aa677app[.]apk | Triage™

General

Target
aa677app.apk
Size 6.6MB
Sample261107-pphbrsds2p
SHA256 61abde52be1dbdf6ccf74db7d107b3bef75c2daf503ac6f3b9dd1c5d4710d9a4
MD5 9ac849bdb783a745cd12321f21996efe
SHA1 74545f6cfd7c7f8306fc574a9b404b198ab760b2
SHA512 bdbe45b6c7031b5625755862f0cab11c148335ba8ad99c680c1c8b61e1478af267c580b7cb72d761ab77ff25de42a64c788c905927af97d039c43d59e9f2ec85
SSDEEP 196608:sfRE6kkJGCEAyBANJe/U7K/eVUOVeUU0tggf:aR9JZz8/eVUceUU0Kgf
TLSH
T1F6660183F748F85FC0F7C33246752662651A4C228B43E6D76A94B3B919B79D04E86FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 9 IoCs

description	ioc
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application to read image files from external storage.	android.permission.READ_MEDIA_IMAGES
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
aa677app.apk

File Explorer

aa677app.apk

.apk 6.6MB

aa677app.apk

SHA256 61abde52be1dbdf6ccf74db7d107b3bef75c2daf503ac6f3b9dd1c5d4710d9a4
MD5 9ac849bdb783a745cd12321f21996efe
SHA1 74545f6cfd7c7f8306fc574a9b404b198ab760b2
SHA512 bdbe45b6c7031b5625755862f0cab11c148335ba8ad99c680c1c8b61e1478af267c580b7cb72d761ab77ff25de42a64c788c905927af97d039c43d59e9f2ec85
SSDEEP 196608:sfRE6kkJGCEAyBANJe/U7K/eVUOVeUU0tggf:aR9JZz8/eVUceUU0Kgf
TLSH
T1F6660183F748F85FC0F7C33246752662651A4C228B43E6D76A94B3B919B79D04E86FC8
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

5a2959fbf84f9d325956a5abfd97ac40c94195c418b78a947d4176be36474734

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=memorandum,OU=memorandum company,O=memorandum organization,L=ZM,ST=ZM,C=ZM

com.ymmtttcg.wwcb13205.ptphivld

Android Permissions

aa677app.apk

Permissions

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.SCHEDULE_EXACT_ALARM

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_WIFI_STATE

android.permission.MOUNT_UNMOUNT_FILESYSTEMS

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.REQUEST_INSTALL_PACKAGES

android.permission.READ_MEDIA_IMAGES

android.permission.INSTALL_PACKAGES

android.permission.CAMERA

android.permission.PACKAGE_USAGE_STATS

com.google.android.gms.permission.AD_ID

android.permission.USE_BIOMETRIC

android.permission.USE_FINGERPRINT

android.permission.POST_NOTIFICATIONS

android.permission.ACCESS_ADSERVICES_ATTRIBUTION

android.permission.ACCESS_ADSERVICES_AD_ID

android.permission.ACCESS_ADSERVICES_CUSTOM_AUDIENCE

com.zing.zalo.permission.ACCESS_THIRD_PARTY_APP_AUTHORIZATION

com.ymmtttcg.wwcb13205.ptphivld.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.READ_PHONE_STATE

Sharing

General

Malware Config

Signatures

File Explorer

aa677app.apk

File Signature issue

com.speed.client.CCMainActivity

com.speed.client.CCWebActivity

com.speed.client.third_login.TgLoginActivity

com.facebook.CustomTabActivity

com.facebook.FacebookActivity

com.zing.zalo.zalosdk.oauth.BrowserLoginActivity

com.speed.client.jpush.UserActivity400

androidx.credentials.playservices.HiddenActivity

com.linecorp.linesdk.auth.internal.LineAuthenticationActivity

com.linecorp.linesdk.auth.internal.LineAuthenticationCallbackActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.facebook.CustomTabMainActivity

com.zing.zalo.zalosdk.oauth.OpenAPIActivity

com.zing.zalo.zalosdk.oauth.WebLoginActivity

com.blankj.utilcode.util.UtilsTransActivity4MainProcess

com.blankj.utilcode.util.UtilsTransActivity

com.engagelab.privates.common.component.MTCommonActivity

com.speed.client.jpush.UserService

androidx.credentials.playservices.CredentialProviderMetadataHolder

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.components.ComponentDiscoveryService

com.blankj.utilcode.util.MessengerUtils$ServerService

com.engagelab.privates.push.platform.google.callback.MTGoogleCallback

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.speed.client.jpush.UserReceiver

com.adjust.sdk.AdjustReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.AuthenticationTokenManager$CurrentAuthenticationTokenChangedBroadcastReceiver

com.google.android.datatransport.runtime.scheduling.jobscheduling.AlarmManagerSchedulerBroadcastReceiver

androidx.core.content.FileProvider

com.squareup.picasso.PicassoProvider

com.google.firebase.provider.FirebaseInitProvider

com.facebook.internal.FacebookInitProvider

com.blankj.utilcode.util.UtilsFileProvider

com.engagelab.privates.common.component.MTCommonProvider

com.bugsnag.android.internal.BugsnagContentProvider

com.sensorsdata.analytics.android.sdk.data.SensorsDataContentProvider

Android Permissions

aa677app.apk