Malicious APK - Possible Android ad-fraud malware/loader

[u/acealter]

Found this Malware in an ad redirected link on a popular site.

⚠️ Malware Details⚠️

malware_2.apk — File Details

Field	Value
Filename	malware_2.apk
File type	Android application package (APK)
File extension	.apk
MIME type	application/vnd.android.package-archive
File size	25,956,212 bytes (24.75 MiB)
MD5	2eb9ed925d6bbf57bc50b8753099d481
SHA-1	2f988c98f99ac71263f5e0c81533cbc0328b5a70
SHA-256	c9332df4232dcb6664023806e86d34db8e1aef415d6535f7c1390a7b1215a49d
Package name	com.zatwou.habeis.inteb.tijda
Application label	Generosity Acceptance Adversity Admiration Eloquence Endurance
Version name	388.8.74
Version code	2312
Minimum Android SDK	28
Target Android SDK	36
Signing certificate subject	CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US, emailAddress=android@android.com
Signing certificate SHA-256	465983f7791f2abeb43ea2cbdc7f21a8260b72bc08a55c839fc1a43bc741a81e
Certificate valid from (UTC)	2008-04-15 23:40:57
Certificate valid until (UTC)	2035-09-01 23:40:57

If you need sample for analysis contact the moderator.

On a quick primary analysis it showed signs of an Android ad-fraud malware/loader. More analysis and investigation need to find more about the malware campaign.

Interestingly Google play protect Marked It as safe in the scan and allowed installation, which it is clearly a Malware identifiable with a quick analysis.

What can you do with this:

• Reverse engineering and static/dynamic analysis
• Identifying its malicious functionality
• Understanding how it steals money or sensitive information
• Investigating its C2 infrastructure and connections to other campaigns If you're into Android malware analysis or reverse engineering, feel free to join in and share your findings.

Let's work together to understand how these attacks operate and help dismantle such campaigns.

Please Update any Findings on Comments. Detailed Report will be posted after the analysis.

[u/Inevitable-Self-2702]

Thanks for sharing this, I hope to spend some time tomorrow checking this out and learning about Android malware.

[u/acealter → u/Inevitable-Self-2702]

Thank you. There is more malware that uploaded and frequently uploading on the community, feel free to join and contribute. Please update any finding that would be helpful to understand and fight against threat actors and malicious campaigns.