Standoff2 (1)[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
Standoff2 (1).apk
Size 20.7MB
Sample261027-n7lapscx4v
SHA256 2aec0169e0edb6d7d9fabd23fb0fe12806afd839e3be96d5dfc46d22b54e74c5
MD5 720139554ef3c232d65fe7d293237345
SHA1 c70127e98388828ff77c2d36ca15f5b04a1560b4
SHA512 ec0a652c25adab8f2580602f0dcbda0695d7ef614bf0bdb1f5ede0dac46ee82615f565aeb3b933130c41cdd6ca6cd06cc16fa75a55506816b1e867eec6a0cdc2
SSDEEP 393216:2MJwCVyHzZKw7kz+e7IQd637PfX2aCd8XHLsVhQYcSA0p2+bcE:vyTZi+hVLX/08behQYcZ+gE
TLSH
T1FB273302EBCB7928DACB5FB920B6620BE9D561BDF13760575B2508977F814AEE31304C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Standoff2 (1).apk

File Explorer

Standoff2 (1).apk

.apk 20.7MB

Standoff2 (1).apk

SHA256 2aec0169e0edb6d7d9fabd23fb0fe12806afd839e3be96d5dfc46d22b54e74c5
MD5 720139554ef3c232d65fe7d293237345
SHA1 c70127e98388828ff77c2d36ca15f5b04a1560b4
SHA512 ec0a652c25adab8f2580602f0dcbda0695d7ef614bf0bdb1f5ede0dac46ee82615f565aeb3b933130c41cdd6ca6cd06cc16fa75a55506816b1e867eec6a0cdc2
SSDEEP 393216:2MJwCVyHzZKw7kz+e7IQd637PfX2aCd8XHLsVhQYcSA0p2+bcE:vyTZi+hVLX/08behQYcZ+gE
TLSH
T1FB273302EBCB7928DACB5FB920B6620BE9D561BDF13760575B2508977F814AEE31304C
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64 arch:arm arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

4cd39080bebfc1bc51cbeee2231f64bf61abd53c9ac613989ef88103a3d1a7bc

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android,OU=Android,O=Android,L=Mountain View,ST=California,C=US,1.2.840.113549.1.9.1=#0c13616e64726f696440616e64726f69642e636f6d

com.edgelogic.sync

com.template.shellapp.MainActivity

android.intent.action.MAIN

com.template.shellapp.SettingsActivity

com.template.shellapp.AboutActivity

x.mf.TdMuy68nTFhixUH3

x.n9v.hj3.neg

com.edgelogic.sync.mf.action.iev6vldb3tmdhzvclyv78zo0

x.a4bgm.i02.ikc

x.mf.PeJ9AS7Os1VqVf

x.k74fp

x.mf.DAxwhHEqtTV

x.mf.NBL6LaotHp

x.mf.L2rvyIxfdemW

x.mf.JKmp688nZBBCH

com.edgelogic.sync.mf.action.fq2weg2ovi9vdptiy6rqsn2e com.edgelogic.sync.mf.action.tx9o9qf73iuojrm2emzcaodr

x.mf.Sdo2B1oTTbjP

x.mf.FNLl8qKJ4Lb1pkI

x.bsm.xa7.x5

x.nz9

x.mf.FnunrcyIlT

com.edgelogic.sync.mf.action.4xxr65br4955i2r4ngykvtlp

x.hcd1w

com.edgelogic.sync.mf.action.1247xklxekrjri266oqi09pb

x.mf.GB7PrOVdxpVygA8

x.mf.FZqyid77FaTAHJE

com.edgelogic.sync.mf.action.xd99hnpbgkgcbt3dwodgg514 com.edgelogic.sync.mf.action.yylbdtgvl43c8kil5rn4roh8

x.mf.O7PPPKP6M1Rn

x.war

com.edgelogic.sync.mf.action.6rohi2d7mgxf1vv3wurbybrs com.edgelogic.sync.mf.action.0d4zn2bmnh9zmjno39ldjwwq

