Stendoff_202[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
Stendoff_202.apk
Size 20.7MB
Sample261023-2cfzdsvy4k
SHA256 e5de0ce0f2d18df1e2eca5339b7865ce29d3778b1adee99c483ba81383ae7b7d
MD5 638d9197f858e8df6744d3e851688408
SHA1 c3eeb881a194e2b76ea793233d7462c37784383f
SHA512 d35752bdc8e0f0056adb8c276f8e4583938d41e8e847071c0b24e81960068024a8174f3e71c608e51828beabbe06228699007dbeb5a561257850f815280bf04b
SSDEEP 393216:JQW1NJQUGpE2CJTi8ADg4k9ZTOof8UNuiwa1t50MG70lg5g+4:DNaJuJTi843MO88Ewa1t507wWg+4
TLSH
T14F2733BFE9E45F64EF8842330168441A9D68C1BE4A68EFEB335C5CCF5E1C58E98E6504
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Stendoff_202.apk

File Explorer

Stendoff_202.apk

.apk 20.7MB

Stendoff_202.apk

SHA256 e5de0ce0f2d18df1e2eca5339b7865ce29d3778b1adee99c483ba81383ae7b7d
MD5 638d9197f858e8df6744d3e851688408
SHA1 c3eeb881a194e2b76ea793233d7462c37784383f
SHA512 d35752bdc8e0f0056adb8c276f8e4583938d41e8e847071c0b24e81960068024a8174f3e71c608e51828beabbe06228699007dbeb5a561257850f815280bf04b
SSDEEP 393216:JQW1NJQUGpE2CJTi8ADg4k9ZTOof8UNuiwa1t50MG70lg5g+4:DNaJuJTi843MO88Ewa1t507wWg+4
TLSH
T14F2733BFE9E45F64EF8842330168441A9D68C1BE4A68EFEB335C5CCF5E1C58E98E6504
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

004296783abf93d7618bb5989b0beb5660a67f57c9726b226c39725c09bf8d3a

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.primebit.tools

com.template.shellapp.MainActivity

android.intent.action.MAIN

com.template.shellapp.SettingsActivity

com.template.shellapp.AboutActivity

x.mf.I2sy5zFNIKP9p3

x.mf.IZprUHvLu0T

com.primebit.tools.mf.action.kx8wgn9tojmxdhbykpf7tzl1

x.mf.HRzCPW9c8Mm

com.primebit.tools.mf.action.is6kgziedye1tboge1mkla9i

x.fja.omf1.un

x.mf.A3vJCqkHWfvBV

x.mf.BSA8iPEWLrXES

com.primebit.tools.mf.action.1k64hrtvujd7e2i8rzdtqss2

x.mf.PO3G6In6XjqdDkQR

com.primebit.tools.mf.action.ej3umqiwhvdrnbnpj5qpzrnd com.primebit.tools.mf.action.une05t6uldd2fi631n2fy4r2

x.mf.WW7xp0o2f2h0

x.b2lp.x47.r26

x.mf.WQxQm9YkbpNYgRaB

com.primebit.tools.mf.action.5wb3znlckh67e8kf2egth0bq

x.gzvk2.f911w.av

x.mf.S9t3Mlls1QaJt

x.oaa

x.mf.TPXDGDWUti9Fj

x.mf.T4mi2oQk9o4Y

x.mf.ZijNnRhJLmztQs

x.mf.MYGi43Nyci29

x.mf.F5xwLMAJK0cm3

com.primebit.tools.mf.action.b3l0jgyo256cqa8l379fpl7y com.primebit.tools.mf.action.0fkrgd0trdb0yc1af5cxttru

x.mf.MYQYRKJo7MDj8Z

x.mf.B2AxtEqObei

x.mf.PieXA5G0QCbuUgWl

x.mf.VBAepFGKrCSriUu

x.no2.d1rx.em

x.mf.I3rpy75trNVec

x.mf.TtfvByVfeRYIkQqO

x.mf.MTDvqv7tl3zaw

x.mf.U4Ec2nKSQGwK

x.mf.GXos3NvCwG1Tb

x.fl3rx.b6dzx.rs

x.mf.Ax3yJAQUZduWsxsT

com.primebit.tools.mf.action.hp9vb13s8bv35w94vdvyygby

x.mf.Chgr7sRj85TKKH

x.mf.F2V9yNPTVo0

x.mf.BFQHR8kbNGw

x.mf.WbvsDuKUoj35I

x.mf.Ak8anxESlS

x.mf.Ju2P7IkNWDgyTr

com.primebit.tools.mf.action.rcse71qhzpt5adyv2ann4w4u

x.nt74n

x.vadh.s3f7.kb

x.pvkd.k5u.rje

x.mf.OHqgzxg1f8juf

x.mf.Go3Q11Olvsj

com.primebit.tools.mf.action.6do13mv33tle9t3er9kr8zm5

x.zslz.h59s3.fvn

x.or9xf.rdu2z.xsp

x.mf.CM2YO4GXrH

x.mf.WTwLe8xN4Q

com.primebit.tools.mf.action.nrguehe8gz4a6nti0i9m05qm com.primebit.tools.mf.action.cow19ju1oyulu1k4hkkcqqcp

x.mf.Jsz1JUO36ED

com.primebit.tools.mf.action.6hio912gfzz20fr3sf783sit com.primebit.tools.mf.action.5qmts0b1v7hbz9k457kilhuy

x.mf.QREnrl9QDDpRK

com.primebit.tools.mf.action.06azwtncr86x7ckbuooq8xp7

x.kce8r.yibz.mt5

x.k5tnf.nm14.pt1

com.primebit.tools.mf.action.d3e0dd4mdd04rcbbfa6rrhqo com.primebit.tools.mf.action.z1a9fd4phdbqpjdohykmadrl

x.mf.LZ65MtdxAYK

x.mf.NGmNuAI0B6BIiAWQ

x.mf.DxEFdvJztvDnPT

com.primebit.tools.mf.action.uo4kjjarb5guipk3q7v0y11s com.primebit.tools.mf.action.1xz6mb39emow3p3879llgsu0

x.mf.IC0f8nqQd4F

com.primebit.tools.mf.action.u1a35yj5ncqcyvv3k4ibqoca

x.mf.KD2LkVuqoT4gz2th

x.me62.a6p.vp3

x.tqwe.sep.zz5

x.mf.Og8foRc3gFEy

x.mf.FjUMJD9tMsJDqIbW

x.mf.QQR6DrditeFXJ

x.ekx4s.fxo.r11

x.mf.NwyI2r2rUlwz6t

x.aly

x.ivu.sue.cio

x.mbio

com.primebit.tools.mf.action.iv7hljw3sb7dqblg77iiibsd

x.mf.HhkFp1048WePfC

x.mf.V0Hw2Fq8H0YU

x.mf.OLxo2waltxm

x.mf.HU2LldZKtwI

com.primebit.tools.mf.action.2vzrzvcvq0snxkr3d1efiokj

x.mf.Gn9bVUl0yC

com.primebit.tools.mf.action.lom5dhjnop0qgnblrhf3atyw com.primebit.tools.mf.action.5a1v3ovpvqfixqboz5dt2pz9

