aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f[.]zip

General

Target
aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.zip
Size 5.1MB
Sample261022-zesd4afv2v
SHA256 11f91b3cf826566fcf7975b1d0917737b0b5c69d8a1f94adf14d4cfdb005c6cc
MD5 297f76626e037d353c2c8e2ffcdffad8
SHA1 514d7ce894f4a67bc181b2b311f382efe088b6b8
SHA512 8d041b239b36a4a1b4870434068ebad100f14e2d604683e46c9871f4ddda1dae1b448fafc2d5dd468b179230bfcd42ca7557dad5b05a10215ea3f037bdd7a3f4
SSDEEP 98304:mPsnZlZf4Jn5eIIGAb3iKZ9nn2+Q/vp38d57ac/GiG/aOVTcXcyRZ:BZf4J5PabSKj2tha57vGhFcMyn
TLSH
T1F7463388E27FBB5156E128166D37C5A10885BBEFD82058CD84AAD5D707C43E37CBE31A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
unpack001/aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.apk

File Explorer

aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.zip

.zip 5.1MB
aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.apk

.apk 5.7MB

aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.zip

SHA256 11f91b3cf826566fcf7975b1d0917737b0b5c69d8a1f94adf14d4cfdb005c6cc
MD5 297f76626e037d353c2c8e2ffcdffad8
SHA1 514d7ce894f4a67bc181b2b311f382efe088b6b8
SHA512 8d041b239b36a4a1b4870434068ebad100f14e2d604683e46c9871f4ddda1dae1b448fafc2d5dd468b179230bfcd42ca7557dad5b05a10215ea3f037bdd7a3f4
SSDEEP 98304:mPsnZlZf4Jn5eIIGAb3iKZ9nn2+Q/vp38d57ac/GiG/aOVTcXcyRZ:BZf4J5PabSKj2tha57vGhFcMyn
TLSH
T1F7463388E27FBB5156E128166D37C5A10885BBEFD82058CD84AAD5D707C43E37CBE31A
MD5 SHA1 SHA512 SSDEEP TLSH

Password

infected

aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.apk

SHA256 aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f
MD5 2d1eb1a04c2f4faf741aa99216064085
SHA1 f3b07cc47f124fc706b7e3ba92f099e2b10f7c74
SHA512 c2a9139a3205d2da5f9d5f2898384e7dcff00012fee8d86b75d56ad0eb0dd7764fbc4d69e238ce0cab0535b1e8844a5e9e87c5a1d7167acdaadc96573f10cc7d
SSDEEP 98304:kfkilQKFkqELOOCQIq6HJz4HQiNa0pFWYbES1W/VsQWqvWNnLdLceot+3Sfi/TaX:Kki2DqkC/q62HX7pFWAwVsQWqyJLceoL
TLSH
T1A3561257B744452EC8B791320A6F523122A34D868E63674BB144771C6DB3B884FEEBEC
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

bdc80f06b5f56c1424f7789230cb209c56de9bddbf903b2eb47311fe6216e8a9

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=editor

com.sec.android.app.vault.kkeda68

aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.zip

aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.apk

File Signature issue

opcx.yvgxas.owmlvu.Fqdtkmv5d7gdt

opcx.yvgxas.owmlvu.ui.Eygp2le31szh

opcx.yvgxas.owmlvu.vpn.Ympn4epzdv0

opcx.yvgxas.owmlvu.installer.Hmw6pz2o7v2w2xo

opcx.yvgxas.owmlvu.installer.A1fh7yswhqk9

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

Sharing

General

Malware Config

Signatures

File Explorer

aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.zip

aa0dd1d81b068a0c29dc245217127141ff2dc73dd444d91aaae0656186902f6f.apk

File Signature issue

opcx.yvgxas.owmlvu.Fqdtkmv5d7gdt

opcx.yvgxas.owmlvu.ui.Eygp2le31szh

opcx.yvgxas.owmlvu.vpn.Ympn4epzdv0

opcx.yvgxas.owmlvu.installer.Hmw6pz2o7v2w2xo

opcx.yvgxas.owmlvu.installer.A1fh7yswhqk9

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider