badbox | c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b[.]apk

General

Target
c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk
Size 25.3MB
Sample261106-b1l77swtbz
SHA256 c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b
MD5 0a8f2ea6664fb8fc6443ab73286e1aab
SHA1 0cae0d9b5944236ae91b304aa1823fc9281df66f
SHA512 39a22309540c6afbb3c581eba73d00bdc062e708508416f5e8b146645be671fcf448860fd713c6fe92f3e2fffb2318c8f5b3c64f419d85c11fe71d857131ba8a
SSDEEP 196608:J63Nv9nEXOUwjQO2yU64Ahz3ugvfhudU8aUbD2w6hsSiyGz:J6dvq+UwjQObyAhz3ugXwdU8HD23rGz
TLSH
T141479C02A60A8C33C4BEB2B755A7039567301D4A6743C7932505B6BFBDB32D46BD628F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor trojan infostealer badbox

Malware Config

Signatures

Family: BADBOX
BADBOX is an Android botnet that targets Android TV devices.
backdoor trojan infostealer badbox

Android BADBOX payload 1 IoCs

resource	yara_rule
sample	family_badbox

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 12 IoCs

description	ioc
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Allows an application to read video files from external storage.	android.permission.READ_MEDIA_VIDEO
Allows an application to read audio files from external storage.	android.permission.READ_MEDIA_AUDIO
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call.	android.permission.CALL_PHONE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an app to create windows using the type LayoutParams.TYPE_APPLICATION_OVERLAY, shown on top of all other apps.	android.permission.SYSTEM_ALERT_WINDOW
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk

File Explorer

c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk

.apk 25.3MB

c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk

SHA256 c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b
MD5 0a8f2ea6664fb8fc6443ab73286e1aab
SHA1 0cae0d9b5944236ae91b304aa1823fc9281df66f
SHA512 39a22309540c6afbb3c581eba73d00bdc062e708508416f5e8b146645be671fcf448860fd713c6fe92f3e2fffb2318c8f5b3c64f419d85c11fe71d857131ba8a
SSDEEP 196608:J63Nv9nEXOUwjQO2yU64Ahz3ugvfhudU8aUbD2w6hsSiyGz:J6dvq+UwjQObyAhz3ugXwdU8HD23rGz
TLSH
T141479C02A60A8C33C4BEB2B755A7039567301D4A6743C7932505B6BFBDB32D46BD628F
MD5 SHA1 SHA512 SSDEEP TLSH

android

Android BADBOX payload
Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

2404dcd9ce0895d5fea37f408d91375edc151a6075850e245ac9ef330211a7cb

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=koobee,OU=Public,O=Prize,L=ShenZhen,ST=GuangDong,C=CN,1.2.840.113549.1.9.1=#0c126b6f6f62656540737a7072697a652e636f6d

com.android.launcher3

android.permission.BROADCAST_CLOSE_SYSTEM_DIALOGS android.permission.CONTROL_REMOTE_APP_TRANSITION_ANIMATIONS android.permission.VIBRATE android.permission.QUERY_ALL_PACKAGES android.permission.START_TASKS_FROM_RECENTS android.permission.REMOVE_TASKS android.permission.WRITE_SECURE_SETTINGS android.permission.MANAGE_ACTIVITY_TASKS android.permission.STATUS_BAR android.permission.STOP_APP_SWITCHES android.permission.SET_ORIENTATION android.permission.READ_FRAME_BUFFER android.permission.MANAGE_ACCESSIBILITY android.permission.MONITOR_INPUT android.permission.ALLOW_SLIPPERY_TOUCHES android.permission.SYSTEM_APPLICATION_OVERLAY android.permission.READ_MEDIA_IMAGES android.permission.READ_MEDIA_VIDEO android.permission.READ_MEDIA_AUDIO android.permission.READ_EXTERNAL_STORAGE android.permission.WRITE_EXTERNAL_STORAGE android.permission.MANAGE_EXTERNAL_STORAGE android.permission.CALL_PHONE android.permission.SET_WALLPAPER android.permission.SET_WALLPAPER_HINTS android.permission.BIND_APPWIDGET android.permission.RECEIVE_BOOT_COMPLETED android.permission.REQUEST_DELETE_PACKAGES android.permission.READ_DEVICE_CONFIG com.mediatek.permission.MIRA_VISION android.permission.ROTATE_SURFACE_FLINGER android.permission.POST_NOTIFICATIONS com.android.permission.RECV_SET_AGREEMENT com.android.launcher3.permission.READ_SETTINGS com.android.launcher3.permission.WRITE_SETTINGS android.permission.READ_PHONE_STATE com.android.launcher3.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION android.permission.ACCESS_NETWORK_STATE android.permission.ACCESS_WIFI_STATE android.permission.FOREGROUND_SERVICE android.permission.SYSTEM_ALERT_WINDOW android.permission.REQUEST_INSTALL_PACKAGES android.permission.READ_SETTINGS android.permission.SCHEDULE_EXACT_ALARM

