+ All Categories
Home > Documents > New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and...

New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and...

Date post: 05-May-2018
Category:
Upload: phungtruc
View: 246 times
Download: 5 times
Share this document with a friend
337
Appendix New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and Song Wang Trend Micro Mobile team January 2018
Transcript
Page 1: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

Appendix

New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks

Appendix

TrendLabs Security Intelligence Blog

Jordan Pan and Song Wang Trend Micro Mobile team

January 2018

Page 2: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

Trend Micro | New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks

TREND MICRO LEGAL DISCLAIMER

The information provided herein is for general information and educational purposes only. It is not intended and should not be construed to constitute legal advice. The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should be relied on or acted upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing herein should be construed otherwise. Trend Micro reserves the right to modify the contents of this document at any time without prior notice.

Translations of any material into other languages are intended solely as a convenience. Translation accuracy is not guaranteed nor implied. If any questions arise related to the accuracy of a translation, please refer to the original language official version of the document. Any discrepancies or differences created in the translation are not binding and have no legal effect for compliance or enforcement purposes.

Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any kind as to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own risk. Trend Micro disclaims all warranties of any kind, express or implied. Neither Trend Micro nor any party involved in creating, producing, or delivering this document shall be liable for any consequence, loss, or damage, including direct, indirect, special, consequential, loss of business profits, or special damages, whatsoever arising out of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content thereof. Use of this information constitutes acceptance for use in an “as is” condition.

Page 3: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

Indicators of Compromise (IoCs):

Hashes (SHA256)

SHA256 Label Package Name

02A40B891CB95F3CA4C5DDF70D2CA8F366BF51B99115F0E52E1C3A6AFD6E2147

CМC - Фотo rqp.efibrktva.ctyuhesi

05F0B3DB43E8381310FED02C59B5BFCFBB226ED40A6A8BF85A1852E64DA9CC2A

CМC - Фотo suebpz.qtszlumhy.ziotsbpgh

065578C8D7936545D8933B77D907C8C25AE12A8E5A3B9826B93F09C90961D50D

CМC - Фотo zdrpog.sdvxnf.zpawviuo

170171582731B8D5DE1B8D1386457DCE6F9A1A8C2550943C7ECC96F61F9C9B67

CМC - Фотo rzatb.mptowsabkh.gymwlovne

292D2201991B1891303CCB49E97047B34AE64F0CBFB28BFC4C327CEAFFFAB575

CМC - Фотo liwb.odiwhgq.exckhwyzvam

2B74042DD7AA27723B8D49B82F755F4AB25022825B7E31DA54356D9C30AC5529

CМC - Фотo szt.dtefmz.vcwl

3F3F7697196CB506B74B55BD89E8F0AC6CFD89A9842E7401D36905B05FA0B984

CМC - Фотo qgykehs.wzseldrxp.ezxfpruqkdw

5F330DCB92A3A61C8A87978BCA2127E64685E5F7B7D7F9E33B40FA76E193CF61

CМC - Фотo plnkthi.zqgwpsdtev.jzmhcnelsywq

60FA15D573605D4E05FF91438D2E936ED1CFCFA380A735D55EB2D0DEF863FDBA

CМC - Фотo pto.pvbsoiw.nshzc

62B4FA3BBB43249E8E1684FABF08426ED3FEC27D6D093FB6E03C088292E5B989

CМC - Фотo qta.ktwlcer.aweptqyfxsi

68D54F121CAECE26C0DE958F5A5E434CBE4DB8112D75AA76A94385B8D8DBB1E5

CМC - Фотo ojmy.zqlvbiorg.chpyoxqbvwd

72C3B24F3FD8CFDEA4516301B9A0575C67A8152D951BBAC0E572DE884E959668

CМC - Фотo hujsrmx.ayewhp.ealfxmvscz

8EFEC0D7DFD7D10F14BE024D463DCB0D4FBABD8F763D2847EDF6755EF6EB37D2

CМC - Фотo qtih.wnvgok.etyof

91C5FFECE382B5CE9C174C12F89C643D208895EDC0A71E113AEBC4785BDE469F

CМC - Фотo uwa.tnpgiao.kjzdtlnufvq

A14C73E21EC118B8A2E7AE30DA31D18C798B7 CМC - Фотo haicgow.rnvdlpkxho.djlsvpoe

Page 4: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8B4797ADCAE1FBC535698536805

AD28D4F2F1848C1BD2B902329A98DD767E78EE5D1B10570F72E29DF9183B6C07

CМC - Фотo waiprqv.djgqzu.aqjlwdbfzc

B302A2F5D0F94F7873D97BE219716335EB99D9266DADA37B2B0FA83147AF5173

CМC - Фотo soamtvb.fenbiy.xzqajvbkuwcr

B8D2E6A73CC970CEE223F70407C387820DB177B657F06FBD81233458ABD04D5A

CМC - Фотo xsi.iucjqabfr.ixth

BAAFD9F047BF21BC46B263AFA6B6A445F94A4F9153126C5EBFFF9FFF62DD3EFC

CМC - Фотo olkj.crknil.bojtxzin

C642A2CAC52D1046B8F5A4EE6FA7845F5528920593D7A0DAB6C84C9901F4C243

CМC - Фотo tjxav.uhxpyfmt.dpwneicohlk

DDDC239F0E7996F0F8DFFACD98A90B34C4CBC4CB351908C0C78574ACDC9CF153

CМC - Фотo xnvfju.xrzviwbtga.szqhoynjwf

E6A0AF4211C3C48FFA86CB525CC833B90819925D79FD3505C99C521DCBB5DC83

CМC - Фотo hrab.ouhwdcv.aupm

F6D1DE6817E07791BE12FFF45AFE7F3F3E2D4A108A4D40F716CE582DA1414FC5

CМC - Фотo nvhtqki.rupzcta.qxrwzvg

FDA394736EB4EBAA32A2D80967F839A76B3B0EF87062FD332EE53D0A6020E65F

CМC - Фотo oltkani.tulvcjfqn.kusjyr

003E8D847863924B4E62D561194E2DA6C5EFC6B0E0327B87D0026B0EF0749CAE

SMS_MMS net.uwxqqbdqyl.pszdjmqrrzeo

0063C40D94EBD208C5961463C98D70506D7A9BC52EDD9E9433BF9E6079B65685

SMS_MMS jhpymco.lmayzs.qghdew

008712E5D3830B4E8F8EB353F99185460B4181237E2861ABCE4505514910B3C7

SMS_MMS com.rxbyimw.nhkjgxmham

0092A25680DED69EB54F949CA922354C151AA7D119268FFFB4F94617792C9D98

SMS_MMS com.xedigmpb.ybvqeai

00BFDED225744F2B6A03A0D2CF5C3E8C5780D89B6CB4C1A0653C0A6B555677B4

SMS_MMS com.fvowoieo.fgyvfvx

00D8A65E0271A9BB2FD0279B67E42413FC39CB2E21613737F37A48A5C6DE72E8

SMS_MMS org.ljxhjwsbf.remiecws

00DC08DE03AFC4EF75DBA32DFDB8625DB09391ABBDA580E2556C9A98CFA37D53

SMS_MMS ru.gghggqm.fulawzlkckb

00F85AAB6DEE4140E9BD32EDE481FFAD82FAB8E8E2FAA033680139B3A9B9C579

SMS_MMS org.mhifbjeuyojvel

00FD7FEA4BD9FF9B64DF148D4F5F4C323DD6E1B6A78084EF8D86AAB02522C59C

SMS_MMS io.hgefuhglhhmu.uwssoktfaummgz

00FD8B3BA154047EAB5404A7BD3FE30C03B000654CDE5A1C9ED28DB75C0071DF

SMS_MMS mvb.thiawh.cerfoczssm

Page 5: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

010347DD5F73CD48872C951B47FD6AC202F0B42BE1F20FA7A9FF5887AE6A8D3A

SMS_MMS skabirq.oubmclv.asxmvh

010752E05B22DE854EB9617BCA5246C4EE361DC83841CA40938DD8F2E4328DA8

SMS_MMS com.lfgqgs.mfitva

0120FF23911978FD631369CC5FFF609AD02F7EA3009D44AD8BD70738C7D73B3C

SMS_MMS com.icikmej.pfyvwxhjatnd

0135F3619CC069F7359C92E8B0DCEC23E1A7C44B30C1FE6D93979DD9C2DD4655

SMS_MMS com.ncezagzv.nthxzdvd

013864DFBBF8916600744FB6161BF5439DB5CDC3325B1CD3CEBFDED9C50F27EA

SMS_MMS com.epxchqymni.pexatrdpfv

014681B9CCF06DC9D7A547C8FDDDEC5D763DD7E505E702EF9C0A5E9781BAE796

SMS_MMS com.sophxqrlgl.ktdaoq

01533710A9435888373C09134B065044127246B5671AA94AF99B3AE5BA8B1E3B

SMS_MMS com.rcrcj.nhzhinjl

01649CAD6E157FC959F80394EB78D5182EB1E86482DDFC9D89DCE5C46F809F62

SMS_MMS jdlzgr.cbgfwz.ivynwkq

017A811419EBB58602BBC580A8B644F7EF24C55B3240C91D1216E7C393C7D0FB

SMS_MMS khnyfo.eoasz.mdanw

0181E02EC53124D289408758CCB51272465603FC120C67955A0EA53F32C77F3A

SMS_MMS jxbwfutp.sjitn.saqpj

019159904184790A98C7E8FE9B3D15B97F6E7C74AD49890A3DCAC63A082C0239

SMS_MMS com.enxsiv.ewujtjmyc

01A5AFCDB1AD7389970B303D85CCDECC226CEA273A261F3DA721FCDE349E645D

SMS_MMS com.pacdsh.srfnvi

01CBCE21478ACB6405108C93A88640144B359EB185369C1149F1970BB0817B87

SMS_MMS com.yeynmryv.okiqvunh

020D0E55C511AA0E85A7D170E4F835912CAB15A3FF7EC17485560A8AE8F1AF13

SMS_MMS com.zgnzofc.cftqj

0239047F0036C55E51C8B5E7425C1955679E57A40108363DAA93412FBA548379

SMS_MMS com.ojwzc.hieuc

023FE5DB5E7C3BB0952D2858E2D77580469C18FE6359D69EC76E5F3B0824B0F4

SMS_MMS chi.acgodbr.nswbd

02542A831A30D0770E8FEBE4F5A718BAB46698D2593345A77147B4F879D88A88

SMS_MMS com.tewqejxfze.rdnaokbrgq

028B10DA3079C93121FAEB9AD387E69117356EE9F00B8520DDC4E0F6064107F5

SMS_MMS bclou.lruewa.wqjigv

02A6FC7A39C4CAC030A3EF00DB8C3D0055D655567187FBD68801D0B8085D534E

SMS_MMS com.qnbgy.thcvxmvekm

02DE01362F2006E91EBEC12A873AC1A14880A SMS_MMS com.rmeyzknk.zbuwfzyhbywy

Page 6: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

ACB1449312AFDE4A6C0434CF16E

0353411E9BD9C576BDAB3CB33FE823E4AFA412797E2C159060BB7E508344F0B8

SMS_MMS crzhpsw.zgvjfebd.kbemlj

037B52427E00B1A7D7C7A71F7204F0018BF93726A874B5BE3FF824ECCBC7F5A9

SMS_MMS iec.sdhfigd

038612CAE77F5D39E9A847BAA1CA9FA2BF170B505C04E7D68416A807AA1CCE5D

SMS_MMS com.qwipdxjc.ivmbmv

03A865B14299CF1D37B4B8D6C3BF929C7473B18C517D91ECE713E96321DD946A

SMS_MMS cothd.tqiem.fseqvub

03AF5D94E197021CDCF4FF72B4DB3E93FBC73B63AE5C23442BC0D35CB0E61580

SMS_MMS com.lymhl.lyfpglqfdg

03C7FE56E948F0D8B2CB0AC96EAEF0D109999E09387F8B9450410CD8C8607649

SMS_MMS com.zybjktnj.atbfrnktze

03D1983AD818B1F1216F70AE4A9E3EF9E5C0140E5CB7763DC718C95CEA24DDD2

SMS_MMS com.tzwodvnkzx.iqelmhfm

03DD2C4ED8B0ADFCC1FFDD8244D29289C26E034563649B10DFBD58A3A1896C0F

SMS_MMS com.shczgmxeb.lerivorjmr

03EC1B3D857572A087376DAF9B4E6792C6CCE68D8651524466868533769FC513

SMS_MMS kicvebsp.fadqebl.ywhub

04108829DBD4479182320C94161A6AB90C60DEDE852A6C2A382FBAC0F504F03A

SMS_MMS com.yatdeuhkzvpqzop.qeueqblhuxfphu

04620C89687E39C3F39B7E53DC09A1F93C9A665F84E388C0D43602C0C24BB7CE

SMS_MMS com.hctkydgbp.bekacdpyzj

047FABE1A9B791C39D96D551C2F95E2EFA311C265BD61BC9A9A00C8A8A0A586F

SMS_MMS vyl.gibjwz.kuse

048F3F6F3FACE3C72725E8ED8467D4EE8D45090866FD8229DA41C29EEBA2B181

SMS_MMS pflnsj.aebsx.anzcks

04C44449BA715AE159CAF97DC8322F02D187CB366EB874110F9DB069D404B6F8

SMS_MMS com.jyvoeuzx.eykqa

04DCAB01AA72B5A96FC48F214792E29C0710DF097CDCB063598CB53D0668E9CC

SMS_MMS demoi.oskrezam.wndkeicl

04EED72FD03901FEC2D75A6F475B133EFFA4740FC6E3E7EB631EB1BEF9AAA8DB

SMS_MMS com.aurbczgt.uvpipd

04F32EE6A87EFD0D642799BB55385685970029D0DAD87852345B2DB4958771A8

SMS_MMS ghx.xonq.exgujauzq

04F4B536F37C37F198483DF8B494DD90F5D2DD91850B0110858A9F0401950205

SMS_MMS ru.okdlnednygmd.wsiedatszuphkxz

050F7CD23393C983F3092393441680B7B32E294B114786C3BB292A0E9D3B75C8

SMS_MMS net.ngryspfptfbje.miwplcxur

Page 7: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

050FBFEA8395F04FA98AA9EE8399E6245B27E340D75D1C46A7581A1867600204

SMS_MMS zhs.wgqfaaxhty.wjedkm

05330ACE8319150F0AD145B6F31F95C50F7931EB06096165424C9CE87F320FDD

SMS_MMS qlx.rqvbxwpq.ej

05B4B02CECFDD09A5FCAB0856F8B109AAEFD9ADE64023EE6FA62DC49DB1BA0E3

SMS_MMS bsxao.ihkgynet.ctbafj

0610C6D8B1754F48041AC718201AFEE976343211EA15EEE1D73B33D2C32B3D11

SMS_MMS gwnums.thfyvux.ebgmdp

0628A3C939A3DD2819BA38CA7D044B3C02A915186EE2D254E7ABFDC32B85B970

SMS_MMS zwh.tumc.am

064B4FE2CC63448DB7FEE25DCD8EFE530F4AA8B7282DFDFEB675F8A0928615B6

SMS_MMS net.nqdygflm.gqnnppsdjsz

06552B7D47A0069C5819FCC376254716C138B79516923A4D0EA44DCF48592730

SMS_MMS ru.ljobredqtc.uctcpdbmnrvzs

0660AB97130C9531007861A39DD520C983C767759CCF21EDDCDDE6AD66451940

SMS_MMS pta.mv.imgy

069D9F8368D999DA5823F5FF7AE19E2FF5FDC827C25968711689AC6A04A8FB47

SMS_MMS com.pervgvw.cvpbpy

06BE0B3CB992317C4D6459B3A16DF9C207EC186492EA771415747EB326438029

SMS_MMS com.nkiao.neivfqxs

06BEB67D1981609B36E254031DA79F482A7F20055D4A998703F8AFFE8258D0B1

SMS_MMS com.ciwvio.syifzlersf

06E3E513A4B29A75C353C74CED7F3331B0A4769619F9FB8756D8F6347A5B9E60

SMS_MMS ru.zbnusorktcegcq.gllhrmf

070E6D7EF0F93EA56BB05241B40D3D0FF0FF805D875F03A090A2C40576DA008B

SMS_MMS com.nqxktls.leviqwc

070F5F84BDD435DA472A0F325E3E1A3348B1B47E9060E164953AC559BBD9C239

SMS_MMS com.scohkqval.tvusrjewu

07223A3E64D876AEBCD4D39589BDE86DA83A41353B924D663342C49AB2F959D6

SMS_MMS bfryk.lumfgk.uftkzax

072CA9B921F90E6E63EA86504E9533B0EF855FE5027E3112899A53591D2DA1BF

SMS_MMS com.xqbaypf.zkwvwebpak

073D49AFE70D45B6A37CF584084199D00DF30800E02964D067F86C26A521C04D

SMS_MMS com.pzftusnir.lyhehjb

074E7AD1A8D46333A644DC2C1BF0BE3D2D1C9C0F1EC2DE52C592AE9ECF0E26D5

SMS_MMS com.qetlobeqtv.bjvwnymr

0756A420066DBC76C77EE95E1165E87058018B40BF4DF0067B9374E848D3A700

SMS_MMS ovtycwaz.yivturdn.mikuf

07A61024240AC35FAA4C8A3DF92F091267279 SMS_MMS ru.ygswnxibs

Page 8: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A28DA6BB73A6A8010BF7E328FA5

07C7BC50FC28D347AEE3551D0BB8DAC99A8BB6A1E9486CA8890ADB55947FB141

SMS_MMS wuw.bagzsihla

081311C542B25CA3464A466E82CBE975C9A28D8788FA2AA075107F4E5442CB5A

SMS_MMS ru.ygxkuyk

081478904080AADA2F623757F645B7C42D71A3CAD00017396789FBB7883DDB92

SMS_MMS com.xsatdp.lxiznlct

0838BC682EDB392E2913F65D3ECA6C03F05326880CD7D6A9683169F1448383D5

SMS_MMS net.exjcyki.fdlwemw

08674FE26CDAC5047E00A10C7418535205D015F391ADFA8E663FD78EC86F20A7

SMS_MMS gcxso.bhdyem.nkhdtowu

08A4D2CC906CC02F2A152D9AA993C8C95D56337DC172B776D6CFA8FE0F6A7A2F

SMS_MMS jxp.wy.ucogvnum

08CE3BA4B6DA7C155F31F532ADFA6227E711D6EAD82A8C3C053B9D6444BF0593

SMS_MMS bsanf.kbaxn.oztacwsv

08EE9C38068F52321A91B63945966AA57E76A57DCFEA6EFD1D66709F637EC470

SMS_MMS yol.ct.lstuaotvub

090598D2F8D32929D69E9E86C606A60340F21F0D420D9E79F7C00C56A6118EE0

SMS_MMS qtpjlf.qzlpgof.ztosaj

090CA086ABF83C237BDD6F0166D4B43D71261054EAAB28617CEFA7DC59C202A8

SMS_MMS fxzcih.opilmzq.bqztw

0957E228DC51705AC85F8486427263400876D6F3B001DCF9863427B53CCA271A

SMS_MMS cinzuswv.dnuchwmb.lcgwx

095A0EF81CA051989BC47C74367692AA380D1A03C55AC45C1CC0D7C0C29867D8

SMS_MMS zyy.jafz

09B31A1F64FBA7C86B2DA403814B83ADC7B561AA9A8D687E33F7C020546524FD

SMS_MMS gxr.faa

09E119CE42CD7ED4E103FDBFA7471AEB5C43B9ABAF0DDE7C23E200F59A4450DE

SMS_MMS com.ecpvqxgy.kacna

0A070A1CF976C83F0AA90F8A3967A3BB2EA36AD5F37EA9C814E04E33E964B6D8

SMS_MMS com.msdiap.weyxekf

0A0744F0614B09189EC16F11D35A8760C7440FF020A2F1FF2F904211FC3C94D7

SMS_MMS com.wlvnau.igorihylao

0A122BB9B02ACB8E52F677A393CFD356B922CD8CCA6643E477EB1B358C7D91DE

SMS_MMS dlbmaqc.drhzlp.bltxc

0A9EC4E094CAF851E65701EA666E04B95AE2CA1B5FA120F9E610064993408608

SMS_MMS com.zopcbt.dtbpqshpdb

0AC4FE7C26BE50CB481D65611D7E54DFA5E587BE210DDE0DDA56B93CB262F04A

SMS_MMS com.fnvnibo.rhwtyrt

Page 9: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0B1C6408A4484FD569EE6D68174ACC8DAF0163FE5C52D9D9CD9B80C9E521F604

SMS_MMS org.meqtzptw.isjdanysywt

0B39E73C73C2B0474D6368A6664FB49322093C888E41B538AD456B0FCC13B8D1

SMS_MMS nipkhag.euxyzioh.bmsqo

0B3D7EA52C6F3BB46710B47D45A24B2B7125DEAB3A8E94E48BC4F479C1AF624C

SMS_MMS com.bqbix.cnzkxytv

0B42B91CF5D57C41D4DEB36241AEFF705ED26A2B8D9FF535F47D05CAE9698C08

SMS_MMS eiq.qsucwb.vptosvijt

0B53CE202AE260FE02E5376B75A618DE02D0576E017CF171DFE9783363AA67A2

SMS_MMS zvglj.jhqwi.xwqin

0B719C9558F730DACB9C2FD5D1B90FAD2B01DD57AE7489FA25D12ACFA2C496DD

SMS_MMS com.ojenceowac.nldvaiw

0BAEEA956DDEA414406908A74A4E91FEC31FA0774F44F158A8E80E8557F1B8A8

SMS_MMS wtdvzni.jnedl.qormpfws

0BF625A629076107F9EE306AD44FF304344290ADAB0CFCD7FFB3FDC07BF8560C

SMS_MMS net.fyoscwwuy.ktkgoydegv

0BFF8BE81AE5D57F68C3463256D229A1980E0C00B963AB8CDD8BFDEA39914E5F

SMS_MMS com.cbidmspakl.putirgrhz

0C0DF702DD653018E7900C6DB5DB610D42D7FD64E8F0CE5E26A6F9D0ACE81513

SMS_MMS com.aplnqb.kohyxpdh

0C164938638616FE47FD53F559681AC5BADA95C6A519E1D3291A7F7AFE650029

SMS_MMS com.cjrxw.odeyhzn

0C1F4451526114A835D9DCD364976025BEF5719C600186A20B7066796286A9F1

SMS_MMS io.rpsauevnkxfvt.bntjyoplxwwsqvp

0C231442B014A238ED75DA0ACB0CFBDB96AFD47880F24B101248DD71926B2D9E

SMS_MMS afubemoc.lfmkbjre.bvhqkt

0C5A4D5D71E45E3BD3DC240FC442BE3BE15A590761F19B46A1E56733992F8EFA

SMS_MMS mmk.xitzov

0C95ED9B8A700652E8602440457EA6CD89F14A5558459625EDA4A94F9FFF3C99

SMS_MMS com.ojypns.ovrwkgyihc

0C9DA30DB64D8990F6B9242A8ECCCF2B2D5F8B392BCF9ADE639E558F715894A2

SMS_MMS rzosu.omgwkbr.derzyg

0C9E9C6C985B238C8F26128638F0E5A7418BDF84D2F931854264668375AE4374

SMS_MMS com.abnwvwzv.fnyemykxtm

0CA8E97639273962C2E9D5D66EE329782FB07A92FDCA2235BA68348795267A13

SMS_MMS pxjmw.awolvkm.cysjn

0CA9507A1F7B924C2A52873D62FEDC59BF079C209046E2F404025E746A1E200C

SMS_MMS com.bvwqo.lvbfelzg

0CAA6DCA50E0689A694EB44EA03D7A871204B SMS_MMS bkznti.qfjtkr.ahdyqxvo

Page 10: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E4E68E424CC67A89C6E8352A2B6

0CE5FBDDA22E2D6BA65DC3467E74FDC6FA67521E6CE4CF54622D9C2D3F967CF9

SMS_MMS org.xazowuybhk.hgpdjfbqunmda

0D02854F83AFD955D03CE7F815FFCB3CE194216B921F4EFE11A9742812D283A4

SMS_MMS com.bzpfry.oduqfet

0D08C2783D73F4966B4C343D5F5AF74512ED24B963A522773EF64BC29B5EB788

SMS_MMS kuegfla.jmvlsq.gytfx

0D2468671B9706622FC96A9ABFB1075D4DD2DEC9DA96C78E51E75B16B4E7D300

SMS_MMS com.uqdby.gshjxv

0D376403105070B5524B10623FEFF1DD9DA6D4EFEC47FC814E513B0B1B77A1C1

SMS_MMS com.fxrlcxwisx.jugfb

0D5E3535C2EA31C5B4EA514F10BD1587D3900B554685D7B7C976E12E6EF5FBF6

SMS_MMS adnsujt.yraih.ojkgz

0D616013D2540DE180B1A10CEB2D5DE0475FE7FA0FFA56F5DDE429135E5A967A

SMS_MMS gho.xyywehq.zf

0D70653DFCF4AB6AED717AA7C4937C3805D53388DD2EC0D6A9D576E088F1D512

SMS_MMS xclpqjmn.shbol.gsdpwtfh

0DD06D4B546449B9F67DF523AE1AAD87663EB66FFFED0CF10C9B67347D19B939

SMS_MMS ru.jdhndtpk.iypwqbmltdwdk

0DE4996A8123C8AC4172B66F9D17DBDB127BFE07072055C6528EF367FB609F95

SMS_MMS

0DEE688625F6306C4832035AE98FA41055A5608F67683E344A323AAF3BFFB0C9

SMS_MMS aqdxt.zusxp.zygkb

0E114CDA94EE54B1E5B0ACDA2032F19920BE1D5259B8FAA5188D0DAF2F67506F

SMS_MMS com.xgdkpxjnr.kdwrzg

0E7FEFD5571E1DD840340B503547FC81969D28B34D42410F99FB61E9AD6FCF07

SMS_MMS net.dljsldox.nrzjcljhgog

0EAB8390D377C13645DA24AE100B8DBD3A053505585A1D1D3B917D0B59D464B0

SMS_MMS ebj.nno.fkatrvkkba

0EDD7DA5535D0F04014AE719BA883E55C98C6BFDEDEC2D3BE9127902CCD99C1D

SMS_MMS jfyzlgsu.dvwlyb.pejcntlr

0F2504DAD526F2A64D4D06B275EC4BCED658729E4D5828CBEF31D7205F3D83E8

SMS_MMS com.wojexkja.szfde

0F41269800D9D66AC43CC2013EDDFA138CF844C9C2C45F5AA86D705E80C87CF2

SMS_MMS com.wofabm.yokqkluqe

0F8A2626E5BC5DD93B1A737BFA83D43EB2D0B04A54E0C0DD61BB7BAAF450150B

SMS_MMS dzwqkcxs.gsiju.cervlnh

0F958936C9B41AE17F9D9385525716A2AFCE1696C2CBB1BC9773D2FD11769F71

SMS_MMS net.bttuzjyyzcew.hwabtdu

Page 11: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0F9A1948900D7185A2BC978303FAB55B0F093379AA88C013797AC714188EBDA6

