app (1)[.]apk | Triage™

General

Target
app (1).apk
Size 5.6MB
Sample261024-jxt3msaw3p
SHA256 e75804a21f214a7d8f4d46e22e16adf588bf44ff3583a1ca9197b57a0d5fa705
MD5 feae427055411c4ad4a8cbe898969776
SHA1 8f2e9eb158d37757c4e8a93e0647dcfae872d26c
SHA512 e02611750beffdba452f9243b5ab8b4b61cafe8c2a36d08bc86c021f94fcd090968fcfc6874471543c370200a7fec5cb9cdc033e0765718d4242fbaf37918bcb
SSDEEP 98304:qg2cVwKXVkX4F2SbVR0SnZ8V9LEqmM+1f4WLJLyNnQln69+lcLdwc:qg2cVwKX+4F2KR0SZ8hmM+ZJL0nQln6n
TLSH
T1D5461212FBC5592EFCF3C3311779163650068CA1C753E28BA85476BC24B3FD48A96AE9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Requests dangerous framework permissions 10 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
app (1).apk

File Explorer

app (1).apk

.apk 5.6MB

app (1).apk

SHA256 e75804a21f214a7d8f4d46e22e16adf588bf44ff3583a1ca9197b57a0d5fa705
MD5 feae427055411c4ad4a8cbe898969776
SHA1 8f2e9eb158d37757c4e8a93e0647dcfae872d26c
SHA512 e02611750beffdba452f9243b5ab8b4b61cafe8c2a36d08bc86c021f94fcd090968fcfc6874471543c370200a7fec5cb9cdc033e0765718d4242fbaf37918bcb
SSDEEP 98304:qg2cVwKXVkX4F2SbVR0SnZ8V9LEqmM+1f4WLJLyNnQln69+lcLdwc:qg2cVwKX+4F2KR0SZ8hmM+ZJL0nQln6n
TLSH
T1D5461212FBC5592EFCF3C3311779163650068CA1C753E28BA85476BC24B3FD48A96AE9
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x86 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

86feedab5bba807f75217e520e896bc666768bd8f2747478026dffcc67bb2840

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.test.kidssafe

com.test.kidssafe.receiver.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.MY_PACKAGE_REPLACED

com.test.kidssafe.receiver.SmsReceiver

android.provider.Telephony.SMS_RECEIVED

com.test.kidssafe.receiver.AliveReceiver

com.test.kidssafe.ALIVE_CHECK

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

Android Permissions

app (1).apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.POST_NOTIFICATIONS

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.ACCESS_NOTIFICATION_POLICY

android.permission.WAKE_LOCK

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.FOREGROUND_SERVICE_REMOTE_MESSAGING

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.USE_EXACT_ALARM

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.READ_CONTACTS

android.permission.READ_SMS

android.permission.RECEIVE_SMS

android.permission.SEND_SMS

android.permission.READ_PHONE_STATE

android.permission.CALL_PHONE

android.permission.READ_EXTERNAL_STORAGE

android.permission.READ_MEDIA_IMAGES

com.google.android.c2dm.permission.RECEIVE

com.test.kidssafe.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

app (1).apk

File Signature issue

com.test.kidssafe.MainActivity

com.test.kidssafe.ui.WebViewActivity

com.google.android.gms.common.api.GoogleApiActivity

com.test.kidssafe.service.BackgroundService

com.test.kidssafe.MyFirebaseMessagingService

androidx.work.impl.foreground.SystemForegroundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.test.kidssafe.receiver.BootReceiver

com.test.kidssafe.receiver.SmsReceiver

com.test.kidssafe.receiver.AliveReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.startup.InitializationProvider

com.google.firebase.provider.FirebaseInitProvider

Sharing

General

Malware Config

Signatures

File Explorer

app (1).apk

File Signature issue

com.test.kidssafe.MainActivity

com.test.kidssafe.ui.WebViewActivity

com.google.android.gms.common.api.GoogleApiActivity

com.test.kidssafe.service.BackgroundService

com.test.kidssafe.MyFirebaseMessagingService

androidx.work.impl.foreground.SystemForegroundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.room.MultiInstanceInvalidationService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.test.kidssafe.receiver.BootReceiver

com.test.kidssafe.receiver.SmsReceiver

com.test.kidssafe.receiver.AliveReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.startup.InitializationProvider

com.google.firebase.provider.FirebaseInitProvider

Android Permissions

app (1).apk