af75d311e83b4d8ac32731f8ecd756c3f3625e9e65bebb57545e26535c1caeee0461c76fa09245e05d4e6943173f26518a
SSDEEP 98304:Wibg4QOVpQdMjwT5YQFdvjts8ftRrm55T:Wik4DV8XTLvg5T
TLSH
T12136AE46E7501D2AC8FE827A28B74B2023765D41D7839747210CB6686FB77E91F8DBC8
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

718af33b2c1023944b93543f69615553394d8e152e76da8c800e12e490937f99

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=By Vzor,OU=Peroni,O=Peroni,L=Bari,ST=Bari,C=IT

com.sec.android.app.sysupdate

android.permission.FOREGROUND_SERVICE android.permission.FOREGROUND_SERVICE_LOCATION android.permission.FOREGROUND_SERVICE_CAMERA android.permission.FOREGROUND_SERVICE_MICROPHONE android.permission.FOREGROUND_SERVICE_SPECIAL_USE android.permission.QUERY_ALL_PACKAGES android.permission.READ_SMS android.permission.SEND_SMS android.permission.WRITE_SMS android.permission.WRITE_OBB android.permission.READ_CONTACTS android.permission.INTERNET android.permission.BLUETOOTH_ADMIN android.permission.BLUETOOTH_CONNECT android.permission.ACCESS_FINE_LOCATION android.permission.ACCESS_COARSE_LOCATION android.permission.ACCESS_BACKGROUND_LOCATION android.permission.RECEIVE_BOOT_COMPLETED android.permission.BIND_ACCESSIBILITY_SERVICE android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND android.permission.POST_NOTIFICATIONS android.permission.SCHEDULE_EXACT_ALARM android.permission.USE_EXACT_ALARM android.permission.WAKE_LOCK android.permission.CAPTURE_VIDEO_OUTPUT android.permission.BIND_DEVICE_ADMIN android.permission.MANAGE_DEVICE_ADMINS android.permission.CALL_PHONE android.permission.READ_CALL_LOG android.permission.WRITE_CALL_LOG android.permission.CALLS_ADD_ENTRY android.permission.ANSWER_PHONE_CALLS android.permission.PROCESS_OUTGOING_CALLS android.permission.READ_PHONE_STATE android.permission.BIND_VOICE_INTERACTION android.permission.READ_PRIVILEGED_PHONE_STATE android.permission.READ_PHONE_NUMBERS android.permission.BIND_NOTIFICATION_LISTENER_SERVICE android.permission.RECORD_AUDIO android.permission.WRITE_CONTACTS com.samsung.android.launcher.permission.READ_SETTINGS com.oppo.launcher.permission.WRITE_SETTINGS com.oppo.launcher.permission.READ_SETTINGS com.htc.launcher.permission.READ_SETTINGS com.htc.launcher.permission.UPDATE_SHORTCUT android.permission.WRITE_SECURE_SETTINGS android.permission.WRITE_SYSTEM_PREFERENCES android.permission.WRITE_SETTINGS android.permission.READ_SETTINGS android.permission.CHANGE_WIFI_STATE android.permission.OPEN_ACCESSIBILITY_DETAILS_SETTINGS com.huawei.android.launcher.permission.WRITE_SETTINGS com.huawei.android.launcher.permission.READ_SETTINGS com.huawei.android.launcher.permission.CHANGE_BADGE com.huawei.permission.external_app_settings.USE_COMPONENT android.permission.MODIFY_SETTINGS_OVERRIDEABLE_BY_RESTORE android.permission.LAUNCH_TRUST_AGENT_SETTINGS android.permission.BIND_QUICK_SETTINGS_TILE android.permission.READ_SYNC_SETTINGS android.permission.WRITE_SYNC_SETTINGS android.permission.MODIFY_AUDIO_SETTINGS android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.CHANGE_NETWORK_STATE com.google.android.gms.permission.AD_ID android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS android.permission.WHITELIST_AUTO_REVOKE_PERMISSIONS android.permission.MANAGE_DEVICE_POLICY_CAMERA android.permission.MANAGE_DEVICE_POLICY_ACROSS_USERS android.permission.MANAGE_DEVICE_POLICY_ACROSS_USERS_FULL android.permission.VIBRATE android.permission.FLASHLIGHT android.permission.CAMERA android.permission.READ_MEDIA_AUDIO android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_VIDEO android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.GRANT_RUNTIME_PERMISSIONS android.permission.REBOOT android.permission.SYSTEM_ALERT_WINDOW android.permission.ACTION_MANAGE_OVERLAY_PERMISSION com.sec.android.app.sysupdate.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.sec.android.app.sysupdate.s.MK55

