Free Automated Malware Analysis Service - powered by Falcon Sandbox - Viewing online file analysis results for 'blokada-v4.1.4.apk'

Incident Response

Risk Assessment

Evasive: Has the ability to execute code after reboot

Indicators

Not all malicious and suspicious indicators are displayed. Get your own cloud service or the full version to view all details.

Malicious Indicators 2
Installation/Persistance
- Has the ability to execute code after reboot
  
  details
  
  Permission request for "android.permission.RECEIVE_BOOT_COMPLETED"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Pattern Matching
- YARA signature match
  
  details
  
  YARA signature "Bolonyokte" classified file "0e4fede38fcaad584c4fae9c33e73318f367111c0d48cc33ad75cdbd86d83ade.apk" as "rat" based on indicators: "login,en ligne,Power" (Author: Jean-Philippe Teissier / @Jipe_)
  
  source
  
  YARA Signature
  
  relevance
  
  10/10

Suspicious Indicators 3
Anti-Reverse Engineering
- Possibly checks for known debuggers/analysis tools
  
  details
  
  "kotlin/internal/DynamicExtension.kotlin_metadataEN" (Indicator: "icext")
  
  source
  
  File/Memory
  
  relevance
  
  2/10
General
- Requires permissions that could be uesd for malicious intents
  
  details
  
  Permission request for "android.permission.INTERNET"
  Permission request for "android.permission.RECEIVE_BOOT_COMPLETED"
  Permission request for "android.permission.WRITE_EXTERNAL_STORAGE"
  Permission request for "android.permission.READ_LOGS"
  Permission request for "android.permission.WAKE_LOCK"
  
  source
  
  Static Parser
  
  relevance
  
  10/10
Network Related
- Found potential IP address in binary/memory
  
  details
  
  Heuristic match: "RRThis does not look correct. Make sure you enter a server IP address, like 8.8.8.8."
  Heuristic match: "8.8.8.8."
  Heuristic match: "WWSepertinya ada kesalahan. Pastikan anda memasukkan alamat IP server, misalnya: 8.8.8.8."
  Heuristic match: "RRDas sieht falsch aus. Achte darauf, eine Server-IP-Adresse wie 8.8.8.8 einzugeben."
  
  source
  
  File/Memory
  
  relevance
  
  3/10

Informative 3
External Systems
- Sample was identified as clean by Antivirus engines
  
  details
  
  0/18 Antivirus vendors marked sample as malicious (0% detection rate)
  0/59 Antivirus vendors marked sample as malicious (0% detection rate)
  
  source
  
  External System
  
  relevance
  
  10/10
Network Related
- Found potential URL in binary/memory
  
  details
  
  Heuristic match: "lib/arm64-v8a/libboringtun.so"
  Pattern match: "www.blokada.org"
  Pattern match: "http://kar.gs"
  Pattern match: "https://blokada.org/#download"
  Pattern match: "c9c98c55-a511-43ae-95f4-e20f7e352dd4-bluemix.cloudant.com/acra-blokada/_design/acra-storage/_update/report"
  Heuristic match: "blokada.org"
  Heuristic match: "example.com"
  Heuristic match: "contoh.com"
  Pattern match: "http://contoh.com/hosts.txt"
  Pattern match: "https://example.com/hosts.txt"
  Pattern match: "http://example.com/hosts.txt"
  Heuristic match: "ne som eksempel.dk"
  
  source
  
  File/Memory
  
  relevance
  
  10/10
Spyware/Information Retrieval
- Found a reference to a known community page
  
  details
  
  "Tap the button below to open our help page. You can also use our social media to get help - we are on Telegram, Facebook, Reddit and Twitter." (Indicator: "twitter")
  "Ketuk tombol di bawah untuk mengakses laman bantuan. Anda juga bisa menggunakan kanal media sosial kami untuk meminta bantuan - kami aktif di Telegram, Facebook, Reddit, dan Twitter." (Indicator: "twitter")
  "ffnen. Du kannst auch unsere sozialen Medien nutzen, um Hilfe zu erhalten - wir sind auf Telegram, Facebook, Reddit und Twitter." (Indicator: "twitter")
  "Twitter." (Indicator: "twitter")
  
  source
  
  File/Memory
  
  relevance
  
  7/10

File Details

All Details:

blokada-v4.1.4.apk

Filename: blokada-v4.1.4.apk
Size: 8.3MiB (8692554 bytes)
Type: android
Description: Zip archive data
Architecture

