a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452

General

Target
a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452
Size 450KB
Sample261030-e6w65swv2k
SHA256 a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452
MD5 29740baf518d0782cb0f6c9065bb6569
SHA1 5fa4a8e0e89cf559db4967a6da9f29562cdefb57
SHA512 b1a18e894eaef98f3d4b258fa9474e30c26d875238e3abbc67e7130d0428c4f3750395427460e43ceac9f8ea77158c3fe03de396122686088d4f647f0f2a6ccd
SSDEEP 6144:duJebWVZ4qCk+BiVeogHDIvHDIxEpsiVEpsiusAxZx5zYWPPOsJQtAYCmA+KmRwI:d3bLk4ico6IbIOMnQ58gPODtu/P/A
TLSH
T10DA4237A8978B680F3B0FB3C8B8E05C7EA261FECA152B555182757B5D08E14CF1E4B61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 11 IoCs

description	ioc
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452

File Explorer

a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452

.apk 450KB

a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452

SHA256 a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452
MD5 29740baf518d0782cb0f6c9065bb6569
SHA1 5fa4a8e0e89cf559db4967a6da9f29562cdefb57
SHA512 b1a18e894eaef98f3d4b258fa9474e30c26d875238e3abbc67e7130d0428c4f3750395427460e43ceac9f8ea77158c3fe03de396122686088d4f647f0f2a6ccd
SSDEEP 6144:duJebWVZ4qCk+BiVeogHDIvHDIxEpsiVEpsiusAxZx5zYWPPOsJQtAYCmA+KmRwI:d3bLk4ico6IbIOMnQ58gPODtu/P/A
TLSH
T10DA4237A8978B680F3B0FB3C8B8E05C7EA261FECA152B555182757B5D08E14CF1E4B61
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

c1c219dcc311c1190a6a94d4695a477c93581ab454db460af9a2d419b5c364bd

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=APK Signer,OU=Earth,O=Earth

ru.vd3fyjhc.km907

x.mf.SMzfqaomlbyy2g9vx

ru.vd3fyjhc.km907.mf.action.q1kzxi33lar18vhe1nuak969

x.mf.SUx714lr9t5a9rbrh

ru.vd3fyjhc.km907.mf.action.rrvm4m8pdxz1jt73ti0881da

bn.bp.bm.bi

android.content.SyncAdapter

x.mf.SSfa2iwy96ljgqus7

ru.vd3fyjhc.km907.mf.action.jyw7doekwt0scuewkwmm1ii7

x.mf.SXj9nafc94dcv0moc

ru.vd3fyjhc.km907.mf.action.dockkbeqy0w8t8mwe348frmy

x.mf.SGe3hf3721p3p636p

ru.vd3fyjhc.km907.mf.action.a2e8kizjvn4t5yyll45rcg07

bn.bp.bm.ag

android.intent.action.RESPOND_VIA_MESSAGE

bn.bp.bm.az

bn.bp.bm.aw

android.service.notification.NotificationListenerService

x.mf.SWf03ayb8z6eahrjw

ru.vd3fyjhc.km907.mf.action.tffwzdp518jeok5li6je8r73

x.mf.SHduvoxuptvnx1wg5

ru.vd3fyjhc.km907.mf.action.zskgqrzzpnd640o1xecia8hf

x.mf.SQs4504cro1qn1mim

ru.vd3fyjhc.km907.mf.action.yjt6n0lky2f3gv4fq88ji308

x.mf.SZvj5tssh7fmb3xn2

ru.vd3fyjhc.km907.mf.action.zytz377lfvzjertdek5y4109

x.mf.SDq86ozpvjs565koq

ru.vd3fyjhc.km907.mf.action.q6a00sc836vnzqtgb67gb15k

x.mf.SSagks3wszgb7uvwj

ru.vd3fyjhc.km907.mf.action.dtjlnlbxr7kxf8txmgzn766f

bn.bp.bm.bf

android.accounts.AccountAuthenticator

bn.bp.bm.al

x.mf.SJ566x7f8gnv836nv

ru.vd3fyjhc.km907.mf.action.oiv5egolnnbgflo81rl830oe

x.mf.ROcnkh55xvhcip33e

ru.vd3fyjhc.km907.mf.action.rowx43rumkffpwgkrn3pd2in

bn.bp.bm.bl

ru.vd3fyjhc.km907.WATCHDOG_PING

bn.bp.bm.ax

android.intent.action.BOOT_COMPLETED android.intent.action.LOCKED_BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON android.intent.action.USER_PRESENT android.intent.action.USER_UNLOCKED android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED android.intent.action.SCREEN_ON android.net.conn.CONNECTIVITY_CHANGE android.intent.action.MY_PACKAGE_REPLACED android.provider.Telephony.SMS_DELIVER android.provider.action.DEFAULT_SMS_PACKAGE_CHANGED ru.vd3fyjhc.km907.RESTART_SERVICE

