viralupdate[.]apk | Triage™

General

Target
viralupdate.apk
Size 5.3MB
Sample261110-yf249aae64
SHA256 b102a521211cad878930a0fdb8ce5f386db1bd6d6e1138445fe1fdfec0c8c001
MD5 a1a1d90d1008a42c545a6b0c35ba6c27
SHA1 93f1956b8e561e41589483740ef748cf93518cbc
SHA512 c09361012ab26b01712e36507d1422bebc07a1296c1838d6b7d3d6dc5aa9e7ff38f9c49abd23ec3b04862fd8b064dba1f5be4ca0dd72f8b37f67182983bb0db4
SSDEEP 98304:Dg5tLpmNoCrCdg1+RsE0z5TGCa6GRCmMSivX9v7+Nyti9blEDprjeJo/Krrmrcd:cpHdhRBkTecmkvX9aUtsbYr7Id
TLSH
T1B046F05BFB44592AC4F793F2053A5326114B4C668B83C7C7A950327C28B7AD07F9AADC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Signatures

Attempts to obfuscate APK file format
Applies obfuscation techniques to the APK format in order to hinder analysis

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE
Required by dream services to bind with the system. Allows apps to provide interactive screensavers (dreams).	android.permission.BIND_DREAM_SERVICE

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to read SMS messages.	android.permission.READ_SMS

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
viralupdate.apk

File Explorer

viralupdate.apk

.apk 5.3MB

viralupdate.apk

SHA256 b102a521211cad878930a0fdb8ce5f386db1bd6d6e1138445fe1fdfec0c8c001
MD5 a1a1d90d1008a42c545a6b0c35ba6c27
SHA1 93f1956b8e561e41589483740ef748cf93518cbc
SHA512 c09361012ab26b01712e36507d1422bebc07a1296c1838d6b7d3d6dc5aa9e7ff38f9c49abd23ec3b04862fd8b064dba1f5be4ca0dd72f8b37f67182983bb0db4
SSDEEP 98304:Dg5tLpmNoCrCdg1+RsE0z5TGCa6GRCmMSivX9v7+Nyti9blEDprjeJo/Krrmrcd:cpHdhRBkTecmkvX9aUtsbYr7Id
TLSH
T1B046F05BFB44592AC4F793F2053A5326114B4C668B83C7C7A950327C28B7AD07F9AADC
MD5 SHA1 SHA512 SSDEEP TLSH

android

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

File Signature issue

Digest

54aa3bb668fb408f9f26526d877e12b38490883a68b6d6cfdc13503771702cfd

Digest Algorithm

sha256

Digest Matches

Trusted

Not trusted

Signer

CN=MrTusarRX

hollow.penguin.shelter

hollow.penguin.shelter.Splasher

hollow.penguin.shelter.HomeSIM

android.intent.action.MAIN

hollow.penguin.shelter.HomeWallp

android.intent.action.MAIN

hollow.penguin.shelter.HomeSmsung

android.intent.action.MAIN

hollow.penguin.shelter.PlayS

android.intent.action.MAIN

hollow.penguin.shelter.fortresshbhifirnclfuwt

hollow.penguin.shelter.whisperlccpcsadrcf

hollow.penguin.shelter.rainbowexmnqzchnaudw

hollow.penguin.shelter.jordanvgxczwg

hollow.penguin.shelter.emeraldmgitqdugqbkl

hollow.penguin.shelter.kingdomeplcdjov

hollow.penguin.shelter.outlandrjazacvhrnvr

hollow.penguin.shelter.speakit

hollow.penguin.shelter.quinoaaaoerrkrcd

hollow.penguin.shelter.evergreennaaiphw

hollow.penguin.shelter.fabricxoewqzxef

hollow.penguin.shelter.Toastit

hollow.penguin.shelter.guitarfgvftltbdz

hollow.penguin.shelter.updatedglaxjrjadogl

hollow.penguin.shelter.Inputkestrelxprcivrjca

hollow.penguin.shelter.umbrellawwhkzzzitzs

hollow.penguin.shelter.teacherlylqnegjqmxdd

hollow.penguin.shelter.quicksilverbwmpkir

hollow.penguin.shelter.cannonxvcmiioboe

hollow.penguin.shelter.sequoiangkbasynct

hollow.penguin.shelter.kestrelxprcivrjca

hollow.penguin.shelter.xeroxedgjrldnhgqmdwha

hollow.penguin.shelter.pantherayastdeyclwh

hollow.penguin.shelter.legenddvvvphmbxtqblywp

hollow.penguin.shelter.noodledfwupyxmsdbcogw

hollow.penguin.shelter.CallBacker

hollow.penguin.shelter.latticembzqcdqxs

kncccr.yxguk.Actplyrnnqgbvkoogayyp230

kncccr.yxguk.Actejurdbtqfdzo984

hollow.penguin.shelter.alarme

AppAlarm

hollow.penguin.shelter.kettleijancapbo

android.intent.action.BOOT_COMPLETED android.intent.action.QUICKBOOT_POWERON com.htc.intent.action.QUICKBOOT_POWERON android.intent.action.REBOOT android.intent.action.ACTION_SHUTDOWN

hollow.penguin.shelter.ResetServices

android.intent.action.AIRPLANE_MODE android.intent.action.BATTERY_LOW android.intent.action.BATTERY_OKAY android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

android.intent.action.ACTION_POWER_CONNECTED android.intent.action.ACTION_POWER_DISCONNECTED

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

android.intent.action.BATTERY_OKAY android.intent.action.BATTERY_LOW

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

android.intent.action.DEVICE_STORAGE_LOW android.intent.action.DEVICE_STORAGE_OK

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

android.net.conn.CONNECTIVITY_CHANGE

androidx.work.impl.background.systemalarm.RescheduleReceiver

android.intent.action.BOOT_COMPLETED android.intent.action.TIME_SET android.intent.action.TIMEZONE_CHANGED