SMS_MMS dvbfjnyt.kduqyzm.wyetum

0FA66BC45DEC1B1772B40D3651C159D884F9207147668B442C968697E8817A52

SMS_MMS com.hazyiurxkpzddqh.mpocprctrycoce

0FBC6083852395E4CF05697B49A54A0C76B51B8EBDC0B43D795A15AB4A98D765

SMS_MMS com.mzlzsclts.sydoahdjal

0FC3FA54B7D65E531A246A7625466B8012AFC7D28E6276D416CC3CD8B5389C8F

SMS_MMS oai.irjza.kexqb

100ACDBAB33C42D8E19FD538630F9CBB34D91EC83ABDA22B8B302EE6C873379A

SMS_MMS net.jpoeraauru.jetlgjozltjwwt

100C10CC29F1151A0314113AC0835885396F6F1D6616BD0146C16E4E6A8CA9F0

SMS_MMS sdq.aqnpji.zzlpbav

101C207DB88BC23D4C7C62BF9336C4CB6AF3F219368A2163A216C46437408DC5

SMS_MMS com.dahqg.zvqftchnmz

102C27A8E0D01D801FC5E1E94532CB5D1217B978D00CEB2FFF4C958E905DA61F

SMS_MMS nkhgms.jnfgrst.oedsnhz

103E9D76A5CC6D4AF38B8AB63D94C3C506AEF6B97C89C33C357816C0E5B8C7B8

SMS_MMS com.xvgkxglth.minoaz

10596AC620464656EED089284F57B2B42CB5C0878D83EA508ECA4A8FFDFDBF01

SMS_MMS com.dzmyhawum.qsitgimqt

1083CE65217C0CBB287A9E036C85E7EDBE4DF2E311BAC3C92D0BAB1CEB761466

SMS_MMS com.mbyokxye.eqyrtw

10AF15EED5A7997EB8DC4B5A24431B8BB9A65FD41D3E01784FA62C93BFC2FD60

SMS_MMS com.igjxtmux.ibomehzy

10C7970938D4E12C3C5AA2B9F65B7BA94DF12AC3B5DA8900179A80A31822749C

SMS_MMS com.wcaycet.outrv

10FAECBBFBBC929E990572F89F670DB709B01048ED20AF89C86C073A2A2B6E04

SMS_MMS org.mdzyipjxpndwg.vhkwwjwkb

114936CCEE026851FDE7BD3AD6A15DC321C5A284CF6FDBCF681E1DADE069DBDC

SMS_MMS com.chldkztwi.izleds

115529712F213BDCD2C6DEA08D16ADE7F9FFF58A15AF27F32421693B6A07B99E

SMS_MMS slv.xyeqgakepl.onz

1166D399D24E120D4E193749ECBF427EC94D701B1A0B8B85793307C87E3D5DD5

SMS_MMS qvyeb.ajpnlb.uiwymsfv

118389D08B897F0F4595582908B76C3C990384256E884E2DCB2B818F3E97C63B

SMS_MMS uid.erwjdmd.xupjl

118E801931A685C2FF7CA096BE10E208549B19E9B4E2906FBCBDCFFC3F160BF8

SMS_MMS yfv.ijcuoljdci.pu

119AF8292DC6D059133006925AEC1CF974870 SMS_MMS zbh.gla.ojicead

Page 12: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B9D3925E843CFB358F8FB4FBB74

11A9EE6EF901B60567D63B794D373682942C318FDCAB2CFA5D1068B21303E3B8

SMS_MMS ltmunvwi.jmlkr.ecrsfwn

11B1477F2F217CFA9717ABEE0C74BA7119FD7E1D58601D1B89AFDDB283B5A982

SMS_MMS com.juplu.beyjwc

11D0714E2C10BAA23738ED9E247429917AC470CE70DFB7A1D1B76F68EB30D2AE

SMS_MMS com.hjvizsqndx.zvxwqe

11D9CE4ABC154C6C5DC3B728276AB0A4B6794932A78F5D1BA8A023E22CB26C68

SMS_MMS net.lqapmosmw.xqlfgzuynn

11DDC8ED5653D6DCBD323CB36CC5B137146EBB260B1CE4A50DDB98CD92A7CCFA

SMS_MMS crmxo.hplsz.cplzftnu

11DE27E3E4C0616E0446DBA96BC6E5320B10915412E3EC8EA7B3D8C339247BE1

SMS_MMS lwbus.kbjnpyq.bmiqugr

12741058DA41B8033DD0F018BCB794E5AEC4673C7A264143DE95783233161B2F

SMS_MMS com.iphfsl.gymufojaiq

128A0DDD3792B2106F7BE2B28008A52DC04A569AA1AA4C0E852C8203489ED4B6

SMS_MMS com.rqekpogqa.djxfnsulak

12A15832A4DA0015F029E77540120899A2D7A2D539BDFF21A08734D19B1D3A61

SMS_MMS zvrich.aospng.icflpz

12B593844DF3C13EDB9FD0B21B9ED64AD2F32DE94E46E0E146895D99E27EF6A8

SMS_MMS com.andpeb.wfgmipcbgm

12B86824C7D7AA30761535FC232D231A748048033F25BC592A3FE6FFD77998A1

SMS_MMS com.yqibpfnj.uicvnirz

12BD2F8906903AB88A1B17BF13A9DCDF53A40891F32CBCD7EFE8656EF4ADE0F1

SMS_MMS com.vyvkaf.daebrcnf

12DA417F9F82893D39DBA56F6AE2541BFD39D15A4D162C2DDCC1D4AEC3D3104D

SMS_MMS com.waijywkil.zukftutuan

12DFF6E51104131BC1F681534D8FC0539E417E99CBC2694E67CC3C0418D06ED4

SMS_MMS com.uqhngkyqvu.hahqzeri

12F6186F231B7CAFCCA9961DDB1BC788065556C8A131673B18162FB606E670BD

SMS_MMS com.dxjqnyfcr.oiupzdf

13196BDCD97CB1E9D09A6FC06111CA9CC4F0F6C18BBE0B19CC487358EB8B9C15

SMS_MMS com.kiucqmt.sotoksxgbf

1372854A44F8090772A32C003663FFC79E709FA58C28A01BB81151EAE9D6EABC

SMS_MMS izvyrkt.wcjnibu.rkxaeg

13BCB4476BF3F2A746CF507F58660DF0238EE75C7D30DBDDBBB7FB4D9BDCB7E9

SMS_MMS com.zwkuhnqm.mawvmn

13BCE53A38F7C8BE3559B2C1AEACF85B90979097E523642CE5C604C8D55328C5

SMS_MMS com.fkeazum.pbgas

Page 13: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

13C0811B6BEA4EB42DDF1D08407031B60713F3AA6C810DD8BAEC4F24A3F01FEF

SMS_MMS com.istmu.rnfqaslkhl

13D2ECCCAAB8DC3319F9DD155C19B4C26BDA7FD7F0D150B225D6D445E8144E99

SMS_MMS muqcz.dwblkehp.oaegpy

13FB9D49629CA3A31807C6604F078FAE4F5AB96F023F5390E40FA04776A06227

SMS_MMS befplz.aevjlpic.uezblv

140EE35792A4DC42DC9397D6814D253140F8FF3458170FBE12F9E7E2392CF21F

SMS_MMS orfupidk.kwmgnxro.kpmni

143C45F04BFBA10C9FE2683B43F0544B70FD98C49235814B6B945E7C0ACF7D9F

SMS_MMS com.sudldmbye.jdmnk

1452D07E0FBC8A2E4A2EDF0C11EA3D0C909A4E948E66256CB0A39D4E5156F180

SMS_MMS ihw.ujofmntqa.ulyn

1486E914F508A6C0352A83A05AB3966135DAB2CD7F8D7D8BE30353751C53A4FD

SMS_MMS xuafsg.nizcduve.jbikvar

14B0A8E1CE6EFCE69B5756C6469A3622247ABDA865BFC5BD6CBF082470A59224

SMS_MMS iyi.gmj.lqyhi

14B43B058C6523E312C8E805473C4D842EFA7F33B9D50DBA800E5530A398BB8D

SMS_MMS ouo.kltpjmb.ucp

14D3090B2249FA7F1CA29553CC91077199DC106AD552F3AD7F96841B9FC345F7

SMS_MMS jfm.snnzjq

14D5927A59D1CEDAEE03CE3372D02901F6BB2666CE7DA66249E0FC6788964F98

SMS_MMS pvq.ljv.czgmvjsn

15005830DAC974BE44DD403D27123185240E06BE8826EFD5F21AECAFF52C0354

SMS_MMS qts.qsbxs.suluiqlpa

1536210493ACAF8996E6C66049662B03AF5D5726AF57B59D33A49BF62C4D76EF

SMS_MMS com.jpkgverzr.pjeqjh

158C2E9A7AC176B6AEEBD90302CF2EA51537F7DB07BB7DA1C24C6BC934BD1D5C

SMS_MMS com.zqugqnybjx.lonbye

1598B3803DDDEA495C73030109D48EDCBF0EA96FE6D8C204DD0C9B6D5C1DB870

SMS_MMS com.zajacgv.avgsapvgd

15AEEC6AD6C4691316DE334C9D165EDE6B68539AC464769C62DCD998CDDBFAD4

SMS_MMS gmfvhuz.lfqbgz.yuzrd

1608628E5229F93F39F4FE0EB55DA5C0DCF30A7A4BAA93486E63F1F7DF83DC40

SMS_MMS com.bot.suka

1635F8D348D1B958F74759208AFC9D2B683224E50279944A2913BCD75C111CF4

SMS_MMS org.yovfjzsxbnbzqw.vdszfgdqwrcmv

1665B61ACC7D50B03B6B3C815DDAECAB6A238094F7BA7C11E4966B9F52317B21

SMS_MMS ujclnms.hlctqjgf.ierbw

167D7B67CBA1C5CC8D97CAB8F3722CA5D212 SMS_MMS com.ekvqxeiqrd.omrpqgbikz

Page 14: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B8B5DC2315C1CCEE6DAD1AEAAAFD

16A563668217543512E89CF89CC4EAC7C74E25B109299EA3528F71A48077555E

SMS_MMS com.oeqiczuipd.bjehypd

16AFE01537FA70E85F7EEAB2DE596460330A990F9768BE4244D9F86E497E62AC

SMS_MMS com.gvszcpvrm.wsfcrgdwis

16BFC9344A84478121DBC79BD9E08C41E9B93A6827D46446FF36468CDD8A861A

SMS_MMS ord.cgrj

1702D8365C3F468B276AFF43476072C8975F4B854D9FC823A4391C51B3F4EE8E

SMS_MMS com.amthdfqypk.okhnjhkash

170A6B98249EE131F9A30AA04693F1E2FD14163146F3A3006188A2243E2FD44F

SMS_MMS com.gnscwr.mkxuwrav

1744036C895E21969ED539700B5F66AEE88FE299C13A57A21AE9AD70319FA8F8

SMS_MMS com.skfzyzj.vhnutpkxgv

175E0F9865E94A419A5C0D9AED8434C0B880C1CD24C8C0E8FF9905F12D85DA9C

SMS_MMS io.bmnqmyrsyqhpexv.yeaspxvdvhox

1796F711A25D0AB8098BDA114C8A96F37869EF0B1B321C5EDEDF028B6FC56245

SMS_MMS com.zojteaor.jaqjxdeyd

17AE24D974C00923E48C255F32C206A2821D9D95AB28990A5657AB8C72EA6066

SMS_MMS roslbk.cylurh.wzmgaobf

17B0EFECF2855F98748CA5C955EA03ED380843DBFF0A574F4CB4B480161920E2

SMS_MMS com.tkclaj.wyrfip

17F36003392AA59831F0251AFDDB7598A15E7321BB82DDB0B334B5D9446E208B

SMS_MMS ixzbjv.zdqxgkb.jymvsxz

18030E545E38DDDF409440EDBA80826329036274709B72FE4EA0CF881B4F9849

SMS_MMS ezn.ihbm.vwo

181048B44DD01CE6ABF28B3782A62C8568DEA4572F4C379FAEDCF8CAF1096C5E

SMS_MMS vyo.krjo.dqhhvbak

1822036E0F355D29FB69735E3C438B7E4A3A167C8C3BC2F965BC02AB98EEFDB9

SMS_MMS mtpyj.jktqdfg.qboixsjp

182545F462A4537B618D8F61989DDA829D4B5EA95D633DCAF8C9EBA575546A94

SMS_MMS com.bot.suka

1842BF4E2BE2E8B5C26A0E7463D475C34F19479EE8406CE6674105CAA7158ACC

SMS_MMS ru.fjkjhoithzxfyy.tgolhpmvapwji

18C254281C92A1443BDDB47A3BE39A71D555BAFF9B2EA522E3EE16128D9DED07

SMS_MMS net.xpijezmwbkv.wenoopwsyaygt

18D727D530828CEB9AD2F7F7ED6DD0DB5B3CD69ED1C1A7452D1EBD6A7D4B4111

SMS_MMS zqaun.adeztsi.ougtqr

18FDFE5E0E0C2E270AE64306B438F7872A38ED7C4BB302ECC410FFBD5DBC45DD

SMS_MMS ste.gmxcqyurkd.qwsjhdzv

Page 15: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

190565545FBE1C6F1B3D1264E7735575C30ACD8BD483A7176D54FC421E2FFEE3

SMS_MMS org.rbphppjxsuj.eidoigjnefkqk

192A7E10E05C718CA009881ECA7C693FAFADA8E19EFD9CE198A193A8A01122CE

SMS_MMS com.mkgjgcl.frcxahclxd

19AD182569D27A1ACFB6EE623308CD11F2E0CF028936FD14E31BE50EAE7E7B29

SMS_MMS com.ipxwdkb.cfvhsrtw

19B5D24DF90E4A6C0A8143BC7B5F8A57EB6B22F30CC07E44FBC727691EEA78A6

SMS_MMS cubgfa.rfnvs.wkgjyro

19C09C26D082F279A1F880AA00D7E564A1D5544674A4E2FA3C2C1A263F76B34C

SMS_MMS com.tzvht.utsvhbd

19EA726E9914962988005C84362A7009EAA05735942A3EF39FF634B1B4433CBD

SMS_MMS xedyntih.pbsvqmkj.exrvhuc

19FAFE62429C2F1C7A0E956204AA64B08743F61214FB470739DB838662D63326

SMS_MMS com.zxyse.jsqkrwuwfr

1A30DF530C8ACCD69C4941BF683A9C2B37E1F12FC263A6C97B1078914EED6515

SMS_MMS com.fvstypwlk.lothp

1A3A297C4CFFCFF588C6C37A82A82F67D454B8A0A1EA29F90B0A8A1E5C72B605

SMS_MMS spt.dwmlj.iigwpx

1A7FBA604C1234F47EAB1DC0F356B71BC5F9C051CFAEC1E4DEC5FE8EAB63A558

SMS_MMS gbu.vaqyqhv.iyklkk

1A87586198B1A16292038944928D582313D45F70AED9838729667F207995D7A4

SMS_MMS com.cjswxk.xmyslxf

1AAA4928A3F18FD223C5F31E1F62BDD979AB1EA13FBEC86468155D9C10FE74EB

SMS_MMS ru.qbindncthv

1AB297EDC4F753B25B197CD5E12D651583A2CF9ABFC9C07CB3A64C32583CC224

SMS_MMS com.iybitkem.fymokozm

1ABF6EE66199B42670BB8FE59A2B0D061893EB33F38B0FA982D18D30437466F5

SMS_MMS io.mqnfhkbxr.ldefbbiw

1AED3B617BED4FE69E9D4741C0D429A6AB9012BABE0F45965337C1B08174E5E8

SMS_MMS siehljdq.adern.duvbptx

1AF969694903B8FFA6354ED30781CB22A3C35BFD92346947C90E3B6F6B539C4E

SMS_MMS btivl.nujmxycv.rsioavpl

1B38FFCAAD86A4368A63B4D59C72F1783B8A85AC242F072444E3BC4AE729A7D1

SMS_MMS gdv.aua.jwdi

1B5267385A7557D42640A3AFC53C06137E2BE13F6A6BF7208E1A82C8046127D4

SMS_MMS com.kdmkumi.rzjbwnzp

1B70E08CFFFB096EC203C47D2FDA43486C409351CD7B5AA96ECC1FF1E632198A

SMS_MMS vve.tlfzbczc.km

1BA2E3219400B27B1851AA744681B656AB2B0 SMS_MMS com.trupsao.emgceprutz

Page 16: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

75071AB245608166E7E4866ACF8

1BA8C492751CC0FF1C2DD191C2E4309434FCCAA06C13337DE397E1AF98B6BEAB

SMS_MMS com.mivhpxhut.afzceyiwir

1BD3ACD284E77C9F9A523A6FA1B8AFCE56A74B45E70EDC2B727E5519AA130109

SMS_MMS net.qaiwkjtlwwf.agulljitbw

1C006058F88D3F771F976B84AB896E81E0ECE8188F3436B50A575732DBFCD5D7

SMS_MMS com.bmduxbcd.uhfcnxke

1C050161670BF434C08BC29BECB681DFC133DB510A927D42E7330647F5C79B77

SMS_MMS com.snimkjwhj.qdhdorzqdj

1C135FD98699133B2BBDB3A42F1524305C80AE53558E7D8EC71832ACC80C9908

SMS_MMS gos.ikzgnakzsa.krlc

1C32A5836C14DB3286AD6A257421E9D6D980D220196DDB8419B2212102698F73

SMS_MMS com.zedxdkc.mrhsygsje

1C5B9C515448FD4D17F7005639614383A12882C60AC82303068CB503E8EB66AC

SMS_MMS hea.sbbmw.vpyjwnk

1C600FD47DEC5BF90A495D9F4381DB62BC424D11949323A80225A0CF9BF0D9B5

SMS_MMS com.niksrmjstqlfbn.cknegegmew

1CAC7962A4AFECEBCF79B43505E658B4F3E153D2E5A8B4807FA510DE4A25C566

SMS_MMS fsn.wxru.ptl

1CD8CD7509322E72929805F0BA0A3EB52511E5FB226C4CC9C72D3B4430FC994E

SMS_MMS com.eghxu.busqw

1CE75B92210ECE0CC08A59F701CC2B2B19287BA81A6E7B4097C1DADF790D8170

SMS_MMS pueyan.tqiolzc.dukcofts

1CEBD3601E104F6B2461CEF66B48446D278FC749137F7BBA5A3E816BDD1372E9

SMS_MMS ru.qazvbrnhhjdm.byfsrlpulr

1D076592AB252488E6135948BEBA5BBA7648DCFE7285D4C07F4C38C4AAF42BA1

SMS_MMS com.vcrhb.vjpzidbsa

1D33C258A9847DB96B2643ABF07210A080154D4CEFECBE9DEBE9F4E414F36C2C

SMS_MMS com.aztmsi.vptbk

1D3C3D1F021E634E0FDC858FCC85466E85D90A11F9D82AC9C386993B2E9284D2

SMS_MMS etzwf.ykoxduw.xvnisuq

1D5FCDEAD34AE1E172E9E4977AFA73F49CF7E41248F322673B71CB9044066F8E

SMS_MMS jcq.zujgftei.ostbiobqp

1D8154555F86FE8283EFD7C99E52479A82DED141847FC11EBE0F01F37EED53AE

SMS_MMS zpg.enudyln.lduarbs

1D8B51062BF0E65B3482A3F41F10BA253227DBA3139296CBACBB92172910FF55

SMS_MMS com.shbht.deqetezput

1DACF3FBDB7783716A660520554BAE1734E89803BB44EF3439E7E4B1F84415F6

SMS_MMS com.tdjbuia.djxdncam

Page 17: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1DBACF686F5527A30CEB8EB5C1CCD7E1ADC5F2D23CEDED06F43ADA67A5C2888A

SMS_MMS com.bot.suka

1DCE8DC9331A2E8B81076800F93516A55B115D21DEA48C5EB7D2CBD34185FF0E

SMS_MMS jxfnoc.juyzosq.mbndcfu

1DD351D274E6CF045D60A7DA07CFCF3AAA7AA74D87BEA535C4F88EBDC453D91E

SMS_MMS com.jydxdgdz.zejtozox

1DEFF56850765CB3630B8A2425CA0124916E55D916122275A66158FA811DADF0

SMS_MMS qxsury.nfdoz.dxiaewn

1E15E7C92A7A638AEEAD8D59D20DDE3F5D3D34F3CC301BACDA2B7884FAE3B3E2

SMS_MMS com.ekykr.wahakt

1E194193978D51AD62FBBE0836E544CAB322F59B0718F522A7E88B7189A32803

SMS_MMS org.yqujsbvsnkk.bzmpmkdychn

1E2C5A2A114DF3A43C5026577B9E7FB1C639839E929EBE794296286465E1F3C0

SMS_MMS io.lnogwbeiok

1E5870987D7446D95B55B82379EBDE0E7D9DF03EAE50EB253FE8C9262923FCAC

SMS_MMS kwumrij.rhbkjp.ugqvwobi

1E7363A4A1433CEB1285083DE886F8F99BA2ED4F7BAEFEBE7C9FC900DB24580C

SMS_MMS com.vgngomtcvj.yfemnbpz

1E75C93A5C3EA35BB43138AF80C5515227A5FD38D1617199B75A9D783C17CBB5

SMS_MMS com.suzegbwd.anacgwd

1E9BF3797DE25AEF8A52B5A71B634176C02B625C36FA0A800022F70326C2259E

SMS_MMS pbfid.mixkb.kguotvl

1EE900BA551B845A3147EC73D3FBA8EE5646526EA4A3097E1832ED42ACEA9C58

SMS_MMS io.sykhyoxixu.byugxhgiqwlwbcc

1F4F9D49CDE207D49922AFE039E3EA098BBE84C29AC79CC7772293BA116CDDE7

SMS_MMS com.valwens.dfqhiuciw

1F5634255A9C6EF2A9CE00A6335B903F8612A674E338CFD67EA04F195E789CB1

SMS_MMS qqg.zmy.aqmdplpzql

1F6C787F2C2AFFA87C2509898E453600BCCF926329FF3E83F05AEA9098DA738C

SMS_MMS com.twanpwufb.tutpy

1F94E4790AFF251C6219038D8607896D28618682F5A4F846136EA40DC636CC00

SMS_MMS com.ebuwuw.kfnom

1FBC7E5B3C844A1D2B17B20E0A900CAFF372A8DEC0F29570158F5E2245C11ACE

SMS_MMS shq.kkwskh.tf

1FC5527208DF9719F7263C7737FCD4134654052B55C1715FCE0B59657403D744

SMS_MMS gvhcnazu.thigsapf.zsoxvp

1FE60FF881EE0C9B52709C353716F8AD2DA50EE3D8CF99F2AB2D2425C784D66E

SMS_MMS xhrdim.wpmevc.fmpvhtb

201ED09D7A1ADF95760D555835A83E866A077 SMS_MMS com.uphqgi.ofwzslbm

Page 18: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7593F0C9B70F73BFC9965D84D6F

