saffron[.]pyramid[.]random[.]apk

General

Target
saffron.pyramid.random.apk
Size 5.0MB
Sample261023-ssstfsct41
SHA256 c502ce95f13d8ac394b0ad9413b5a4a3615ffeea8f293eb3d41e97fb5368b23e
MD5 a1a813ec10c94bb49633e38c2143ad64
SHA1 e23e15634488517587d890ce09c45fd2d48cbfaf
SHA512 de088687f01bfe036d040c072d182d7b97d7c501edecbc6c7bfaa4cda8ab117ab2772cbf687768cfe132dec2c69a4c7bd217efa45a1f052f5704bec7ab4de7b2
SSDEEP 98304:1ReRGUz+ot4si+o/Krrs19SXrz61SMoUDU:D2h4si5SrzzMhU
TLSH
T15336DF8BFB84A9ABC4F353B24136532251474C268B83D7C75958723C18B7AD07F9EAC9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
saffron.pyramid.random.apk

File Explorer

saffron.pyramid.random.apk

.apk 5.0MB

saffron.pyramid.random.apk

SHA256 c502ce95f13d8ac394b0ad9413b5a4a3615ffeea8f293eb3d41e97fb5368b23e
MD5 a1a813ec10c94bb49633e38c2143ad64
SHA1 e23e15634488517587d890ce09c45fd2d48cbfaf
SHA512 de088687f01bfe036d040c072d182d7b97d7c501edecbc6c7bfaa4cda8ab117ab2772cbf687768cfe132dec2c69a4c7bd217efa45a1f052f5704bec7ab4de7b2
SSDEEP 98304:1ReRGUz+ot4si+o/Krrs19SXrz61SMoUDU:D2h4si5SrzzMhU
TLSH
T15336DF8BFB84A9ABC4F353B24136532251474C268B83D7C75958723C18B7AD07F9EAC9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

e03a342202a3766c529db4ce5f9b3251726a43e4a300917ea510bda36f723e68

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=MrTusarRX

saffron.pyramid.random

saffron.pyramid.random.Splasher

saffron.pyramid.random.HomeSIM

android.intent.action.MAIN

saffron.pyramid.random.HomeWallp

android.intent.action.MAIN

saffron.pyramid.random.HomeSmsung

android.intent.action.MAIN

saffron.pyramid.random.PlayS

android.intent.action.MAIN

saffron.pyramid.random.uniformqbrvnyskk

saffron.pyramid.random.builderccubcxmduelrao

saffron.pyramid.random.granitesesmtgqtjblkxj

saffron.pyramid.random.crescentnwbmututhx

saffron.pyramid.random.dunedwuyytplgnhgj

saffron.pyramid.random.oasiszbgwowb

saffron.pyramid.random.hammerwdadqwdy

saffron.pyramid.random.speakit

saffron.pyramid.random.glacierjzurghyddpfzmprx

saffron.pyramid.random.elephantazdvgnfasasron

saffron.pyramid.random.octoberorbdmhrosq

saffron.pyramid.random.Toastit

saffron.pyramid.random.pythonpaccfhxys

saffron.pyramid.random.carbongxbjpis

saffron.pyramid.random.Inputvictoryxlzkgvzjnlx

saffron.pyramid.random.zenithtgvukm

saffron.pyramid.random.beaconifdyuyhxk

saffron.pyramid.random.glorioushjnhwbdhpupplt

saffron.pyramid.random.targetorcexqentnc

saffron.pyramid.random.kettleziowdggbyk

saffron.pyramid.random.victoryxlzkgvzjnlx

saffron.pyramid.random.kingdomtxyrjodnjnekr

saffron.pyramid.random.umberkqvkgpq

saffron.pyramid.random.jacketkurvjfmdn

saffron.pyramid.random.rocketezbprxslyqv

saffron.pyramid.random.CallBacker

saffron.pyramid.random.bakerpmfwrulfb

saffron.pyramid.random.alarme

AppAlarm

saffron.pyramid.random.legendjmthufkxdan

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

saffron.pyramid.random.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

saffron.pyramid.random.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.POST_NOTIFICATIONS

saffron.pyramid.random.permission.TDOS_DIAGNOSE_BROADCAST

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

com.android.alarm.permission.SET_ALARM

android.permission.WAKE_LOCK

android.permission.SYSTEM_ALERT_WINDOW

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.PACKAGE_USAGE_STATS

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.FLASHLIGHT

android.permission.RECORD_AUDIO

saffron.pyramid.random.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

saffron.pyramid.random.apk

File Signature issue

saffron.pyramid.random.Splasher

saffron.pyramid.random.HomeSIM

saffron.pyramid.random.HomeWallp

saffron.pyramid.random.HomeSmsung

saffron.pyramid.random.PlayS

saffron.pyramid.random.uniformqbrvnyskk

saffron.pyramid.random.builderccubcxmduelrao

saffron.pyramid.random.granitesesmtgqtjblkxj

saffron.pyramid.random.crescentnwbmututhx

saffron.pyramid.random.dunedwuyytplgnhgj

saffron.pyramid.random.oasiszbgwowb

saffron.pyramid.random.hammerwdadqwdy

saffron.pyramid.random.speakit

saffron.pyramid.random.glacierjzurghyddpfzmprx

saffron.pyramid.random.elephantazdvgnfasasron

saffron.pyramid.random.octoberorbdmhrosq

saffron.pyramid.random.Toastit

saffron.pyramid.random.pythonpaccfhxys

saffron.pyramid.random.carbongxbjpis

saffron.pyramid.random.Inputvictoryxlzkgvzjnlx

saffron.pyramid.random.zenithtgvukm

saffron.pyramid.random.beaconifdyuyhxk

saffron.pyramid.random.glorioushjnhwbdhpupplt

saffron.pyramid.random.targetorcexqentnc

saffron.pyramid.random.kettleziowdggbyk

saffron.pyramid.random.victoryxlzkgvzjnlx

saffron.pyramid.random.kingdomtxyrjodnjnekr

saffron.pyramid.random.umberkqvkgpq

saffron.pyramid.random.jacketkurvjfmdn

saffron.pyramid.random.rocketezbprxslyqv

saffron.pyramid.random.CallBacker

saffron.pyramid.random.bakerpmfwrulfb

saffron.pyramid.random.fortresslhiaonikyn

saffron.pyramid.random.zenithxkjgvkyauifpk

saffron.pyramid.random.crystalvhzhvnvaints

saffron.pyramid.random.starlightdqtchosdl

saffron.pyramid.random.vibrantsydqko

saffron.pyramid.random.keepsakecnwhgxkiczugq

saffron.pyramid.random.tableivyqfowan

saffron.pyramid.random.gravitygkfifjrfrlf

saffron.pyramid.random.falconsewipnuj

saffron.pyramid.random.minserv

saffron.pyramid.random.iciclebrhtcqyowaed

saffron.pyramid.random.Msss

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

saffron.pyramid.random.alarme

saffron.pyramid.random.legendjmthufkxdan

saffron.pyramid.random.ResetServices

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

Android Permissions

saffron.pyramid.random.apk