system_update_v2[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
system_update_v2.apk
Size 6.7MB
Sample261107-2wmlaav1dy
SHA256 8e2823c6dfe18b719d1b590bcca04067c84ab71d346b9127997e1a53ef58ade7
MD5 de61df0479a0286ebc2f6814b0020cd6
SHA1 6905cbce63bbc55fbdeab6279f5d077f554f5140
SHA512 648d1b24e882ddd4939e5d5ad9dc25f9175df166f09ef1df6461053e205a53942868d76a1c60f3a3acbf727ed348a1f01e89cbe440c7aee2d0e60babb6b0b28f
SSDEEP 98304:gR0FlwKTL8EVtSIgxC/xx9gN+FB0wuEfiUk0WKN5BL60hQTjweNBdMM2EMtzzxHQ:gqNtTJx+Amwu+kCX60KAepMMkwjn
TLSH
T1DF662352F3D89C2FCC3380324FFA666A56825D86CA06D75385A4B21D4DBBAC44F96FC4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE

Requests dangerous framework permissions 8 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to send SMS messages.	android.permission.SEND_SMS
Allows read access to the device's phone number(s).	android.permission.READ_PHONE_NUMBERS
Allows an application to read SMS messages.	android.permission.READ_SMS

Untrusted Codesign Signers 2 IoCs

Codesigned file was signed by an untrusted entity.

resource
system_update_v2.apk
unpack001/payload.apk

File Explorer

system_update_v2.apk

.apk 6.7MB
payload.apk

.apk 4.8MB

system_update_v2.apk

SHA256 8e2823c6dfe18b719d1b590bcca04067c84ab71d346b9127997e1a53ef58ade7
MD5 de61df0479a0286ebc2f6814b0020cd6
SHA1 6905cbce63bbc55fbdeab6279f5d077f554f5140
SHA512 648d1b24e882ddd4939e5d5ad9dc25f9175df166f09ef1df6461053e205a53942868d76a1c60f3a3acbf727ed348a1f01e89cbe440c7aee2d0e60babb6b0b28f
SSDEEP 98304:gR0FlwKTL8EVtSIgxC/xx9gN+FB0wuEfiUk0WKN5BL60hQTjweNBdMM2EMtzzxHQ:gqNtTJx+Amwu+kCX60KAepMMkwjn
TLSH
T1DF662352F3D89C2FCC3380324FFA666A56825D86CA06D75385A4B21D4DBBAC44F96FC4
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

b8de73027ac74f48c551cfad2c567d59af6f531c9aa810ecad0cb7f09cd76255

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=Android Debug,O=Android,C=US

com.system.update

payload.apk

SHA256 6bc531b9f4841bfd32271d4c927e1c992399550010ed98f82939ecec65a0557b
MD5 6933eac7eb56bf95bd254ccfe851a1dd
SHA1 f9369d2ec3e539ce545107a01104597f6cef0835
SHA512 1d7a2d6375da3fbe6baf4498448ce29392cadc57a75634b1a010e544bb86d85a97da6feb28be60eac321f68f36bb55d4dd83d3143f272b52c0a78fcca94d50a7
SSDEEP 98304:CcUybhygp4ZRUn1r7CWoAo/KrrqaI9DFjb1WwBDn5:f9yguwndCWoKIcU9
TLSH
T13536DF8BFB44A96AC4F753B2463A532251474C2A8B43D7C35D58323C18B76D0AF9EBC9
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

