Thursday, October 30, 2014

Android icon vulnerability - malware sample


Research: Cheetah Mobile: Android icon vulnerability can cause serious system-level crashes
The malware uses a very large icon which overloads the system’s capabilities and causes some important processes to crash, such as the Settings and Launcher.



Sample credit: Weuzhu Liu

File: d.apk
Size: 12245344
MD5:  DD23039E2C18F2CD1CA2604478E8CD00


Download. Email me if you need the password







Android ransomware samples Koler. C



2c82604a5b8cd48e841f4a37173df1b0
b31ce7e8e63fb9eb78b8ac934ad5a2ec
6b0fa323d01fb7c363c9fcb9948812a1
153626fae2eaa8ae6ef4727958104ee7
3eea7a9bdeba1c6de34dc79de831784c
691f71c3cae19547df2a879789cc0b34
f60e6b977a4de0ec194c77cb12ef1101


Samples credit:  Mario Bono



Download. Email me if you need the password




SMS worm Selfmite


Research: Adaptive Mobile Take Two: Selfmite.b Hits the Road

Sample Credit: Charlie Bronson

1bf7a3639bf81e2260547fe5e04f864c


Download. Email me if you need the password






Wednesday, October 29, 2014

Android WipeLocker.A



File: Angry_BirdTransformers_1.1.0.apk
Size: 548938
MD5:  4E2201CDE26141715255D2421F0BCFB1

Sample credit: İbrahim BALİÇ




Download. Email me if you need the password



Android Chathook ptrace


Research: http://blog.csdn.net/androidsecurity/article/details/27504615

88870ad3c7bd42cfe1d728b4a4ccc104

Sample credit: Thomas Wang


Download. Email me if you need the password




Wednesday, October 8, 2014

Xsser mRat Android and IOS samples


Sorry for the delay, here are the Xsser samples.

Xsser Android
File: code4hk.apk
Size: 409709
MD5:  15E5143E1C843B4836D7B6D5424FB4A5
sample credit: Shalom Bublil


Xsser (mRat) for IOS
https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/iPh~InfoStl-O/detailed-analysis.aspx

File: xsser.0day_1.1_iphoneos-arm.deb
MD5 2ee65c7faeba0899d397f6e105cc53c3
Sample Credit: KernelMode forum and anonymous upload to Malwaredump

Dylib files from the C2 (e.g. http://www.xsser.com/upload/Lib/iLib.4.0.0.dylib|iLib.4.0.0.dylib|4.0.0|1033720) 

FAB47459D191C09406DD15D90AF403CB_iLib.2.0.0.dylib
2CBA795AFF750259A2FC447CDD6EA1C7_iLib.3.0.0.dylib
CFC300B52BF0A4F09FE3E8F9B3459862_iLib.4.0.0.dylib







Monday, September 15, 2014

iOS AppBuyer malware - infostealer


Research:
Wei Feng Technology Group -Wei Feng Technology Group] on the source of malicious hackers discovered a rogue plug-track hacking  (CN)
Palo Alto  AppBuyer: New iOS Malware Steals Apple ID and Password to Buy Apps; 


Sample credit: Claud Xiao

File: com.archive.plist
MD5:  6EEE2BA0C18C69A71E3F879C2A46BDAA

File: updatesrv
MD5:  1C32F9F05234CAC7DD7A83E3925A3105

File: u2_88
MD5:  B4DAFC195DB19C661C25C54AEA39982B

File: u1_88
MD5:  68424FF30F6FD1DEBD3CFF1997FAB17E

File: u1
MD5:  69147A1AD05D64202B2D7BB0EA1BAB46

File: u2_80
MD5:  5F4741EBAFFD9C53473D79A1252F82CB

File: u1_80
MD5:  B88451E74C1091B9022F7199704959B0


Download. Email me if you need the password.





Sunday, August 3, 2014

Android XXshenqi SMS sender


Research:
Analysis Report: Baidu  http://safe.baidu.com/2014-08/xxshenqi.html
News: http://finance.chinanews.com/it/2014/08-03/6452953.shtml
Sample Credit - Thomas Wang


File: com.android.Trogoogle.apk
Size: 1563595
MD5:  EF819779FC4BEE6117C124FB752ABF57

File: XXshenqi.apk
Size: 2588891
MD5:  9C06E0963A3F3383CD810F5041364BFA

Download. Email me if you need the password





Wednesday, July 23, 2014

Android ScarePackage Ransomware


Research: Lookout. U.S. targeted by coercive mobile ransomware impersonating the FBI
Sample Credit: Tim Strazzere

File: com.android.locker.apk
Size: 488296
MD5:  645A60E6F4393E4B7E2AE16758DD3A11


Download. Email me if you need the password





Monday, June 23, 2014

(Another) Android Trojan Scheme Using Google Cloud Messaging - SMS Spyware



Sample credit: Federico Maggi

File: test98.apk
Size: 1051288
MD5:  D65C5EF9739ABAE77F5B13B8B562B18A

File: test99.apk
Size: 1051283
MD5:  D968FF20B7A25A79E922511101B7F7CC\

File: test97.apk
Size: 1051286
MD5:  5A7C8EB61061F86FDCDBF9118711CC53





Wednesday, June 4, 2014

Simplocker - Android File-Encrypting, TOR-enabled Ransomware


File: fd694cf5ca1dd4967ad6e8c67241114c.bin
Size: 4917678
MD5:  FD694CF5CA1DD4967AD6E8C67241114C

Research: ESET Analyzes First Android File-Encrypting, TOR-enabled Ransomware
Sample credit: Sanjay Gupta


Download. Email me if you need the password




Tuesday, May 6, 2014

Android SMS trojan - Google fake installer (downloader from Dropbox url)


憑證.apk
67235B16BC2FAB6836847EA51703E298


Download. Email me if you need the password


IOS iphone Stealer.A - malware acting as a Substrate module

Android fake AV - Se-cure MobieAV

Android Samsapo.A


Research: ESET: Android malware worm catches unwary users
Sample credit: Steven Chen

Size: 473650
MD5:  60B4EF7037CA6A4D1EE7E3C35C8E27D7
Size: 473875
MD5:  C1F9283B7AD8457160D3C189430F2C75

Download. Email me if you need the password






Android locker from the Reveton team

MD5 fb14553de1f41e3fcdc8f68fd9eed831
hone_Police_Ransom.apk

Sample credit -  Kafeine

Download : http://malware.dontneedcoffee.com/2014/05/police-locker-available-for-your.html?m=1



Android Fake banker

MD5
7276e76298c50d2ee78271cf5114a176
a15b704743f53d3edb9cdd1182ca78d1
aac4d15741abe0ee9b4afe78be090599

Sample credit - anonymous (thank you)



Download. Email me if you need the password




Android SMS trojan Flash fake installer

File: imauyfxuhxd.qhlsrdb-1(20140414)(2).apk
Size: 141987
MD5:  7D25D4CDBF3CFC8B6E9466729B84D348

Sample credit - anonymous




Download. Email me if you need the password