skygofree | Skygofree_main[.]apk

General

Target
Skygofree_main.apk
Size 1.2MB
Sample261015-fwfbbaxybv
SHA256 dc0fe72d8904a10bae6d0d76ccc5c7f455b636b0a52143938c1b5c6def5386e8
MD5 e50ba7cbb18b7b97fb2396fe8028a92b
SHA1 38ecf9b9e792840c96e8b9465fdd64de36cddb71
SHA512 f1070e4a9c753985ff1d6ea61f62cabcec08bfc85a30c2b8d168febf65e9725c07373a7000ab58a0644d3419e971e9a38e2072b19ebac1965a69feef1c40d3f6
SSDEEP 24576:6EVGA11ItQWQbpb6TAB1xVAjt8OsP7nvUxDn5Of4NClF4dsdc/sLdIyehQvZV:VN/ItAbpW2Ot8OsPAxD51CrmsO/sLdIG
TLSH
T12745236AF1B401A4E76FD23F16883F21653D2673508D717C6E12F49C8E9ADB91AC18CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

spyware skygofree

Malware Config

Signatures

Family: Skygofree
Skygofree is an Android spyware first seen in 2014.
spyware skygofree

Android Skygofree payload 1 IoCs

resource	yara_rule
sample	family_skygofree

Declares broadcast receivers with permission to handle system events 1 IoCs

description	ioc
Required by device admin receivers to bind with the system. Allows apps to manage device administration features.	android.permission.BIND_DEVICE_ADMIN

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Skygofree_main.apk

Insecure Codesign Algorithm 1 IoCs

File was codesigned using an insecure algorithm.

resource
Skygofree_main.apk

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Skygofree_main.apk

File Explorer

Skygofree_main.apk

.apk 1.2MB

Skygofree_main.apk

SHA256 dc0fe72d8904a10bae6d0d76ccc5c7f455b636b0a52143938c1b5c6def5386e8
MD5 e50ba7cbb18b7b97fb2396fe8028a92b
SHA1 38ecf9b9e792840c96e8b9465fdd64de36cddb71
SHA512 f1070e4a9c753985ff1d6ea61f62cabcec08bfc85a30c2b8d168febf65e9725c07373a7000ab58a0644d3419e971e9a38e2072b19ebac1965a69feef1c40d3f6
SSDEEP 24576:6EVGA11ItQWQbpb6TAB1xVAjt8OsP7nvUxDn5Of4NClF4dsdc/sLdIyehQvZV:VN/ItAbpW2Ot8OsPAxD51CrmsO/sLdIG
TLSH
T12745236AF1B401A4E76FD23F16883F21653D2673508D717C6E12F49C8E9ADB91AC18CD
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android Skygofree payload
Codesign digest Mismatch

File was altered after it was signed.
Insecure Codesign Algorithm

File was codesigned using an insecure algorithm.
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9ea28da8553983a11755596a64afa6dae7e2d4f0

Digest Algorithm

sha1

Digest Matches

Not matched

Trusted

Not trusted

Signing Certificate

OU=negg

Chains

Jan 1, 0001

com.sysmanager

com.sysmanager.MessageManagement

com.google.firebase.MESSAGING_EVENT

com.sysmanager.InstanceIDMessage

com.google.firebase.INSTANCE_ID_EVENT

com.sysmanager.system.AndroidSystemService

com.sysmanager.system.AndroidAlarmManager

com.sysmanager.system.FetchAddressIntentService

com.sysmanager.system.AndroidSystemQueues

com.sysmanager.system.AndroidClock

com.sysmanager.system.RegistrationService

com.sysmanager.system.AndroidSystemCall

com.sysmanager.system.AndroidSystemLog

com.sysmanager.system.AndroidMessagingService

com.sysmanager.system.AndroidCallSystem

com.sysmanager.system.AndroidCamera

com.sysmanager.system.AndroidTouch

com.sysmanager.system.AndroidFileSystem

com.sysmanager.system.ClearSystems

com.sysmanager.system.AppsManager

com.sysmanager.system.AndroidAccessibility

com.sysmanager.system.AndroidMDMSupport

com.sysmanager.system.AndroidFileManager

com.sysmanager.system.AccessibilityService

android.accessibilityservice.AccessibilityService

com.sysmanager.system.NotificationListener

android.service.notification.NotificationListenerService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.android.gms.measurement.AppMeasurementService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

Android Permissions

Skygofree_main.apk

Permissions

android.permission.WAKE_LOCK

android.permission.RECORD_AUDIO

android.permission.READ_CONTACTS

android.permission.RECEIVE_SMS

android.permission.READ_SMS

android.permission.CAMERA

android.permission.READ_CALL_LOG

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.PROCESS_OUTGOING_CALLS

android.permission.ACCESS_NETWORK_STATE

android.permission.CHANGE_NETWORK_STATE

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.ACCESS_WIFI_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.GET_ACCOUNTS

android.permission.GET_TASKS

android.permission.INSTALL_PACKAGES

com.google.android.c2dm.permission.RECEIVE

com.sysmanager.permission.C2D_MESSAGE

Sharing

General

Malware Config

Signatures

File Explorer

Skygofree_main.apk

File Signature issue

com.sysmanager.Main

com.sysmanager.MainWeb

com.sysmanager.Administrator

com.sysmanager.EnableLocationActivity

com.sysmanager.CrashDialog

com.sysmanager.AccessibilityDialog

com.google.android.gms.common.api.GoogleApiActivity

com.sysmanager.MessageManagement

com.sysmanager.InstanceIDMessage

com.sysmanager.system.AndroidSystemService

com.sysmanager.system.AndroidAlarmManager

com.sysmanager.system.FetchAddressIntentService

com.sysmanager.system.AndroidSystemQueues

com.sysmanager.system.AndroidClock

com.sysmanager.system.RegistrationService

com.sysmanager.system.AndroidSystemCall

com.sysmanager.system.AndroidSystemLog

com.sysmanager.system.AndroidMessagingService

com.sysmanager.system.AndroidCallSystem

com.sysmanager.system.AndroidCamera

com.sysmanager.system.AndroidTouch

com.sysmanager.system.AndroidFileSystem

com.sysmanager.system.ClearSystems

com.sysmanager.system.AppsManager

com.sysmanager.system.AndroidAccessibility

com.sysmanager.system.AndroidMDMSupport

com.sysmanager.system.AndroidFileManager

com.sysmanager.system.AccessibilityService

com.sysmanager.system.NotificationListener

com.google.firebase.messaging.FirebaseMessagingService

com.google.android.gms.measurement.AppMeasurementService

com.google.firebase.iid.FirebaseInstanceIdService

com.sysmanager.OnBootReceiver

com.sysmanager.system.UpdateConnectivity

com.sysmanager.system.AndroidDeviceAdministrator

com.sysmanager.system.UserPresent

com.sysmanager.CallReceiver

com.sysmanager.system.SmsReceiver

com.google.android.gms.measurement.AppMeasurementReceiver

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.firebase.iid.FirebaseInstanceIdInternalReceiver

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

Skygofree_main.apk