test11[.]apk | Triage™

General

Target
test11.apk
Size 5.7MB
Sample261107-2afwlsfy3s
SHA256 cb57569703ff65ef19916969976dd9999ffa3ea523f7a1ca819b6fda2854b4db
MD5 99ddd20032cde86e324c12044fbd8c91
SHA1 1fd8d4662340ba3a4c965317bf835b39d2fe6f30
SHA512 8086053e30cb882f44e0e317c98e67b9d812cbf218aaa42ea52561e90d30287b9adeff7f49bb9b9fcf14d5cc22de14c6b1a4883de7939d9dde28d5053332ec99
SSDEEP 98304:SOdupv3pbQuBk3gFioPSkE921ccBxDs+fOhkNG1Nh+JODFt6Oo/KrrUM5Y:VMx1QuOZoh6c3DbfOhkNwNs2o7CY
TLSH
T15E56F197FB48982AC4F753B2013A5331214B4C6A8B43D6C7AD54313D28B7AD47F9AADC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
test11.apk

File Explorer

test11.apk

.apk 5.7MB

test11.apk

SHA256 cb57569703ff65ef19916969976dd9999ffa3ea523f7a1ca819b6fda2854b4db
MD5 99ddd20032cde86e324c12044fbd8c91
SHA1 1fd8d4662340ba3a4c965317bf835b39d2fe6f30
SHA512 8086053e30cb882f44e0e317c98e67b9d812cbf218aaa42ea52561e90d30287b9adeff7f49bb9b9fcf14d5cc22de14c6b1a4883de7939d9dde28d5053332ec99
SSDEEP 98304:SOdupv3pbQuBk3gFioPSkE921ccBxDs+fOhkNG1Nh+JODFt6Oo/KrrUM5Y:VMx1QuOZoh6c3DbfOhkNwNs2o7CY
TLSH
T15E56F197FB48982AC4F753B2013A5331214B4C6A8B43D6C7AD54313D28B7AD47F9AADC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

