Malicious
2
/61

Threat

ua.sytor.wifipass

Wifi Password

Analyzed on 2021-11-12T19:04:30.160286

2

permissions

2

activities

0

services

0

receivers

1

domains

File sums

MD5 2ff03cf557ab35fe85faf529e3e93573
SHA1 28c067950782792a774cc772ab146862f32a5df6
SHA256 7b4706323ec8e644489783caa864c45e57cae8ffb6070a4982465b5b4906253a
Size 3.62MB

APKiD

Information computed with APKiD.

/tmp/tmp3ef7ptgj!classes.dex
anti_vm
  • Build.MANUFACTURER check
compiler
  • r8

SSdeep

Information computed with ssdeep.

APK file 98304:5++ZkusVKX5CY8qG6JicmM8/r2QqbG/cpFAqv0fr2R:54u75s6JhmMgr9qYuAQ
Manifest 96:nKiOVaU1Ier/XiuSsGIatnTqSqsyT5Dg9DM+pW5k9A:KiOKeDXirsGIWnTqSfyx6pFA
classes.dex 98304:JYHEOuainsj0z7ZQjJt+DWK629zOV3LmHiwatLuCTTAH:JETuY0z7ZQ9t+Dhiwa…

Dexofuzzy

Information computed with Dexofuzzy.

APK file 6144:GgmrT0EBvcKPcVBdHKPJijVYDQTEPbA0NwEBVv+syDTST:GZTJ6YJpMOT
classes.dex 6144:GgmrT0EBvcKPcVBdHKPJijVYDQTEPbA0NwEBVv+syDTST:GZTJ6YJpMOT

APK details

Information computed with AndroGuard and Pithus.

Package ua.sytor.wifipass
App name Wifi Password
Version name 2.0
Version code 7
SDK 21 - 29
UAID 6e121b920483bb75814f844cd5a7b4d7bdd79121
Signature Signature V1 Signature V2
Frosting Not frosted
Blocks found within V2 signature:
  • 0x7109871a: Unknown
  • 0x42726577: Verity padding

Certificate details

Information computed with AndroGuard.

MD5 39f5f51ef0bd02c504d64b16d3aef2d8
SHA1 4186fb3547ad02a05e142b095020186cd1ceec09
SHA256 cb1350a5df8c438886c74df346fe48c9f6568aed2e590f9f7ef941eebbaa086e
Issuer Common Name: Yaroslav Shulyak, Organizational Unit: Mobile Development, Organization: Shuriak, Locality: Brovary, State/Province: Ukraine, Country: UA
Not before 2015-11-07T19:25:12+00:00
Not after 2040-10-31T19:25:12+00:00

Manifest analysis

Information computed with MobSF.

Medium Application Data can be Backed up[android:allowBackup=true]
This flag allows anyone to backup your application data via adb. It allows users who have enabled USB debugging to copy application data off of the device.

Main Activity

Information computed with AndroGuard.

ua.sytor.wifipass.screen.MainActivity

Activities

Information computed with AndroGuard.

ua.sytor.wifipass.screen.MainActivity
com.android.billingclient.api.ProxyBillingActivity

NIAP analysis

Information computed with MobSF.

FCS_RBG_EXT.1.1 The application use no DRBG functionality for its cryptographic operations.
Random Bit Generation Services
FCS_STO_EXT.1.1 The application does not store any credentials to non-volatile memory.
Storage of Credentials
FCS_CKM_EXT.1.1 The application generate no asymmetric cryptographic keys.
Cryptographic Key Generation Services
FDP_DEC_EXT.1.1 The application has access to no hardware resources.
Access to Platform Resources
FDP_DEC_EXT.1.2 The application has access to no sensitive information repositories.
Access to Platform Resources
FDP_NET_EXT.1.1 The application has no network communications.
Network Communications
FDP_DAR_EXT.1.1 The application implement functionality to encrypt sensitive data in non-volatile memory.
Encryption Of Sensitive Application Data
FMT_MEC_EXT.1.1 The application invoke the mechanisms recommended by the platform vendor for storing and setting configuration options.
Supported Configuration Mechanism
FTP_DIT_EXT.1.1 The application does encrypt some transmitted data with HTTPS/TLS/SSH between itself and another trusted IT product.
Protection of Data in Transit
FCS_HTTPS_EXT.1.1 The application implement the HTTPS protocol that complies with RFC 2818.
HTTPS Protocol
FCS_HTTPS_EXT.1.2 The application implement HTTPS using TLS.
HTTPS Protocol

Code analysis

Information computed with MobSF.