205F52F1710CEF7DB04A6EFB94FC73DC58E8576953DB818A11863C8D604C8C5C

SMS_MMS com.awymjgcega.copabogckp

20ED145DB8B1ED57F9D2BD8D1D4B6D3FAB54C124DCD5099A11E1CCDFF892A134

SMS_MMS com.zxvciacig.bngjtok

20F0A617E26EEA18D72097C1BCECA7FB2B0EFB91630372B426C084D9CA5F0560

SMS_MMS com.gfiygr.wdoad

20FE867708A9EE29D580F49BB6812BAB7E6E17FC817CD37F81E671F11F2ED69F

SMS_MMS wsfzkjvq.ksryqfpl.plzxjhng

2113326DCF918EB3E20D10FCFA4E8A7ABE2DE841F816A669B39B1CD3F7CE981A

SMS_MMS kiasb.mpcbriz.mbvonq

2175E2E7100CDB23147F5B0131A07787A3C7ADBBE89E9F73D330317E7EFDAA7E

SMS_MMS com.afceutm.zgnwyryf

2193A44A314AD30CCDBA617BE5A8311E7017E40110643AE285973A47A4234AB1

SMS_MMS io.uwtgqsilublz.bvglljusc

21BB61DE8263E290A36A8C97118D92D271F2968787345AC74E11C7380FA80CF4

SMS_MMS com.pjwerob.pudhiwagje

21CE30FAC2A851A94E47514A3530E297577C08449C4C00FA73BDF08C2B2FD98D

SMS_MMS com.ongmtoect.nylzqy

21E6C60FB076A3E60B4C47E68D6C7471DF453480158AB602A16F27BB5D153AF0

SMS_MMS nbtpmd.dsjuwba.xajkt

2207F21EC95A2CDA5E365361DCD9B86B77A32FE7145088A4BF8FC30B34AA527D

SMS_MMS com.ryopyre.ghwup

221DC9190A4F31C4EB18BBE0AEDA949D27799D0F5873B333F8FD6AB8B3E0E3CF

SMS_MMS io.mnkkldzq.qdsczaucci

2237E0D961372276DC7345337A4705022D4800BDC9FDAB56B21586291514E92F

SMS_MMS com.ihvbq.xaxqt

224A4FF23041B7833F388C8FD020D65321F609BD99D13ADB3544FEBE62386889

SMS_MMS fbh.ihfokwl.citwuggpcu

2250BF504C7AF2DD04F8BB8A9F2D91B83F8EA004305F60B1A2D24FFA2D700E7C

SMS_MMS net.oqwbyriocs.notpoos

22AFD4582DDEEFAFBD4014961306C6FBFCF60E2415C07756676F912D8ABC9583

SMS_MMS com.obxqejoulf.vfpgngkb

22EACAD4755BD6B4C8AB2D4B36A8FE505F4316BA06A7FBE0E73588A56D70D42E

SMS_MMS net.giwvqaownv.snlxukbzpdp

231A4806C0A56D586E8C28C22536AF1D6022E6875C97A0D3087FE41BCD220D68

SMS_MMS com.bot.suka

231D2B5C01D59B6023382BA9BEC04303C747B8A7B2C4DF807251317F9CBF32E9

SMS_MMS io.ihgjpbvxlkpemrh

Page 19: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

232540623253B370691BE6ACBA555A540F86A0F8D7F4A5C8820DDFBAE6130E26

SMS_MMS com.hbipcv.wmgkjafmd

235EB56273314F46806168DE60F982CDDEE73253843AF553A806CC0CF6EA3C70

SMS_MMS net.dhxmhuwdgutucce.vohjuktmzbowsid

236156E727A50644166E0E30C96AAD18B98E14997320F88DE2633B6447AA7133

SMS_MMS enytavl.jgqwzf.iesdcaox

23812BBF85DA6850736D87CA65C6506831CD5E5032D9DBBBEC731F4E54CF91B3

SMS_MMS com.ozswbplwy.jstgawuq

24135AE38435B3E0DAD1379775746C9881A2164E721D58EB79807E3C2493B229

SMS_MMS com.rdjdzefgvm.mjvkb

2415134EB1A99E230C434CF87DCA7C82DDD76C53F60E371EBD236F0E6531F5AB

SMS_MMS aekysnwb.defgjsqu.vkxwjyh

242A76A2CDD0FDE30FCBAD447C8CBE805CE9AD79A907F38F175C31B4BA76EAD8

SMS_MMS nsq.qohcgyqc.ats

2434B360F6CFED2E85C6B13EA73B9F517287982CC69C35665906FF7C4D46E9B9

SMS_MMS osnkbz.jotmew.jinecqh

2439312CE9B4773EEC8AF0D805D1C721FCCBE88A07E74DB2B5DAC0F59F7B1B3B

SMS_MMS uot.lw.ftfnsaad

24735F3DF5B24498AEF44407B5B8398E1665C3AC12A0D45BE21969D3EE627292

SMS_MMS nmdshb.nauyg.yfgadpsn

24B8A749FED68B5A9BEFE1D98B00D5A3F66A0F121B2B94EFD0AB1148AAFCBB9F

SMS_MMS gvt.vle.rxhr

24C08CA444345A37819C3372DE79569DC379632BDC37D0EEA64485AD76A90712

SMS_MMS hkzocu.byawr.wqyrj

24CACB9BA682A10A387CE7AE8F9A04D70DB2E7659B7DF43832D1D586E878829E

SMS_MMS qxbjge.qkzhoe.qeblkuf

24E667C728C3F26D4F000B13B344039D046E2BF1F60D3281E22598ED8D0F70CD

SMS_MMS com.ufvwawgxoz.oinzspjhq

2558C1D8B238D75001B94AE1E9ECCF21355E30EB25463FC390511E249ADAC2AD

SMS_MMS com.bot.suka

259C512A60BED61D7699505B8AB52F22447D5BE47A50C03DF7B5F0BCEA38BC3D

SMS_MMS ioyrf.ylckuwis.xdopnzi

25A91E5CD016C47A8CD795073A8BDA03A8959093AEB0B87D64CA855EE1BCDEA7

SMS_MMS ckreoj.gcexyst.cjusga

260BE6F2726417A3C6EE7E2DF9AF798372EC5FB7743B965EEE1A21B6AF2F02A9

SMS_MMS org.ebsyumwl.jjfzfbhvsythg

2637AD197FA530DDD2F30CF44569E24DE87BD76F456BE452699281FB1EF6812A

SMS_MMS efq.jwygd.qpbiqzi

265373FD3E2215E5213BABD4C2F1C09D961D5 SMS_MMS com.rmswmj.rpyfzkfnb

Page 20: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C804CE740C55F49BBBE56F201EF

266B66E92FAF25EA7F2B9DFA0628FEF9B6C3746CB3E981F6D991695AA726F53F

SMS_MMS com.cydtw.rgpuqvq

2675A60176893A442F7B18EFFE4B759AF7721D810A750FFF1124063C8238EFB5

SMS_MMS com.qznintr.vhaobnfe

268A97A6D0B2742E75AAFFFF6CDAC1D850407762C81E74C77128058F4E93E027

SMS_MMS piydzatx.akfxbml.osgxhtr

26AC4811AFC65408156EDC633C0C6C1F87D9BB7F03A53D630B190FC67AE10228

SMS_MMS com.kfujqkwc.bbiqixmewaouu

26B7FCB64882DEDF69A3A8B311689D6E856ACED2FDAD5F7FC41A2BD65EE05F2F

SMS_MMS io.llxyaxc

26C0B60268991EDCBDA6DBCC2FE5C731CC762B0FDFBCDBC1DC4593FA545BEEF5

SMS_MMS wwo.rxprk

27146B445F72551A158B19D21C5FB8EA32E151EEB5D56E326083708CC0F6C815

SMS_MMS ymfgizx.kmvabwd.upvija

27360359BE0EF8915DD28D95079D5DC256B9D0FEC62E5B9EC0717A72445B9A5F

SMS_MMS com.bot.suka

274A8F39145E420B72CEA79B3D846288228F59E502029909F7F60C44415AA3EE

SMS_MMS com.glreaq.iavpah

2764C6F94185B6327D23BB0866E1FB759FA13E874E02A479CF73C5F443F6E931

SMS_MMS com.zuinzjfko.ghxebo

277667050D32C9B8D36DE36D3BFC70682AC56B85FEFAFA25F8F10E4C9D77DB19

SMS_MMS com.ysinvjrcw.fgxqjdqko

279995000ECE2925A360E6107EAF2551D029AF7AF479CE20F1BBD268C4644FB1

SMS_MMS ygvofnk.bctzedm.zhkisnfj

27D15D9F2ADC9486ABBF764AFE1FA2291A7A7AA5D8359952D295F54CBABC50C1

SMS_MMS com.oesiqjq.lviykgxgbh

27D692D7289833B4B6B763173F569EBA547A382AB0BCDC4CA5D7FB2338B74295

SMS_MMS com.rhnav.shxbsjtizw

27E75501AAB82BBBC745F78ACA8899F3503AD36934208343FDF2998A54C683B5

SMS_MMS jsq.rf.dlaohdd

281EDA84646CCF2B6EBEB9DA6DE1FA2A5CA5637C671EE793736BCC7F24CB3028

SMS_MMS whs.ledrqhassg.jwvyi

2850BE45DC222D493973EBE03267F7C21127E2C196DA9518701DE1E3C2F8D165

SMS_MMS com.exmxpakpkg.gsoiwzowq

2864B3427E97E8A6C30F96589CC45B2A435019852D2FDB76CB1D5D9CA4C23DFF

SMS_MMS com.uzmaimb.iuetclnrql

2872AF045CEF22F05DECA714CE18C665DCF6CB6909246CCB8C4BECD3EA0B086F

SMS_MMS net.tgaetnla.vhoksqkaae

Page 21: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

28B641F00F37F04A6D81D2F037068FE0C668BC37A417834E7304FD945E1258E1

SMS_MMS net.ubwtvtpuop.cwozpgfpgp

28D0DA5241F4241DC84AD8B3C3A908DAADA07939BBE20DB0BF4644EC2C8622CB

SMS_MMS qtxdv.ezhubrm.hgnfzu

28DEA3E749D3E21530C8C0C8C9827B33E8FBD8E3B1873E502529280B01B79A3D

SMS_MMS rla.qirdxvpy.spzmss

2903F6664902060960FF208EEC667CDF796700B52FBAA428A287ACF4A79F2D23

SMS_MMS net.iuthhur

294BB7217C31472B167FD97F5E16051ADE48246F535C92223C19F0721924F25D

SMS_MMS bbp.qzryhpu.fvihjbxxf

29AB01B7BC7BD87D5B6B29671CF8187FDD163C40B25D9C01A10BB65B232CAE59

SMS_MMS mbf.usfnmkmyyx.iv

29AF7CC70BAEEFAC4072B17EB7FAA6F80F69C10959BB79646577672BD96AB54E

SMS_MMS asqbcfr.takspvc.gujsk

29DF7333F50D6E9FB595EE0F5360ADD5E63D2C60D2A27077751DD33590DB9EC8

SMS_MMS com.ufgqm.wlhouhqp

2A067F59CEEF50DADABAD1B14C4A6386C77C1E63A6C880D483BC3DC414316AC6

SMS_MMS vuhfmqea.wrcbf.whdtsy

2A10F88C1E25DD913FD61A98D44F3DF3750AD13224F5A0B2A8AD97E9052FCBA8

SMS_MMS com.hvwqhufv.mozgnzrou

2A2AAFFD4C799923A78314E2550632257C0D82260D4BE3F5BD836E0B60EE3F4F

SMS_MMS lly.fwx.gsjdx

2A2B5C1D89DB546F2CD7618D78A2E34CDDAFA726EFEBEC97E3A4E10F60A7EA6E

SMS_MMS dcibtxeg.dgzujk.atsokzj

2A3A1566B0B1EAE5E0F483B2719D44F7D9616D443D8756A7C370C41BE223D33F

SMS_MMS com.hjfgxmf.xjnzjinbpf

2A4B9BFDE5D1C68E2E0F06A66F2231F8F39BF4AD15B1142433E4F96AFED95611

SMS_MMS io.iexiabo.qbaybfwgbefbct

2A511103CFE21D612576D0FA6D228CC29A251277884A4D01455FA47278728471

SMS_MMS com.ibdzatn.yimvfxwdao

2A874EF29B52BA09091242D1D571A14396B262C3536E9C4E9704560DA77FD74E

SMS_MMS asfuwxml.xwkep.kgnzi

2A934E01D0613CAF232EC0253099521A2147E4B186267820DBB38DCBC29C5446

SMS_MMS net.njhstzookssg

2AA159EE1B34C56258D487EE501DEB176DC14B9CE9A9254422549356368F2F5B

SMS_MMS msxyz.jgdsqwfk.ourei

2AA8A1956A356E3BE6794232A7C608CFA26BE5B3DF0B24BB6D127F641BF94CDF

SMS_MMS ceplnft.mgjeu.kvjuyw

2AAD3E9A7925FFAF76FF78FFC1F1E9CA2F1B92 SMS_MMS com.iwpecjsls.pwugdaz

Page 22: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F4F94BF54148153E5A5FEE4E95

2AB24EA6B7ED267E0923E0EC37D907A9475BB2094F4D38E97DD925D206E78FFA

SMS_MMS net.mkdkmiwmnvsbd

2AE7A87D4B1C90DFB547C25551FB233512D42174E7800D30F6F1264E71C6955E

SMS_MMS mss.yejnfm.yiztimwoz

2AE92222B3FFEAA57421DE13851A3F5FA572E44AE136FF2D4611B07510C31388

SMS_MMS com.fmwliovsha.rlfkfaja

2AEF8D8780D1B45B4FF7E908C3A886D705588D80F592BD0F3F2399767C4FDB11

SMS_MMS bth.sxvifkhn.yafy

2B2BA818E60243A66D33DF53F12DB1A1334B74BB8421E50E109C3247E11B4BC0

SMS_MMS com.dnubzmeyxg.zlowedkyo

2B63ED4CA35FA712A12D3177F9C505E277D207C54F3C8ECACF80D0710EAE13C2

SMS_MMS com.jfcsudanh.nuxizxqeg

2B702E49932C5C258CD73F05CC5AC7295CE852C6C05C0944D3C36618A9555806

SMS_MMS swfadjv.hazctu.ijdrt

2BAB1A89692A06CD65A2A66F399C398BD1B7A5036EF725294D2018F6B450CB3B

SMS_MMS com.xjydjl.fmtrprm

2BC0FD0FC01DEE15C6651E4B4CF0A9B4E998AE3ACFE4AFDADF33AB92D73F1969

SMS_MMS org.golhyjv.qzcftwvkab

2BC205F075BC7B1B135D9DD8A924FA04F1C95166B6D8D47DEC0CA0F2DCAA7004

SMS_MMS ngxtf.kdijf.eyalwn

2C52F666DB9DAC1EDBAD27F097C8D14A5BF7D1EFA9CA127D473E31ED46AC723A

SMS_MMS com.rjsxq.nbxsfxzi

2C5EA5C71140657EF02F013AF966FEA34EC7099E07DA3753C6468551754984E8

SMS_MMS com.sgiljhdjoa.voenvtynth

2C723F5D1C8F755AA6916B1593EA410C64B9BD293495740DEE3D3DEB5DFC2ED0

SMS_MMS ypqsnb.roakqml.qzknh

2CAA6E662CFBE52AE22938F1A37C6F2FFE6A931E52F287452926BA7157DAEE96

SMS_MMS org.ypkjaqfl.hnabcevr

2CAEA6B38208589C18C59C88E222F1E398B9E697528C68382E5EEAD5DEC7572F

SMS_MMS com.indhchclc.dzxjybdvgibrpa

2CC6BA8017464EE48FE074C5D4D980F121BD87D64E6D3405B7BBE7E064864387

SMS_MMS com.snawrtbffukziru.uqmjptt

2CE733042861940EEF4B570B764FB68850B7FA2E0D25348F3035932BB0C889AD

SMS_MMS com.zwcnvo.hcxkcwox

2D22265E8BBF1BFB90FB1E8338E26BF468F4C7D4075E4B0C424F2324344C6C0F

SMS_MMS jlprn.cglzyev.ymsvft

2D4A785CED38F7B36AB8AE6C35A1D0CE0C30920C6DD19F2DB0606699743505E2

SMS_MMS com.dpktvyjp.dldyh

Page 23: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2D6947B370C1ED4BE866CD801BD1B5310FFA789BBE21C24F69B9A7E3BD552FAA

SMS_MMS rvlxcpj.kqaectnw.stwlfkdb

2D8CC454C0634BCB3C9330DA08D80A82FBD27E187BF87F92057484EB27817822

SMS_MMS com.ghictygthp.sgdawgjgkv

2DBA3BEEC809CEB6C860CC811AEBE1B0C2572320ADCA5355A9E532845141404E

SMS_MMS com.nbynaz.xtmfy

2DEB7472F6B6958F8BBA51DF4D874562D595A6B8DA66B4170641F879F9A265C2

SMS_MMS jshcvz.rwfkay.nfpzrva

2E001A97FF301ED6981C32B3870112FF6C3803543E2F0F5A6BF8D1E5F895015C

SMS_MMS com.vzytpnbaqs.mxbtq

2E14E649F94B2A7820B05EC6A9FC6DD5F0EAFBDECB28D1A9C39FEAB0989E0FD6

SMS_MMS com.zplhed.soduih

2E2E7ADFA7B5C048183F7DE275ECD786B6E15007156EBC8392BC81A8E06CE0C5

SMS_MMS rmj.wgtcloixs.noqjrdnse

2E314A690F712072ECCFC9D7751E6F5FC4CBB6781F3C54007C316EC0AC5D16CC

SMS_MMS com.nhycjw.ldsmte

2E451A339F93D6824B83AFAA4199FF9E942435430016FFA11BC2B4985051CFE9

SMS_MMS ray.vmpqaqqas.jfyvk

2E761D8788EB8946310D660B6C0069DC6B34C843EBF9A4FD90B8C6E18DE7C95F

SMS_MMS aow.lzetd.im

2E96A6858686CA0CD59967E241CE1C4DC1F8191164041AA9622FE21874E910E6

SMS_MMS zeycaoj.gmtken.wecjmvgx

2EE9BBE3039C17047009A6134B6A617FD10C26A565CA28D06320CD9621CFA9E7

SMS_MMS com.gajywtx.oisbwv

2EF9B0C6E62DC25C281C6B3762D904DB99420997163693E63E4B591E4DBB05BB

SMS_MMS com.vaecsb.sybjga

2F156477CD26BD72E057C906FAC8C4DB2406BC1298CA87521F165EDD00B284B0

SMS_MMS fwhmk.zsvliqen.jovzgtk

2F1C0F35FA903028289B4BC26A39F406EB05ADEDA1BCD02A959C7023E38F9B93

SMS_MMS igxqy.xphnz.emaokhlj

2F31EB6D4887DC8D1CCF3CF44754008F11F7739BFBF9B855E54F1692576ACB0B

SMS_MMS com.kcvcaotmr.wpfoedt

2F4AB615AEA08D2A936CBA53B625812A5C509683EDA7FD3899E0FB273A08F2B1

SMS_MMS vtziw.xtgrqnjp.wagzhfor

2F5190BBECF8333555BCC51CFD89040C8C56CF6074671E3F9D55D7EDAA6C0E8E

SMS_MMS com.tvqiokdsou.hjhonbvwqx

2F51C5667BD60705498E700988C7A61EAE26F89A475E5D668BD7F42B3C151FD3

SMS_MMS pej.cxtoy.vr

2F529BD1436AF89AD8833EDBAA91EC2E6C9F2 SMS_MMS com.ngcps.gsrhtvb

Page 24: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A7EC104EA7C96B4BCFB8A4B3FCB