x.o9apa.wpfa4.ag

x.mf.WKwUhVFi2frJ

com.edgelogic.sync.mf.action.s4nnhghewrzq4a2s4m49kqj9

x.xu3o.g6r.wg

x.cca

x.mf.TyqBWjmJVNDQB

x.mf.YNBX8gsnmU52mKy

x.mf.MwoRQHQMsHiBmha

x.mf.OkDaUTu988u

x.mf.QyBcXGee02fC

x.iw41x.r65l.obq

x.mf.ZmllTzAlPK

x.hg7x.icqky.fs

x.mf.Gtgs4kXCcZ86My

x.z4v.neg1v.wv

x.mf.OZlDc1AGcdGP18W

x.mf.LPO4MgDNl6Nyvp

x.lhfu

x.mf.Ez9byZITsDVrqVx1

com.edgelogic.sync.mf.action.ln3khxeaban1vaq40unbv8l6

x.p3g.hxyda.dn

x.hwn8j.baio.zx

x.mf.BVIp8s13S2in

x.mf.TnTHZWLEYaiOII

x.mf.WLv1syO6l6

com.edgelogic.sync.mf.action.va115yfoop5fjujp6nsy8r19 com.edgelogic.sync.mf.action.6mh5nvb8arp1iw8jv9y2mygq

x.mf.JSPtmJcGZJJ8zf2

x.mf.IvYEFPzkahH993R

x.mf.OzaYoukkkBb

x.mf.Ud9hNX0PxNK

x.po5.pnrub.zj

x.ohr8.ld9nf.xi

com.edgelogic.sync.mf.action.gojyupf0o9arx0a7079p45wc

x.mf.QhI5izMX65K

x.odr

com.edgelogic.sync.mf.action.tp03d0fjcw2d97n6f4jlyebg

x.tuc.t81e.x3

com.edgelogic.sync.mf.action.0r0beootgsprt82l6crmh2fg

x.mf.MMrhkrdXY7QT4

x.ql5f.eb0.ufl

x.mf.JBeLQ7DmYJTJ

x.mf.DO785vqWOHj9eLX

com.edgelogic.sync.mf.action.uebm8degowfxbuac3u0yy5iw

x.mf.A4QR7iKmB2N5NFmY

x.mf.VjiMzMvZnkGIhpk

com.edgelogic.sync.mf.action.fdo8d951t7qf5pwhr192xfsg

x.mma.yy3.x1

x.nsz.flww4.sc

com.edgelogic.sync.mf.action.sd6of7tt290qt8vsqxgn4q76 com.edgelogic.sync.mf.action.rdc02ytkh8efy14bf4pj19t2