High
CVSS:7.5
The App uses an insecure Random Number Generator.
MASVS: MSTG-CRYPTO-6
CWE-330 Use of Insufficiently Random Values
M5: Insufficient Cryptography
Files:
 kotlin/collections/EmptyList.java
kotlin/random/AbstractPlatformRandom.java
kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$4.java
kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$1.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$6.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$3.java
kotlinx/coroutines/scheduling/CoroutineScheduler.java
org/jsoup/helper/DataUtil.java
kotlin/random/KotlinRandom.java
kotlin/collections/AbstractList.java
kotlin/collections/RingBuffer.java
kotlin/random/PlatformRandomKt.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$7.java
kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$2.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$1.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$4.java
kotlin/collections/CollectionsKt___CollectionsKt.java
kotlin/random/FallbackThreadLocalRandom.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$2.java
kotlin/collections/MovingSubList.java
kotlin/collections/unsigned/UArraysKt___UArraysJvmKt$asList$3.java
kotlin/collections/CollectionsKt__MutableCollectionsJVMKt.java
kotlin/random/FallbackThreadLocalRandom$implStorage$1.java
kotlin/random/PlatformRandom.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$5.java
kotlin/collections/ArraysKt___ArraysJvmKt$asList$8.java
kotlin/collections/CollectionsKt__MutableCollectionsKt.java
Low
CVSS:7.5
The App logs information. Sensitive information should never be logged.
MASVS: MSTG-STORAGE-3
CWE-532 Insertion of Sensitive Information into Log File
Files:
 org/koin/core/time/MeasureKt.java
kotlin/io/ConsoleKt.java
org/koin/android/logger/AndroidLogger.java
High
CVSS:7.4
Files may contain hardcoded sensitive informations like usernames, passwords, keys etc.
MASVS: MSTG-STORAGE-14
CWE-312 Cleartext Storage of Sensitive Information
M9: Reverse Engineering
Files:
 ua/sytor/wifipass/BuildConfig.java
org/jsoup/helper/W3CDom.java
org/jsoup/nodes/Comment.java
ua/sytor/wifipass/core/parser/entity/WifiNetworkData.java
ua/sytor/wifipass/repository/password/SharedPrefPasswordRepository.java
org/jsoup/nodes/DocumentType.java
High
CVSS:5.5
App creates temp file. Sensitive information should never be written into a temp file.
MASVS: MSTG-STORAGE-2
CWE-276 Incorrect Default Permissions
M2: Insecure Data Storage
Files:
 kotlin/io/FilesKt__UtilsKt.java
Low
CVSS:0
This App copies data to clipboard. Sensitive data should not be copied to clipboard as other applications can access it.
MASVS: MSTG-STORAGE-10
Files:
 ua/sytor/wifipass/screen/wifi/WifiScreenViewModel.java
Pygal United States: 100

Map computed by Pithus.

Domains analysis

Information computed with MobSF.

US github.com 140.82.121.3

URL analysis

Information computed with MobSF.

https://github.com/SYtor/WifiPass
Defined in ua/sytor/wifipass/screen/about/AboutScreenViewModel.java

Permissions analysis

Information computed with MobSF.

android.permission.ACCESS_SUPERUSER Unknown permission
Unknown permission from android reference
com.android.vending.BILLING Unknown permission
Unknown permission from android reference

Threat analysis

Information computed with Quark-Engine.

Confidence:
100%
Load external class
Confidence:
100%
Implicit intent(view a web page, make a phone call, etc.)
Confidence:
100%
Find a method from given class name, usually for reflection
Confidence:
100%
Connect to a URL and receive input stream from the server
Confidence:
100%
Method reflection
Confidence:
100%
Connect to a URL and read data from it
Confidence:
100%
Retrieve data from broadcast
Confidence:
100%
Read sensitive data(SMS, CALLLOG, etc)
Confidence:
100%
Implicit intent(view a web page, make a phone call, etc.) via setData
Confidence:
100%
Connect to a URL and get the response code
Confidence:
100%
Monitor the broadcast action events (BOOT_COMPLETED)
Confidence:
100%
Get last known location of the device
Confidence:
100%
Get calendar information
Confidence:
100%
Get location of the device
Confidence:
100%
Method reflection
Confidence:
100%
Connect to the remote server through the given URL
Confidence:
100%
Get the time of current location
Confidence:
100%
Initialize class object dynamically
Confidence:
80%
Start another application from current application
Confidence:
80%
Read file and put it into a stream
Confidence:
80%
Get declared method from given method name
Confidence:
80%
Connect to a URL and set request method
Confidence:
80%
Get resource file from res/raw directory

Behavior analysis

Information computed with MobSF.

Certificate handling
       org/jsoup/Connection.java
org/jsoup/helper/HttpConnection.java
Execute os command
       ua/sytor/wifipass/core/command_executer/CommandExecutor.java
Get system service
       ua/sytor/wifipass/screen/wifi/WifiScreenViewModel.java
Http connection
       org/jsoup/helper/HttpConnection.java
Https connection
       org/jsoup/helper/HttpConnection.java
Inter process communication
       ua/sytor/wifipass/screen/about/AboutScreenViewModel.java
ua/sytor/wifipass/screen/wifi/WifiScreenViewModel.java
Java reflection
       kotlin/internal/PlatformImplementations.java
kotlinx/coroutines/internal/ConcurrentKt.java
kotlin/coroutines/jvm/internal/DebugMetadataKt.java
kotlinx/coroutines/internal/FastServiceLoader.java
kotlinx/coroutines/internal/StackTraceRecoveryKt.java
kotlin/internal/PlatformImplementationsKt.java
kotlin/coroutines/jvm/internal/ModuleNameRetriever.java
kotlinx/coroutines/CommonPool.java
kotlin/jvm/internal/Intrinsics.java
kotlin/jvm/internal/Reflection.java
kotlinx/coroutines/internal/ExceptionsConstuctorKt.java
kotlinx/coroutines/android/AndroidExceptionPreHandler.java
kotlin/jvm/internal/ClassReference.java
Local file i/o operations
       ua/sytor/wifipass/repository/password/SharedPrefPasswordRepository$sharedPreferences$2.java
ua/sytor/wifipass/repository/password/SharedPrefPasswordRepository.java
Set or read clipboard data
       ua/sytor/wifipass/screen/wifi/WifiScreenViewModel.java
Starting activity
       ua/sytor/wifipass/screen/about/AboutScreenViewModel.java
ua/sytor/wifipass/screen/wifi/WifiScreenViewModel.java
Tcp socket
       org/jsoup/internal/ConstrainableInputStream.java
Url connection to file/http/https/ftp/jar
       org/jsoup/helper/HttpConnection.java

Control flow graphs analysis

Information computed by Pithus.

The application probably gets the network connections information

The application probably plays sound

The application probably sends data over HTTP/S

The application probably starts another application

The application probably executes OS commands

The application probably creates an accessibility service

The application probably listens accessibility events