2F5B37867E0DACE6AFD48F697C801B6DDDE3970CFC235718BCC96E619032C98D

SMS_MMS com.jdwtoqcao.syhdtexec

2F6AE4A3AD475BB3DD41816A475922D63D7D7D2E1724BC3B507D644DB76B3A1E

SMS_MMS mwpfba.dtzsp.xludvwom

2F94908910B81838A990A09A083DDDED0E6D751302FAD1F6FD79354667C2B060

SMS_MMS com.xguqvfemf.oyvftd

2FC0FE43451AFEBC42B0AAEA4BF092708C463FC8C1232F649E0572751C0A3C14

SMS_MMS com.gmuflrlmyk.tljxaq

2FC3FDD71D191189595DB789C7DC004DA6ED133543C2FFF5CF3AEB353A7A4C1E

SMS_MMS com.twqaieub.doexqnv

2FF0A5FD4BB043B6E86E540C829997D90BBF2092F44C855ED0C1F44ED2C0601E

SMS_MMS com.wkyxhumb.ebvzgmtyq

2FF115B36E5E1742A2924CCF3C34C578DE3124AC5091DCA5ED75287FB32A95CA

SMS_MMS com.jilgevn.zbmsrrvohamgt

300AD7A07F8E40405A882FB98A246A227A16AC9C57928F4F46DDC55EDD57E6A1

SMS_MMS mfhui.sjmyugpb.nsfdt

300B19005DDCB356DB4FF43586BBF28D76145C752D82BDFDD9744782A7F9DE22

SMS_MMS carwlju.urmzpevx.fvrig

301B42ADE0FC4CE858575FE9E488927ADDE91ED18040CB279963CB6EFDA2D373

SMS_MMS arf.vqdeou.dmte

30271E94EA6DC673D0C832CD8031BA2C8421E0CF81CCDF69A98114C2DC968847

SMS_MMS vvx.odxqgwqsb.bkfb

302A7CA5F84FD4DB079B2EEC4F353746CB372DE04D83CE6D0EE6FD45DF5368DC

SMS_MMS org.alnxdflls.ribienucafncrie

30353B92218A9135DDBDC2E535B895979AA13ED2026250B8BD9A7255623398CC

SMS_MMS gom.ccvogfhn.niafjf

303952BA77A0D81B91E68F3B1971BF70CA0C56A1DC7A4E3DEF0FD271D92F5157

SMS_MMS org.eoqopwz.hwywhnzwavvl

30555B7CE7689462671FAF29AED77154C6974A0A1C63B7901AB25345B414311F

SMS_MMS qaf.xstmdhzu.rrffd

306E277E3C396D78CB02E6B46C0C28AE02FB6EFBAF69E98CF8F6FC68B88C1ACC

SMS_MMS weobzdi.rqvbldxp.eiktouxw

30A6B663A7503361AB8ABE52926B674DFD276781D817547E2A8AEF3236F18203

SMS_MMS mokzjt.lxwbm.vgabdo

30C058CC8754A075E7FC606CE985866113722675928B87B79C2F1C487081BF36

SMS_MMS com.exsljmapix.lemxu

30DED7572ED5FE1F78BB5CF0F7B1F78B2EBE47B3923D39BA8564CB41A76399F0

SMS_MMS lksmxt.kurpabj.ytqgmfcr

Page 25: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

30DEF7CC5AE7574309E694F699AF47AF7398000925138AC2EDB81EC5D93670D2

SMS_MMS com.cuntha.mwonqa

30E568D5AD18370257C06151FB37263936BC576086D59E929C0F50D977250C97

SMS_MMS com.fvfhriu.lsptk

30E9EDA75CE6709035F04659611C1917334D70AC3EE74CEC6E149E518FB99E1E

SMS_MMS ktx.lhjwfki

30F98D8229CBFC35503D2F7AFB457CE2053F134466C1808621C24405C233AD51

SMS_MMS com.ckpkig.dewzh

31052F0A72325281C71053AD7956FE176A5F05D61FCE9D884073E0B79F00927C

SMS_MMS com.ihfumgxr.sblhzmqp

310BFAF1CE6416953A2641AE8167BB607450155B65356DDD9C484A6B6B927434

SMS_MMS net.qbfduzfohfysv.boekksifpes

310C5733AF1DA4A637CAD0088A16649A8512A7E85E974CED8EE1F0DD5667A76A

SMS_MMS uwm.wizbsaxxm.rgxb

310F9BEDFE914573BF14D29CDA3750894A8FF576B4096197EDE5F033ED3DB5AB

SMS_MMS lyp.ltzjo.jwbwp

3114F09621F99079628415E6D0A356E831BA7B218107CF75911FB2054DF0695A

SMS_MMS wxkpzlju.ywqzvi.jtsmdlzc

312DBB49FE61392D8C43334B564FBE562CEE7F59B82C38C418C5282535D54542

SMS_MMS jwr.cjxo.egrqhr

312F73F66867CC53D081CE3C0826B00B546D810B572361729969D5B22A6D4289

SMS_MMS qyg.dtsxvalg.osvhstqz

3135F71DFBA90ABC4953B67C233FF3105B0CFCD1126273E95D1AAB134B0D4F46

SMS_MMS com.ucywgfvn.jljtf

313B1BD44EEA2E341033F458CD276A63151795B6B012303352AD7D5268B4B61E

SMS_MMS com.gcrcjq.mnielkuiv

317783E896BD79A4CD271CF407714BC9808AF401C06BA6765F84258C134255D3

SMS_MMS com.zekgwqt.xbrbt

31AE410C51F6B9B923C83CDEB7D9FE754F41BB309B6D01FF313819879019C60A

SMS_MMS com.cnwzqwaw.varvhmkn

31C4AAC1017A9C76DD7AD5EBB61794EC61282AAB3841BB645E36EC10005B3C67

SMS_MMS god.oiqkcoasvd

31DD842CAFCBA48DB224A8D0F00199BD177CE8340399B908BD2366482BD37873

SMS_MMS com.onieewvhrsglzf.ikblzvzrthyjn

31E170C51DC7636659AE001449D38AF0A3F6D5AB15F388AC4A544FF4A14E76BE

SMS_MMS yjr.byaoerk.omlrsyqtzn

31F1AC7937078FA15EA76B2EDCEDEC747F40872FB0A53FE01AA7E6FD3AC44CF0

SMS_MMS pby.olxelrw.llwlwzgh

320235D3D32C5E9308A4843AC09AC04424612 SMS_MMS com.hbfid.lmrxjf

Page 26: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

21538C83E4D4693D1800C52A036

32136D7695DB18A819956E6BA736E788B05E5ADAB04C8105A405F08F149BD45F

SMS_MMS snbhxl.ptgdmabu.vhzns

3233F435D63360CDCBFB5F8BB33FBD31DD79A25661681A01D6A86073C3D4A0B3

SMS_MMS unj.idr

3237837DAED44A8D5E7901758F2AD1238FF8147DA809BA484079825C53C5485C

SMS_MMS com.wpolkcruze.dpxikjdte

324ED71B3A68A2DF08607D1D2EAE008A882CD46EAE7910DE79C335857B1B7421

SMS_MMS com.lmkstn.sekzko

3267077AC2622F473A3C1016F272BC1CA8EBCD54BEDD53A09E79AB282D2FB57B

SMS_MMS lbhwkg.wunisymj.tmcglips

3271460471A514E0C09CB9CB08C1CE4A8565609DF5A266DD7BCADCB735B28C34

SMS_MMS wiu.vekmkmt.auu

32B35109B3EA0C8BD436D89014C5EA44AEC82DFE4BC129114B06446F174D0F9C

SMS_MMS com.piwrxmhw.bkmbvgwuuqnhz

32C3943AEDBAAFC744D633CA345FEF5E660786FB48C27C4E106FDA529CB879FA

SMS_MMS ivv.jtfro.jpyphss

32CE2FC11A255915BB188157CFF2343D2F86BEB41F5788EE766B155C27F30D6F

SMS_MMS com.jpctg.trars

3339D0DF758F2911F3DFCC56341BD7AC0BEF3139A2C32F335C3705CDFA4C710D

SMS_MMS com.jxrhotvgy.yzaedkhry

3376DD83448A97BED9E3AD0F5A8D9DB1B2E3E82E81E9B1DC8623AA9104350045

SMS_MMS jedouv.fdilasp.fporyki

33844E22552A0EECF53320753665572ABF47B1257DAC59630C57A764ED26DF06

SMS_MMS maipn.jzsykc.uoajikxb

33943F83A43AD396D23F0B2355CDDE23E222820E6D2C1338AD87F4086B4E49FA

SMS_MMS ltorvdiy.kbxzw.scpbd

33985D9C8FFBA9A56EA2375D0C8F467545F867B0426D0DD3E6827F3FB9064ED3

SMS_MMS com.vckac.psugknhcp

33A5ADA9DA5189AF725ADD5339C3E07951CE6AA1A8BFD3B23D22D713BAE90125

SMS_MMS tpx.ei

33C20CDF7331DB2C12C5B5EBEE48BD492F55A4D66B13C411D75A730346C3FE31

SMS_MMS net.hwqpeqfr.sooupcphdfprpdw

33C888B4D0E8B75DA5CF021D25482830EBC6A1590B341260DFD02AE7C8BFDCF2

SMS_MMS com.axahvxaxrk.gdhdo

33E1C31A0299D9999E0D672494C4E8E4E4B7242EC3905704152E5EAA2BF3988E

SMS_MMS org.iwubooaewhuadjr.ebhzysisakregyj

33FCA7675B211DFE03965519931C36D2AE124398F805B9B92A0F706B00B083C1

SMS_MMS mkm.qqqtssrv.akfbwlhjnx

Page 27: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

34008425DA81683BFD17B5FDAD848174227B111D8E4F838FEF091798D8B8E16E

SMS_MMS com.hxqjqyizdn.danrmhux

3402438806F87AFFFEF5C02C2C5F07ECB6CE019BC07FCEE383DAC4E851E684C7

SMS_MMS ru.mzaozbqwkp.djpufwxvjseuah

3406B0B6CB154673D47B7539FAF95F1341F5327D5AF99C16059DEDAECD253D1D

SMS_MMS com.ngpsjwfzsg.mziksxaz

342D8F40BE8FAA3DD3E2C3C953590A3B29F402B577F10C703B10BC6D55D54B9B

SMS_MMS com.evcelmx.zfpyiclch

342F6A77CD8334750C99A9D226C3434199606F38106F73073CDDE794471359A2

SMS_MMS smkzbetx.ygcotrw.nitvf

3465C8B84068A21F381BBDCF308821932511A09D46BC11D55AB6A08A5FCCC5C5

SMS_MMS com.rqzsmve.grskqpig

3475A0B5CD8922083B0438D824607B80D03A2DEE9A718B88EA778BFF4B4615DA

SMS_MMS ru.elhsaqmpqafsy

3497D27E4E1BEBCCF1A62BBB034CEADF7EFD1F3569B801DAD9362D7E3BE118BF

SMS_MMS yin.vmhxyddpjm

34ADDD96AE4ED2A23966DD062142FE3E3DA8C42C90A1F7FADE3DF3A5C9CD5A8D

SMS_MMS com.mxusmgprws.kjkewksf

34D48763B990B7CE50D30FD54B7770F804BE4AAAA286EB5ABE7CB87345D78E3E

SMS_MMS com.sevig.nlkcz

351836D000CA946281316054D996115A73233BCDB243BAB1D0A825AA18E9B813

SMS_MMS qfwordi.qwzajtb.mgtcbh

351A14CF38F2502BF38D924B9BC7C4BD41F7913D525F2E166D2746B6CEAAED88

SMS_MMS io.ckecszurartnc.otbohjtimlrk

357DD1B1E8D82C42C8D7627495137DBD413BB4E652D125D7053518129C33D484

SMS_MMS com.zpvnod.mcdpgidl

35848731BF3EA322071085BB37536FB3F601B139936DB5F26F254B0BD6669135

SMS_MMS com.epwurd.dytrsctvt

35A903C50ACF0D92D09C573B00CF6C0F768B45AF92854EFC30C0864219DE5D05

SMS_MMS com.rergdbdji.mpmag

35AF48CBA4797CD2B24101DC6E4817317ED0272A13EB53BF3BEC2188448AD533

SMS_MMS com.lsrtuyuedn.wmvzm

360CA626EF9ED4DC15EC44686DE1D02AFE3FB9BB0C1588E80F6EB0F1346E98FD

SMS_MMS com.xgxzmfd.elqmwoux

3657A9BDB37FC2A47A6907FA1087ECD7C62F9261E642407ADDDB98334DE2DA78

SMS_MMS com.vsxdmfbvo.ykglfz

3671A9480F40A3E2E8816CC5B36A457B6E4E78BF92F66DCCEACA8D6B16714DEF

SMS_MMS udlbfs.rupbysvi.jamrpyb

368E69597ABC28780FFF5888ED8C64FF8808B8 SMS_MMS com.lecviovgbv.undkxoyuru

Page 28: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BA283016BC6568523ED1D39A33

36AF7670648DD69E0D55FD5FD3811D4D6DDECD65DC00C876298BA04CD2481F78

SMS_MMS net.ljckeltnrellnqm.htoodldrtzrtjog

36E6944253E32DA82DC20897A2127521A7A3BD8F898524E017C87BDD59718FB8

SMS_MMS com.wbfxpxpm.pnyhzpvcbp

36EDEEDD7F5F42E872A61AB8371E02B96EF3169102DE0E065B577EC700E8DE26

SMS_MMS wmzil.lmeqyhvu.dilohytp

36EEC435D4BA36B6D4F49CA519F089349F20CF0C410FF539B7554F8F9352750C

SMS_MMS com.hscjxp.cjnplb

37381FEE359125B32DB0AC4DB0BB57645E852DB2C5F8FAA35991B8BE50DA00E6

SMS_MMS yaxbg.orvxc.knduslri

3742FF8811CA112D111781EB40BED08BC01491BBE6D15F37026A4903FB463E89

SMS_MMS com.qrzbqlvx.osrpifl

3758A1AD3A9520B4461E096CC7F5117120CF1890B934C8968311F55E4C610AD5

SMS_MMS com.czomsg.kawvbc

3760CEA41AE4B18EFF559F9A49150671CAF366050F201EBD984F73BADE7072AF

SMS_MMS com.abocjlns.tdlbekfida

3775E79A549984B9BF87F8E64BF5B1ADF7BFD0FB8779A1ADC7D35253BDF31775

SMS_MMS com.mkcrigm.ewfawzypty

3777261CF8BF91465F12E6359AD3457950E8BDE1A88BE06F2D663DF762BB0201

SMS_MMS net.slolkyjbl.enjtjsixk

378D17DF4730AF0CBC11A26D66C267BE60E8D96A78B487D760AD3089491C1255

SMS_MMS com.lgwxuesboa.crodtu

37D5FFE36D752CF57359BD2B8545B4E6901570F6E6F6D818ABA6945D8D695291

SMS_MMS net.kvwtacekctvb

37D81C23E54DF859225A57B869043A39F507E87084659393ECF4EB1A4818BCE4

SMS_MMS com.wutawu.niykewea

37DC51F171E108F53FAAECB0841F4CE3B5AB878F9B6C1B0998A9A04DA05D0A64

SMS_MMS com.dowmwlxkau.hjexacfhzm

37FD321F42E546005085ACC9D07111F15113D3830135C20CAE5383C6E898A521

SMS_MMS com.msbuchwxpf.qmdvite

3816879A6F0B8A2A0EE55885B7CB4BACB16CB2E14EBEA352D87EC791480B3B62

SMS_MMS com.vgrkl.dwtcjisgf

3830B3CE9E3D60795C1A6E9124BD2B634BB4BA683505442E6772D96496E2AF19

SMS_MMS com.tolctpof.nqbxrtv

387644A51B37DEB61E0AFE532216326263A8DE99A671FF0BBCA8A473AE0E2C28

SMS_MMS ibned.sebag.utlwvc

38C6D7C3B7474C9EC3EAC0519032D8D5D4862EE49DB1263A90D096305D191169

SMS_MMS qgzvatpf.yumfinkg.xjwse

Page 29: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

38E5FB2A31A9A7010755A1D62073ACA847F2AB11195E450EB00B9C3C93CB72D6

SMS_MMS com.mkjeinkxdq.csruwlf

390CC2ECEB6C82588940252A5205E28C40628766D3B8EC2C81D887FAD1AD428F

SMS_MMS com.zoylevqk.dbibr

391E3C62BB254E6AF725B33D780F31916E1878C62780FAB36A454EF48F3C46EF

SMS_MMS uhq.msaj.lzy

393C9B2FD19FBDFF9A5082D9FBC98D59D4B270A13D01820F502C6A5330BAB06C

SMS_MMS com.phfgiwjrp.mpaoip

393CEA9399C1607DE0949777A986F32F001FD5B0636E73F8930B8AC7C461B817

SMS_MMS com.xpmyljzowd.nfjmzln

3949CA3E058DD5CE642E1B73675CAD3E07071F2BB3310E1371145AB125270DD4

SMS_MMS oyjkd.xoznhe.avcwsx

396E951D746423582829BF0BF7D0BAE50F6AC66ABA1273ECA7C1FB0767E9956C

SMS_MMS com.nqvnl.uxgwkdeo

397C5D7878CBB2DC8D017F454F094AA2DF8B477BA0B8E5BE6CD6AB27A1F008C4

SMS_MMS hziapr.juahnwf.qzcspi

398EAEE9E0EC7EA77848379D16E3A945B022C1ABB3828F294368FBFFE5764AE7

SMS_MMS com.pufci.eknpklc

3A08EF6967BE60F88BC5A32D853B34640212E66E917570328BD0CE4BC0A0FF62

SMS_MMS com.zecilkdcev.kebao

3A1691346D97BA067D5DAD8A1A4F655625AFADE83CCCBA8DF04AACE256D5D4D2

SMS_MMS com.wtyimnvah.cmoayaid

3A8EABE4EC74D0841E7C7F72EB119B5F97E80BAB9BC4534C031D73B64B6CC90D

SMS_MMS io.runohtahvm.olcqwenwxkxk

3ABD33503D3EA7306C652C4CD2337C51701CC1568CA84EE07D0EB5F34236AEAF

SMS_MMS com.pjsph.xwzufzhoi

3ACEE2E84DF1FE715EE9620C5C5ADAE7CEEB3213F580799CF43B8C8BA369032A

SMS_MMS com.kpqytfilo.mlswp

3AD72E68C2953E000BF90BE78778360E14C691A23B7F441100E9568AEEE03F02

SMS_MMS siucj.fcpiblxa.ykelh

3AEBD35F2448AB6AD8514700B4848A520C99DC93F1D38E962E6633DABCB9308D

SMS_MMS com.suvpckmqs.fqofltdelf

3AEE532D3D1A2D8885383920624C1F0320296867235C84698A510181458CAEBF

SMS_MMS com.orkocyvgq.fbfagj

3B1528CABD69DD7685108F1AA26E660F6BBA5FE1CED977CC4F3AE91F2D35DA24

SMS_MMS com.iapsdedtj.udziguadwm

3B31F2F53F53818C39A55320878A964B2A2C8A12253B31E8F567C4AA29E81E5B

SMS_MMS com.jfilqbdpz.cspcgzvyq

3B6F8BA8C33E1F9A8F72371F3AE5135C620B33 SMS_MMS unzhk.htbzeiya.midjhtay

Page 30: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

823429AE9B8CE1C12313F86511

3B7039E06D9717EC9631680A1F928D6A1B0D02428576E69B684553103FC9CEAE

SMS_MMS uiq.rirndgpy

3B7CED92C3E36217AFD3F6023FCDFCCC3FCD2E433399976FA0F1381EB7D32F1A

SMS_MMS ru.wpxrmxdjvs.apafuvipqxiqc

3B89AAF70D82004FB5CBFAB00E8E8AE0DBD84DF9DAA0A01602DC3326BF633E8F

SMS_MMS com.oatoyzdvw.fsnsb

3B9E8981CCFC652B4155884436AA5C8EF765F3B21DB868B3B8D78A3FBBBA2760

SMS_MMS com.bot.suka

3BD7A0A22FA678F192B96328613D9A86328882255461952EA04B70648841ABE8

SMS_MMS com.iwogyn.kqsqi

3BDF121BE07F07DDC370C5324B071E23F02FF06B540D1BD9FD7D73B46EFBEA07

SMS_MMS com.pxtnvbl.sjiyb

3C0464B37CC829425A181689F3A8365FDDD1698441E4239768D0D0A3FC0E8B1A

SMS_MMS com.ugaotmkge.dqfousdkym

3C0E08612DA3518CD4A82177F8EA41D3DF8050EBA1B65897AA54B2CFC38130B6

SMS_MMS gem.ygiukwc.asejglap

3C198BBCBBC4233CEE660CFAED0D65E5BBAC84D686EDBD50EE39B848A08FEEA4

SMS_MMS com.eawylnrp.xrnmaho

3C8FD8B9A402D15C25A68B0743D6A5502DD7BCF0AA64995875B0AB9952266A4E

SMS_MMS pti.bkahseu

3CA2D441623EE2D2FD7FCE162CDE88E2F7921EA3F85003BE9745434626B000C8

SMS_MMS kad.tpiw.zrg

3D12C35AC8EEA0E3CE3B39B6765ED4F755B403421C05889C674ADECB17D07C1A

SMS_MMS com.nkyiao.yeufeio

3D18754FC590C4375009C07C6007DDD483102EFBA89A074CBCE6304D3BD192FA

SMS_MMS com.wmsnqdews.ntbjte

3D22FE6F670114CCCF2CD3B10549863E5B6D916C2E0524D30B911AB408CD573F

SMS_MMS com.gistng.vlrofb

3D2A9A3848160BB7DFB72CC9D039BB1A6D910176E0F28787813114F54EF0DB06

SMS_MMS com.yhvtzkrsit.zetsromj

3D60E5A14F7FA3CADDD7AF874C33D64091040DDBE5B100ED946DC7B0F8C8F177

SMS_MMS com.yxfldpb.pbcfbrnu

3D8A71ABE4C865106B4F4C7653333174C5844C6609D7C25684F74C5E49DC7C53

SMS_MMS com.pomey.ihokx

3D8BB76333E7DDD68B1E89B91F1207271C3A226437C431D545FD0CF556ADD945

SMS_MMS com.whaeakole.fbrvz

3DB9760BCEA03B2CC9C31CE13758F8C9B27F82CD75E33E1359D020BAB248B2C8

SMS_MMS pwujk.qrwhlcj.lgaetk

Page 31: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3DC7028D7538BDFB7AD483767A86505E7EA6B1C32D6130F861E72BB8F1BBF596

SMS_MMS net.fezhlqdutxyfj.zosfiwmanq

3E097BBFD48507A47683B41FC1343333AEECC96F20AECC4A1CEDD2FAD6421415

SMS_MMS tvzrog.cedvtki.abdyolr

3E13FE901D1D4505F6E177557553260A17C1ACC181C49F2FF5D69F16821BEE28

SMS_MMS org.voryjbyaqwt.muiiifjrqyoy

3E1AF33A327EFD152BB43C212FF5880601FE025286C9853CB4C6963CBFF25D3E

SMS_MMS com.bireif.kesbjgvtmx

3E1E2ECCA5148CEAE75A8C507F831B2E9D6B3B0D4C2390B76B595CE2D2F2209D

SMS_MMS oho.obrzivhqwv.cmjl

3E209455447856E0D68B13BAA03D6CE1B0E82306BA6992AC5FDF9724EE051011

SMS_MMS com.pnihguqh.soknwday

3E311CA48CABC5B083C8191BB4A6D4F9A2E4A402E43D6FFF6ADD9C7768AA5308

SMS_MMS xioctpdm.wvyrxf.ctqlwzid

3E5A9E3B031996593B60A4CE1BE53BBBFA2ECCFFEAF87A544A30041FC793690E

SMS_MMS com.ygvut.qrpfndvf

3E6947D639B9398C2D9C84ECF4A45DA0EFF4210F093EB8CF93CA74A92E7C91C1

SMS_MMS org.incwrsnipvbe.ahadkcroohyj

3EA2F6CCFF618F4A5BA492E640DE7F65918882A952E313F8ED30A3382CA5D6A0

SMS_MMS com.kyarzphn.tsvxe

3EE4E369FBBA9F12693B855F4E4691872106242577B5EBE22BDD303EE4701E2E

SMS_MMS com.hcney.xfiqyg

3EE77CF91046D064A1862E88FB112CA8D7F2544A4931C9A6B9C35084E9A1F5C3

SMS_MMS com.kimrzks.qribfaj

3F4326586CADD521E1A072157FAE3AAF9066A1D968089D0D5B6A6EBA36376994

SMS_MMS ufu.simwolmw.qwrv

3F6DD63EEC0E6DA22DD6453BF582AB170FE8D519F59260E7617C6248A72C8805

SMS_MMS net.uagffxsufx.irbrilpuuvu

3FA3C821F39D99E2970EBC7787DD1ED658E0CA450DAA8C07E4F292CFC7412B39

SMS_MMS org.lozymuk.nidwvpihb

3FF07F063AA55761E8859754E156D79E2B3411147C12920C801E227F8F363407

SMS_MMS tcvikmga.goyfz.bdqaro

401FC14601B8FC1C3E605622EF63A71BA9F2DECDBD129E661AD6597BEAA73167

SMS_MMS ayjuqv.jkoipnfe.cbdzukgp

40278E945AFC6E9798D6FE2ED648D3A327AEF30F95C9F5C07D183CEFA9399F96

SMS_MMS zzk.osvkputeqg.okiiijxex

402797AACAFC0E54001580A4D7C16E1F8220CCA0AD4CA11BF9E64A29341FAE5F

SMS_MMS com.auzlayjxq.acneuhnkiv

404CFF121EC5A6F3F4D52C880C66A9CC05C3EE SMS_MMS com.xapmhw.lmzftseol

Page 32: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2EF144C5AC67892B7A63BBD3AA

4061D31768C23AC2C5A70AAC01197FB2092CCFD2A520969B1A3207277DD54C9B

SMS_MMS com.zehdl.igiuv

4072D504BEBC18D146C66AE4C4A4D3484DD84E3D2872F388678CC8EB891F9357

SMS_MMS net.ozjvnnjal.zoehdqhvvq

40A9A9B879E087FA0A9FE08139B2A32AF99C8DEECE7B8C5D63741CBF4E3D7C30

SMS_MMS pkx.bbmqhguem.gwxykolr

40C7C1F58ED7F412BA635227965E0E43BE96C5D28B6DF1729ECFBCA89E3A2A34

SMS_MMS com.aeyhspwbu.rcmjrq

40FED5C745AE24CDA5351A1401F45994DE7606477A8A4C1DAD4CE096508F9E89

SMS_MMS io.zoourxpxib.ierhxiti

41020471AF147A8490775DA6AC50891652C3866C1DEDE7311E2D536571AD2D05

SMS_MMS com.egjlgpsh.sbnfajnisw

411EBC4F840BF38A77FC96301FEC53801B8179F4B2EED3DF3E0979A92C15E257

SMS_MMS com.ikgjmyzilg.krmnbflf

412252B14B054C6FC1F51177402544E45CE1124A096F608F8975829806B3DF93

SMS_MMS com.msuajfp.hbvftryay

413686C9AA96437D05796DAB000FCF4F0BA7D203F554DE5DB86E629FB063BB1E

SMS_MMS vahzotnk.nafoxt.dnuvzxpf

415D5245FDA8A0CB60EE30D037F61374793283225EB0B64FCF38F6315391E788

SMS_MMS com.xdmjeam.fcvnofbxy

416B836A6577BD862C4E9C64826B16E46FDBF34A96E08BA01D85EB7F82547AA2

SMS_MMS com.cmtifdyoy.otoron

416E12D6E5C15AF71B5856810C213A8527D03BBA2FEFA5978C8BED5D83836400

SMS_MMS com.esuozqkolm.uwxtbcj

41B0B9D508C427E1DEA4A3DEDFAA8F15D0F84615617919CB9040FFD070720A5F

SMS_MMS com.bot.suka

41CD67BDE683D9637E49F094689152739740E183DDE23EEB9576F388E2E88CE4

SMS_MMS com.vjszuq.qlmjvfrb

41EB0B4C2A737A7CD0C8CF2E07303D7D27A22D3DBD59E0B526D34F7A547F3038

SMS_MMS com.henmw.wqrdg

41EB6B40AB4423D2E4800EBE2A36D92BFB869CB76E97BEA54F5AFB659166774C

SMS_MMS net.zfdaqsaak.sstmzgflya

421268B9D4E2E2EAE8CF8337D000062F813BA80185FE199EC529E5BC8901D1D2

SMS_MMS cdenkxv.zsavoby.yfznwdu

4227BC2ABF231F55A4ED6155C96F6ADDA1BFA373B35108A7FBF40885755C4D37

SMS_MMS com.psztsiwogu.rhyripqlk

42443CE52CB5CC711A24F966DA99DD0DBA1F057F1A48774BC83E28EAB9F8A157

SMS_MMS com.cyqizbv.nevorgnj

Page 33: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

42603127EF5383DE4675903327C5ADB56D773CFAB26BA5ED40ACC40366820B11

SMS_MMS pcynkbs.euqxh.luyfvwxi

426F33B8C1DE088B363CDC9D0AEADB7066EBB58FE1F6C0823B4466204BEF6D2D

SMS_MMS uofvzjst.qxylkr.dorvfju

427241454A3A391DA8EB59882F2469DBE00F5BC1F6C6641248E60BEBDE351CEE

SMS_MMS yus.yiwulycvb.sttwthzvz

42741C16F9BE5844AE3D7EE4BE1D8885B885B579BC1379392BAF5B47C1172CC3

SMS_MMS rcz.mchjyr.jclxkb

4275CBB549DB94E14A2EB4CA7651413AFFECF861343B4DA0920383EFF62DCD61

SMS_MMS com.yxfmag.ymxthkp

42A02F00AF74D9FF2A1BFADCE31DACBE87675F9BB4DCE289038F3E54F3D943A9

SMS_MMS whk.fnhyasn.dn

42EC4E571A472492E3A3C14CF7BB07E9DCA5A45FEE96FB1BE16A1DE43E11B033

SMS_MMS bhvkdguj.ytcsuabq.ygkpnqal

42EEA1EF1715FCB4B064C7B8B502FF08BDED11D40B7BF20DCF6CF5A3579753AA

SMS_MMS hjcglx.skdcij.sntryiqc

42FA445E42D4215E06DA265EFA5B9F8CB7CC427482DC743D4821BCFE49FD26D8

SMS_MMS com.oyvnzxd.qacjsum

430B81BB3E208DFA9C628B9D434EEA9746EFE0D46D9DD38F8B175C2BC2F8DF5F

SMS_MMS io.myqdjjffdt.aejidnjnikev

4328312FC780C6F93A5907E2ED726FCA48D5375C7A563247353E20704DB53B62

SMS_MMS jfxeuoz.pqmcgyto.fehqi

4342296AA6B9A0A937D1F110772F06625BDA3CF85AC3EE17BDEA73E920B66F18

SMS_MMS jzpwrqlf.pkexwgh.uselzi

435C28EF3D5B52A9F35F07EE8F3BB8BDA1405EEB1FE38BBC08263B30F46B1613

SMS_MMS com.ajlhnkjg.zkwnofxjyh

43BA002A51163B758810B8E612E39A083434A5457D2D92CB03B7E151ED16D0DB

SMS_MMS com.pbrwhesg.ghnjmakaqo

43D48EF40EBD22919B1F4E55D3E7294DBB2A6386E5EF5D0B34A7FF0F8865AD41

SMS_MMS ftmyko.lqvxjbaz.awqdjfgv

444E4F20E4257B6FCE14D561714540DC55CB6ACA3D1829EA0C2C150D401E1A5B

SMS_MMS sjnhyw.wnbci.bmqsyt

444E736B348DE957AF4ED1F766963771B377492CDD34A2E559C9FDDE5E996B9A

SMS_MMS zityf.fhtwk.mxbrdyni

447BBC68EE4A8CE5D079FC3865114C1760C212BE865C386E134C644235A05981

SMS_MMS com.hzqzjoxp.hcjpt

448F6902169140EFAD47B4F4498EABA8884BF0BBEDA075211924C50F399355B7

SMS_MMS com.jmphk.ipjfywol

44C16C90DDA093218B51629C453DB479BB925 SMS_MMS com.flrxovkua.cwhxynks

Page 34: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

20C46ED39F48E36C9C4E2079016

44DDBB46C691473B904C4C7805AAD1F635AF15D418332A8A1073A0A40ACC985F

SMS_MMS com.yxtiuz.tycmjswz

45426977583515C35F4BDBB6FC3D7ED21D00CA01EFED30CB0B94CF6D4D2EB24D

SMS_MMS mhcjqldb.wtacij.yqdnxi

4543F96231C47FC33E027BB04BE4E85D6F6D81641D4C5FEBCF7C0894071752CF

SMS_MMS com.kcubdw.nutatshqv

4544C45DC734D452AB75E8516D6491EE740111C4F2F542F5DDDC221A0E74055E

SMS_MMS pie.trf.remh

45686A21F09686C0E225CA4498DA13B6323CB5ABB92A4BF47E4CF4226AD80C83

SMS_MMS com.jzorgmwmv.bpqnfawti

4588AE377C3865F2B658CC9DB163C599443D5F9BA67BE7106D2E9255B6F00EDC

SMS_MMS zkcaye.klrhmwze.ervcs

45D230A14C5F1D1152C7A8157436675988FA5C040682980408D090C689EFE30C

SMS_MMS com.wpdwy.iknelsx

463FBDC589CA872D92B8AC6D6A1D958581888379395952F4985CFADB6CDAC7B9

SMS_MMS kob.qwbqjinkk

465BEC414A70BFB2826FAA4A66D9F743191A5B463A989D6B0BF0D6296D2ED059

SMS_MMS xiz.cbtwvmo

466FA961730FB71BB59943C81192E1C1A0C02CCA1D13868EE056074DE93FA2DE

SMS_MMS alcsziog.rijqwx.rzumx

468C3E9CDFE233370DC7DC01E0F420E9DC54714FDBA8ED47E83BCF9F76C1F33C

SMS_MMS com.cmghmts.ebcnar

46AB139362EAB692AAC0055E4EDCFED94DCB429A0C00D3C973FDA14DE1E4158E

SMS_MMS jbanmrwd.zwylk.kxgjhbz

46CD9564AA4200314381EA318DE7A656E7C821ACAA30DDB230D6283F156C33B7

SMS_MMS com.gxwtsvmvl.vfanwra

46CF1D4CA43D1B3AA2514FA3E9A1D40C8419133CA1CDA967203BC43DA4C9F5E3

SMS_MMS rpb.mtptjwe.qtaehn

46D2BB5EB19600235136E270B695687ABCA4FD04D09658022591C6E5E52535AA

SMS_MMS ru.xwoxjykdlmynpm.ijgufhfgw

46ED1EEDB9C8FF12C9BFBB85D74B6782ECCEA5061EB2D7BACDB0A341CDE57A91

SMS_MMS com.bot.suka

474877BD9A9498523195D7EFB841FFFF5DC658970E8F8FED55AF6B0BB59185F2

SMS_MMS aexsljn.aunlpxrw.jmrcl

474A4399F01BDD7012FDA0B7C321481D0A8DF8A845AD4625D82B0C401638E844

SMS_MMS com.bxdku.rkyeolreu

4788C6C569D4A8E1C84923007CCC45F1A31B3160116FDA103E9630ED76948580

SMS_MMS sbv.xr.bjbpwkcra

Page 35: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

47A32DBF56BF97EAC5067BFD54F7C6F16B8B9D0A9333E45089926E4936D1C4AA

SMS_MMS com.zdbkyef.denkqneovw

48034970F9F2AF2C644319B99D2BEDC32AAD73FA50E3F14295ABF029452DC6E6

SMS_MMS ifdgblzu.bklmjnyv.qyboipu

4813E06D47E75EE32F1FC6F3330873DDF4EE7EC92C2E3F1F55E1606E53A67530

SMS_MMS com.dnifhdesf.fspmedao

481E0C0C0DD9C4BCF041390236B33BF93AD1528672CAE0572CCC1FD90363398A

SMS_MMS com.rizbz.wkakmg

484F86892383A65588511C06CF456E8FBA324E974A740AF54E82FA27A3EA8EBC

SMS_MMS com.sohfrl.wmacs

4850AF12629AAA58ED4B09D2058C0B3726C90475C9A616BAB428B65E51219E8E

SMS_MMS com.dptusfd.wbinvnuh

489372C126100E07C32FF130DFBC0F8E9AC8D599519992E5A92E3C54B3DF7266

SMS_MMS com.ymhfpu.chftqo

48B6CFBB07912F4357C6EE8750CDBB714354F9087C6F01759A2B0CBCE4C34BC4

SMS_MMS ru.wodudwip

48C70CEB063C5ABA3E58793A037AC85E137520C55EDE305FC922E634C3169559

SMS_MMS day.atrixwdyvf.gbkglqm

48E20AE09B8205705CFC62DBF912DC3C941501BDC8015905C676B32AA5881B9C

SMS_MMS namdkop.yimrb.tslwpgdz

48E53E64F47D03C3D0AE6686586BFD6F46B6F291B8B0E9FDE35C31CA350F3C4E

SMS_MMS qpkmb.cuxjzd.fpqbv

48FA3CBFF244C8800DD567E9FB410E253649CDE21883747C8181F0D0F5C6EB4D

SMS_MMS hzcrjkp.rhndqzyj.hprzjn

490401D4D9F99AF95BC6A2522FA791461418A1AA03FFA3E1B064AA023C38F4ED

SMS_MMS ru.zbaspqxgiqw.xeprtmr

4924EC64DA72C1F45D20A92DC4111E2F0EC7EC3872F79DBFF671FE80B6F84C70

SMS_MMS com.evptmse.rjrhjde

496C4A7D8792CDC1D947EA3994FF2F54864297F5A0E7B452E3FD6E59B99A746F

SMS_MMS net.tcbovnvmx

4972757EBD38FCBE58FFF33AF2B6DA60674EB57D1E7A39E5E4DD27B281E9DD55

SMS_MMS com.gxztpxstyi.lxljt

49B7FC80FCA0AABBC8625BAA2D717BC5C28336C34B1022EBC5B207914691808D

SMS_MMS com.icisxsm.tyenrdl

49C829BD9DA3C0CEF7974D29B67D78091B736D1246F38C070A1FBC2BD90B0CDE

SMS_MMS tiqwnrfh.halgx.wxpaovg

49D4C71CE337AF5E0CE98AD0A8CDFA16B9CDBBFE65BFFE1934EA78C328AF8A85

SMS_MMS nre.mkknti.swmhvjmclu

49EAF0E37D02AB64F05A335362D8B325517BE SMS_MMS mrezgocw.zvfgj.tqrzwpf

Page 36: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EB8D88BE1F325325F787A56568C

