Button VPN(1)[.]apk

General

Target
Button VPN(1).apk
Size 417KB
Sample261022-xaydfattat
SHA256 c3a5895b6d38af17da610c1e66d20888dc10b5c94bebf30d5c7acefa3c92ad85
MD5 7833329e41945463ee5f21b9fea4e985
SHA1 07260cb4728f80c6dfd792b14f52760b1be47d6b
SHA512 2a651ca34abeeb6a35bed81258454e91930966635541a656ec348c85fb4c6a6abd0eec3a3186ecd7da3fd049462575a83de1d3bd8cb7fe8c076ee74c229f9b91
SSDEEP 6144:/i5wjnH/ucjWgkrNlWp14mKRrKsLiAvoH7G/FoxCvXeUYcCsTMMHDdz0F7Hn:OQnweOmyrvGdH+iAvrosTNJwF7H
TLSH
T1DA94125AB7DCE757E263C130184A8252540F3EB8CD45F3AB76303BADA4B3F640B556A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an app to turn on the screen on, e.g. with PowerManager.ACQUIRE_CAUSES_WAKEUP.	android.permission.TURN_SCREEN_ON
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to monitor incoming MMS messages.	android.permission.RECEIVE_MMS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to receive WAP push messages.	android.permission.RECEIVE_WAP_PUSH
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Button VPN(1).apk

File Explorer

Button VPN(1).apk

.apk 417KB

Button VPN(1).apk

SHA256 c3a5895b6d38af17da610c1e66d20888dc10b5c94bebf30d5c7acefa3c92ad85
MD5 7833329e41945463ee5f21b9fea4e985
SHA1 07260cb4728f80c6dfd792b14f52760b1be47d6b
SHA512 2a651ca34abeeb6a35bed81258454e91930966635541a656ec348c85fb4c6a6abd0eec3a3186ecd7da3fd049462575a83de1d3bd8cb7fe8c076ee74c229f9b91
SSDEEP 6144:/i5wjnH/ucjWgkrNlWp14mKRrKsLiAvoH7G/FoxCvXeUYcCsTMMHDdz0F7Hn:OQnweOmyrvGdH+iAvrosTNJwF7H
TLSH
T1DA94125AB7DCE757E263C130184A8252540F3EB8CD45F3AB76303BADA4B3F640B556A8
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

1dab2db1e7db301f365602fd859731a919a0d51664dda4b9867a95ab63e5cf19

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=f2bff280b2c5,OU=Mobile,O=51fce2cd7c,L=City,ST=State,C=US

com.buttonvpn.hjexqm

Android Permissions

Button VPN(1).apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.TURN_SCREEN_ON

android.permission.POST_NOTIFICATIONS

android.permission.READ_PHONE_STATE

android.permission.READ_PHONE_NUMBERS

android.permission.READ_SMS

android.permission.SEND_SMS

android.permission.RECEIVE_SMS

android.permission.RECEIVE_MMS

android.permission.WRITE_SMS

android.permission.READ_CELL_BROADCASTS

android.permission.READ_CONTACTS

android.permission.RECEIVE_WAP_PUSH

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.RECORD_AUDIO

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.USE_EXACT_ALARM

android.permission.WRITE_SYNC_SETTINGS

android.permission.QUERY_ALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

Button VPN(1).apk

File Signature issue

iq.mpm.xs.Zlz1

iq.mpm.xs.Fdc

iq.mpm.xs.Jv5

com.system.framework.LoadingActivity

iq.mpm.xs.Maf

iq.mpm.xs.Zp

iq.mpm.xs.Opc

com.google.android.gms.common.api.GoogleApiActivity

iq.mpm.xs.Dn4

iq.mpm.xs.Rfy9

iq.mpm.xs.Nf7

iq.mpm.xs.Ijc6

iq.mpm.xs.Jm6

iq.mpm.xs.D

iq.mpm.xs.Mph

iq.mpm.xs.Lzc

iq.mpm.xs.Ldl9

iq.mpm.xs.Mxr1

iq.mpm.xs.U

iq.mpm.xs.H6

iq.mpm.xs.Nz3

iq.mpm.xs.O6

iq.mpm.xs.Lbz7

iq.mpm.xs.Z0

iq.mpm.xs.Cq7

Sharing

General

Malware Config

Signatures

File Explorer

Button VPN(1).apk

File Signature issue

iq.mpm.xs.Zlz1

iq.mpm.xs.Fdc

iq.mpm.xs.Jv5

com.system.framework.LoadingActivity

iq.mpm.xs.Maf

iq.mpm.xs.Zp

iq.mpm.xs.Opc

com.google.android.gms.common.api.GoogleApiActivity

iq.mpm.xs.Dn4

iq.mpm.xs.Rfy9

iq.mpm.xs.Nf7

iq.mpm.xs.Ijc6

iq.mpm.xs.Jm6

iq.mpm.xs.D

iq.mpm.xs.Mph

iq.mpm.xs.Lzc

iq.mpm.xs.Ldl9

iq.mpm.xs.Mxr1

iq.mpm.xs.U

iq.mpm.xs.H6

iq.mpm.xs.Nz3

iq.mpm.xs.O6

iq.mpm.xs.Lbz7

iq.mpm.xs.Z0

iq.mpm.xs.Cq7

Android Permissions

Button VPN(1).apk