com.android.quickstep.RecentsActivity

com.android.launcher3.proxy.ProxyActivityStarter

com.android.quickstep.interaction.GestureSandboxActivity

com.android.quickstep.action.GESTURE_SANDBOX

com.android.quickstep.interaction.AllSetActivity

com.android.quickstep.action.GESTURE_ONBOARDING_ALL_SET

com.android.searchlauncher.SearchLauncher

android.intent.action.MAIN android.intent.action.SHOW_WORK_APPS

com.android.launcher3.prize.IconSizeSettingActivity

com.android.launcher3.prize.ScreenStyleActivity

com.android.launcher3.theme.custom.CustomIconActivity

com.android.launcher3.theme.custom.CustomTitleActivity

com.android.launcher3.theme.ThemeActivity

com.android.launcher3.prize.widget.PrivacyAgreementActivity

com.android.launcher3.prize.widget.wallpaperchange.WallpaperChangeActivity

android.intent.action.CREATE_SHORTCUT

com.android.launcher3.prize.widget.memoryclean.MemoryCleanActivity

android.intent.action.CREATE_SHORTCUT

com.android.launcher3.prize.widget.flashlight.FlashLightActivity

android.intent.action.CREATE_SHORTCUT

com.android.launcher3.dragndrop.AddItemActivity

android.content.pm.action.CONFIRM_PIN_SHORTCUT android.content.pm.action.CONFIRM_PIN_APPWIDGET

com.android.launcher3.settings.PrizeSettings

android.intent.action.APPLICATION_PREFERENCES com.android.settings.action.EXTRA_SETTINGS

com.android.launcher3.secondarydisplay.SecondaryDisplayLauncher

android.intent.action.MAIN

androidx.slice.compat.SlicePermissionActivity

Android Permissions

c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk

Permissions

android.permission.BROADCAST_CLOSE_SYSTEM_DIALOGS

android.permission.CONTROL_REMOTE_APP_TRANSITION_ANIMATIONS

android.permission.VIBRATE

android.permission.QUERY_ALL_PACKAGES

android.permission.START_TASKS_FROM_RECENTS

android.permission.REMOVE_TASKS

android.permission.WRITE_SECURE_SETTINGS

android.permission.MANAGE_ACTIVITY_TASKS

android.permission.STATUS_BAR

android.permission.STOP_APP_SWITCHES

android.permission.SET_ORIENTATION

android.permission.READ_FRAME_BUFFER

android.permission.MANAGE_ACCESSIBILITY

android.permission.MONITOR_INPUT

android.permission.ALLOW_SLIPPERY_TOUCHES

android.permission.SYSTEM_APPLICATION_OVERLAY

android.permission.READ_MEDIA_IMAGES

android.permission.READ_MEDIA_VIDEO

android.permission.READ_MEDIA_AUDIO

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.CALL_PHONE

android.permission.SET_WALLPAPER

android.permission.SET_WALLPAPER_HINTS

android.permission.BIND_APPWIDGET

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.REQUEST_DELETE_PACKAGES

android.permission.READ_DEVICE_CONFIG

com.mediatek.permission.MIRA_VISION

android.permission.ROTATE_SURFACE_FLINGER

android.permission.POST_NOTIFICATIONS

com.android.permission.RECV_SET_AGREEMENT

com.android.launcher3.permission.READ_SETTINGS

com.android.launcher3.permission.WRITE_SETTINGS

android.permission.READ_PHONE_STATE

com.android.launcher3.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_WIFI_STATE