4A0AA699E6595C207B28B8399A74C55D0D6EC22192F8531F95C93E7AD7445DF2

SMS_MMS com.demtoi.zmjvg

4A1CE61BC56568EDD47EA6CD6228A863DEA1661D1D09E50D5BB893EC353CF6E0

SMS_MMS com.kgbwszkza.rzlrdoyofc

4A26757ED6EAF9AADEE2E532F079C9669F12112E339E6C1F4884C1A843BD78EB

SMS_MMS com.nkbosi.fbsptltjab

4AE732CE7B7E761FB5096420DACD10C5C06829BBE14529F82AAC23C0991D14A8

SMS_MMS com.vmdeykyq.mdgeoxzub

4AEE4A7983ACCDA44AB2352F3606CC16B2E3A75E78B335A12688F3491D2323D9

SMS_MMS aezdqito.mvhdq.ogbknx

4AF462202A8899ADA2A04D035ACABC94AD9BB2FE2265D6FC20B1B8BE804990EA

SMS_MMS com.hpudgltk.qopwkxcn

4B1DF35647E4FB58DCC7FCFCF72E2A924FEFD3A3F7EDDDF309A0CC6851C031D2

SMS_MMS com.jetojyxwv.jtqak

4B1F555DA1E162E6E3E9CC131886879A5EA443423B6CB800295FDF1D4E84C4D3

SMS_MMS com.diyduns.qyberkr

4B1FA9A8CD7C1CBA8A8CEB7AB2780F8E2D5D83AAA927EB54FFC14BA1B2C6B9EA

SMS_MMS aesrntu.iyfnekuo.ahgljzk

4B499F92AA9560DED5F08E1148F52C89FD5B22AC4530839B2C548A18C2DA0640

SMS_MMS org.vrypwko.brisilwqjxlsgnx

4B8D171241A4C2083DDAF4B1DE317CF711B3BD8E5D18DB869F652A80B944D8EC

SMS_MMS com.cpqouaok.bcqklml

4B9EDD57FE2E68A9DCCBDEE7DF27F3C39715E80AD1F89589AE24BE4FCF85F7E2

SMS_MMS com.awcdfnbgw.ykdlsgirw

4BB0F1D0440F34D43AD9095C747D080859D21466D7FFC059EB6D609E1B16C4F6

SMS_MMS fmpwidch.yshbu.zjsmgbi

4BF1DAE9DEB546029921FAAC0F8BA1558E99EBE8B013C6CEA6596F3528538BA9

SMS_MMS com.srpqxdmbcg.comwfaguax

4C020BE96447C84BA6BB3D7B8712C27F2454E41E2F7C56BD383445A605CA0538

SMS_MMS net.rqrwtjo

4C11ACEC993D81D0F29729BE1F10335359F1CB5EFC1AE38E6D42D154CF08B126

SMS_MMS com.rbjeniopia.vpydgdvk

4C2EF8B9F34CA36DF1DA42602CE264BDC5F13AF5404D2EF25A6F310E116A9415

SMS_MMS dlqgwiy.kaymbe.mxredtn

4C33DC5E67341057DFDCB8AD7A1B8ECE326AEA6D0410EBC5E9A80017061519DF

SMS_MMS com.thmtjvle.dieohj

4C48E74C94EF42694CF2A9935D309665569D79DCDC93CC06017CB21A4EEDC299

SMS_MMS tvh.mcxg.mnts

Page 37: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4C5C0681AF6411AF78DAA319752995609CCCF07277E9566BDFDE64B8C5751DA7

SMS_MMS pkzoqjx.dltqfup.kgqiw

4C6469249CABEAABCAA8FB83F1D5BBA9B5C07B200960D260CEE8E2B1343BD2C7

SMS_MMS com.hnukcr.ejdxbkagqe

4C784E4C3CBAEC349773D53182E9B63B1BECF6BA33665198D67039A8BBA804E5

SMS_MMS com.tntbmjsbhr.szhxgrytu

4CC877D5149F540292AA2542A4125C65897317CB1B106F7DDD2BD10DC35DD3D5

SMS_MMS lhyutoq.fqydgxrk.oqftjbdk

4CD489480DE0817C6D20B92DF7C4DCD1EE3D7485184B260C78FEA0E80184FC9F

SMS_MMS com.gulnmkt.mtapejzjtv

4CD5CB305BDF9B7B76AB0688BA021BDB471FF9D2F69F38C8E4B29EC47CB821EE

SMS_MMS com.xdpywjimw.lptuylvdv

4D2651B7BC289CF11157AE59950A38BE40B9B10B73412147CD71BDC16537C29F

SMS_MMS seb.hbki.gsalvpdekc

4DB4879E84F4C81530DF435E5A3316501D9F8AD289396ACFDCAC762AAD2F3EAB

SMS_MMS com.vmsbu.veydnihlo

4DD6AD86C14BC8810FDF1798ABFBEB197369308CF22DCF11E11EBBD2A7B3C68A

SMS_MMS com.tsiop.zlvouoz

4E0F63F8C795A7CCA6B238178B833E2FFA7C8403A987EB20341E5F887A26B498

SMS_MMS com.cghxvda.uqszq

4E17968AEA581FC28F4F03B37DFD8C64AD27C8AE8455EEE854B65C2DB7CDEC43

SMS_MMS ltcpa.jludzgq.bnvcwlku

4E17AD4CB0047297A06C0C7694E5D48481536F9E15E90DD7809219A863B9EBA0

SMS_MMS lgsmhix.kitec.akmlu

4E1860BC424C2B07F8D0429DE863D7EA061B60B57000D56F00B74A975CF0097A

SMS_MMS com.sohevhn.vlnlixtxj

4E2D9C3BC1D3A0677C0472D44A823F01F69B51AE5E4E6B9C56F464C6CBDD53AA

SMS_MMS com.qzdajue.luohskefg

4E7D335CCB13A09B73B2F2D8A87EEDCB05B1EB176D0521451E52DFBEF6697D82

SMS_MMS tvwkim.mhlab.fsmucqeh

4E8946E35EF0C155F104F91D2CB9A1FCC277C4071349A9DD4AD703996CAE02D9

SMS_MMS fbl.ntdd.jlljc

4EA2EB1E843DD8E4F3239450415D8B7D52EE7479607CC72D9F56A7D5B2A3DC8B

SMS_MMS ledxiy.qxaksbc.kyjwiq

4ECAED103AEFB5000D8FDA075FE44A04B3E0CF7670D10DF9CFACCF7CD5F7649E

SMS_MMS tfhrlwz.ldixpo.fticshx

4ED69AE9C36459F47C63000E61DC12E3F4A1D894B1BBB63F486BAB7F5C23A950

SMS_MMS org.noytcoptzk.nniviqmuex

4EE051FBC402C62B8E9D70F17EB83CCA1087D SMS_MMS uvc.shrrxt.avwt

Page 38: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D698164350A6E0CB577D289C3C8

4EECA1F3C46A24DF9EFBF8FFC499F12C882BD9715A083CCC802E741FF0A10784

SMS_MMS yod.eh.fs

4F0A6E7840682ED75D69874A0BE2B8B37E29FE3F80AADC85A752E858D4C9B84B

SMS_MMS com.rwcnainm.gikcvrwahe

4F2676DCB65F1C2A81A2C11E0591B271EB1E0337BC80EF4BB7FB9746160FC5B6

SMS_MMS xda.kgrpfzoktt

4FD45484A368EDB306FA03AF667D6ADD52C732B0AC2CB670B85A4CA4B2027E0F

SMS_MMS com.evfequy.kfycxzbwq

4FE685B6A1098758A53036EC78A59C157AEDD79CF3B47462730F42CB6A5DBC81

SMS_MMS jwkphi.vptghbs.qpfdw

4FF4CAB13E60D6EDC4B3B5AAE6D6FDF76BDD723FDE133FBF0BD8628C1C5BA1DB

SMS_MMS jhzvgus.kirxwu.flwgp

50476E03B14CF0DA5B040132CB7041AF5E4CA046C2CF3B233866111484D0E798

SMS_MMS com.uwpublwqx.wzybdrv

504904C898F1128DA7462211D6490E43923CA0BF01D7BCAD481864F3E23C9560

SMS_MMS com.ojpezxsl.obqhcrsbfi

504A1E86173EA32430353A29235B8BA390EAAEC76610F40083EC534F4FE515EC

SMS_MMS com.hfyboga.jitwyvbv

507135BF16239EC5482F8051E6807E6FACD4915C4F7483523C5384F7C6EDF2C8

SMS_MMS cqytj.resqk.hadtcqr

5097DA28EE1C92ABC1C6950A8CC3C5881D12E67FB743D5FF44512D039B891F2C

SMS_MMS com.ayvskuhkb.upwnlcd

50D23DE5589B19C412A5C577DBD04FBB684F73A00A9DBA00D8DFD64AC536F7F6

SMS_MMS twunkci.ahbco.eaxvzmu

51743ECEF511B9B08EA1D00A5B373CA4ADF2249D57EE660EE25D2B3DFCF4BFEA

SMS_MMS com.xqzlkys.zvpighxk

5188B85641CB5016B6584333B169870BCE7EE1A094EB657EE83990D88CC740E7

SMS_MMS com.kflxlsofnj.ngripukn

51A91E7E9B0D2EE34EFF1F131F8DEAC215CD183C2CD19AAF7368ADD2DBACA113

SMS_MMS nvuhdowe.gtfvaqsd.tlzqgxv

51D89B4A80C4E30ABFE8F54C6E52B7385C3D18172B9CBC686327D16539CACABC

SMS_MMS crdplx.wzxmejd.rcwpbxjz

51EBAEE7FE3A1FF3BA77ED96FC2155331F5D57C49900777EAFC61D8E1208FA87

SMS_MMS com.cjkzli.rtjlfzv

5229A4BAD14903880DFD6969AD4C4D22C20E83B40B42221D90DCA09838A2CE6B

SMS_MMS org.mbjrjciyt.lvhaspjexczsng

522ADEC3A664625A4C94071F186ECABDA0F380C7535007B9A476CB81F3EEE944

SMS_MMS com.dmnmlcto.vjkdulxnf

Page 39: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

52337EDFD39BCC245B640955B31F346D26D7AC069F349701BF8C0BF3DCAA8035

SMS_MMS pvb.tjqytag.plez

5234B35497405364173896081F8E7764206770B5D3B9544FA0E77A0449D31AB0

SMS_MMS dvt.umgl.pomzyjnr

524C84E2E344114D31C5ECDD2A739765D99B79C16D718493F5A739CFF3C917B5

SMS_MMS com.pxuvhqjzs.qtpctjqp

5271E6E881F3F578740DC4A063F3BE408B224FDF38182BB16316CE8D879CDA6C

SMS_MMS com.ltwxmem.lowowocvuq

5272525D6C662A3718B97CD841B160C4C48B4E4FD39EADCB9EC8FE93AABDAFB5

SMS_MMS kev.zkfjalh.aaaxy

527FF942865A1AF3FCAF790EC6FF6AEF83BA2933790A9ED573C004F21EDA6995

SMS_MMS com.ibaphkufh.nwpmjeyh

52B73D8A07784E64EAB64EA20D798E232899B29ADA118A1C8968E1DEECC35C5A

SMS_MMS com.kaxeazx.stlhxkjx

52B7BFBBE0FCF863BB0440FDA995B9B3E9F78EDBB62D8F846F4FD1A821D87D6E

SMS_MMS com.fhybpdj.vycmr

52B95C4CFA67070B5BFB303F9D6B7A687C9E7358C421942EBFE4564061A2EDF5

SMS_MMS com.rfxzqhd.iuxdzxsg

533DAE66A744C09D395A5EFAC4F05F186458967CF4900992FD21A9B939866AFB

SMS_MMS com.hqrqafg.czezo

5345D502B66A79C3F4F323BB1CC019BA11ED2B7369B6320F521B9FDBAB9F7A42

SMS_MMS nfgtlk.oudca.jlsuzmx

5376B9B535C068FBF8BE1F26E7089454FE6018E802F208CDE454F56BB1112324

SMS_MMS com.gjlmc.daksz

5388D02CBA5C4F5E3E7B13B379BDEC87D859A8E3E4AE853DBD51A95483FC388B

SMS_MMS com.bot.suka

538E1B346894379EF1FA728FBEB3D3FB403F2C419D34E18411DC2535521C65A3

SMS_MMS wsy.yhwtkhfd.jtjuhso

53BAEB9CD59DCED800A4604B5E1D2DFD0A271333ACFBCD90473C46967B54FC65

SMS_MMS com.qmtbeld.xkuwz

53DB8CD4E82513A38B461532779BEA16052135226071356E816CB41E63D7C27E

SMS_MMS com.xzpcfm.vaxpkxz

53FDE361CC9C8000ED1EC514CB2155FC782FCBD58D3BF0F7DFF44969A26517F0

SMS_MMS com.rgjaxmewj.gpeol

54233C2FAB004CD62567C1163B0D689447A7E4605DD974D36B1DBDD1900007A5

SMS_MMS pkmznhr.ajwfy.fltvhwjz

5426149802F56BA4BE08950512D747B588DB591DC484C3C4347729AD37AA79A4

SMS_MMS com.qeolwe.ixpiqp

543D1E8CAFECD73B79FF290886E688AEDE0A0 SMS_MMS qfxth.pitwuhrd.tmucsf

Page 40: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

629C17D1A0F9604572E7B7B0CCC

5442312E46C371208FBF6F4CFB12D14F2B0757F97805953C759BC514F6E0C934

SMS_MMS com.whphrs.qsqtoung

5476CF80E28D75C9714AD1101F7511FA67C451B79258B5C29A93570D85890C7F

SMS_MMS com.nexbshjdbd.iqulrak

5486F21382424BC8B312FA5369FF2EACB8340CF9FB12BF8470E4D695E50CAA10

SMS_MMS com.qbnfhnc.jghms

5494698EC521066150CA0A386E7E5D2D98DA305573E53CCD1FBC211E85BD3DAA

SMS_MMS com.zidrtv.wsauadrkle

54B3280680E47FA02C06D591776E14BE6C3D9A1661949B09EC497001FFD6BE02

SMS_MMS io.wxokrtordl

54B5E575BBFD8850B45D31D5B7A805C28B11D549E8A3F03FB7164415EEFB9231

SMS_MMS kyf.tanywhduwq.pyocobkqm

54CD04EBEC68DDAEC1466C255401FF84CE8EEFC5AAE3762780087B9763AFC55B

SMS_MMS jazgf.xlnmcfuq.igspwav

54D67F105B7E174678784964D26D44551C72C915C396E8441E8580AF87227D9E

SMS_MMS zra.cmzhxapfd.ltfojnw

54DA01A132EB2AAA86D594FC61FA38681E8D1F9782616DAC03AF1398C4343388

SMS_MMS com.hgoruehfwr.gcosrbue

5516F7BC3D0DA213F83847AE9AC5A18B98970F0BF4504D21D86A9296C4A4E5D6

SMS_MMS com.uilzkagdn.bxpjl

552FACB324BF378B142E1BC4ED1787EE0D5F5888FDFBF823831BC09AD2F0CF36

SMS_MMS qanykxh.fasmnwk.pljmz

5531B0896A0D5C09066F4493D064A67594F0EF39D9A7FD23F20014CAA72F84BB

SMS_MMS io.xnbkmnhsnsxbnx.jrxokfr

5536C807C2F087DA99FB21FA1AC1B0EDE1E68B02B26CED015E16E7A618ED073D

SMS_MMS cfw.cjfhmry.vicd

5581F5614B6B39362813AA17D188C6E3EEABD64A7F37057039A12B523246B79D

SMS_MMS ewpjbf.fesog.yufibp

558B651E4B051B47CDEA0788B8B4F6BD5EEC48F9041D50335B365AF1B0F89DC5

SMS_MMS com.xhjdhs.zoudvpixn

55CC4A96FEFCAAF2FDD225AD535098EAF342F9B1E4448834E71ADE0E87E8C11D

SMS_MMS ksoxyej.paduksz.ltrhg

55CD2FB5F401C238BDB5F218311028DCFC5EDC85262D135C2501DBC28B7499AC

SMS_MMS dgm.tsb.em

55CE62F6EC658B6F6FC74857ADE137CE335B4BA53E85B647FA47955C0CCAA3AA

SMS_MMS com.mpyvplvmn.dkfro

55D4D3E2343E80D66878D7040DCDC141F89B6869E2C2879CB778009E6EE5418A

SMS_MMS net.nkashcrhhc

Page 41: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

560F0B49E09807903DCC09796E71E4CA94A2F92265A1744DD504C0F428CEBAF2

SMS_MMS wxj.olqyvhgkyh.xisob

562019176C179B41EFD6F1A80D8A91D7112EBDEE0F9B0E704A243478513DE2B0

SMS_MMS psqrfnmt.ucaoshzq.uczbx

562DB344DD02CE4665194C2472FBF6379FF991E1A5916BCFBA10C3E0A7FDC424

SMS_MMS ru.jykiauvkitiv.kfxsevvkmxexqu

56505A2240FD612F863F6FB603D4C7A9E1D36627AAC2104267C123E444972BD8

SMS_MMS com.abfxgqmlo.rbngnrzpmy

567F9F399F758E4181F218F10CBD17A724C35BECB5CE42F089E2428F7D3D8C81

SMS_MMS net.lpiouuccghvrsyb.vvhpfnexntrxjz

569878A62FDCBB8CD99CAF2664A9E2A7172E69CF93F8CAAC216801D07EC36A8A

SMS_MMS com.pgjbowpf.wjbegenabx

56A17000D8A6794EA80B198A5D438895C268F8A7D423098699CD97CEDEAD4105

SMS_MMS com.xqpdqbns.uxdhluvewb

57318CE57BE70AF6542E6447DE21B869487D2D4844FFD8B7F01402219EB0CBD0

SMS_MMS xufokga.jckpiszq.vjmgr

575D7802F0744F8E39EDAFC1C0A5C992A6CA9C3D35C7F2FBF1E2EC7895D3EAA2

SMS_MMS ru.gojgnljds.olvehnezbfm

5777E6970EA5E15A5E2A810CE4F2E303C7A64C8EE45016753BC87C72BE5A6158

SMS_MMS com.gxehgiidnjd.vxhujts

57868B3259A766843C0CF1478BDFF51C4368AE57A5B9132AADB953AA7044D6FE

SMS_MMS net.duzuzihwp.zumruwlyptxtj

5794783F9FA10D8EFB6BB366B90D1B7F626544F3F13706838801F4A4D6434FB6

SMS_MMS tdfjpy.ocdrqtnw.mojat

57AAAF2A499822C7AC3191465457AFE597B67A4A95CB978932AB24BEB1432E17

SMS_MMS empgy.qfjneg.vchbwku

57D6EC2A3CEEC131C5E13B99973B0CC762B80446F244C1C95CA1BAA907C9C27C

SMS_MMS ent.bnawzlpof.rskw

57EAAB9928F96448C30F59CF8D2CD7BC39796997D7EBFADE7D2E817B01B809C7

SMS_MMS net.judoysmckkt.hsjthapyrmmizp

5807F1D043F8675C3345644B2AF0ED134F4401E9243B05155B86BFAC8511E8E3

SMS_MMS miybcqz.byhndw.ptoch

5818CFCB881A2B005D8118B7BD0D68BF48925625FA7972261F6A17A431FFFE24

SMS_MMS phj.ktmg.awlxf

58266E8439E7B6C36DA11253FAE1D01C0E8A200FD6A24AFD12E0CC17917F4A00

SMS_MMS cxfgnm.lhnek.yjhgwom

5872722C0B58B95FFD75AD8F479F5D4563C23B5C99B23C68C95A82E9797BB019

SMS_MMS ru.zulvjbewbhdfc.irchbxr

58AA0335338147DF990847BF431810C7288EFC SMS_MMS com.vjpki.qldjeisghe

Page 42: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5F6083CB9CF4C5C3F5B9D20AD8

58B49939E410F1BABD1AEFAE95E5CABCE7306104183AD190337C4DB4EEB956DB

SMS_MMS com.zprvn.yfbknbw

58F963DEA0D24CEFB9388FE1516ECA6C17A8606F2D9A6636EC5CB6AB1F1B4E1F

SMS_MMS com.xtzkymbp.bhqfnlhuzf

590B713FB2D6204A6E552F7FEA147AED3F265DBF5A81A593B718D6ECA0109797

SMS_MMS xvm.xywxt.rkad

5919EF635D6FE02777106760448CCB9B052F52D3659B2B1750B08C06D70DE4B0

SMS_MMS com.aytyj.ersej

59293D79AE6E1FF5C9BC9BE45B3AC05CDCD876BA5C70B25FD1A2595B86CDF31B

SMS_MMS net.cwmzvwamrcy.zifpwmaosjbm

59319B5B8C1EEF245D500891FBFE56C6A6BF37437E58A5F0E4C5EFC8FE9398E7

SMS_MMS aly.wdyzuu.gjnlo

596DB725144BD46B0ACD6767A2310904B10782084EEEC2C10803B243EBF8EA9A

SMS_MMS com.bpdqjn.sfjem

59769973EBF6C6FFFF81A59772F1F37D266E095FE1D99DE803DEA8033C264C06

SMS_MMS io.xfvpceib.hsoysadofnqve

59F39B913AB0D24A1581D8E95AB6039D3BFFB14522218B51DDE1EB1C378A4D5A

SMS_MMS com.pzlqhqabj.wtczwid

5A16B939AC955818F537394055D7DF8EB1919F0379DF931D90BF68EB5E98FFEB

SMS_MMS drjtzuq.sbgxicu.fvkljqh

5A40BCA2F5AFF3BC24C201BA97D84ADCA4014990F00BF8C2986CF1349EA447AE

SMS_MMS com.esguwbt.fbwqiaz

5A47F3E30F08F65F767CFB40C8D989C773ECB98093C783AFDC49EEADFF6E6637

SMS_MMS gzeavsu.iuyawxrl.yvgatj

5A6AB84E1FE91EA1FF17F7FA348292C0225BBB3EB734F6F8738A299F53B57A14

SMS_MMS com.tmsqfrkvyhvit.truubplqjn

5A7436817EE1EEEFE9282A3CC2CE45F85C4E655FDE63D9199551E231050EDACE

SMS_MMS com.dcrxiznid.fbfbloge

5A85960F8E83CBF1B5B650F8D27C6E9000058F8EFC87357D3BBD8313FC38A96F

SMS_MMS com.jeqmviwda.oifkpxer

5A9DA8F5FF1C862D2A00C6D066E1CCDA61C76CF7FDBC3BE0A57751590679632D

SMS_MMS fgcnbthv.vscma.wgqdhk

5AD5CED4CC974763CC9D9DAF419B3379DD46BEED1848F81253022DBFA2C2B9DC

SMS_MMS com.luevkca.hxcgeavj

5ADF10A5622B6977532C575CAE54FC844D331C9C2CBC6276F3ACFBDA801BC406

SMS_MMS kwmyvia.aohtnm.verfhak

5B10040187E3B644F29132E2D991F293C41679310D1DB494E2C214A035C4FAE2

SMS_MMS io.uyxvvklc.srlqcqldlz

Page 43: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5B1B7953722FE020B03BF4F4540535C05BF8348A53E5ECD3B75124B5E4E06E30

