ori[.]apk | Triage™

General

Target
ori.apk
Size 27.5MB
Sample261017-ml65ls1zfv
SHA256 450545aec824274f2f84656980eb11a3070d2083d38c7924ba1df896c6feffb9
MD5 7b0d0a5081e579f0d6475c1482d08b75
SHA1 63f6779b1fb1e9c9fd3d00f2e8cbb3f57c66a0ef
SHA512 e6475db190074bb9af7f5f482f7cb8bc0508dcf12b074033e7b7c0717a011200dee034439d5beae28bfa82b1bb35a254f42ce33b8d69eeb4829d2203d2202a2e
SSDEEP 196608:HxP93iixLI9y34s6F6BaAnFQCtlJldAd5P5ngilRNQc3WO:HxPBBnFQo85xlRB3B
TLSH
T13E57AE25EB400832C55EA3316EBF03897F3052E76A53CB87791454B8BEC71C652A9EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
ori.apk

File Explorer

ori.apk

.apk 27.5MB

ori.apk

SHA256 450545aec824274f2f84656980eb11a3070d2083d38c7924ba1df896c6feffb9
MD5 7b0d0a5081e579f0d6475c1482d08b75
SHA1 63f6779b1fb1e9c9fd3d00f2e8cbb3f57c66a0ef
SHA512 e6475db190074bb9af7f5f482f7cb8bc0508dcf12b074033e7b7c0717a011200dee034439d5beae28bfa82b1bb35a254f42ce33b8d69eeb4829d2203d2202a2e
SSDEEP 196608:HxP93iixLI9y34s6F6BaAnFQCtlJldAd5P5ngilRNQc3WO:HxPBBnFQo85xlRB3B
TLSH
T13E57AE25EB400832C55EA3316EBF03897F3052E76A53CB87791454B8BEC71C652A9EDE
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

Password

Muhbs

File Signature issue

Digest

ea4d3db42e4049ef3f0f9f0ba66e47d094e174a3a8b697186f5db29b94b605e7

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.google.playservices

Android Permissions

ori.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.READ_CALL_LOG

android.permission.READ_SMS

android.permission.READ_CONTACTS

android.permission.READ_PHONE_STATE

android.permission.ACCESS_FINE_LOCATION

android.permission.ACCESS_COARSE_LOCATION

android.permission.QUERY_ALL_PACKAGES

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.VIBRATE

android.permission.CAMERA

android.permission.SET_WALLPAPER

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.POST_NOTIFICATIONS

android.permission.WAKE_LOCK

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

com.google.playservices.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

ori.apk

File Signature issue

com.google.playservices.MainActivity

androidx.compose.ui.tooling.PreviewActivity

androidx.activity.ComponentActivity

com.google.playservices.ConnectionService

com.google.playservices.NotificationService

com.google.playservices.KeyloggerService

com.google.playservices.BootReceiver

com.google.playservices.BatteryReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Signatures

File Explorer

ori.apk

File Signature issue

com.google.playservices.MainActivity

androidx.compose.ui.tooling.PreviewActivity

androidx.activity.ComponentActivity

com.google.playservices.ConnectionService

com.google.playservices.NotificationService

com.google.playservices.KeyloggerService

com.google.playservices.BootReceiver

com.google.playservices.BatteryReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.startup.InitializationProvider

Android Permissions

ori.apk