Overview

overview

10

Static

static

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    kt_renew_ch7_6670.apk
  • Size 6.5MB
  • Sample261102-w1kplact81
  • SHA256 a15d76a2933e64bbe23b90a4b11f36c6217f7507f012b1f6e5fed7fe2713f1e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
trojaninfostealerspywarengate

Malware Config

Signatures

  • Family: NGate

    NGate is an Android malware that utilizes NFC traffic relaying to steal victims' cash.

    trojaninfostealerspywarengate
  • Requests dangerous framework permissions 1 IoCs
  • Untrusted Codesign Signers 1 IoCs

    Codesigned file was signed by an untrusted entity.

File Explorer

  • kt_renew_ch7_6670.apk
    .apk 6.5MB

kt_renew_ch7_6670.apk

  • SHA256 a15d76a2933e64bbe23b90a4b11f36c6217f7507f012b1f6e5fed7fe2713f1e3
  • MD5 SHA1 SHA512 SSDEEP TLSH
androidarch:arm64arch:arm

  • Untrusted Codesign Signers

    Codesigned file was signed by an untrusted entity.

File Signature issue

Digest
c0b68c9bdcc35140679b7c9322e91770411f810a854f50e8dfa6fcee9c19c328
Digest Algorithm
sha256
Digest Matches
Trusted
Not trusted
Signer
CN=Debug,OU=Debug,O=Debug,L=Debug,ST=Debug,C=US
app.raven.backup

Android Permissions

kt_renew_ch7_6670.apk

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.NFC

android.permission.READ_CONTACTS

app.raven.backup.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

app.raven.backup.permission.BKKWWLHHW

app.raven.backup.permission.QGTMPIM