SMS_MMS com.pstbhr.zjbsc

5B757C56474E35A238531E7BB9A77260787E362BB05DF4B0031C2F8F12C3DFEC

SMS_MMS com.qwbqbegd.gseceych

5B7AD3282F33EC2A7D80257355907A9EE0FA55CBFB8CB1A7A737F9C3BBE871F0

SMS_MMS io.ekdkgbejhqqvqs.qmrlmxru

5B7F7E648DBF572545021CB55B8390871DB68E6B130D564D5E0FF6B612FF0E07

SMS_MMS com.nvwsjioimm.rpuqrwhkqj

5BBC0F7057559AE9708BF787CDFCD0B5D7198510DC5F97B2D1FDE5F100FA6346

SMS_MMS com.cotuhn.jshyvbv

5BC6796F4B4839F87EDCAB0F67108B244D8E68CCDD9626FB37579DE8FBD9C516

SMS_MMS bst.jqqqpxpcu.by

5BFB0DA850F52F996B3A4A7B78E9926EEF419DE3AE2FE718F0C38C1E61233B71

SMS_MMS org.xdtpapqxhphp.oanjdbmliwlejl

5C0B0C1FEFC65E3B8F5D3FC529813C440A35F284EB8681975D32ED211A14E0CA

SMS_MMS dznvp.eipzhgj.euiwv

5C41BA3D2E246918985A6AA260F7E60137F1E9820CD36958FDBB9E5E947E0A04

SMS_MMS com.ykcao.wyvjyhrutd

5C42B2C006F574F29367EA35D4FE8EC648602BDC5F36B2F69052B360C16FAE76

SMS_MMS com.hwydw.hlsdtioy

5C7EB918EC2201E3E043D012FF38967EE95BC84E4AFA7B738FB3AE81458D284E

SMS_MMS com.rzgakukzic.nwzjgewd

5C8969E987DBD55E8FF7DE6C71A086F8245DDD47CA718CA35F33098EC3673BB7

SMS_MMS com.bkbehjmu.zcpkasvmnp

5CD90D0A04A27BC166B88FE4D766CCD7E12703DEF49786E9A6699AD905704E65

SMS_MMS lth.llylr.tyatwbvsyv

5D0DEC52010D41FCAE372BA59B1CCBE84660CD3BA9A3E3D76D052E07C9CD6A9F

SMS_MMS zhfpjy.mairy.indglm

5D1D0214F48E16764EE9CE68B9CD86D519D7A997C8F0C534080CEE4B31A51D83

SMS_MMS com.coabplmedr.actma

5D3D11189D695F81FFD4C7EC7AB3C7702012F49DB80D0EE4D10C003CD7C0A949

SMS_MMS com.bxedabohrx.behwl

5D5D60F956D82A64F37791EBB63E656546749128D19E1F73E3C99A329BF6AD23

SMS_MMS com.uxmprkecca.kjfeztcrv

5D6310F7EA9DC0176003AA89681C73FD31B9721C8DB3871D8464BAB46378C654

SMS_MMS com.usewg.wuqwrnwhcq

5D73F489E62BAC69A09846B094F9851016862BAD515CEA2F5D7D56DBCD06CBCA

SMS_MMS com.whgirnogx.nmcpkdhopyl

5D840F9986FCA6593C0B30B4748A9164F593F7 SMS_MMS com.ldjrd.fatwj

Page 44: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

006FDDE39FDE533585425028F0

5DA9F68114545D163881C97290A3820E9259456709FD4F27ABE793D2C1E6FE62

SMS_MMS com.gxgtxpeud.nclihjcjaf

5DB1131A89F5C1BAB4D48FA4DCAFA461B45CA9AA66317FC458E87CC75A4FAF1A

SMS_MMS dimjw.ztyourpi.agifoxe

5DDCE166F0F357D87E0AD4E54A544FCBD2A1DBEC341CF77215F623AE6475444A

SMS_MMS com.jkcasfqb.hckhjkuchq

5E0F00823A6A564BC7D48F2D1AA4E32118E393892984FA80B014E72AA7869657

SMS_MMS syjcg.sctbny.fmawcn

5E1197FA7CCC07BDD898260D16564E4D4CDFB39865865F5A1B32C10E0FEE005B

SMS_MMS com.tmuengobr.zcsigci

5E2190EC983BEA6447F3EB045B66530499C6507F191F4521E91E9AED5F2B4D66

SMS_MMS pzxrcafn.qtenj.rviyeuhx

5E3CBF80C928DEA8F6391A52D141ED6F6BD1D2FC86DE088DA9C8B3B133C9A0CF

SMS_MMS nvols.hmzoknwe.otizhdl

5E6AF26C20EEE0EB7315127B06D2A23015287A4BBE539A32BB4A290B1C13554A

SMS_MMS naq.qdsfc.kv

5EA3E140578A41E6D525F8C87E746BBA378E9F6049374849E24EE0BE2BC40DD9

SMS_MMS com.echxp.syqpub

5ED085982E228C52F7DF7FB5FA1FB0A65B6F81E217EF8089D0A7BDF8A6D46D27

SMS_MMS efb.fejjnoe.wgclhencto

5F0C0B41CDEBD7A5E5C8CB045526BE33BD7CE9CB4FC787848578805DFC8CCEF2

SMS_MMS com.uramdvacs.tavmecvyuf

5F850AF41CBDFF5194D70947E5D0F48039E3170AD97094799E56437F06385C9B

SMS_MMS stmzbgqy.padlhg.hzwxnjg

5F91AED71D11F66C88B685A55D41AC63778A562B838D0D9E7541A2C669C134B3

SMS_MMS qwo.dtqeubgfg.hq

5FBC9470EBF40AA641BB98A6114B06DB5F5F026B5830F8E80479F88758060C15

SMS_MMS org.ekxcgbxh.vqoktlxvuhwecb

5FBDFA957F183D098C7BC0D8C827C7A09DA714EBFC6FAE5D038CD80F332EA732

SMS_MMS com.ieoliuzoe.aigsjgudp

5FC31790C22BBFC63BA245588DDD5DB573A28CFA966AB7FD3929B9B4B5293E52

SMS_MMS zmw.xifjgzmxo.teubkq

5FFA8550F507D3209106990EBCE8B7755A0DF7D94DDCBFDDAADFC576AD807C3D

SMS_MMS ru.hampielz.aasfpuu

5FFFFFB7E56A78E542CF213A39D9AE8CBF325842A117EABEDAD839766091B9C2

SMS_MMS jdp.bqsvqmcch.eaieggmim

601A3D7898FC83468C432A1529655E5B51758FDCC490F09272A51EFA9C85E3ED

SMS_MMS com.gzxzescihk.jhxcl

Page 45: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

601EDE9A7A63351661B512B08B7CA5EB83A5B59B592CD67AC494473E8D347CA5

SMS_MMS asrdt.giclt.xfznihbe

6023E66728873552EAB1D095285197CC88808D24D3BFD3DEB9C26F3169A4B264

SMS_MMS com.cvqtaywiw.zlxirdk

6029FCC65D2CADB1A0D5F0D32EC0F8A5C8B98FFDA3719A5EB35E14F449491F96

SMS_MMS fhwzy.makflq.vrwhe

602BF0A496320219CD826D0CE909287919EB780AFBFCD7BB9224AB65118C3F29

SMS_MMS com.mvaiuifty.hlsfdxv

603E614792CEB624BBC50F84CE8F000424DB1BB0C9193242753FA52D22EF49AF

SMS_MMS com.eadugsaku.uipcjth

60D6BEEFE8F36E58D86B7095D0C87CEDC0FA33B754FD77F06412E322FED08D37

SMS_MMS com.ckpowc.vxjihkxosy

611E64DA2D6FE7E816805FEED9D51B3C2239CCCFECC40052EF1F71407409F5F1

SMS_MMS rfanpm.vpzsmqy.suldqjvh

6151B3425464D85AFBD77601C33D240F502CDD21454055DE726B89AEC9656A31

SMS_MMS com.imndz.plfzdxte

616F54BF862C9A7E5D064F3026B18179F382DCBC1DA776302D97C83CD22892A9

SMS_MMS cim.lvdu.xmvxowqoc

61C5C0BBE6E56B5ADFEDE045B674EEF4E57BE5CC0BC1265B9D72FA75C301382E

SMS_MMS jru.rqh.xnzngrujcy

61E50BF9F4AA8EA2238B162AB2EDD0BF82D8A5BC264E5D041594AC0BE599C56E

SMS_MMS ohspxrb.ordtyj.ahdgk

61F18CD3F50C0BF90C8B2273E5745D00594465B7C3C060BF11967423C4B348DE

SMS_MMS com.msonq.yqdxloran

61F7F703AE3CDCB50C2EA87BDF2A0FD9A6DC7F4D0FFC4046EDD96EFC64A6C282

SMS_MMS com.ldbjvaxu.xwcbw

622CA2293FFBE31D4C5AF44CDB9D04951CB8B152D447E598BAC8434A869894A9

SMS_MMS ru.kzoaaskuuwhbqz

6235A00DCB9E14F7BFA8C67EDD4E53842CF6608A6A9A017C1D40470DA69ADB34

SMS_MMS rdx.dtjoau.yzgjiqkmsa

6235F2CE43379343C34B72FEF0E2D4C282D00C69B1AE3E33DC0D44C7F4A3AF2B

SMS_MMS net.yiwdfseensuwsw.iodxlrsmiefg

6257204699E6CF0E610454BFEE6099E88624DCFFBDD89816930FD2E091E71BCB

SMS_MMS com.bot.suka

6272BA2B25744960FDB1DB0B175D8B4D5EC0F4DCF4EA49DA76734167FF5F4E21

SMS_MMS com.vedkrbzqw.fvfjmc

62DF7845E2985FB1BBE35757ED6E5BEDBD9C3EB54DE5097784F9B71D0C7EEED0

SMS_MMS com.hryhm.vtvkcj

62F4D64BE776DAFFBE4B9EB90DF30E03135B9 SMS_MMS com.jkveoqi.yoznrkwxq

Page 46: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1703B19A895A7B3FBBC3E942A03

633C0FB9E07CAB1A22BC983A96A10BF49147CA12FEA18A818248A85E8404EED7

SMS_MMS com.nzcoa.iqjyztpge

6353B449C91F9F133F59CEBF5531CB2A2E681265B0042B1EF4D91BCF611A098E

SMS_MMS ixlkm.qfjel.scber

635FD4E3AB8C85C796D87D5843ED9DACB7BD396A36AAF3E53966D35D2F814E3A

SMS_MMS mar.dshsedq.jktyrwfe

63645C6F701D5A7C350E0747848C21D1A85B3F1955023C9D3759CAD628CEB413

SMS_MMS ru.adxbgqcffw.ilbzakfvdh

638DF5526ECDDD896BEBC9EF6A836A91C1358FD7FDB07415D03C0651A8BB276D

SMS_MMS kvd.zfwotthzew.ro

63A6606257CF330AC454E6CE53092BA5F967764F232A67D292A332A083BC769B

SMS_MMS kfbmw.dqsekzh.vwxli

63C3104FCF59E4FA9D69D5D6B7B8DC37E0B995ED31952033190F3225C567B202

SMS_MMS com.rcmncea.fdvsyzyz

640F5E65BCC00699C717551964DA6ECA095B564288720D3C029511C25A9AE0DF

SMS_MMS vktnsour.ethwdk.uwzaygk

642B9E6EE078B501BC672A7ED56D1404089171706AC6B72503821F3D64E1C716

SMS_MMS com.vysniaegm.refxqmxsh

643B97115DC4B1B9CB60406510472B811AC29EAAFCD8C4EBF472CBC3746B6377

SMS_MMS atqwpxu.axmshv.eajycxgt

64AE3EABC17DBB74DC9137772B82210EFCBF56C3902ECE3D761766D390D36E33

SMS_MMS com.otigthdm.nzmnq

64D3A981D49F6DBF838DC1CC8484FE30972FC25EFDDDCEAC3232D7CA3432D11D

SMS_MMS com.dsoxtduf.aesjh

64DF2324C65DBD0E5B43F847E925D9DC1C1E74AB3B39F8A935EC73C1705439BD

SMS_MMS com.qekmx.cqopmvcdy

64DFFC6512120CE775F1B491A3E521A3EF4E5B6D93FAEFF14CD23542D1E43224

SMS_MMS com.gwpfhq.kqejvtxk

64F8A1D00910ED6208D68C858F414C9175C78017DA4D08BCD7A971F26AAD3D31

SMS_MMS com.twiyghzl.vjtdel

64F98A625185A0A3753E808188F34EEC409D08FBAF1BAFB0E1E6EE8DF87E675F

SMS_MMS gyozwrje.ieqdf.ytnsjwdm

6508B83FDB16B2739F3B5FFEEB534EE810B88C8DE4578BCC7AF052F31C989147

SMS_MMS net.laestukuonsseg.uflbvnhympbni

6509169028D54283713C947360530BDAB2DB23854EE0F02AE7C827DAF77EFE74

SMS_MMS com.eyvhv.xbudsx

65112C646BC7F9AF6A680ED901617A6B453FA96857F1928E3D990981A47A8144

SMS_MMS com.azfhplvlp.ugpigxa

Page 47: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6571E79FE6C5879037D5718AAF23D40E3C32C951BD3718FF2D7CC7F6FE6233CE

SMS_MMS dwu.vdwoi.innzzqrktx

65790E5C7FA24DB122254F2B1086F3330E83FA6E44465A34F796DE853EEEB280

SMS_MMS net.wzmktnbdwdjkxs.kvnmxtyrvhv

6592B9B9A411CD5FB26D17B36E570E321102943CDF2A920A1CDE633DE15857ED

SMS_MMS com.izawgp.ubegqosmyx

65975C72B54444072F61EB2D7990843D22BD41D3F8A5E05B751E44155F8BCF7D

SMS_MMS fmyno.mcibjrs.otwcmlk

659C88A39F89FA37AB7974F4D8531A0E9FFAD639DABA6D7CB97B277C5F44501D

SMS_MMS com.zfyau.xbtbhirges

65AC20903059224A9E7DF4438D410CC8BADDD456122E6C7ECF2997E585E1632B

SMS_MMS com.isxqewrqe.daunr

65E09BFC8211CA3AECFF99284AEDB6469BAF2EA1759E614520601E498EA23955

SMS_MMS wniyjt.ulhaonw.cxphum

65F6B3DAD674DAD270072FC46E81F0134F2F1CC7E4E21F1D1007FC0E99918F7D

SMS_MMS com.dsnbhtdw.iudju

661DF7B8729D556CF617B9D450CFC96945B7CF75A251E2846BEE2FD1595FBA1A

SMS_MMS yrmgld.qjgzslm.pxygkean

6644F7C39CD2339B5C80DB3FC9393E430FBCA667F0004ECBB4DB9E095EFE3D93

SMS_MMS net.ynavacsxjcfjcx.vrsqcniipiiykv

664C35CFE61007FDEC9399478602F565C1009CD17C7D2A3BCDC0753482B9E045

SMS_MMS wrypj.zqwip.ofejbwp

666400DD388013F69E32192BE938294BB94208E57C3FCE2815A2CB453CEE64DE

SMS_MMS com.xmjdxuvyntm

6669EDC2B8845016835F913DA9120DEC1D066B46A1A97F0947162F656B95E829

SMS_MMS phutgcm.phdrm.mqgdp

667A694EAB8B7F5FFE84DDCF97B1E898A75CA656AD44878D20A137F10B70C225

SMS_MMS io.psbpndmlsp.cpcffhvi

66A14DB21F4701C8F016E6B2D9606F437E49C0E80D0DC6DA773561C89BECAAEB

SMS_MMS com.xanfmwubfc.odnuis

66F192D6948E9D8363483846669709E2FAE4EBF6E3EAE2E378F0E5167A0A10C3

SMS_MMS com.mkzteqitg.zdceasj

66F1A1BB238E9AF5AF2098B4BD4960F25A5B3152BD851368AB8B6339D69E0D79

SMS_MMS zslcabhr.pcdbohs.ejdpn

6714F0D229D32F42E2123FC70C40EB8ED886723A71E13E9DF3BEA03ED8FE4AEA

SMS_MMS net.pvvkukbro.hcqlphsilm

6746536D1B52DC589F68E9CF8519885BFCDB24C01DE575788E2D46BEF3B80D9D

SMS_MMS vncwlpza.gxhansje.pmrgtv

6787D7E942223944364F92660ADE02E20DDF5 SMS_MMS com.hgovyo.umqoueaxt

Page 48: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E731AFADFB01F01E330452F9073

67B00B777196F881295F962C64818EB88D89FC82760B9D56620B2FBC4E446BA9

SMS_MMS com.jizxve.vyewrs

67B8CB7CAC320C1B6CEE7B75090F637CAB399B0216DE827C8CB703F60690158E

SMS_MMS com.zjovir.yohjfsj

67BA5AAEB6511AAF55D0E58398BD0B3273071346CD490B4E7709E0073135410B

SMS_MMS com.nxudesqwar.whexl

67DB1955869891EB21E5EE5D2D1CAAAB7292EEB765C9C4EA41615BB792B9937F

SMS_MMS wqvkfpcg.nzwrg.tjesv

67ED349836BF093373944FE0397C37BD29B0230292C989F797F7F726FB411CF7

SMS_MMS net.fvmucpcdnqrktfg.znzkdhfivhgev

67EEA9342CE1F905E68E728EE022A3445000499DC6907AB1A5AB246F61710B90

SMS_MMS lpo.trom.khdzjq

68350B34E28E3A1491733507F73259E8D2197FADCE9176E27633EF458ADFE0BA

SMS_MMS org.qjxwylkh.lykfocwt

68698E6FAEFEE9D353E79DBBEB0630E3C707CF81178451050E7BD6A1A730AEDF

SMS_MMS io.odpdsmqr.nrriozfnpnczjlq

68850E0B82631EC84E5C3CAD3A0B2F336E1AEC5748BE2DEE3FB6868E18D7C6AC

SMS_MMS vpfirjch.lqowef.diqfhx

68F571C82C0E9D6CEE04680274413ACB1E42EC6B32BBEEA3B4F963F7A04D65A3

SMS_MMS amzeqon.tdrmfv.uaprldo

69556BAB3198D3FA263777C651A2172E67551927046ED42597C23A961C3E35D7

SMS_MMS xrd.lbluf.hawetvvni

695EEEE695B4472CDB0748FA146AE2E13CE08F1D76D00CAD52C656BB51EB6281

SMS_MMS com.pghgyrk.jlnbvrap

696214CD4A903D04E73FF4B29AE4FFFF8D171ADBF034355CDCE53575D7CDE7A5

SMS_MMS com.nwjzlx.dprjxejo

6984B7CC84EC07FA60588C5BAB1F925BF857F1614715FACCCA68F0599D0CF6CC

SMS_MMS org.vernbnctf.twdkyjqqfuayucc

69879F97D2E65491E34BF8F8B2997F1A12DCD4BB1DE79A6609E49049D5E9886E

SMS_MMS com.bozgioanp.bwsejzgk

699B62D2A70A38DC3E8074D54E8C3A971C2F941A4F6D11B1678636540EC992DB

SMS_MMS com.upfsm.eoczpfuzr

69AF2522C5C7CA9AD9B385FCA6A6CC9D826FC16101B018C957AB856A34F6B6CC

SMS_MMS com.tsiqrnbnqo.hwzwafrtiu

69EDD68104F2AD865BE590D5AB9C9E03AE871B06ECB63C5A585C5D4F0B92857B

SMS_MMS pbntilks.sjizopn.moflzhg

69FFA793A2E1BED9C36E450649C0AEF40CA4B2A914687EA6D4316CF17BBDF4BC

SMS_MMS com.rcyupkew.lzluy

Page 49: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6A6F66ECCAA4227F6EBE96002E0DD3200E1A5329A7C8C5277458E6EF32055BF5

SMS_MMS iegbhmk.abqhuzm.akndbev

6A991E52DF70C0C9226CBEAB5122218C47127FB0B325913A96536A92B775F00E

SMS_MMS com.igecvwq.psshnvkhjck

6B0459C0F95E6CFEC88A87B98006771A022742726A1B453D25E823455810DD9B

SMS_MMS zrtgd.usxzd.uvaky

6B352C9427A1D36FA79D699B077B9CD9282BE6E7E223D7BE57983C68253B2DE9

SMS_MMS tiz.vnnh.cldu

6B3ADB6B1F1BAE4E8F8B32BE86F962BF8AA19BFD74E5D14F4AF8E6DFEB1CD483

SMS_MMS qpxsbgc.qeowxfy.revpw

6B61563AD8041D274B39D463590ACD3A84BD72B9B1931D3CA518A391EA9B43E3

SMS_MMS ru.oymjcojdod.nvnmscdstayym

6BA3F3DFD421034882D7FEA39340A14A73E0F7AF962F7C9B8ED076B435B3F8F8

SMS_MMS ru.xsscsqqntbn.oezgmdwpms

6BB0BF9D1DC22A0F04153C231040C27D9F1796FD8E038132C3E8AD19572AEB5F

SMS_MMS com.eizazq.aocrwerlr

6BB71A392FAD84CD21CC67E9FED9D59D208E4F11787F8B1E4FA7B57ECB2953D4

SMS_MMS com.hbshvhdk.doqegcbrd

6BD2DB1C3F24CFAAA8EA2F82378D36F76CC1433E8AEEA233299CF15D5B8BE7DD

SMS_MMS com.omasrbraps.hwrdhjzo

6BD491EF1EF88AFF49ABD173A2B4B8F85E3D8EA537C622EFD64B4D80288FD587

SMS_MMS rzpifqa.obgitfk.twgfskuj

6BD90529AEDBE00E357C4D45666974825E83732A063F25717337E94F179471DF

SMS_MMS wuqinlo.fwztumgh.cyutqx

6BDC6BBD3037952F2A02CB97C313DB5AEFDC704CE66AA95FAEF5A3448A286477

SMS_MMS dryvoz.swpjvn.gdvfbimw

6BF9C5D8F0AE4E8C5CCF67F50A038EFF6E44293F9F3C1F7898FBDDBB753427CE

SMS_MMS cjy.ofiuwjudxa.zvtlbpfpy

6C00DEAA880664F2670A427C1FD227FF368557EFB681CB3587EDCDBFA315D8C9

SMS_MMS zhr.ft

6C0EA83BE277BFAA1EB08C49B311539B627480D9E230C2A84B25E82EB3F8DFF3

SMS_MMS srzgyeio.qiwgy.osgmlb

6C58EA1345686B53F6DEBD62C5468E2EA2EE711427C87A2ACD9695500D77CE11

SMS_MMS ios.rcypvvusif

6C6529B9A588712F7162D8BE4D12441E7416D196EE366FDC6617A5D2FEF818DB

SMS_MMS xstvwmof.yjmdfe.dgswcqbo

6C6D5BD46D7697A3B714D2E1786DFC6040F468291A0D6AC4C945ED9013E4363D

SMS_MMS com.trnfrncyc.fiqltg

6C7485392BDD4194E2F6ED53CAE6AF1D63EBE SMS_MMS otn.yfawmfxmy.pxfwwu

Page 50: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6967EA414DB5ECE1C0E67D117D6

6C8323B46F2B8F45D8524C783EA68FD8799CAA1DDD57B796D6DEBF40CD8445BD

SMS_MMS com.ohzau.lywdbz

6CBA7928D125D6666EEB940B38BE93A6207C4F5F9A8081843728ED43F4B6B463

SMS_MMS com.ztkevidjsr.ajqxiyf

6CC2BA911B596E3418A5DB2FF23D540DE21B00F7FA623EF05BA305C23BD65241

SMS_MMS com.nvmwypfmdu.fgoidzngwf

6CD25F24F9A109AA3A8A71C05560C3756AA13214C7E4F71AB764CCDD069B4A54

SMS_MMS moyxwv.capzjry.mbhxnruk

6CFA03BB6DDCFAB1B1B9E96662AD8252101E4CEDC95B20E33787C28CA04921B5

SMS_MMS com.fechfbk.jrvxqcezas

6D14FEB265F434EE1461218505D572DCBE767BA10A35A5AEE29DD8A310777AE5

SMS_MMS com.apqybmji.xfgnuodzb

6D1FBF8E56AEA60EEAE643C526B03605DC2BEBE9A2DA324CBB038662C8FB11D1

SMS_MMS uvrwqbok.fguarv.cjsbm

6D38B4DB19250BBDC1480C4B19DFC4CA9FA11F3C4922C04463C2A5E534DBC95F

SMS_MMS wsqxjyk.lrhnd.apjgkyim

6D4C3FA49842D867B2A7739346D3A53EBBBC2439ACCF758C283D0F34FF8160A5

SMS_MMS msy.uelxszyqc.jsssmimyf

6D5509160989CB75106B7A75634ECA6EAB4D0EF9E77E87A4516E1B3AE35E3D1A

SMS_MMS com.osrljvsqd.dwkbr

6DAFE2B81F5800DD4AAF9F90FFCC4C03EF420A5A8D089EB5EA293E72D5C67DA5

SMS_MMS awo.cdcqserr.qpkhbsvl

6DB686E379A72831C07053FFFD420D2A666C22E6F4DE008785ED09F74ACCC755

SMS_MMS sxzinq.obpvgfy.dseal

6DEBFE9349B7E6A263013581EEE9D7D9666F06FBBFA1956596BC5A9C55976901

SMS_MMS com.svhmpmbgk.lmruyp

6DF8A76C67DE2A576C69573BEDCA22B7DC31FA6D2F773E9CF4B0713EAFC6ADDE

SMS_MMS io.iukumbipkxwn

6E2ABEB38A98E92661488228103788FF411319D769CDB995242549CEFE1BFBB2

SMS_MMS com.hfoktj.levsrfzf

6E66D30FD6CDBA3991E3EDF27B3604A30FC1B479B0D4CA4A02E8C8E4F33440D8

SMS_MMS com.kphphrjse.cbibramjxh

6E7AA123BF92CF1B752D47641A0A82AD170D738212452622543BD5AC025FB1EE

SMS_MMS com.gjipirc.ctgiycn

6E9D0C0A5C7A9F74FDBA2B44EC38DFC7BF838BE5AC6DADEBF81D0206F63542AB

SMS_MMS com.vqenje.fmehxegez

6F13230F66A3E869721943B8EADB0589530712D23DDFB5E5AB18A36D62532474

SMS_MMS com.xldea.gqdqoeir

Page 51: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6F33E31CCD6FA23ED3C197AAA0EBDFFA965418EBB56A206DE376CB71166D0586

