5 ms·
One interesting thing is 2abeb8565c30a3d2af0fc8ea48af78a702a1c3b432845e3f04873610fac09e1b was mentioned in the original description 1 but removed in 2/3. That
by arsome 4y ago
One interesting thing is 2abeb8565c30a3d2af0fc8ea48af78a702a1c3b432845e3f04873610fac09e1b was mentioned in the original description 1 but removed in 2/3.
That package is signed with an Android key instead of a vendor one...
https://www.virustotal.com/gui/file/2abeb8565c30a3d2af0fc8ea48af78a702a1c3b432845e3f04873610fac09e1b/detection https://www.virustotal.com/gui/file/2abeb8565c30a3d2af0fc8ea...
- ShredKazoo 4y agoSo Google's private key was stolen?
- arsome 4y agoI'm not sure of the validity of the key, it's possible it was simply an untrusted key that had "Android" in the common name and got removed from the post as it was unrelated, but I'm curious if any more details surface on that one.
- dhx 4y agoI doubt that is a real Google-issued certificate authority based on the issuing CA certificate having an e-mail address identified as "nbbsw@nbbsw.com". It's likely the reason this sample was removed from the post?
- axsharma 4y agoSame thought here. The domain appears to be associated with Ningbo Sunning Software, a Chinese vendor and likely a Mediatek partner than anything Android.
- arsome 4y agoGood catch after looking into it more this may be related to subcontractors providing vendors with malicious update tools that they then sign. https://maldroid.github.io/docs/vb_2022.pdf https://maldroid.github.io/docs/vb_2022.pdf
- MishaalRahman 4y agoGood catch!