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.background.systemalarm.UpdateProxies

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.work.diagnostics.REQUEST_DIAGNOSTICS

androidx.profileinstaller.ProfileInstallReceiver

androidx.profileinstaller.action.INSTALL_PROFILE androidx.profileinstaller.action.SKIP_FILE androidx.profileinstaller.action.SAVE_PROFILE androidx.profileinstaller.action.BENCHMARK_OPERATION

kncccr.yxguk.Rcvrgahjvhlnoip455

android.intent.action.ssgbftlnykxa

kncccr.yxguk.Rcvrymtiwhpvqft247

android.intent.action.fhlhdgktijwhrtdeo

Android Permissions

viralupdate.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.POST_NOTIFICATIONS

hollow.penguin.shelter.permission.TDOS_DIAGNOSE_BROADCAST

android.permission.FOREGROUND_SERVICE_MEDIA_PROJECTION

android.permission.FOREGROUND_SERVICE_DATA_SYNC

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

com.android.alarm.permission.SET_ALARM

android.permission.WAKE_LOCK

android.permission.MANAGE_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.READ_EXTERNAL_STORAGE

android.permission.CAMERA

android.permission.FLASHLIGHT

android.permission.READ_SMS

hollow.penguin.shelter.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION

Sharing

General

Malware Config

Signatures

File Explorer

viralupdate.apk

File Signature issue

hollow.penguin.shelter.Splasher

hollow.penguin.shelter.HomeSIM

hollow.penguin.shelter.HomeWallp

hollow.penguin.shelter.HomeSmsung

hollow.penguin.shelter.PlayS

hollow.penguin.shelter.fortresshbhifirnclfuwt

hollow.penguin.shelter.whisperlccpcsadrcf

hollow.penguin.shelter.rainbowexmnqzchnaudw

hollow.penguin.shelter.jordanvgxczwg

hollow.penguin.shelter.emeraldmgitqdugqbkl

hollow.penguin.shelter.kingdomeplcdjov

hollow.penguin.shelter.outlandrjazacvhrnvr

hollow.penguin.shelter.speakit

hollow.penguin.shelter.quinoaaaoerrkrcd

hollow.penguin.shelter.evergreennaaiphw

hollow.penguin.shelter.fabricxoewqzxef

hollow.penguin.shelter.Toastit

hollow.penguin.shelter.guitarfgvftltbdz

hollow.penguin.shelter.updatedglaxjrjadogl

hollow.penguin.shelter.Inputkestrelxprcivrjca

hollow.penguin.shelter.umbrellawwhkzzzitzs

hollow.penguin.shelter.teacherlylqnegjqmxdd

hollow.penguin.shelter.quicksilverbwmpkir

hollow.penguin.shelter.cannonxvcmiioboe

hollow.penguin.shelter.sequoiangkbasynct

hollow.penguin.shelter.kestrelxprcivrjca

hollow.penguin.shelter.xeroxedgjrldnhgqmdwha

hollow.penguin.shelter.pantherayastdeyclwh

hollow.penguin.shelter.legenddvvvphmbxtqblywp

hollow.penguin.shelter.noodledfwupyxmsdbcogw

hollow.penguin.shelter.CallBacker

hollow.penguin.shelter.latticembzqcdqxs

kncccr.yxguk.Actplyrnnqgbvkoogayyp230

kncccr.yxguk.Actejurdbtqfdzo984

hollow.penguin.shelter.imagineubkfzmeze

hollow.penguin.shelter.vibrantfgquwiwlbh

hollow.penguin.shelter.lanterniipplzvorigovi

hollow.penguin.shelter.petalknonrtbr

hollow.penguin.shelter.dandelionsxuadcm

hollow.penguin.shelter.vacuumlvtgqmuy

hollow.penguin.shelter.nightfallnleleicocagj

hollow.penguin.shelter.nightfallmmnxgmkpbnsdj

hollow.penguin.shelter.pencilwkafjtj

hollow.penguin.shelter.minserv

hollow.penguin.shelter.quasardpplbmtyavxjqsd

hollow.penguin.shelter.roameriqnnkoowrsqiq

hollow.penguin.shelter.Msss

androidx.work.impl.background.systemalarm.SystemAlarmService

androidx.work.impl.background.systemjob.SystemJobService

androidx.work.impl.foreground.SystemForegroundService

androidx.room.MultiInstanceInvalidationService

kncccr.yxguk.Svccawxnamamsynibovnr21

kncccr.yxguk.Svcewpjyjnhglkap108

kncccr.yxguk.Svcrjmiuodkherpmqcpzr932

kncccr.yxguk.Svcbbcerqggktfmxcxholg296

kncccr.yxguk.Svczjefdkhithrub867

hollow.penguin.shelter.alarme

hollow.penguin.shelter.kettleijancapbo

hollow.penguin.shelter.ResetServices

androidx.work.impl.utils.ForceStopRunnable$BroadcastReceiver

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryChargingProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$BatteryNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$StorageNotLowProxy

androidx.work.impl.background.systemalarm.ConstraintProxy$NetworkStateProxy

androidx.work.impl.background.systemalarm.RescheduleReceiver

androidx.work.impl.background.systemalarm.ConstraintProxyUpdateReceiver

androidx.work.impl.diagnostics.DiagnosticsReceiver

androidx.profileinstaller.ProfileInstallReceiver

kncccr.yxguk.Rcvrgahjvhlnoip455

kncccr.yxguk.Rcvrymtiwhpvqft247

androidx.core.content.FileProvider

androidx.startup.InitializationProvider

Android Permissions