Exit DLC _btmobrat_walnutkoz[.]apk

General

Target
Exit DLC _btmobrat_walnutkoz.apk
Size 14.7MB
Sample261104-wlpp1ayv7n
SHA256 5602e4baadc1de80a7369d16890620f38d2288df7cd93b5c63c64c0c708962fb
MD5 9592283ebc38e61e9db70ae95539d287
SHA1 92319d655d2d321863d325be0fb9f3b9ed7a4d23
SHA512 675e11568efd23f4bfee3af0ea30fc25fc9229b4f37f953b9e1f014db4be48f3d2a1004c81ce60ed7976fdfc6921a967e14bc43cae4762a5b6888510099e14a1
SSDEEP 393216:pqUQ1FvZwmtOmw3gM+MNPcBqV52fddvWdzU:fQLamc+MdPlcdvAY
TLSH
T10EF6225BFB54486AC0F343B2013A5326154B8C668B43D6C7BD58713C28BBAD46F9EACD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE

Requests dangerous framework permissions 14 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to write the user's contacts data.	android.permission.WRITE_CONTACTS
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
Exit DLC _btmobrat_walnutkoz.apk

File Explorer

Exit DLC _btmobrat_walnutkoz.apk

.apk 14.7MB

Exit DLC _btmobrat_walnutkoz.apk

SHA256 5602e4baadc1de80a7369d16890620f38d2288df7cd93b5c63c64c0c708962fb
MD5 9592283ebc38e61e9db70ae95539d287
SHA1 92319d655d2d321863d325be0fb9f3b9ed7a4d23
SHA512 675e11568efd23f4bfee3af0ea30fc25fc9229b4f37f953b9e1f014db4be48f3d2a1004c81ce60ed7976fdfc6921a967e14bc43cae4762a5b6888510099e14a1
SSDEEP 393216:pqUQ1FvZwmtOmw3gM+MNPcBqV52fddvWdzU:fQLamc+MdPlcdvAY
TLSH
T10EF6225BFB54486AC0F343B2013A5326154B8C668B43D6C7BD58713C28BBAD46F9EACD
MD5 SHA1 SHA512 SSDEEP TLSH

android arch:arm64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

1e05d70f5a0cf1196f6ef1346a5c48e36406cb2aa7e2c54790735e3360e77509

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=MrTusarRX

exit.cc.recode

exit.cc.recode.Splasher

exit.cc.recode.HomeSIM

android.intent.action.MAIN

exit.cc.recode.HomeWallp

android.intent.action.MAIN

exit.cc.recode.HomeSmsung

android.intent.action.MAIN

exit.cc.recode.PlayS

android.intent.action.MAIN

exit.cc.recode.undergroundhgnvjbujuefc

exit.cc.recode.nectarinebxjzqylabfiq

exit.cc.recode.voyagerznahgxa

exit.cc.recode.phoenixllewdlcm

exit.cc.recode.unforgettablevwjwfamo

exit.cc.recode.waterfallgpvxvry

exit.cc.recode.magicalqjuyrsm

exit.cc.recode.speakit

exit.cc.recode.teacherlyvqwaiclz

exit.cc.recode.kangaroozgdpzby

exit.cc.recode.bananaydelxfxlqymhb

exit.cc.recode.Toastit

exit.cc.recode.uniformzmmivvx

exit.cc.recode.yearningzjauoj

exit.cc.recode.Inputhunterhylpryiqdzfjziy

exit.cc.recode.shadowyklfdqzssv

exit.cc.recode.seasideckpldoimptpv

exit.cc.recode.yonderxadwezls

exit.cc.recode.breezeznapaalzvd

exit.cc.recode.launchdjhspxirxkns

exit.cc.recode.hunterhylpryiqdzfjziy

exit.cc.recode.umbrelladgdpvwvzhe

exit.cc.recode.yogurtawwotnhbdj

exit.cc.recode.obsidianrjiopyaugvazjw

exit.cc.recode.crimsonfaikiyvtnkyb

exit.cc.recode.CallBacker

exit.cc.recode.gardeniyluqrkxkxz

kquzjxs.fdxjwgag.Actdtonwgrhqr258

kquzjxs.fdxjwgag.Actykkkwmljctqknbdbsm861

kquzjxs.fdxjwgag.Actgjfakbwnuy692

exit.cc.recode.alarme

AppAlarm

exit.cc.recode.quaintlyykxacluhbk

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

exit.cc.recode.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

kquzjxs.fdxjwgag.Rcvrzociakysojc952

android.intent.action.mbqumjwgqclytbiugct

kquzjxs.fdxjwgag.Rcvrvjhnjyklkm960

android.intent.action.saxeaxalfcdzyas

kquzjxs.fdxjwgag.Rcvrhkncajwpixdeuwrkht654

android.intent.action.lriattlhoyxfxlmbzb

Android Permissions

Exit DLC _btmobrat_walnutkoz.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.POST_NOTIFICATIONS