SMS_MMS com.mapbpzw.nrfajc

6F5F1CA6C5C9D3B0E3BBF08F95328FDE96F451082934B274F77D8E4093B7909B

SMS_MMS com.lrajpwtej.yrnfapkw

6F658C5BCA54EE244020146F469B101F84A5860588926D62E6CF900B7DE07893

SMS_MMS net.dkkmgltlo.slspqkdoemgjir

6F9B8A95DAF7D786271DCA04242433CAAB0519E7A29ED4919E52245B27C33348

SMS_MMS com.nrtvlzufbv.ivwgnfpv

6FA33A941C07243786C70AFFE8341A1B4DF5E3354ED5515DA1D9BF490BB3AC07

SMS_MMS io.hximuwvdfpkrxb.fhnuubhdvjz

6FE21F08772B6CC7708B7A34A614E016F0C4D8F6AEFC418ADC8BBFD65EF7DE25

SMS_MMS com.yzptytbxj.rhpcsvmedaeuop

70FDC29726BFE9ABD7A1C489C1052507476E5D68ECF5829C6D72300CF0725D48

SMS_MMS com.ycbqylzr.vpuqws

710105EF38A86AB3FDA98A6066403340535DEB457DD19454276B826A1F6DACC0

SMS_MMS hop.vwpyxsiih.on

711FB7F3DD49F72D4F5590C42636717785178EEE9EF366302074E32E06B8E59E

SMS_MMS com.rwquanurbh.imnoqcgy

71511E5DEFFD094C19B91B1F8056F7399C88D0C5F388DA242184614564916DB6

SMS_MMS ybm.spmeekp.plrhjjogj

71617712760BD2A0980F1313E2781418251EE27CF7BD539CCC48C5D5798D7B28

SMS_MMS vjt.ykccpnrgdn.fqpxzley

7167BF1A7E5220C86E0EF0498AF0C9AE3BD1E7E81C7D0EF58A1106E2ECE7257D

SMS_MMS coa.xrjujzk.pizu

71739E46C043BB60C7705723E5CC5521BD5ACC65D41327CC3352976939D8F55E

SMS_MMS com.bjoqovxfbo.thpubrzv

718024AF277A9AABA92732200AF14D4316DD40E2EC2B3D5397E8879B985F99DD

SMS_MMS yjmho.gdsxpnqj.ucqspt

71BC7D599499FEE68F29C16CD5D0F1B648B6D5E1F18B0D7E035D8422B1225B25

SMS_MMS gty.jbthfcgya.lbe

71E8A806D2581096A12DE865A2AE521D3445E670F584AAC6C528A06ABE4DA088

SMS_MMS sjlfc.ikyom.unjipxh

71EDAE397C75A5A445110597B9D0EAEA8039194ED2BE2BD80311C97D9D200094

SMS_MMS com.slxet.oyfil

71F3C9EE8DBD2F2A0C997C70EC7987D51CD2BFC80347D118FBAED338C00F5C69

SMS_MMS rny.mcpaafwv.wm

71FD23AE91B8821137F2B2C88B0C86FA0DC8F70D9E201CC50ACEB34365C48FC7

SMS_MMS com.bevntrf.hwzwnqj

721C6E6FB1F5D101BC9A3A166F07D098947D6 SMS_MMS com.asghdgnb.ekfldgist

Page 52: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9A7D939649296BA50B5E43DF9DD

72261A93EF3478C32F1D9AA5D1F376E60E1D002755DBE090807DAE54993D4EFA

SMS_MMS com.ijnmnxgox.fotihivh

72442302AC30570CB4330A7B746087D0E055AF3CEEAAAB2CE3F240CAA4215BF0

SMS_MMS com.hdjuqdkz.ahfcph

7244A51F52B669CBC4FAD9E4A6C17A4FE8806F1F25726590936BAA9B01B2819D

SMS_MMS uqr.mccqgqzi.fzzfuktkps

7289ABF0931F52E2AD162D40AF51470DC16AF231929FB6F2B8272A556C873792

SMS_MMS com.uuoyzzehbydbpq.ljhnietn

728EF1824D6A980A850DA80225D94BF67904E076C0D06F2AAA4E179C8375763A

SMS_MMS com.ufvnxtmlvh.lfvdhlfq

730009F747F5D5D78B0F525B16C49A5CF785EB060AA4EC6124264F0A377E4A45

SMS_MMS com.teoke.zpjtzmsoi

730D92AF4E6AFD6BF89487C09550FEBDF76C97DEAEFCB29774D8A0225BFBAEC0

SMS_MMS com.rkxojgz.yprenf

73180F34DEB934B1DCEEBD987752E78F8CBCDC230E2DB418284F0638DC92B697

SMS_MMS com.bqasrnzviu.umxvpgr

734BB861A9E57F1A3A7E147461755B0155A1F12B9AC42AD86FEFC88A257141AB

SMS_MMS org.dpmrpkm.nmxzwpokpdqj

736FA2147EC6C81B4D6B34EBE3A8D9E79C22B13B98C5DA03BC46A6AF8774713C

SMS_MMS com.rgwowyqnar.dsanh

739E410E6CDFEA8F7868E935973CDAB4F56C185DC03F8EF7062FD60682F08531

SMS_MMS com.oqduhji.iyhsg

73EB7CAB74CB0F29B765F808866BC8E29D47B848F68D49233F0FBE2D247D8B63

SMS_MMS com.lvdjspxg.clbdbnlybj

73EB9E65B8DE777BA77CADF6EE0CE9DACA040E0B64897F49ACB455F54871ACF8

SMS_MMS com.yolqj.pxfqegpq

741ECBB0B9951C94AE5F32B82AE245D1F50FCBE315F36BBAEDFA90CA62FF9E1E

SMS_MMS net.pdweyrun.vfdaxvdnotohzts

7459B5A63E401FC4B3FC2F5EBCDC05AB00D779F235D547BD7DDD2702FE05E105

SMS_MMS com.rudlnb.dxslvi

7461B958F1749527FB8D0936D4CA73CD9AB4C38E21FA4C79F23CB74EDF7EA0A3

SMS_MMS com.bfhnjpgujd.svdlkd

747BBFEDF082A1FDA701CE55CEBA4B2B347751E90BBC0A22472A8AD7777E529F

SMS_MMS wpfhm.chemx.dnmxj

749027AFF12504F93996B775D12D3FED672D939C34FA948412F987C49C78E778

SMS_MMS net.bftrzczslbh.vgleppz

74916D316C4E485655E35E275EF47AE9F19CCC6F4D45E4EEF4A348B989A62C21

SMS_MMS kqm.gfos.yendhjmpuw

Page 53: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

74DA03F1FB8AA4047A94A652B6D742CC999D36DAFD67C7E0F0B744C2303E4AA9

SMS_MMS com.tboin.kdjpdvb

74FCE18908A20FD63278FE4CECB00DDEF9BBA8EFE99B812CBADFEA4B03CD5A1A

SMS_MMS net.rdgydypdxetvgsn

7534AD0122011017057F3D1114C081D7749045E664876CA50A36628B7CCA073B

SMS_MMS com.xivrd.ucxwrsace

7564F305B8B2295AFEFDCB22D300C653E52AC13321AE50A6ADCFF28535E5D11D

SMS_MMS com.bot.suka

7573E83E4D09357F6E89CA311C17AE5CF117ACF02C618AC9BBDCE83F23E53BAB

SMS_MMS aupfcst.oqfsrnc.shqugj

7599B54A7621B8B8EBB1FD767A974DD4C10AEEB876AFE2AE3262A4309B6A6231

SMS_MMS com.yktmid.poiktzc

759F5C0E0BD898FDEA00127A9C92F3570FF3862B708CCCD51511A04F7876C651

SMS_MMS com.bot.suka

75AD3BC9E0DF674583324B8169461871BA15FBA742CFFEA1E0B06F7652967DCB

SMS_MMS pmqkyg.qrfbki.pzrmglc

75B5C93507A1710C21F6E27B6197797C6583418903C16F28F7B3846975C08F67

SMS_MMS ghtjlrz.vbfjhuls.hadxq

75B648DE5DEAF291B5F8048E8903F598BA43387E6CAC9669908849F623CADA9F

SMS_MMS tsfea.gdcxhn.mbwrcxe

7604440AEAE37AAE78EF2C875AE2597E17F7C91C02B870F8A795954FF1BF93D4

SMS_MMS ukcjro.thawc.anutb

7606890C7CCB57BE5C63C91987297CC59BEA3163C732F594267664C6542012B3

SMS_MMS ru.qtnofjqlxgsn.fzptbzyjtfcpmla

760E51880DE4A409DA8FF26DE48220BB538DBD9429DD9B7FE8CF80DD281A8B50

SMS_MMS com.smrqurcau.tgwqxbycg

761ED895AC29228CC913B32F7D7F5905A43DD511F680A39B1D4D745844361D6A

SMS_MMS eax.kqdonahcvy.xucw

762A24E9E205F0628D447588E35C2A2C70AF6210D81D1AF428A3AC9079AB9817

SMS_MMS tfmjh.olkhjrcs.fosgjh

765882663BCA007C54F84089DD2D21FAFF80315C279E0DD948A901A2F214185A

SMS_MMS com.schbiyonniblot.ywhxqempniiv

765B80B02FC8F9C50D14C9C46EADD477A6379F4C789C63F1AF87F9A86411742F

SMS_MMS com.ofrfw.xolbjblse

766F92F3AADB42604F7B7CACD0D1EF7F4ABBA12D170BCEA81E29B91090283840

SMS_MMS com.ztsalfnf.tpgjyjpsh

767EC17063B48A604CF8AE0236A8B8CBBA49A3B673714CEEAE4D89D25E7F5AAE

SMS_MMS com.uiahuwrc.xekbukq

76A98134A633CB20A73068678635FDB1FE7C1 SMS_MMS com.rdzlxdrz.kqryb

Page 54: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

11502C208FAAA4006D7522E8C95

76BE059E853F7B846B5F883B1930CEC9616DC4FCBE57ED2E61A6EEE2142664A9

SMS_MMS net.lwqnxagmemlbwwu.ibretpwftwxgqss

76C87E91108886776F8DB5B66E2270854118DD24BE68978374AB2AE953699FE2

SMS_MMS com.jynftpv.zdrnj

76CDF63B38673A0FE254AC5FCC16060BF51E2BC925BF2506D959D508780AD35E

SMS_MMS bdymv.czohtp.fulnib

76DE181C7A1A6965CC9EADB2C62F7BCC90E284521D92BA30FAABA589315529B8

SMS_MMS wuy.kbabtq

770D7957B1756D5F932F88BBBBF9E1E5DD388B5B3ECE08495EBDA668B07F7B7D

SMS_MMS com.udoulpuw.xlfuilqojw

7711E7C2F0C345D846D686919924EBFE3A1C211463822B796BF586EE4F815687

SMS_MMS ipqsczj.qurlmyc.gqkpbev

774A18D3B35CD90BBF081759E9ACB9884026531BC29E0BCC0DBB687F50095403

SMS_MMS mii.qixifylrlk.htpts

774CBADFA597C9AEB67AC6D7B9DF220B2517D76338795E64C021C9B40C382AD1

SMS_MMS io.peixbqfcvbkwqt.yuidqmdz

779F2BBD0D9D523D140F581206273F806699A8E718C71AC8F10234BC2127360E

SMS_MMS com.hzfyu.qajxdstr

77CF63A881EE0B3ABA14333BBBB36626F9192F5BF27427A7ED8AC8012756E671

SMS_MMS howyvi.pbrjnq.mkuexzq

77D59974630D604D16B73FD23FC32D216673BD8FB7C9F44C26CF64F7A546767D

SMS_MMS uek.rwulmmvxc.ctfbzqdu

77EE1F3749D674571CBC2F213609DFA0FB1C93BB4C5DA193F01FAC814829DBAF

SMS_MMS xnh.gjaax.hcrjhe

77F0409D9C8041F09B53816E3186DCA45D02630A044533F87CA87CBAAD1FD160

SMS_MMS ajduripg.jvbucy.tdhel

77F786DC39C966DFDFAA18521FB08A9B6351CD5B8A28D5F584637376B152CBDB

SMS_MMS com.vbthesljiv.zxmsx

784449D2BF50B6451A8A514A69F30475FC28DB481CAD5FC6D897A411E2C06E33

SMS_MMS com.bcoswnipcd.rdjgq

78561DDB3252BCE89C9B1B8FEA234B20C1489524C2489E23983D1E8A22645E2D

SMS_MMS cztxakp.xnris.xyhknb

786E2E96A5D69DBC06064D436BBDDDAA3A628E6403819854FAD566A6949C4088

SMS_MMS com.dcytdj.gtkdt

78B72A068A5A9A35CB22ACB7F9DB4D138ACC1C7C93B503DD7FF8DB29B12D0A47

SMS_MMS com.reyvnu.meyouh

78C0E9058F24831C3A04D35501102B0C2EDBC4A43C9B6D56A4FC86B5AA39C465

SMS_MMS com.ktphqm.xcjnjymazu

Page 55: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

78DC7C78599AEFA6B9B3BB0758C7AFDAF618A99FD58EB6FC7018F2FC06ECF996

SMS_MMS com.liqcvey.tdzkam

7910EA3D8E128A96A31A057251B3957C74E2FA2B55AFF0104C671B67B233555B

SMS_MMS com.wizekousb.dxkybmogc

7927350C4403F251A39F4DE1FF04768797395FFCBCD201021818C16F3913807D

SMS_MMS com.hzdihsnvb.kjlpuiwgx

792C60C62E5C9A8451F556A0A14A5A6E249F8ED573D80CF2BCF96F96CC352CE0

SMS_MMS lygthqk.xauvil.jdxwc

793B9728FFFD176B5B1F3817697B831A0717EBEE88FCC570AE1E4AEF13793777

SMS_MMS com.krmgmlmbl.zhzem

796F188762171682B803025FF87280306EC0FFAEB0FAF5F52CAAD9A747F5085C

SMS_MMS io.uohcfgzttdnyhgw.izjvpywmaftj

7A0A0B8EA9A18F52F52EAB620E913D37C9BEA34416B82B62B3CC36CBE34D4D30

SMS_MMS com.eoexp.qnafsnihn

7A0CBC6654CF2F4991880238843800F5C052FAD942551A753E74E648AA63572E

SMS_MMS bhieyzta.mhuivjbp.mqxfui

7A3966DB371D46F276BB7057E92BB049A512E3E67B1E83422113FAAA0D920950

SMS_MMS vphkjy.vnlchbw.xkfre

7A7815820949C02EFD78F1462FF32537559B22BFF40D5727079E29DA0DBC2329

SMS_MMS net.iwbsseb.gquwbmq

7AA1C7474D404A7EF87E81638B9DE9739A73E5962D7E54CB25F9D9D3F9908262

SMS_MMS com.rgyglqfh.ueqxide

7ACAA95048E5E126180ACEA82DF1895BF9A351A97D191002020C397038CC5181

SMS_MMS com.mwkake.igzxtfxu

7AE68FE2049FF43DCB4D25CCFAC2996BA0FBB09B540314569D26E099EE0BFC71

SMS_MMS dyx.vphfaopaw.hz

7B286123D1AD2102FE4525BA42238355810FDFAECF906E29FD00611A722DD6DF

SMS_MMS zaikhdn.ujvgx.zqdglvjm

7B3977A783F0606F8D2FF33F545E9653619CAF087ED80DDB95FDD3EC9921B118

SMS_MMS com.lmwxuqe.nocebfg

7B69760B200F479320871FCF07098C8ACFFB9D97696CE4BD488F7DED194B22D9

SMS_MMS com.yzbnoki.mghdpyiml

7B821E77F9BC6D9DDDB05D4593560D7B4E5C679DCE7126C18B23E5203CA1617D

SMS_MMS com.keoqxmdr.nwtcgfjdnu

7B962AFE6F709F6AB89E1AA896CFE07768762B225864F31221D70D634E5EA748

SMS_MMS com.bqkdvcze.ukwqbniu

7B998EFC58ED39BACC5362FA26DD4E053B5DB7A1AFB56222F6DC3A7D004196A2

SMS_MMS oyxzfp.upzgdmoq.urcown

7BEC3120CAF5F954D34169512EBF2AC1F6A9B SMS_MMS dolrfwx.jnzho.gnylrfjv

Page 56: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2F5329AEB6050DA87C48360CCFB

7BED9ACC91D002E8A0AEE3AD5B6B360B27CD068671A75F73C2E4A68A49545210

SMS_MMS org.kbwiamribniedev.yxhsfrvgcya

7C0FB02182E44709BF890DE373AB87B10C857222AC45EF2B647865A00CF41153

SMS_MMS com.skorcy.zwlaeiz

7C1EBE3BA9A5FCE19D74DDE131320DF566958FF626D6B348226BE88C2E50BAE0

SMS_MMS com.bvectrfk.iuacrcy

7C210BA2ED272F6F6F15298D291AC2C4E6E2E0197E1407058D236B3FD4E9D601

SMS_MMS rqpxmnv.valfeht.jfovswd

7C65EF8CBD04CB4F69BE33988DC4A8E6CAE5F68AC18142D7E384028A76CBA738

SMS_MMS ywy.gx.hjvt

7C66CAC731E2B8FABE4D394ED893E6D249B276A33F7E742D5D463CAA154295C0

SMS_MMS org.qdwizzantwztsg.mkedzsczsrqhsu

7C69D13CAC35136AC526ADE0F4A137A91B9F98D393BF576684EB69CA66557C75

SMS_MMS com.moaxwdag.xrplhjzo

7C70AD10FD760E540B7DE3386BC30DE3121F1D132D34017BF53D18C51EDF7548

SMS_MMS org.kmvjnjsr.xeiiagyo

7CB1AF62C1CCD15B0FE10D824608E780E083DC166EB35D53AE4FEE88213E22FA

SMS_MMS vnd.pyawbono.zczb

7CC033F1F44AE440D4BF7A7F19E41BE67094F399F8A4586363D2BB8CCBA3B4D8

SMS_MMS skczv.vywbfp.zhluntjm

7D31DB752013381B82A28FBF9D64E9927B169FCA4434F2CB5E07D9E646B057EB

SMS_MMS org.dooorjytxc.tejqprk

7D429EB0B8D696B9ADCC5543DCC07853B709F833ED3C4BC37F5057FF6FA47288

SMS_MMS com.kcnaz.ehrawbx

7D7A1C9A8F601CF00707E7C566CB3D33EE8E26CBA2D43159492E8F5183C5897D

SMS_MMS com.mvmqhk.ngyof

7D9E0A5F57887D03E29A218CF51060DA3A284F2F58673E10C9E48331FA1A484B

SMS_MMS ngbvsq.jiytpe.tfeku

7DB89B96DA5E30BC0CCEA38C7609E23595730B69C10EBB25FF28C4F3162DC4A3

SMS_MMS ru.qwiytmzjk.jnbiqwchwnekn

7E21DF69C5F39AF5A852785484ABB22A7F27F1E6E5FD75069FFC86F4E435D5F0

SMS_MMS rwekui.yfmco.filsk

7E42E5BEAC6E2DF50BDD73AEA8441BBFFDEADD62562C2F1C8AA68F7432175BAC

SMS_MMS net.fangqirgkaafb.ipxnasoftxdqq

7E510439BEBDBDAB184935DED884B61D317725035F4EC07F34D7D792ABA4A94B

SMS_MMS com.uzxjtlqfx.fuyfeca

7E5C9220593A79C77E63E2038B4080348B21271E7DEFF595513B83CE8DEF9518

SMS_MMS com.rbrgt.cespem

Page 57: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7E674FC7C85C47AB2DF429605066196534BF660D0B291FA432CE8243C0DF3A51

SMS_MMS com.ksxgkpjfmy.smfbf

7E8130A742A081D02B0A715861B07C26AFDD7196E05138DFD3B899D8C3D1FF66

SMS_MMS ldxbs.mouzh.tdwolqpv

7E854D4FE631AD20B0FB8391C9F0925C1C0FDB7F5A685A6E59E222B582A77BA1

SMS_MMS com.oghsijiu.waercvl

7E8F92B7559D738E0D70E7D355218D2EB1BD4EF9A693D7BF2A9B1E3FFA78CCB7

SMS_MMS io.njmglfarsljpqq.ofkftqaandqcs

7EA202FF1843B60639E17678DB89553E5C769EF9FE806ECC86A4E6782F35CF27

SMS_MMS net.oszzvwp.ywohaemier

7EA48620C8FA023F3ED04826816BF8CABE0BF629FB38888F47C7D64B01FDEDF2

SMS_MMS szo.zgrg.cqtiazzli

7EABED68755D981087C6A3D74EBA24244CF79675E40BF180DCD55BC2277FB11A

SMS_MMS com.kmpuepb.yqyguzjs

7EB7071FB39F3BD87592E6588DF4B78E78782693E2FCDAFD20879E3FE40EACD0

SMS_MMS com.yhebuamq.slgbmbuk

7EE25269A50323EA156F451B9B8468B10F21B51A24207A33017F4B6B39EC9468

SMS_MMS com.rlfbqmfx.robaetvy

7EEB3A4DA63293C2EF4D716C30CD44C733826B268A8E6FE38B01EBDBFFFD2100

SMS_MMS io.vuwjhexevmhpu.posdkvawxotgewn

7F47390EB33894C5474FD9AB89CAE6A2A734779560C4DC018A46D293F441713A

SMS_MMS com.otxgicqs.zpxmlyimbgcc

7F4B69BA8C7E108591EAC100DCAC86ABFF3C5B3024A906C20F3928B467013998

SMS_MMS figwlhps.xzdlip.zvbtcgr

7F60D67ED6B8522FBB203B55C21BF5267C98148C5DCDADF0F1D7B6D0CC20AE82

SMS_MMS com.tzqzot.iowpxslebg

7F83834C75A69D1A0A86415182A4ACF110DD0B43F7DCDF968EABCBA20A3A7EAE

SMS_MMS org.lhjaacwu.iwjyzpdpzcf

7F881980635996846490EEE8A187DE49A4F8F13EBAC305B99A3800743E08246C

SMS_MMS clj.tms.ijev

7FDC04E047D7E545F8B8446BCC8A3811B3786C19FDB7192107D6325DAE9DFD00

SMS_MMS uhgpy.ztgkspu.cgqzkdl

7FF3A4156728EEC265A9325C390A8820BF6AA1ADDE4FBA95F7581BD415F738A8

SMS_MMS vqafnc.ljuqmrc.gmbkx

800B9322E5D5889E86D67660AD06CCB42CD440B740EAD1E2C6A23F3C2538A021

SMS_MMS fvw.mhloaywimu.hq

8041C9C68D3775285E23C173F50D289874ADA0597F240815C32F564C8F270C61

SMS_MMS ashnbly.xtjacfho.cosyae

80421B52A4B0D38C198B549EB4549CBE16B1D SMS_MMS com.bot.suka

Page 58: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8B243A961C451FD2A2BEC387A23

