Vsem VPN_2[.]0[.]6[.]apk

Target
Vsem VPN_2.0.6.apk
Size 65.8MB
Sample261026-vbftnsgs8k
SHA256 f81439436afef9113e2b41ee3119404586f831094fc3be82d07c7f75395afe48
MD5 ddecf30121f492986239057d1cf3cd17
SHA1 c407b8bfdf349689d2f3e5a25a74774c435350ad
SHA512 b8b037397bb4fedf608d407635fd7af4ac3c7d14bcbdc4bfce93b487ac9a86c02332936bd245169752cf207d3e228df1d16f6b250d9a20b215aea338d780d37d
SSDEEP 393216:yPLgXbr801R868tdExGjP6cZyIiAIbjFq1kxJEICZTz8DLkql+ybAuF:EL68768fNjTZyIiAIbF4cQI9
TLSH
T1E1E7AE23E7525E33D5AF933958FB87447B326988A7834B832045E5B8FC933C16B992C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

backdoor rat

Malware Config

Signatures

RustDesk remote access tool 1 IoCs

RustDesk is an open-source remote admin tool.

backdoor rat

resource	yara_rule
sample	family_rustdesk_apk

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 1 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Vsem VPN_2.0.6.apk

File Explorer

Vsem VPN_2.0.6.apk

.apk 65.8MB

Vsem VPN_2.0.6.apk

SHA256 f81439436afef9113e2b41ee3119404586f831094fc3be82d07c7f75395afe48
MD5 ddecf30121f492986239057d1cf3cd17
SHA1 c407b8bfdf349689d2f3e5a25a74774c435350ad
SHA512 b8b037397bb4fedf608d407635fd7af4ac3c7d14bcbdc4bfce93b487ac9a86c02332936bd245169752cf207d3e228df1d16f6b250d9a20b215aea338d780d37d
SSDEEP 393216:yPLgXbr801R868tdExGjP6cZyIiAIbjFq1kxJEICZTz8DLkql+ybAuF:EL68768fNjTZyIiAIbF4cQI9
TLSH
T1E1E7AE23E7525E33D5AF933958FB87447B326988A7834B832045E5B8FC933C16B992C5
MD5 SHA1 SHA512 SSDEEP TLSH

android

RustDesk remote access tool

RustDesk is an open-source remote admin tool.

backdoor rat
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

45dec664948cfe1f0acc9ce3f321a57bd6d15bf837e75cfa8f7b806d2fd1fb060452f76433d7c53e99a90cf8ca40d60d1d921775f98bfdd94d46b1b8427d716d

Digest Algorithm

sha512

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Google Inc.,L=Mountain View,ST=California,C=US