SHA256
: 0e4fede38fcaad584c4fae9c33e73318f367111c0d48cc33ad75cdbd86d83ade
MD5
: 8aa03ec631ed97dbe87eefb8333d97ee
SHA1
: 01c7a2465e5306bee4c14bd77aa3a14e4065a297
ssdeep
: 196608:O8VipRe3Kbgr1beehUV9Z65gqTWPeq7dfiAKutXdOJKR:OxpRe3Yeigw+JTJq4FQX0e

Resources

Icon

Visualization

Input File (PortEx)

Version Info

Minimum SDK: 21 (Lollipop)
Target SDK: 28 ()
Version Code: 401000004
Version Name: 4.1.4
Package Name: org.blokada.origin.alarm
Entrypoint: org.blokada.origin.alarmcore.PanelActivity

Classification (TrID)

60.3% (.APK) Android Package
16.6% (.JAR) Java Archive
9.1% (.WIDGET) Konfabulator widget
8.0% (.MAFF) Mozilla Archive Format (gen)
4.5% (.ZIP) ZIP compressed archive

File Permissions

Permission	Description
android.permission.INTERNET	Allows applications to open network sockets.
android.permission.ACCESS_NETWORK_STATE	Allows applications to access information about networks.
android.permission.ACCESS_WIFI_STATE	Allows applications to access information about Wi-Fi networks.
android.permission.RECEIVE_BOOT_COMPLETED	Allows an application to receive the ACTION_BOOT_COMPLETED that is broadcast after the system finishes booting.
android.permission.WRITE_EXTERNAL_STORAGE	Allows an application to write to external storage.
android.permission.READ_LOGS	Allows an application to read the low-level system log files.
android.permission.VIBRATE	Allows access to the vibrator.
android.permission.WAKE_LOCK	Allows using PowerManager WakeLocks to keep processor from sleeping or screen from dimming.
android.permission.REQUEST_INSTALL_PACKAGES	Allows an application to request installing packages.
android.permission.FOREGROUND_SERVICE	-
android.permission.BIND_JOB_SERVICE	-
android.permission.BIND_QUICK_SETTINGS_TILE	-
android.permission.BIND_VPN_SERVICE	Must be required by a VpnService, to ensure that only the system can bind to it.

File Activities

Activity	Description
org.blokada.origin.alarmcore.PanelActivity	Entrypoint
org.blokada.origin.alarmcore.StepActivity	-
org.blokada.origin.alarmcore.SubscriptionActivity	-
org.blokada.origin.alarmcore.WebViewActivity	-
org.blokada.origin.alarmcore.RestoreAccountActivity	-
org.blokada.origin.alarmcore.SearchActivity	-
org.blokada.origin.alarmcore.PowersaveActivity	-
org.blokada.origin.alarmadblocker.ConfigWidgetActivity	-
org.blokada.origin.alarmcore.AddDnsActivity	-
org.blokada.origin.alarmorg.acra.dialog.CrashReportDialog	-

File Receivers

Receiver	Intents
adblocker.ActiveWidgetProvider	android.appwidget.action.APPWIDGET_ENABLED android.appwidget.action.APPWIDGET_DELETED android.appwidget.action.APPWIDGET_DISABLED android.appwidget.action.APPWIDGET_UPDATE
adblocker.ListWidgetProvider	android.appwidget.action.APPWIDGET_UPDATE
core.BootReceiver	android.intent.action.BOOT_COMPLETED (Priority: 500) android.intent.action.QUICKBOOT_POWERON (Priority: 500) android.intent.action.MEDIA_MOUNTED (Priority: 500)
gs.property.ConnectivityReceiver	org.blokada.keepAlive
gs.property.LocaleReceiver	android.intent.action.LOCALE_CHANGED
gs.property.ScreenOnReceiver	-
tunnel.RenewLicenseReceiver	-

File Certificates

Owner	Issuer	Validity	Hashes (MD5, SHA1)
CN=blokada.org	CN=blokada.org Serial: 73a06916	08/01/2016 11:41:25 07/26/2041 11:41:25	7B:8A:0C:C9:5C:E1:F4:38:71:42:EB:24:36:AF:7C:37 55:2A:FF:E3:F8:63:56:9F:9E:D0:51:25:D5:29:91:C2:74:4D:2B:B3