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.ACTION_SHUTDOWN

com.sec.android.app.sysupdate.s.MK69

com.sec.android.app.sysupdate.DETONATE_CHAOS android.app.action.DEVICE_ADMIN_ENABLED android.app.action.DEVICE_OWNER_CHANGED android.app.action.DEVICE_ADMIN_DISABLE_REQUESTED android.app.action.ACTION_DEVICE_ADMIN_ENABLED android.app.action.DEVICE_ADMIN_DISABLED android.app.action.ACTION_PASSWORD_FAILED android.app.action.ACTION_PASSWORD_SUCCEEDED android.app.action.PROFILE_PROVISIONING_COMPLETE android.app.action.LOCALE_CHANGED android.intent.action.LOCALE_CHANGED

com.sec.android.app.sysupdate.s.c.s.MK8

android.provider.Telephony.SMS_RECEIVED

com.sec.android.app.sysupdate.s.c.c.MK76

android.intent.action.PHONE_STATE android.intent.action.NEW_OUTGOING_CALL

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

coreprotector.org_sample.bin

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_LOCATION

android.permission.FOREGROUND_SERVICE_CAMERA

android.permission.FOREGROUND_SERVICE_MICROPHONE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.QUERY_ALL_PACKAGES

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.WRITE_SMS

android.permission.WRITE_OBB

android.permission.READ_CONTACTS

android.permission.INTERNET

android.permission.BLUETOOTH_ADMIN

android.permission.BLUETOOTH_CONNECT

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_BACKGROUND_LOCATION

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.BIND_ACCESSIBILITY_SERVICE

android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND

android.permission.POST_NOTIFICATIONS

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

android.permission.WAKE_LOCK

android.permission.CAPTURE_VIDEO_OUTPUT

android.permission.BIND_DEVICE_ADMIN

android.permission.MANAGE_DEVICE_ADMINS

android.permission.CALL_PHONE

android.permission.READ_CALL_LOG

android.permission.WRITE_CALL_LOG

android.permission.CALLS_ADD_ENTRY

android.permission.ANSWER_PHONE_CALLS

android.permission.PROCESS_OUTGOING_CALLS

android.permission.READ_PHONE_STATE

android.permission.BIND_VOICE_INTERACTION

android.permission.READ_PRIVILEGED_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

android.permission.RECORD_AUDIO

android.permission.WRITE_CONTACTS

com.samsung.android.launcher.permission.READ_SETTINGS

com.oppo.launcher.permission.WRITE_SETTINGS

com.oppo.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.READ_SETTINGS

com.htc.launcher.permission.UPDATE_SHORTCUT

android.permission.WRITE_SECURE_SETTINGS

android.permission.WRITE_SYSTEM_PREFERENCES

android.permission.WRITE_SETTINGS

android.permission.READ_SETTINGS

android.permission.CHANGE_WIFI_STATE

coreprotector.org_sample.bin

File Signature issue

com.sec.android.app.sysupdate.a.F

com.sec.android.app.sysupdate.a.P

com.sec.android.app.sysupdate.a.M

com.sec.android.app.sysupdate.s.x.MK74

com.sec.android.app.sysupdate.s.c.MK12

com.sec.android.app.sysupdate.s.MK28

com.sec.android.app.sysupdate.s.MK73

com.sec.android.app.sysupdate.s.MK31

com.sec.android.app.sysupdate.s.c.MK13

com.sec.android.app.sysupdate.s.c.c.MK1

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

com.sec.android.app.sysupdate.s.MK55

com.sec.android.app.sysupdate.s.MK69

com.sec.android.app.sysupdate.s.c.s.MK8

com.sec.android.app.sysupdate.s.c.c.MK76

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

com.squareup.picasso.PicassoProvider