com.vsemnetwork.vsemvpn

com.vsemnetwork.vsemapp.MainActivity

android.intent.action.MAIN

io.flutter.plugins.urllauncher.WebViewActivity

com.yandex.mobile.ads.common.AdActivity

com.yandex.mobile.ads.features.debugpanel.ui.IntegrationInspectorActivity

com.inmobi.ads.rendering.InMobiAdActivity

com.applovin.adview.AppLovinFullscreenActivity

com.applovin.adview.AppLovinFullscreenImmersiveActivity

com.applovin.sdk.AppLovinWebViewActivity

com.applovin.mediation.MaxDebuggerActivity

com.applovin.mediation.MaxDebuggerDetailActivity

com.applovin.mediation.MaxDebuggerMultiAdActivity

com.applovin.mediation.MaxDebuggerAdUnitsListActivity

com.applovin.mediation.MaxDebuggerAdUnitWaterfallsListActivity

com.applovin.mediation.MaxDebuggerAdUnitDetailActivity

com.applovin.mediation.MaxDebuggerCmpNetworksListActivity

com.applovin.mediation.MaxDebuggerTcfConsentStatusesListActivity

com.applovin.mediation.MaxDebuggerTcfInfoListActivity

com.applovin.mediation.MaxDebuggerTcfStringActivity

com.applovin.mediation.MaxDebuggerTestLiveNetworkActivity

com.applovin.mediation.MaxDebuggerTestModeNetworkActivity

com.applovin.mediation.MaxDebuggerUnifiedFlowActivity

com.applovin.mediation.MaxDebuggerWaterfallSegmentsActivity

com.applovin.creative.MaxCreativeDebuggerActivity

com.applovin.creative.MaxCreativeDebuggerDisplayedAdActivity

com.google.android.gms.ads.AdActivity

com.google.android.gms.ads.OutOfContextTestingActivity

com.google.android.gms.ads.NotificationHandlerActivity

com.bytedance.sdk.openadsdk.activity.single.TTCeilingLandingPageActivity

com.bytedance.sdk.openadsdk.activity.single.TTLandingPageActivity

com.bytedance.sdk.openadsdk.activity.single.TTPlayableLandingPageActivity

com.bytedance.sdk.openadsdk.activity.single.TTVideoLandingPageLink2Activity

com.bytedance.sdk.openadsdk.activity.single.TTHistoryLandingPageActivity

com.bytedance.sdk.openadsdk.activity.single.TTHistoryActivity

com.bytedance.sdk.openadsdk.activity.single.TTDelegateActivity

com.bytedance.sdk.openadsdk.activity.single.TTWebsiteActivity

com.bytedance.sdk.openadsdk.activity.single.TTAppOpenAdActivity

com.bytedance.sdk.openadsdk.activity.single.TTAppOpenAdTransActivity

com.bytedance.sdk.openadsdk.activity.single.TTRewardVideoActivity

com.bytedance.sdk.openadsdk.activity.TTRewardWebActivity

com.bytedance.sdk.openadsdk.activity.TTFullWebActivity

com.bytedance.sdk.openadsdk.activity.single.TTRewardExpressVideoActivity

com.bytedance.sdk.openadsdk.activity.single.TTFullScreenVideoActivity

com.bytedance.sdk.openadsdk.activity.single.TTFullScreenExpressVideoActivity

com.bytedance.sdk.openadsdk.activity.single.TTAdActivity

com.my.target.common.MyTargetActivity

com.unity3d.services.ads.adunit.AdUnitActivity

com.unity3d.services.ads.adunit.AdUnitTransparentActivity

com.unity3d.services.ads.adunit.AdUnitTransparentSoftwareActivity

com.unity3d.services.ads.adunit.AdUnitSoftwareActivity

com.unity3d.ads.adplayer.FullScreenWebViewDisplay

com.vungle.ads.internal.ui.VungleActivity

com.facebook.ads.AudienceNetworkActivity

com.chartboost.sdk.view.CBImpressionActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.android.billingclient.api.ProxyBillingActivity

com.android.billingclient.api.ProxyBillingActivityV2

com.google.android.gms.common.api.GoogleApiActivity

sg.bigo.ads.ad.splash.AdSplashActivity

sg.bigo.ads.ad.splash.LandscapeAdSplashActivity

sg.bigo.ads.controller.form.AdFormActivity

sg.bigo.ads.api.AdActivity

sg.bigo.ads.api.PopupAdActivity

sg.bigo.ads.api.LandingStyleableActivity

sg.bigo.ads.api.LandscapeAdActivity

sg.bigo.ads.api.CompanionAdActivity

sg.bigo.ads.api.LandscapeCompanionAdActivity

sg.bigo.ads.core.mraid.MraidVideoActivity

com.fyber.inneractive.sdk.activities.InneractiveInternalBrowserActivity

com.fyber.inneractive.sdk.activities.InneractiveFullscreenAdActivity

com.fyber.inneractive.sdk.activities.InneractiveRichMediaVideoPlayerActivityCore

com.fyber.inneractive.sdk.activities.InternalStoreWebpageActivity

com.fyber.inneractive.sdk.activities.FyberReportAdActivity

com.mbridge.msdk.config.activity.MBRewardVideoActivity

com.mbridge.msdk.activity.MBCommonActivity

com.mbridge.msdk.out.LoadingActivity

com.mbridge.msdk.reward.player.MBRewardVideoActivity

com.maticoo.sdk.core.imp.video.VideoAdActivity2

com.maticoo.sdk.core.imp.interact.InteractAdActivity

com.maticoo.sdk.core.imp.interstitial.InterstitialAdActivity

com.maticoo.sdk.core.imp.interstitial.InterstitialMActivity

com.maticoo.sdk.core.imp.splash.SplashAdActivity

com.pairip.licensecheck.LicenseActivity

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

com.mbridge.msdk.foundation.same.broadcast.NetWorkChangeReceiver

android.net.conn.CONNECTIVITY_CHANGE

Android Permissions

Vsem VPN_2.0.6.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.POST_NOTIFICATIONS

android.permission.WAKE_LOCK

com.google.android.gms.permission.AD_ID

android.permission.QUERY_ALL_PACKAGES

android.permission.REQUEST_DELETE_PACKAGES

android.permission.VIBRATE

com.android.vending.CHECK_LICENSE

android.permission.ACCESS_WIFI_STATE

android.permission.ACCESS_ADSERVICES_AD_ID

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_TOPICS

com.android.vending.BILLING

com.vsemnetwork.vsemvpn.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE