888rioapp[.]apk | Triage™

General

Target
888rioapp.apk
Size 6.4MB
Sample261023-pcv24abv8v
SHA256 535d28a9848ab210a6da4a2c7e319eb7abe5d62eabf834ed4c52ca2897fcdc00
MD5 2307e3682cee13d1f652ca36e8e84d4b
SHA1 342f60b46acc922f90f3ee4353b4b1047a69e597
SHA512 988219f201a5fca54b9750625a2494743392799e8a2abb5bf4757eae710de8abf383f42611fd6101da4fc801d54746e36136ac7da59162260c11da1ffc97895d
SSDEEP 98304:PBX7gcF+eeGfppsg6Slpn0eVGlIrBvL/AVtkpgGzhFDAUX6UkOp/0:Jg++eHfpCSlpngY/AVAVhZAUX6UkeM
TLSH
T1C5660187F748F85FC0F7D33296714262650A4D228B43E6972918B3BD1DF7AC48A49EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
888rioapp.apk

File Explorer

888rioapp.apk

.apk 6.4MB

888rioapp.apk

SHA256 535d28a9848ab210a6da4a2c7e319eb7abe5d62eabf834ed4c52ca2897fcdc00
MD5 2307e3682cee13d1f652ca36e8e84d4b
SHA1 342f60b46acc922f90f3ee4353b4b1047a69e597
SHA512 988219f201a5fca54b9750625a2494743392799e8a2abb5bf4757eae710de8abf383f42611fd6101da4fc801d54746e36136ac7da59162260c11da1ffc97895d
SSDEEP 98304:PBX7gcF+eeGfppsg6Slpn0eVGlIrBvL/AVtkpgGzhFDAUX6UkOp/0:Jg++eHfpCSlpngY/AVAVhZAUX6UkeM
TLSH
T1C5660187F748F85FC0F7D33296714262650A4D228B43E6972918B3BD1DF7AC48A49EC9
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

321e3f0f2eca2cc6651de4b244c4fca4db2a94b33f462722189dcbcd6d08c1e2

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Franky Hu,OU=personal,O=Franky Hu,L=Mala,ST=Mala

com.zsljcg.erq9602.riqfh

Android Permissions

888rioapp.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_WIFI_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.READ_MEDIA_IMAGES

android.permission.INSTALL_PACKAGES

android.permission.CAMERA

com.google.android.gms.permission.AD_ID

android.permission.POST_NOTIFICATIONS

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_AD_ID

android.permission.ACCESS_ADSERVICES_CUSTOM_AUDIENCE

com.zing.zalo.permission.ACCESS_THIRD_PARTY_APP_AUTHORIZATION

com.zsljcg.erq9602.riqfh.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.CHANGE_NETWORK_STATE

android.permission.CHANGE_WIFI_STATE

android.permission.READ_PHONE_STATE

Sharing

General

Malware Config

Signatures

File Explorer

888rioapp.apk

File Signature issue

com.speed.client.CCMainActivity

com.speed.client.CCWebActivity

com.speed.client.third_login.TgLoginActivity

com.facebook.CustomTabActivity

com.facebook.FacebookActivity

com.zing.zalo.zalosdk.oauth.BrowserLoginActivity

com.speed.client.jpush.UserActivity400

androidx.credentials.playservices.HiddenActivity

com.linecorp.linesdk.auth.internal.LineAuthenticationActivity

com.linecorp.linesdk.auth.internal.LineAuthenticationCallbackActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.facebook.CustomTabMainActivity

com.zing.zalo.zalosdk.oauth.OpenAPIActivity

com.zing.zalo.zalosdk.oauth.WebLoginActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.engagelab.privates.common.component.MTCommonActivity

com.speed.client.jpush.UserService

androidx.credentials.playservices.CredentialProviderMetadataHolder

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.blankj.utilcode.util.MessengerUtils$ServerService

com.engagelab.privates.push.platform.google.callback.MTGoogleCallback

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.speed.client.jpush.UserReceiver

com.adjust.sdk.AdjustReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.core.content.FileProvider

com.squareup.picasso.PicassoProvider

com.google.firebase.provider.FirebaseInitProvider

com.facebook.internal.FacebookInitProvider

com.blankj.utilcode.util.UtilsFileProvider

com.engagelab.privates.common.component.MTCommonProvider

com.bugsnag.android.internal.BugsnagContentProvider

com.sensorsdata.analytics.android.sdk.data.SensorsDataContentProvider

Android Permissions

888rioapp.apk