9e4055b68ce4d4bc8b99040aef5621c0336b6c135033d331ce4e00b9fbfb9e1b

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=MrTusarRX

xenon.inferno.impact

xenon.inferno.impact.Splasher

xenon.inferno.impact.HomeSIM

android.intent.action.MAIN

xenon.inferno.impact.HomeWallp

android.intent.action.MAIN

xenon.inferno.impact.HomeSmsung

android.intent.action.MAIN

xenon.inferno.impact.PlayS

android.intent.action.MAIN

xenon.inferno.impact.meteoremoqvzav

xenon.inferno.impact.kingfishcwwdjncpycput

xenon.inferno.impact.acornpembobrauvclsxz

xenon.inferno.impact.xenonlsmwnhrcoleo

xenon.inferno.impact.oceanzxzjttx

xenon.inferno.impact.jungleljrswrffaom

xenon.inferno.impact.kittendgqxfbymbdrms

xenon.inferno.impact.speakit

xenon.inferno.impact.anchormxvfqmpanz

xenon.inferno.impact.kingdomlualumxgful

xenon.inferno.impact.blanketxwyxhzdf

xenon.inferno.impact.Toastit

xenon.inferno.impact.nebulapsncyhu

xenon.inferno.impact.titandxnvoipbclqp

xenon.inferno.impact.Inputeternaloexzlpgv

xenon.inferno.impact.keystoneuqaklbjkwmrt

xenon.inferno.impact.hiddentpsygtzwceba

xenon.inferno.impact.railwayaeiwfbfgjuu

xenon.inferno.impact.zephyribuxuthcwhh

xenon.inferno.impact.xenontijxxywlyp

xenon.inferno.impact.eternaloexzlpgv

xenon.inferno.impact.galacticlitrlcetimfo

xenon.inferno.impact.kingfishkinplfkrz

xenon.inferno.impact.orangevgojbemlb

xenon.inferno.impact.resplendentzxsrjdnnccfy

xenon.inferno.impact.CallBacker

xenon.inferno.impact.umbrellapksfowsxxu

xenon.inferno.impact.alarme

AppAlarm

xenon.inferno.impact.falconeawcqwlggif

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

xenon.inferno.impact.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

Android Permissions

system_update_v2.apk

Permissions

android.permission.INTERNET

com.system.update.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

system_update_v2.apk

File Signature issue

com.system.update.MainActivity

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

payload.apk

File Signature issue

xenon.inferno.impact.Splasher

xenon.inferno.impact.HomeSIM

xenon.inferno.impact.HomeWallp

xenon.inferno.impact.HomeSmsung

xenon.inferno.impact.PlayS

xenon.inferno.impact.meteoremoqvzav

xenon.inferno.impact.kingfishcwwdjncpycput

xenon.inferno.impact.acornpembobrauvclsxz

xenon.inferno.impact.xenonlsmwnhrcoleo

xenon.inferno.impact.oceanzxzjttx

xenon.inferno.impact.jungleljrswrffaom

xenon.inferno.impact.kittendgqxfbymbdrms

xenon.inferno.impact.speakit

xenon.inferno.impact.anchormxvfqmpanz

xenon.inferno.impact.kingdomlualumxgful

xenon.inferno.impact.blanketxwyxhzdf

xenon.inferno.impact.Toastit

xenon.inferno.impact.nebulapsncyhu

xenon.inferno.impact.titandxnvoipbclqp

xenon.inferno.impact.Inputeternaloexzlpgv

xenon.inferno.impact.keystoneuqaklbjkwmrt

xenon.inferno.impact.hiddentpsygtzwceba

xenon.inferno.impact.railwayaeiwfbfgjuu

xenon.inferno.impact.zephyribuxuthcwhh

xenon.inferno.impact.xenontijxxywlyp

xenon.inferno.impact.eternaloexzlpgv

xenon.inferno.impact.galacticlitrlcetimfo

xenon.inferno.impact.kingfishkinplfkrz

xenon.inferno.impact.orangevgojbemlb

xenon.inferno.impact.resplendentzxsrjdnnccfy

xenon.inferno.impact.CallBacker

xenon.inferno.impact.umbrellapksfowsxxu

xenon.inferno.impact.applevoiutjyj

xenon.inferno.impact.zenithtxqdsrjbolv

xenon.inferno.impact.nomadhhwitzg

xenon.inferno.impact.desertlwtowvkjhjsz

xenon.inferno.impact.whisperbqzhwaelydq

xenon.inferno.impact.welcomeorjrrcqvbnk

xenon.inferno.impact.nomadbdmlqpkyn

xenon.inferno.impact.targetrfpsqkzbazy

xenon.inferno.impact.seafloorshilifte

xenon.inferno.impact.minserv

xenon.inferno.impact.nuggetyhxdgqaojgzvzgp

xenon.inferno.impact.crystalykkrmejoplhs

xenon.inferno.impact.Msss

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

xenon.inferno.impact.alarme

xenon.inferno.impact.falconeawcqwlggif

xenon.inferno.impact.ResetServices

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

Android Permissions

system_update_v2.apk