android.permission.FOREGROUND_SERVICE

android.permission.SYSTEM_ALERT_WINDOW

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.READ_SETTINGS

android.permission.SCHEDULE_EXACT_ALARM

c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk

File Signature issue

com.android.quickstep.RecentsActivity

com.android.launcher3.proxy.ProxyActivityStarter

com.android.quickstep.interaction.GestureSandboxActivity

com.android.quickstep.interaction.AllSetActivity

com.android.searchlauncher.SearchLauncher

com.android.launcher3.prize.IconSizeSettingActivity

com.android.launcher3.prize.ScreenStyleActivity

com.android.launcher3.theme.custom.CustomIconActivity

com.android.launcher3.theme.custom.CustomTitleActivity

com.android.launcher3.theme.ThemeActivity

com.android.launcher3.prize.widget.PrivacyAgreementActivity

com.android.launcher3.prize.widget.wallpaperchange.WallpaperChangeActivity

com.android.launcher3.prize.widget.memoryclean.MemoryCleanActivity

com.android.launcher3.prize.widget.flashlight.FlashLightActivity

com.android.launcher3.dragndrop.AddItemActivity

com.android.launcher3.settings.PrizeSettings

com.android.launcher3.secondarydisplay.SecondaryDisplayLauncher

androidx.slice.compat.SlicePermissionActivity

com.android.quickstep.TouchInteractionService

com.android.launcher3.notification.NotificationListener

com.pri.appcenter.service.RemoteService

com.android.launcher3.SessionCommitReceiver

com.android.launcher3.AppWidgetsRestoredReceiver

com.android.quickstep.LauncherSearchIndexablesProvider

androidx.core.content.FileProvider

com.android.launcher3.LauncherProvider

com.android.launcher3.graphics.GridCustomizationsProvider

com.android.launcher3.testing.TestInformationProvider

androidx.startup.InitializationProvider

com.android.launcher3.prize.ThemeProvider

net.grandcentrix.tray.provider.TrayContentProvider

com.pri.appcenter.provider.MyFileProvider

Sharing

General

Malware Config

Signatures

File Explorer

c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk

File Signature issue

com.android.quickstep.RecentsActivity

com.android.launcher3.proxy.ProxyActivityStarter

com.android.quickstep.interaction.GestureSandboxActivity

com.android.quickstep.interaction.AllSetActivity

com.android.searchlauncher.SearchLauncher

com.android.launcher3.prize.IconSizeSettingActivity

com.android.launcher3.prize.ScreenStyleActivity

com.android.launcher3.theme.custom.CustomIconActivity

com.android.launcher3.theme.custom.CustomTitleActivity

com.android.launcher3.theme.ThemeActivity

com.android.launcher3.prize.widget.PrivacyAgreementActivity

com.android.launcher3.prize.widget.wallpaperchange.WallpaperChangeActivity

com.android.launcher3.prize.widget.memoryclean.MemoryCleanActivity

com.android.launcher3.prize.widget.flashlight.FlashLightActivity

com.android.launcher3.dragndrop.AddItemActivity

com.android.launcher3.settings.PrizeSettings

com.android.launcher3.secondarydisplay.SecondaryDisplayLauncher

androidx.slice.compat.SlicePermissionActivity

com.android.quickstep.TouchInteractionService

com.android.launcher3.notification.NotificationListener

com.pri.appcenter.service.RemoteService

com.android.launcher3.SessionCommitReceiver

com.android.launcher3.AppWidgetsRestoredReceiver

com.android.quickstep.LauncherSearchIndexablesProvider

androidx.core.content.FileProvider

com.android.launcher3.LauncherProvider

com.android.launcher3.graphics.GridCustomizationsProvider

com.android.launcher3.testing.TestInformationProvider

androidx.startup.InitializationProvider

com.android.launcher3.prize.ThemeProvider

net.grandcentrix.tray.provider.TrayContentProvider

com.pri.appcenter.provider.MyFileProvider

Android Permissions

c9154056cf3146bd3249de862fca6ceccd6eb020095aa889ce7d9da08c3d314b.apk