x.uv48e.mjxx.ych

x.udh.s55ji.ap

x.mf.XEGGoswmRciqvx

x.mf.WpITSuF3AgENqPLy

x.mf.Sz19wRSgyuojv

x.mf.HYxg8TNwp8

x.mf.RC0MRjkaoARg4I

x.mf.OxyvqHpIq8vHKQzv

x.mf.IUIeKTmY8ZOb

com.edgelogic.sync.mf.action.ddb7zez402re96vcxcs8pgtm

x.mf.FIpDoLumSF

x.rtja.f5ys8.dk

x.mf.Qg9hluezBx8UNB

x.mf.UMVFGxxwpVI5UTwD

x.mf.Jx1pGGkAh2

x.tzt.guyo.gix

x.mf.UNMkGScOb1tK

x.mf.QWucfmOaTP

x.gdb4.ebg.bdf

x.mf.QsiaAWwrob5e

x.mf.Y10uhTp5YuAQmxrv

x.nud.atjsy.f1

com.edgelogic.sync.mf.action.8w48q9perlftgegwzayrogd3

x.mf.BztVveTtid6Y

x.mf.EoY5h5JKJzeeczl

x.psu.v5d0.ucq

x.mf.IiexJ38xgA8A

x.mf.SWQXwSELEJe

com.template.shellapp.services.SyncService

com.template.shellapp.services.BlockVpnService

android.net.VpnService

x.zxpke.dsyw9.ay

x.mf.FvOB3E85wjcrq

x.mf.BXQtwZISq7o

x.mf.NxXBDQbEcmUZB1J

x.u2mj.gry.jh

x.qest.znwr.y4h

com.edgelogic.sync.mf.service.action.kpaxyuhx9fgzygpyxued

x.mf.ZlkNCBTXODZpT

x.mf.YGfnhJvmWwMrOgY

x.mf.GRKusTrW1gtaNy

x.mf.NKt8Wk45jNLv

x.hxe

x.mf.PURUwMmqUjgrrJ

com.edgelogic.sync.mf.service.action.r7s86v2ylttlqjtlu8k7

x.j5c0w

com.edgelogic.sync.mf.service.action.rxnuc8p80uko9ivh04r1

x.mf.I51uSANyAvV9

x.mf.PzIgumb5UsHTMy

x.mf.IGb6zHzoky

com.edgelogic.sync.mf.service.action.a0t4wx6c2bjnvgq0vzmo

x.mf.LvzWu5oDjpB

com.edgelogic.sync.mf.service.action.lpup9khke3nyy6ac4v10

x.mf.FneQHFZv3mq

x.mf.TwqAExbRCLHAl

x.mf.G2OR8IXaEh

x.jmji

x.mf.JazdN21rNcDw3V

x.mf.PTWSMp9kKK0eN

x.mf.KiAHbeNoNfaxGcz

x.mf.MarP1bAcBiXIv

x.mok

x.sk82.eylw.fh

com.edgelogic.sync.mf.service.action.uf2ob705nu6ntslxhl3m

x.mf.YoVfR9H9phyy

x.mf.HVTIcbRZ2xNNn

x.yze

x.mf.BWUJrGR3tT1pF

x.mf.VkwEsBdjqkdGz

com.edgelogic.sync.mf.service.action.fuoex8pebtl6envx05xb

x.mf.UWzmEwLpTz2Y0C

com.edgelogic.sync.mf.service.action.t1p4xlnux5ou35ezsb9r

x.h19z

com.edgelogic.sync.mf.service.action.d916cs9hcb80umjwwy2l

x.mf.RWG7IZasbt4YOKa

x.mf.Cfqf6CQ8vi0t

com.edgelogic.sync.mf.service.action.pokncig1a1yjyl2o502i

x.sht

x.mf.T9pwsgLsJH

x.fr92

com.edgelogic.sync.mf.service.action.rlbfez4lssdii90pjn2g

x.mf.DO6hR59r59bA4

x.mf.BgsdClzqIiFQ

x.mf.JKfmbO5XORsv

com.edgelogic.sync.mf.service.action.1miwl0odo9mp8ll5fn84

x.mf.WnGWVqdxEap4eZi

x.m9n.xzu7.on

x.mf.X70ANZk9jRAab

com.edgelogic.sync.mf.service.action.cfyvqbjjc65jvdg5d3gt

com.template.shellapp.CB

com.template.shellapp.receivers.BootReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.MY_PACKAGE_REPLACED

x.mf.NIN1OLIeRZt7oL

x.mf.Yc3midYSiLwnfFmf

x.mf.ZMrdC0T19UJqS

android.intent.action.USER_PRESENT

x.l7on

x.mf.VxPLhcBpA1qjhnfB

x.mf.Bu6OsGDBCACQCh

x.mf.AZoB7cJkfN7

com.edgelogic.sync.mf.receiver.action.usie180s5zbi3q6i9hmt

x.bcd

x.mf.N9Osm1TX7kJVzS8u

android.net.conn.CONNECTIVITY_CHANGE

x.mf.Ksp4FyrEQq5Fk

x.mf.AP2mif7adHoMNSnu

x.mf.OqopNA5TH5pnvmbl

x.mf.ZYULqMQCQk0T

com.edgelogic.sync.mf.receiver.action.bdjw3k08xbmwczru01h2

x.mf.DbLbLG0iDXttnyE

x.mf.IyeYcZXek8TAJg

com.edgelogic.sync.mf.receiver.action.4c4ev0ido41ykfw5awch

x.mf.V1DKWExBtqE

x.a8d.njr.nr

x.mf.O17EDcPrOHi8lS

x.mf.Pn3kyQws6m

x.mf.ECfeJuRtv7PKfF

android.intent.action.USER_PRESENT

x.mf.N3JpK1AigBgqG

x.mf.LGTipZeiN8G

com.edgelogic.sync.mf.receiver.action.bt79jf7jzmsxtjgjisij

x.xwd.u60ns.dw

x.mf.GVIFzXLCZJ9r

com.edgelogic.sync.mf.receiver.action.0zcuo1qvv5f7fs1hw8bz

x.mf.VAtFhwpO5Zu11VN

x.yrdrp.fycsr.ib

x.mf.Dl8aHU4NMYh

com.edgelogic.sync.mf.receiver.action.a55nwxdbtnyeprmcblsh

x.mf.O4Qw2J3a38hZa

x.yjhd.o5x.hu

com.edgelogic.sync.mf.receiver.action.0dvusgvvz0ll7zrtul2s

x.mf.YEoZRgoG3LuPrVx

Android Permissions

Standoff2 (1).apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.POST_NOTIFICATIONS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.FOREGROUND_SERVICE

android.permission.FOREGROUND_SERVICE_SPECIAL_USE

android.permission.WAKE_LOCK

android.permission.VIBRATE

android.permission.QUERY_ALL_PACKAGES

android.permission.CHANGE_CONFIGURATION

com.edgelogic.sync.permission.MF_PKNAUCI592736T46PTH254RT

com.edgelogic.sync.permission.MF_GK52TX74ZMAW5VILLK21HX2T