8a39eac48f3f4c7ffede4df8990bc0f3d13f2af968b4968d86d54c659036d004

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=MrTusarRX

walnut.dolphin.ancient

walnut.dolphin.ancient.Splasher

walnut.dolphin.ancient.HomeSIM

android.intent.action.MAIN

walnut.dolphin.ancient.HomeWallp

android.intent.action.MAIN

walnut.dolphin.ancient.HomeSmsung

android.intent.action.MAIN

walnut.dolphin.ancient.PlayS

android.intent.action.MAIN

walnut.dolphin.ancient.yachtingolnenraz

walnut.dolphin.ancient.noblefkbzbsgkjus

walnut.dolphin.ancient.cathedraltbzyjdki

walnut.dolphin.ancient.boulderdsqotnpkq

walnut.dolphin.ancient.journeyfuhbpcn

walnut.dolphin.ancient.improvevwvemkxnsw

walnut.dolphin.ancient.knolltqlhcdpfzuu

walnut.dolphin.ancient.speakit

walnut.dolphin.ancient.forestzyoiionvtd

walnut.dolphin.ancient.maximumfrtembthgoeky

walnut.dolphin.ancient.zodiacitiyhxomjflg

walnut.dolphin.ancient.Toastit

walnut.dolphin.ancient.marbleqshwktzvcuz

walnut.dolphin.ancient.desertedwlhgczaqxbynu

walnut.dolphin.ancient.Inputquicksandcarrbqqalfmik

walnut.dolphin.ancient.almondzoqbuwbjqfw

walnut.dolphin.ancient.emberlygnsfdlvhc

walnut.dolphin.ancient.ribbonkbsldjavxcdni

walnut.dolphin.ancient.thicketwyikrku

walnut.dolphin.ancient.wintermatrvsaucm

walnut.dolphin.ancient.quicksandcarrbqqalfmik

walnut.dolphin.ancient.holidayknlagrj

walnut.dolphin.ancient.zippernkpzydf

walnut.dolphin.ancient.zenithalvqwcjfn

walnut.dolphin.ancient.improvenykjxbfptee

walnut.dolphin.ancient.CallBacker

walnut.dolphin.ancient.silverwcjzpp

azlmddk.ddjhl.ntdswzqp.Actjulgabrwgyagho831

azlmddk.ddjhl.ntdswzqp.Actmdbdyaqafdhtptro460

azlmddk.ddjhl.ntdswzqp.Acthxuwofzxfdfung618

walnut.dolphin.ancient.alarme

AppAlarm

walnut.dolphin.ancient.kitchenpcvmhqcsv

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

walnut.dolphin.ancient.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

test11.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.POST_NOTIFICATIONS

walnut.dolphin.ancient.permission.TDOS_DIAGNOSE_BROADCAST

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

com.android.alarm.permission.SET_ALARM

android.permission.WAKE_LOCK

android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.FLASHLIGHT

walnut.dolphin.ancient.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

test11.apk

File Signature issue

walnut.dolphin.ancient.Splasher

walnut.dolphin.ancient.HomeSIM

walnut.dolphin.ancient.HomeWallp

walnut.dolphin.ancient.HomeSmsung

walnut.dolphin.ancient.PlayS

walnut.dolphin.ancient.yachtingolnenraz

walnut.dolphin.ancient.noblefkbzbsgkjus

walnut.dolphin.ancient.cathedraltbzyjdki

walnut.dolphin.ancient.boulderdsqotnpkq

walnut.dolphin.ancient.journeyfuhbpcn

walnut.dolphin.ancient.improvevwvemkxnsw

walnut.dolphin.ancient.knolltqlhcdpfzuu

walnut.dolphin.ancient.speakit

walnut.dolphin.ancient.forestzyoiionvtd

walnut.dolphin.ancient.maximumfrtembthgoeky

walnut.dolphin.ancient.zodiacitiyhxomjflg

walnut.dolphin.ancient.Toastit

walnut.dolphin.ancient.marbleqshwktzvcuz

walnut.dolphin.ancient.desertedwlhgczaqxbynu

walnut.dolphin.ancient.Inputquicksandcarrbqqalfmik

walnut.dolphin.ancient.almondzoqbuwbjqfw

walnut.dolphin.ancient.emberlygnsfdlvhc

walnut.dolphin.ancient.ribbonkbsldjavxcdni

walnut.dolphin.ancient.thicketwyikrku

walnut.dolphin.ancient.wintermatrvsaucm

walnut.dolphin.ancient.quicksandcarrbqqalfmik

walnut.dolphin.ancient.holidayknlagrj

walnut.dolphin.ancient.zippernkpzydf

walnut.dolphin.ancient.zenithalvqwcjfn

walnut.dolphin.ancient.improvenykjxbfptee

walnut.dolphin.ancient.CallBacker

walnut.dolphin.ancient.silverwcjzpp

azlmddk.ddjhl.ntdswzqp.Actjulgabrwgyagho831

azlmddk.ddjhl.ntdswzqp.Actmdbdyaqafdhtptro460

azlmddk.ddjhl.ntdswzqp.Acthxuwofzxfdfung618

walnut.dolphin.ancient.marbletutvqjcndl

walnut.dolphin.ancient.knightcybpnrukbdrwwhm

walnut.dolphin.ancient.zipperpgneatecul

walnut.dolphin.ancient.dandelionndabgm

walnut.dolphin.ancient.fountaintcemqdbmyuws

walnut.dolphin.ancient.adviservcghndkjnakkj

walnut.dolphin.ancient.lanterncvrcmtpwv

walnut.dolphin.ancient.labyrinthnqpwjnrm

walnut.dolphin.ancient.mirageurlktsrrpysn

walnut.dolphin.ancient.minserv

walnut.dolphin.ancient.warriorktafzirn

walnut.dolphin.ancient.amberxvhtvpzurcc

walnut.dolphin.ancient.Msss

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

azlmddk.ddjhl.ntdswzqp.Svcbnjniynrakharox798

azlmddk.ddjhl.ntdswzqp.Svcznucabxfmnk107

azlmddk.ddjhl.ntdswzqp.Svcuxhrowpigzh804

azlmddk.ddjhl.ntdswzqp.Svcfzfhwuomfdco551

walnut.dolphin.ancient.alarme

walnut.dolphin.ancient.kitchenpcvmhqcsv

walnut.dolphin.ancient.ResetServices

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

Android Permissions

test11.apk