exit.cc.recode.permission.TDOS_DIAGNOSE_BROADCAST

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

com.android.alarm.permission.SET_ALARM

android.permission.WAKE_LOCK

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.FLASHLIGHT

android.permission.RECORD_AUDIO

android.permission.READ_CONTACTS

android.permission.WRITE_CONTACTS

android.permission.SEND_SMS

android.permission.READ_PHONE_NUMBERS

android.permission.READ_SMS

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_FINE_LOCATION

android.permission.CALL_PHONE

exit.cc.recode.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

Exit DLC _btmobrat_walnutkoz.apk

File Signature issue

exit.cc.recode.Splasher

exit.cc.recode.HomeSIM

exit.cc.recode.HomeWallp

exit.cc.recode.HomeSmsung

exit.cc.recode.PlayS

exit.cc.recode.undergroundhgnvjbujuefc

exit.cc.recode.nectarinebxjzqylabfiq

exit.cc.recode.voyagerznahgxa

exit.cc.recode.phoenixllewdlcm

exit.cc.recode.unforgettablevwjwfamo

exit.cc.recode.waterfallgpvxvry

exit.cc.recode.magicalqjuyrsm

exit.cc.recode.speakit

exit.cc.recode.teacherlyvqwaiclz

exit.cc.recode.kangaroozgdpzby

exit.cc.recode.bananaydelxfxlqymhb

exit.cc.recode.Toastit

exit.cc.recode.uniformzmmivvx

exit.cc.recode.yearningzjauoj

exit.cc.recode.Inputhunterhylpryiqdzfjziy

exit.cc.recode.shadowyklfdqzssv

exit.cc.recode.seasideckpldoimptpv

exit.cc.recode.yonderxadwezls

exit.cc.recode.breezeznapaalzvd

exit.cc.recode.launchdjhspxirxkns

exit.cc.recode.hunterhylpryiqdzfjziy

exit.cc.recode.umbrelladgdpvwvzhe

exit.cc.recode.yogurtawwotnhbdj

exit.cc.recode.obsidianrjiopyaugvazjw

exit.cc.recode.crimsonfaikiyvtnkyb

exit.cc.recode.CallBacker

exit.cc.recode.gardeniyluqrkxkxz

kquzjxs.fdxjwgag.Actdtonwgrhqr258

kquzjxs.fdxjwgag.Actykkkwmljctqknbdbsm861

kquzjxs.fdxjwgag.Actgjfakbwnuy692

exit.cc.recode.hazelimfojrabbr

exit.cc.recode.radiancezkibvcrxfmx

exit.cc.recode.nighthawkmqdpetjct

exit.cc.recode.acorneyddxwdu

exit.cc.recode.tigerwtiencbseksg

exit.cc.recode.latticepzktygkao

exit.cc.recode.kaleidoscopiciumbikxo

exit.cc.recode.updateetwsqt

exit.cc.recode.rippledurajvbivlx

exit.cc.recode.minserv

exit.cc.recode.yearbooktrmreicffwj

exit.cc.recode.zenithalpklklfvgpo

exit.cc.recode.Msss

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

kquzjxs.fdxjwgag.Svciqbglfndlkheptzzz753

kquzjxs.fdxjwgag.Svcqcqzewcaeeqmunxlxl343

kquzjxs.fdxjwgag.Svcckhtlyjxnwnqyym850

kquzjxs.fdxjwgag.Svcgbuhnjcttbmifwui301

exit.cc.recode.alarme

exit.cc.recode.quaintlyykxacluhbk

exit.cc.recode.ResetServices

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

kquzjxs.fdxjwgag.Rcvrzociakysojc952

kquzjxs.fdxjwgag.Rcvrvjhnjyklkm960

kquzjxs.fdxjwgag.Rcvrhkncajwpixdeuwrkht654

androidx.core.content.FileProvider

androidx.startup.InitializationProvider