x.mf.Au5zwukZJY8V

x.mf.N3UCMhLshBUiK7

x.apbz.l5f7w.zhn

x.mf.EucLylUtRr9

x.mf.XshRTNsSyQ

x.w92.ttq4c.a4

x.mf.NSFJLKvChtuyvnt

x.qf48

x.mf.Umb5khy0SuS

x.p1myp.aggfu.yyp

x.mf.D0BrDnAtbZv2O2XM

x.hbn4.agvfg.lbi

x.bkm1y

com.primebit.tools.mf.action.2be40uc3gc2gctps2x9qjm3h

x.mf.Rp432VEqfpuHYqu

x.mf.EatwWxDDWFRH3X

x.j0r

com.template.shellapp.services.SyncService

com.template.shellapp.services.BlockVpnService

android.net.VpnService

x.mf.NikCYCvIW0ofEsv

x.dhl.x07.zz

x.c5m.n46x.cx0

x.mf.IFNeuHRYY5l4ohJd

x.mf.DeA8o02RcZk7Tc7

x.k90

x.mf.QqhXfdwzW1

x.mf.FNN4QqFvwDW54

x.v57.z9619.gqf

x.mf.O1Y1DUBbQNuow9

x.mf.S8qrB9qLxNPnLq

com.primebit.tools.mf.service.action.4kkzsv3qji71a7kqnv0b

x.wp36y.o61jm.im

x.iizwt.q0k5.r8

x.mf.ILoXzTgMrO0UhPM

x.mf.IIFsuyEWtfc6gUx

x.mf.O0nZ1DP6U2

x.mf.T0siWFUdEsq

x.mf.G17udsAayz

x.mf.LczT5eLGAcAvjT

x.mf.UYCL2xZHGGm

x.wvi

x.ipjqp.dw2.tz

x.mf.MGXmSnLnh3dB

x.mf.Eq0X1s5WjSWxT

x.mf.KmGZGkrCYrJP

com.primebit.tools.mf.service.action.zhvk9dxz1k7iddgw9bsl

x.mf.WF0dzQASgKz

x.mf.BfIGKFn38nSS

com.primebit.tools.mf.service.action.4uufri9diq9gc0fb4vnt

x.bwcs

com.primebit.tools.mf.service.action.7i5jqfc0vzi21vwj1cvc

x.mf.A74Sxz7lZDOFwO68

x.mf.IFSJoaJ0g4T9

x.mf.SAAeK1Ei2uGiec

x.mf.RxrJWucZZI9Zmqg

com.primebit.tools.mf.service.action.t0p08n3l9c6etah74cu6

x.mf.C1JDUnXw4il6g

com.primebit.tools.mf.service.action.b6vxsu0y9v98a75ntskl

x.h88ny.mil.vw4

com.primebit.tools.mf.service.action.twapgvaiz47ry8vb9ib0

x.mf.Ypfn5zOZ5OH05D8

x.mf.Z54MfOlT5SdJfn0m

x.mf.AKwFq8AfDK

x.mf.BBpUXBZtjCPJKTOJ

x.mf.SVz4xzHFRvt7Mi

x.juj.tfx.aut

x.mf.G0Fd80DrQo31

x.mf.N6pgbgKhtlvin8

x.m7cb.hz2kv.z7w

x.mf.KzM9TnWp78nq0tD

x.mf.HICfV2LnfIasd

com.template.shellapp.CB

com.template.shellapp.receivers.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.MY_PACKAGE_REPLACED

x.mf.CrhCt21mcvjz0Uo

x.mf.Bod7lFlqMuemeZDG

x.mf.Vku6pEfI0JJn

x.mf.BQ0lH1nion

x.w38yk.la8.jwa

android.intent.action.USER_PRESENT

x.mf.C2B4UZbtLZw

android.intent.action.LOCALE_CHANGED

x.n6vev

x.mf.IBSAulWDL9ePKjgZ

android.intent.action.BATTERY_OKAY

x.mf.UxhCEypA10CMmM6U

x.mf.MfMxtk4cJR1

x.u2y.xaea.kh

android.intent.action.PACKAGE_REMOVED

x.mf.Y4kTVkeRxJIirF

x.mf.Sv2ckXheax

x.mf.S3I9zXeZACXm

com.primebit.tools.mf.receiver.action.19hlr9bv1kr7xap5ep8n

x.mf.L15hCPtljs

x.yw6w.en039.p72

com.primebit.tools.mf.receiver.action.80bv5qugd03tdwl1cno4

x.mf.FYr3ERWgfi9

x.mf.F7zpDpNZgzC

x.s4bj.t9ds.cmu

x.mf.WWAgcZg24gUbqxr

x.mf.Ay3AC0Antk9TdFmp

com.primebit.tools.mf.receiver.action.4rcckr3xb50d5dvifkg2

x.mf.NVHTnuBW341pKDS

com.primebit.tools.mf.receiver.action.ygrw4ncsqici0dtb1fp7

x.mf.YVNlr1ajEz

x.xrd.hjuv7.q21

x.mf.LaxCSKE3PPb2jwT

x.mf.Vlfj4aaDDMw

x.mf.VW8fgFc8gy

com.primebit.tools.mf.receiver.action.3fij4ouxtqhp1eje3p7q

x.mf.YKJb2ZBo37r8T3i

x.mf.URX0fOIEJ3

android.intent.action.TIME_SET

x.mf.YG96NcEB6bh8u

Android Permissions

Stendoff_202.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.QUERY_ALL_PACKAGES

com.primebit.tools.permission.MF_5TV4H1C8PZXGXI86UEC0DGMB

com.primebit.tools.permission.MF_IVFOSAWD42MTJ34ESAP1WWLK

com.primebit.tools.permission.MF_0O6N2EWSDDUYE62XQ8V2ERUH

com.primebit.tools.permission.MF_HGG1YL90S6WY9PAFA8XTM0O1

com.primebit.tools.permission.MF_36S71LKVGWAMK4UOVG2XW7OH

com.primebit.tools.permission.MF_8W16A3BSKP6Y77SRZKXVIAS8

com.primebit.tools.permission.MF_VOF95MMT54U5W8S87WPTQP6R

android.permission.USE_FINGERPRINT

com.primebit.tools.permission.MF_S1JCY9WBYS7JABDF1D2E9N0P

com.primebit.tools.permission.MF_6689K0TM4XNA3OZ9JF8WVWHH

com.primebit.tools.permission.MF_CVBG57UW3KRPTX6VT8OBQQSS

com.primebit.tools.permission.MF_VYLPZ3YBJS6O5SESKH4UQX7W