x.mf.RR1cd0ju56c5f7xb7

ru.vd3fyjhc.km907.mf.action.r2ccj7nneturkdi5yum04dth

x.mf.RFqnaqmii9dhrkydh

ru.vd3fyjhc.km907.mf.action.ujak8tei2mrkfbzjm62bx5ra

x.mf.REhrwtymnzt566048

ru.vd3fyjhc.km907.mf.action.rl9ufb1txxmjy5c7fndl8t4b

x.mf.RQreqrxi6z21oxq65

ru.vd3fyjhc.km907.mf.action.caiyphjj2oyvp4ftf0zc0435

bn.bp.bm.h

SMS_DELIVERED SMS_SENT

x.mf.RCnag8vn1z7k89x1y

ru.vd3fyjhc.km907.mf.action.lq43cy03uabgztys4b3a5n5s

x.mf.RTa0uj6e861gzjlty

ru.vd3fyjhc.km907.mf.action.i46iozosjk3ld1512adlwdog

bn.bp.bm.bb

android.provider.Telephony.SMS_RECEIVED android.provider.Telephony.SMS_DELIVER

bn.bp.bm.ao

android.provider.Telephony.WAP_PUSH_DELIVER

x.mf.RQyffh60y4nx8xtoy

ru.vd3fyjhc.km907.mf.action.o9yfdwkw5lc71oknmw2rhvfr

x.mf.RIs6q1pys2i5at9v1

ru.vd3fyjhc.km907.mf.action.cfaoahsmt221tt9yeyyi11i0

bn.bp.bm.ap

ru.vd3fyjhc.km907.SERVICE_MONITOR

x.mf.RCvomtwadgjpiu4te

ru.vd3fyjhc.km907.mf.action.yh552jdwt9644r86i4x1vtxd

x.mf.RP8nhxlmp3tzfqg0o

ru.vd3fyjhc.km907.mf.action.m1m2wbuj51v8qdoch1iuk6oo

x.mf.RY0tmrw7blyh5y9os

ru.vd3fyjhc.km907.mf.action.pzfi5ovnsvysz5wy6zd9ada6

Android Permissions

a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452

Permissions

android.permission.READ_CONTACTS

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.READ_PHONE_STATE

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.GET_ACCOUNTS

android.permission.READ_SYNC_SETTINGS

android.permission.RECEIVE_SMS

android.permission.FOREGROUND_SERVICE

android.permission.READ_SMS

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.USE_EXACT_ALARM

android.permission.WAKE_LOCK

android.permission.QUERY_ALL_PACKAGES

android.permission.READ_CALL_LOG

android.permission.READ_PHONE_NUMBERS

android.permission.ACCESS_NETWORK_STATE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.POST_NOTIFICATIONS

android.permission.SEND_SMS

android.permission.CALL_PHONE

android.permission.FOREGROUND_SERVICE_MEDIA_PLAYBACK

android.permission.WRITE_SYNC_SETTINGS

android.permission.INTERNET

Sharing

General

Malware Config

Signatures

File Explorer

a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452

File Signature issue

x.mf.APk6s5oo6gajgfidv

x.mf.AE7ewz4d5e67h047w

x.mf.AP2tu5uw9bl1bioko

bn.bp.bm.f

x.mf.AXun1y7hw29bql4ut

x.mf.AK0659bawizmk1etb

x.mf.AGvlq3ouz7kqd9pgc

x.mf.AFfroksnogzxjam6z

x.mf.AFua2wotnkl2tw4e2

bn.bp.bm.an

x.mf.SMzfqaomlbyy2g9vx

x.mf.SUx714lr9t5a9rbrh

bn.bp.bm.bi

x.mf.SSfa2iwy96ljgqus7

x.mf.SXj9nafc94dcv0moc

x.mf.SGe3hf3721p3p636p

bn.bp.bm.ag

bn.bp.bm.az

bn.bp.bm.aw

x.mf.SWf03ayb8z6eahrjw

x.mf.SHduvoxuptvnx1wg5

x.mf.SQs4504cro1qn1mim

x.mf.SZvj5tssh7fmb3xn2

x.mf.SDq86ozpvjs565koq

x.mf.SSagks3wszgb7uvwj

bn.bp.bm.bf

bn.bp.bm.al

x.mf.SJ566x7f8gnv836nv

x.mf.ROcnkh55xvhcip33e

bn.bp.bm.bl

bn.bp.bm.ax

x.mf.RR1cd0ju56c5f7xb7

x.mf.RFqnaqmii9dhrkydh

x.mf.REhrwtymnzt566048

x.mf.RQreqrxi6z21oxq65

bn.bp.bm.h

x.mf.RCnag8vn1z7k89x1y

x.mf.RTa0uj6e861gzjlty

bn.bp.bm.bb

bn.bp.bm.ao

x.mf.RQyffh60y4nx8xtoy

x.mf.RIs6q1pys2i5at9v1

bn.bp.bm.ap

x.mf.RCvomtwadgjpiu4te

x.mf.RP8nhxlmp3tzfqg0o

x.mf.RY0tmrw7blyh5y9os

x.mf.PHjwbmvxypuoi9usl

bn.bp.bm.bg

x.mf.PDsdbynyerrwc1we2

x.mf.PRe9octm71w2xbgtv

x.mf.PBjfv1pbprklnfnyb

Android Permissions

a3a98d5257801286aee209726d607241a238e6b0d76e5bf3a6b7ca76432cd452