Resubmissions

19/10/2026, 16:43

261019-t78znaxzaw6

18/10/2026, 15:53

261018-tbxazsf14x6

18/10/2026, 15:50

261018-s9554sfz918

18/10/2026, 15:50

261018-s95jksbf55

18/10/2026, 15:48

261018-s8z8gafz7z6

General

  • Target
    ExpressVPN.apk
  • Size 19.4MB
  • Sample261018-s95jksbf55
  • SHA256 5804103c452f7849d0bf2aaa7fe2b4feb3056610d7a817d3156c141da11ec783
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10

Malware Config

Signatures

  • Declares services with permission to bind to the system 2 IoCs
  • Requests dangerous framework permissions 3 IoCs
  • Codesign digest Mismatch 1 IoCs

    File was altered after it was signed.

  • Insecure Codesign Algorithm 1 IoCs

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • ExpressVPN.apk
    .apk 19.4MB

ExpressVPN.apk

  • SHA256 5804103c452f7849d0bf2aaa7fe2b4feb3056610d7a817d3156c141da11ec783
  • MD5 SHA1 SHA512 SSDEEP TLSH
  • Codesign digest Mismatch

    File was altered after it was signed.

  • Insecure Codesign Algorithm

    File was codesigned using an insecure algorithm.

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
dcdd5175a4c575ef40f30effcff097bb16e30c03
Digest Algorithm
sha1
Digest Matches
Not matched
Trusted
Not trusted
Signing Certificate
CN=SAEEDStarv,L=Center,ST=Telegram.me/Glype
Chains

Jan 1, 0001

com.expressvpn.vpn

Android Permissions

ExpressVPN.apk

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.INTERNET

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

com.android.vending.BILLING

android.permission.VIBRATE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.WAKE_LOCK

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

com.google.android.c2dm.permission.RECEIVE