80CD55731B9C02DE09032107E0F9B28E06D216F55C3BA5E5E89A98D243D4A888

SMS_MMS ru.imogfwn.ryobklsclozwig

80DF8ADA798D745AA48BE8C4BC2E581365C513EC7C26119FD088E6551F270DE0

SMS_MMS com.aoafzrhs.qnfto

80FC57621C188AF810660DAF78F9305037BAC85B9E091FA45496957EA0224798

SMS_MMS com.aodyanm.xgfaouqv

814FF0BC3982E73911007FB684B1F4344D29067C3D14E91EDDB46CDE06524B31

SMS_MMS com.iyefru.tnujlnjbcy

817B79FAFA0D51D7F99525AA51DCD00EC3BB90F52449E02B7756237594404BCC

SMS_MMS fwxobi.apwrygd.bfvsz

81969C177C7ED23CA11DD1250A9DF44073297F204E1686FA0C4BD4F8B476C2A0

SMS_MMS com.syvcfnbmo.qxjwtpmlh

819E7C79AF264446525CEDF7599514800809F2B1B477620F1C6660A15DDEF9E1

SMS_MMS voe.ijrjgpztbg.jhlpoeliox

81A41B50654A97DA55B070A3FB22478EC011B7CB1057E372962C60E5EEE92071

SMS_MMS ndh.rucclu.oupjl

81FF1D8BBBAACF0967951A92E8EB633EA2E134F91DB622FA3405EAD9BC5E4872

SMS_MMS tzpcug.ugrkclm.vpxsofh

8213A2C9EA730FE8B893807DEAD92BBF55BA91611C52CA613679B9C768F80D4E

SMS_MMS ezg.sg.vndzgrv

82476757EF0E6D0969ABCDA5F320440C903D924DA50293A828C42411EAC6061A

SMS_MMS com.yvebg.bytwe

824D8B37EA96219141EA2951FEA76E0F9BBA30F7C2580EC2663C78DE4DAE7F12

SMS_MMS com.oafhbgz.wqbzhgdwmx

826D691E4ECC57E36A262F421221BE10FDEB42B676E6E0176B249F2675D38076

SMS_MMS agu.dxyhnu.aotfqt

82767CCE07ABACEAC1464F52A4682FEA630E72F104394DBCCACB1B8F190BF826

SMS_MMS ybawtcf.xqtbvhmi.kcrzp

828BEA7F6D753D10659DB0A1B1D579A8EE34B2943BB3333D51E0DF8B0B258BE1

SMS_MMS tlhudkqv.atcsuni.xscjmk

82A391E2B8AC443662436039AA30A137085B0A4D8603FAD2660296394DCF5E1B

SMS_MMS arn.wmjtvre.edyfykjq

82ACA9A05831C4EEE933BCDCD3B651B16E7AE17A1C06826DAF90984106D73167

SMS_MMS qce.txuhrzaa.bmgcl

82DE05BCBD57568ED93122ADB3A9C4C4245349C45ED220AA94A2772047FD8975

SMS_MMS com.ighjipivxg.slcqjpmjqf

830EC30F3D06DAD00215AF1F27DBBA3A8DF54D6B0B350A93A87535FCFD6EECB3

SMS_MMS com.swxoyb.ricwqft

Page 59: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

831CA475E1BF507FCA96CEC74FB78A9AE7B8C694FDAAEBCE78FC251F4C463B5A

SMS_MMS let.bqi.vaojifzenz

832279E85CFA1BF7708F1BA42B11237600C47CBC0B727DBBACD667014C8FD5FB

SMS_MMS com.ahndrnjvg.gltdp

832E2416FD14AB603C981957F3C79805B016B3410C38DD18CCDCE7AB7C51BBF0

SMS_MMS sufadp.qahfu.kylwshx

8352019740B3BEF862E6DC1F1623B51BAFCDBA67AB33C0E1EB7EC3E2917AFEE5

SMS_MMS kvy.sv.fpv

8375E19F0CAC56E4E6499DE78F29123762A6DBC08E80911BC562B801A9445486

SMS_MMS com.bot.suka

837C28FFD3EA74EE266EAE50FE4189D08216C2489D67E17AF706C8190ED0F2D7

SMS_MMS com.rzdelnc.jfztvwk

83A265A7BBA6D0632FE97C577BA45E0C387E0A4301C511A7B97C545C23C86D36

SMS_MMS utrkgbdy.svtkpd.kilosfv

83A854F3F96D7A7601FDC00075FAA7B9139116EF21EC19285A8621BDA9C87C2B

SMS_MMS io.qskrtcoteosgifo.xypvydwnjrfexx

83DA2E8AE3382FB9AC6ECB5FD2F207E4C594D92C1458EBEBD1329279F606EE71

SMS_MMS org.qznzunzfprus.zaiyspk

83E4002FD654DB602E6AC5651CBFABB5480162E422AC49E346C101BAD15F11D9

SMS_MMS com.bkemrhpm.qmiztjzp

841A0739919061292CA292F0E00C7327ECF2AD6F2F94093472DEB8A1D3077AB0

SMS_MMS com.lpkufwnkrz.sbpehil

843A7154890A0B8314ACD5B1250F378A3A1CEEDC754FC9E28B040E03A80A0CCA

SMS_MMS com.koaxoxa.ckgsig

84C50F827D243022A5954F7CC86103DFEF645AA96F035CB5E41F9839B71E1F34

SMS_MMS euazl.hjuqpzxg.mvkeihs

84D3E8B593C54396B9DCFF49CF548C9B6CBB1DC91D54B56FC0093579AB0D471D

SMS_MMS com.wiqusonk.uycnjeqbqi

84E67F5051B771A30489282FC80E357ADA24F65B852EC2BDB7BBBAF96EBC52AA

SMS_MMS io.qogneei.yzhwcryoqsdb

84F4F423B77421A125C87459DF266D198AB1F4532583F53DC8A7E3DD0682A2CD

SMS_MMS jaerpf.byhljkxz.smgtizlr

85234DA8F2B047B6A2D79FAB9B7CE8CC0BCCF039FD46591536E0433003273304

SMS_MMS dxy.qzcq.fm

85390652BC85879FFBC7034BBB586246964E7DBB2CB0F42C67C57B6FACE61508

SMS_MMS net.jrwpcogmmkfsnnc.innxvjxd

853DC5DDC453B29AC5EADBB24226039A5BF34B9DFF3036EC797DC9E4E8B6CE2B

SMS_MMS agm.wacuy.brjifq

85904126FE0AEB38257D1B1951948300471C2 SMS_MMS com.hndkjnhr.drhcgshcmp

Page 60: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B3CC45C683BE16C1A81C6E76360

85A54F90C87916DD0C96EB7A2027375866A7980929CE6E36AAF79E6D339DCB64

SMS_MMS com.hlsdjedzmf.hiykczrc

85AA0CCDD52A9EC44E7A50DA757F2CC2040A46313F8DD11317A2B44D56767628

SMS_MMS com.nsfao.bfdaczm

85C1CAABE32BCB4929E0C32DF9DB8332998654C435F0A39C333806F46AEEF78C

SMS_MMS com.iuwmxf.suzeidbdg

85C72F605D8CD5D51C216C7415FA30216A055148BDE117E5B8767F12A777CB2E

SMS_MMS com.jzhnvm.wkxnjme

85C86236E898AC8270399736A363E107C4E33A242E71AE666DB852688AFE9CF0

SMS_MMS ru.mhjbsyjysxflso.rzckffgahuejh

85F049961BCDE0A03860F4BB5961AA95083C305055AC9202CE10E32CB04DA643

SMS_MMS com.aqldsuxyk.mhgmxgvo

85F681857022DE69862EF2FDE272FE06B8CD34B4992F590F2CA2C5EB1FD08211

SMS_MMS kty.nbkzh.opoftqcl

86115985D6D5F3706D97F6BD9160F74D38472A5E21110CEF16E202DC08196AC8

SMS_MMS com.yqfwljs.stloedcgvy

862464BF2D9FC93D9161AFD0821C28066FE4A80F4A4B0F60033C7E4746CA3A88

SMS_MMS com.bot.suka

8636041A2FF7ACA47E18D016A4E3A04218ABC413CD8D793C5D123E8614136F2F

SMS_MMS com.mvgyxhwshf.byafwhvs

864F3A595E353375D0024331A3DE939873D31BC6671987070E752EE577E501FD

SMS_MMS com.luzndv.kdchlmtdbp

865537C66FA2435F2546B5538AD773F7AC954214C3326F46783722DA31E388AC

SMS_MMS jwhnrlk.lazjhy.ufrgzde

86B3BB3A0843855F120D2EAC222F396F683941390309A2FFFA31F0DFBE848569

SMS_MMS com.rqwxnjlj.uybjvord

86BA06C635260653D468870652942D7DF63E1AE297013CAAA3A0680A98E19FBE

SMS_MMS com.tweqir.vaqbhp

86C15B84DF4BB20D48AAA7E362DC7C07443962583C2F4CBCA2AFFF6FA3AE9E86

SMS_MMS ru.ybhqbjvdcetpugj.ipiwmynsweshv

86C6CCD5097DF5A6239B02E886977C90A6FBA61D3BE73E2077E31A742D5BC9F7

SMS_MMS jwemniyz.dojfc.qkorviu

86CABD98A792A906E64D4562A3C0204FCF0D4B23FE1B8D76D16B2C8F3B3142D6

SMS_MMS com.dumflvpzxgs.bylaicqpts

870DA4AFC416D92B139C6FFD1D5A48797870B0115F4A80562A8366763918E5C1

SMS_MMS com.mwavoxq.rbpumtmk

875B77AD529DDC7ADD64CF6E233D0D34E745B4CADDCB6C2EA2BC730D7666ED1C

SMS_MMS com.kedkn.xzjdx

Page 61: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

87BFF0A0B1A2C2B7849BA7314CE881A12A7F2CEB45CD4460525E839CD82E41B6

SMS_MMS cpuzjsbh.cztyr.txzsv

87D7A8FEBB40F277A7C4C285EEF08885AF8264027211C44C1323371F5CAEFE66

SMS_MMS org.jduafdthze.vzckmmkllhcpngb

87E12F11CB9E3CC3761454FBE1DDA850038A76EF7E7A6AB059ECBDD7DD7D5B20

SMS_MMS aoediucv.gopwjx.uacfxil

87FF9300C141FBC5CA6A531FB43B7A04211A51FE2649065D2D36D90A908D94D8

SMS_MMS lartdx.uswyo.ofmwq

88342204D8BC638C338F0A235224A5817F6F09D89523363B49D476FD84F84BE5

SMS_MMS ifj.jutzyrz.qxsb

885376116CBD589F24661C0B2BE6559E4A2AF0747522F3274E2126E6C09EEB0F

SMS_MMS com.tsabnvubpt.tzyvok

885FC67EFDE38B88547C63CB92CE4A1E16EBB45D59D92D478021CD2CB1F5F003

SMS_MMS com.cujesxgr.odphjs

88772D36674FE702717FC11BFFF6343B0C926A07D7E73AC15A01026160D35DC6

SMS_MMS org.sekwizoyhzxs.fzradrtsqx

88865C799D46181178892E545966A52663A1D85A17D61B0090BAF7714FC527DF

SMS_MMS kdi.dluicyyow.irokidbvbp

889717B2B7B2BE5D7E697BF2B24D667F44CCA32C20FE6353C7EFECC8EE602AB6

SMS_MMS com.igomurtvf.knpipkv

88B2A3B8B0F4C42FB0F11A520830C606B9CFD1931035ADEB865BD08B00CE8459

SMS_MMS fme.oubwgjmiqg.sbrhcurvvr

88FE6A3C4182E22BCC3005471A092A74BC5B91D00887F57EBDC9FCB6BC7EB278

SMS_MMS znkxo.cdgsqu.rfgvmi

89273ED4D3CD867D573DE70884B1091218667E6DD83B154E715CE7CAF30F9481

SMS_MMS com.fypuipi.vcaeksgne

892D5B3CF3F869FAA8F94A69E36BAD1952F8E5F6BFE66C0C27FF449D13A99154

SMS_MMS ubj.luktmss

8957BDAF042181D2FE4B1EF4F33C7B64C867E604EEFBFAF410C794D537C98DAD

SMS_MMS com.bplqcpats.zqilud

898C6BD7A309A31DFA4978CEF7CE6340670D94D892F091D14F8D4E307AD6062B

SMS_MMS net.zgzhfdufzhvxiej.atsuhvipgwqqh

899288C51CDA1C445ACB62DF4104AC78B16EFD7C8A94988D4B772EAB10B7E223

SMS_MMS iaymnt.ryobctv.znbpskm

89DF314F9F4DF4A7C8CC0B729277C9FA34C269FAC0B8959548EF1032D8692BDA

SMS_MMS io.ohgekpmp.irgudawyk

8A0150C34C2550CB87C7C87FA57EFFE1B0C2E3FF192EB9C164D1C39CEFAE4FF2

SMS_MMS com.uqaimqwoy.qkdnj

8A180FB59B45ECB88A5076E2A81923BB63C7A SMS_MMS pmm.jeymrir.ek

Page 62: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A402E1097B57B5308CE5404F71C

8A2862CC0A062D5EB43BD8856E2F44B7D721BA2171F73867975A2E6928F82899

SMS_MMS ojvcq.ucrsnp.uvexnfyt

8A5096A1197C9B68F30551936E5671482083E97D7AFD36561AF56B890EA75E3E

SMS_MMS com.fysocsmd.ysbgmur

8A69A56E60D5CB82AE9F9E16DCAD40A12DA9D3F037155AEF6805427112892B2C

SMS_MMS gsbne.nrgcjqs.isxhpjya

8AAD243AA75F49A89ED22BFD4D587A9D4B5501B0313EE6FA91BF978DBCD6C5C3

SMS_MMS com.svcrvkrnt.vasipfkj

8AAFF53005F026D7603508E16E49DB8FDC23DFF78066F60234B5FFCDFB262053

SMS_MMS mfxtghs.tflsr.txkyi

8ADB52C0AE7260789700EFBD6FE995BB87A80865356C60F48864F089E725D6F1

SMS_MMS com.nvjsz.fnrihkeyx

8B05981251AE72A520313FFA6CE8FE386671D43B44833CF33E802E396A1F42E4

SMS_MMS kjndgue.cdoghe.qsrhmzlg

8B08CC5CC0A4EBEB2989DAAD55E83856C9698471E6C8AB67245B5863B9D69C5A

SMS_MMS smfdulr.awkimd.dpwirmlf

8B129E2F7A35E09BC04BCB70898830B02565FCAEF417BA1200AB93731AE7E06B

SMS_MMS com.jtvjakfl.vltpyuf

8B192D0A58EB50A40A3F7068837D7C4555D8E4FF32E5D6EFE8BC823318B28674

SMS_MMS com.xuhjcxw.wdelao

8B7A06B9D0593CC5FC111F454EE75183118F61BAB4F6D80AAB83E4B53C228EE1

SMS_MMS ejs.awowoqf.zrkj

8BA9CDE7893B970F12DD37B3744D0E0E8067BFDCFEA04E07206E9580F99EE465

SMS_MMS io.ifzypxmhnx.mvrsmmcd

8BBA21AE83EB97E6F70DE7309481505A40A06242711B26BBCA40A9D9DC78A766

SMS_MMS pro.capcw.mqvoclvnwj

8BBAE5660A8E9CC2F28858087085A723F8D4DA41616BDF3EB80F6B7FA557C970

SMS_MMS com.radyliqtj.yxerpcfomo

8C06BCD86FA1138B0358FBFEAF95CD7602D7DCB8058CDC835A83990EC200F9D9

SMS_MMS xro.gpbby.qkvafefk

8C12DA42F6089D98BCC586A623DCE5997E9C685C1068FE4D20FCC5E4E668CFE3

SMS_MMS com.ihnvgkdpve.yhdzx

8C3537B4EC02484C2CBA2AFF4B0C0F9A659662C69C139D5D244DFB216FC549DD

SMS_MMS com.drhztzml.ovmeybq

8C4456EF75109DAB934EE7463A84EDB86C1A4C73074B8211FB9CFD451C69E262

SMS_MMS com.hefzkdh.dnbgivmkme

8C560C22A341830191167003224EBC5BBD41DA281AA99402F68F143DFA96644F

SMS_MMS wagksojr.gmnib.bwrnkdm

Page 63: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8C998781A1D296403BE6BD32B33AE8C4FEEF1A7CE4DE81C283F4FD6F27A8F339

SMS_MMS keyio.vtpwem.xdwyhb

8CC46CBE585287C2EA2442DF2815D87E69276E0AD05CA1675F1DEC09FEAC4ABE

SMS_MMS vea.dpwo.hwlcpfrix

8CD31456EF0F106469CD563B5540AF80BB3528ECFB92FA3CEB26DABE78599998

SMS_MMS com.afdlvg.qumqtvqhmz

8D442E0902B9928EC6442CB05FE6F4D4D7A8207876328F5BA9C4A75378A9E80F

SMS_MMS com.ngwzxocqp.xhoqmtifs

8D7A61E850EE2AC687B1C0B025F989C54008F1C4CE1096EB3941AFA079D8DCF8

SMS_MMS dlnsraq.vyuogep.qoaxilb

8D7DFF6C3D2C67C983E211BEE368B19CA472373F930F15EEF0F7EC6E72D557D1

SMS_MMS wrazfm.wuqxhmvf.brzwepkc

8D8955A36C3D520994ED1B27ED8E7440BE5169803740AB1A38706020B47866AB

SMS_MMS okcegzhi.stokd.kneus

8D963106F983BB73699F44D3097BA5D7C0565EA4BD3F8EF36768BE2764297045

SMS_MMS com.mvlfw.cfptvjweu

8DA9AB5D09999E56FF8F416D8FB9E662F8EECAA7F42208E37B6B23ED9784DCB2

SMS_MMS mcwog.utqmcird.gpytx

8E0EE03037620A4124C5E4499DF9B77F4F72D78BB0B8D174F041AD766A5F7A93

SMS_MMS com.unascxvju.mzaugvwp

8E252E1D1C496BBABA9FC663903C8A552AA33CE9B775643031D9BD8450611888

SMS_MMS ektdfnj.ahxoebv.ncyzd

8E4203690B3CF69AF428845D53085CE5EDDB1CD5AC42C61734AC3C1302A56534

SMS_MMS rqg.ilps.dgentn

8E522D7362D3BB9C3F9FA1922E1A044F543A0F9B6F5505797302D06D4B7F0C86

SMS_MMS xus.gdxqry.kjvbzqz

8E54EF000DEDAFC130F3FD59D5E21029B90672A3DBA8E3BAFCF6AB7494E8DB0C

SMS_MMS com.harnzfnpg.rikscta

8E9FBB68EC54943DEB38E2901500866D68EEBBB1C2744C791C9224FB6073E47B

SMS_MMS com.bycwhpzucbhmt.dafqclfxijm

8EB45C1A95B7E8821CD3445BFB132E66E91D7FAC9A297341152A0AE7A7A92DCB

SMS_MMS xvcay.xdklj.zxljn

8EBEAC5DC376102760CFA447787417E6BE2B20ACA2C5EE79508BD07B7FB66374

SMS_MMS com.eavewoxa.dkvsdftzri

8EEA87D51F37A609491550C8303D9CE7790E81DCB152D13586A461B661FDB94C

SMS_MMS org.xrdiyzlua.ibubpwwqicmd

8F068DAD0792BCF09C409FF9CB449E659A5FEF2DAF2C6EB9CEE4C0EEC418BF11

SMS_MMS hjteagry.fzrwpcqm.raopdybz

8F2D3837539DF024CA09C36267811C014C41A SMS_MMS com.xnvbh.gzidlurdy

Page 64: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E41F805D4CFD07A62BDF82524B4

8F69058012D3ED613A080A958CF1D2F872D4651FABAE92241CA906BCCA93BC98

SMS_MMS com.gjtaet.vhoduclm

8F7C7435E81B006F89B90F631A8B84CFBFE53CC241C60D20B65FBC25C66A1998

SMS_MMS xyn.dhqtdr.emgeyf

8FBD65771AB6F1E70077494222065E7628897EE4F3A4642DAE9CCE62864C6D48

SMS_MMS ru.vvrfpznef

8FDA0A0456DE7840120BCE2C80A59AB497B77CA0CAFBA4B064A853BC32C10B43

SMS_MMS kziagf.ncmix.lcfwsdit

8FE26A44FAF5A3579211186F758B09384642BF94F744A1E20F2E959BF4FB270A

SMS_MMS kiwurv.ylcqsu.pkgly

9000367CDF5945A830A8301580CE73432D7153708CF408A33EBC39CBEB082CB6

SMS_MMS com.blmvnz.bwquegtwlh

9016B177C17E56C40D84EE5FE5772C6150EB63C0D57711E3A9926FDFCFDD88D5

SMS_MMS com.dlxbp.qfafw

901940E12029858D299E068F4049F0ED135E6B1B31BB7A5C3F9E24AE29B76D67

SMS_MMS hawiznx.weynlzv.gekupwv

903511BC4EE5B4FB1084914D76115B1886CE4A93D032B1508D50AC44409A9A3B

SMS_MMS io.zfjderpros.slaukzeescp

9040CA508B0C6B895D1014CED46A3777E55BA68247A4B1FE29ED311FCB472514

SMS_MMS wgaftj.nwebhmd.cnhsl

90536216A27E7EB3932D5F8A7DD2D30D4C5CFCEEB23D7B2EF5DED95FB80F3D6D

SMS_MMS com.bihemv.dscvn

909B9C8DEC5DFE62BBB6A928C685C836C29822F15B9A430D8BD3DCCF36313920

SMS_MMS evzfmlb.zjoft.rbkzld

90A3688679233C3D92D92EF45492344CDB0B284BDA2C9BE4DAD8879D0329F14C

SMS_MMS schrqxd.xuiolw.cegzkrdq

90D0249BB6B81DF6C698FCCE0624F0FEFFF7675085BE7FAD828AE396327BC751

SMS_MMS vbw.ylttwdntwg

90D184D3B8088CBB0405F516C0C9EC31AA23A7CEFE6AEC6539B022B7480B408D

SMS_MMS com.ltvliknx.fomxkygcktnv

90E83893F8F53A0BAF769AE76E72A291AE11C66268C76D54A597CC42F10C93D0

SMS_MMS com.qnuqlrol.smubgo

9112E023971C7F8B03A0D7B72C00C8BDCA13E146978C14E3F2BBA2A525D3BC29

SMS_MMS com.fhumq.fgixo

914594BAD102585CACB2BE25A20F21D45610E929E1234F913D1087D56A53F1C7

SMS_MMS yvr.sxiltw.slpsrwyo

9155188AB42967CD7E60A9650A41E203AA150C5A45D0C5AC5B5AD3CC2AA1A35E

SMS_MMS cobwak.ibpcg.amlbh

Page 65: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9169588FC5CBF9531A759FBA148958148384DDD3B0A749F1D72AAEF17F611A0B

SMS_MMS uamhejwl.typei.zhkypt

916D9082989ACC284A850B5C052C3DFA01481A93F2E07B4C4750008BF158A0D8

SMS_MMS lyb.xvflddfwd.smv

9178E919430A4DC1ABE09A387B6D1A27E9F82F78239ED4FC16DEC8EDCF17E067

SMS_MMS com.ufydinf.wfpfavd

91AD938D548EBEC271B41AE1AD8F787D1A82291CD45C323F649BB64713961D17

SMS_MMS com.ruorpisyw.qgnvnwxysz

91C60C39CFDD7C23C62557B10C3DA3138AF542FB67476916F9F7C65B4B2B387E

SMS_MMS com.vyiwqi.lzeoedgh

91CAFE8A06A3F598DA0B6CB4A885CCA7636B0F5213D18A18AC3FB38AE060C8ED

SMS_MMS net.eikvcfemoaqainy.oxoxwonva

921A4E73CF984A15B8FC584857E4FF2674C50C82F26B01591B9D5FF5A8097E5C

SMS_MMS eis.xvyour.yjawifnv

924EEBDFE91EDE99BEE246798B16AD7FB96A108FF92CCA4C99E775503822BD59

SMS_MMS org.tdacyxyvzxqtf.iwfzjgfsy

92948B6243EE80E52C6C82BDF1CD31B35853A95944604C37DC6740E7A1AC279C

SMS_MMS com.iuqlunya.kiyuptafqv

9298E909119AE5A13DC37569A4D0543FFF18E37C5140372375A615BB3CCE4742

SMS_MMS uen.flavnp.qniei

92A134CBA23F334A6B0CC2F4921085CAF15D4BCDA58D7E1BA5801787799D7985

SMS_MMS wyfbc.fuozi.qnhcyxwv

92BC31A2256E02E122809171F4EE5211C21B4C3772F3D36E22B2F40EABA59FC0

SMS_MMS com.axcvmxy.ukodzl

92E63779F0B8B6577E88C65A79023B81716F1309F3690795085D2E9322BCEF42

SMS_MMS com.dobdfofipytyz.fhzrrnncgywrl

931F96293D0E98A3E6E72FB60CABCB5B5BED2E0032479CA12657F40369040C8B

SMS_MMS jixumo.nxumqtgy.gvihp

93211E3DA2FC34204D2BF345864883624EEF38B175F8AA76D5188DC75AFEDEC6

SMS_MMS prmbzvko.dnazk.sdugrybm

945E80A0489B2457E1BBA546000F55AB5A49FF0A44A214BE270CC92E20421F1C

SMS_MMS com.misyjgxn.lmkbnpmdn

947294FB9FAEA40502682F443E952E939AC2A955976CD531318A8C0F1FEC9FAC

SMS_MMS zot.ukqo.asjneuv

94A5DA0DFE5190C6789E57511BC51CDFDF4D9C67CC3F9B4AB2EA4DCF2096AFF1

SMS_MMS com.itqmwkb.hfuqyn

94B6FA203673C9811E3CDB6F43ED9D35497F54B6CE72EA4ED29CDBEFB63B32D5

SMS_MMS ru.bvdlhmzsst.smljwqlirokwu

94B90446C014014897A943F55AEBEB57648CEF SMS_MMS com.emjtsar.taojbwz

Page 66: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4EED1781CAA01E4059D0B00B60

94B9FB7022B1759FC8E99C24787F3E18E46D677A9854A30701F027FC3620106C

SMS_MMS com.bot.suka

94BF3015C6E2D00F3327CC250B9DC7B73478B4AFF3AE77C114DE46A62C838568

SMS_MMS vqyce.jwzrvug.mtbhc

94C8D05D566664FC1D45A532A25C4F45D3F10E1F26D99C742712CE009C430C7C

SMS_MMS rouesw.wouncbd.ilnapc

94E7D3F092507ECCB3053FF58F25C5BE34DE43282A1CC3DF919A25478CA25A0A

SMS_MMS com.slnafkby.wclzrldzin

94F020D76D8EC2FA9E53A0D6DEF13193E592541FF6BF5838C612DCC0A66F3471

SMS_MMS wpcin.oygnvtcm.qbpesm

9515A5CB86DC71D0666E307C0225AD7D08532DA7529B8313CE6F3CF304A30512

SMS_MMS pdi.kjuufkmhph.broz

951682044B835DA1D19282AE7840C22AF001B578510BB66A6E2E01673881F05E

SMS_MMS rjwnbuxp.tpvlio.dbvyntm

9521BD868C9116459FCA16F1C7FC9F7AA9CB7AA6A781D526944B245E441100CB

SMS_MMS eklodaw.pqnvtib.zeqjca

956BB4EB314DE9A1077E3FE5EAA3BE54DEE802F8B558FB6E2FC6B745D0199315

SMS_MMS com.gfkueukbley.sndcujann

95899D533CDD26636F245967FFA6468DA427BA5917E9EFC0D6346A2B0B27EA09

SMS_MMS com.mwrfqbqtzb.buirt

95914C550E25D00DAE0DA2DE1D72EC1E2232D21521C3FD6336B0B09C04782A00

SMS_MMS com.hlvatg.etbqpie

95B7B7473F1A7499B06F04860D7C6E68C40932E93F9360CD5F25FB8F5A1F7DB0

SMS_MMS mpb.nrtofqghte.fxqhmtgewe

95D33EAC80A35E47E510A35B005E00CD709855C42554ADB49F420C704CD13BF8

SMS_MMS com.mvqph.hseaqzsodl

95D927C9C7034E4E01D8B06A06CE638A0D208D60979F2475BCFC03DB4CCAC133

SMS_MMS vqekfp.upyvhdgj.kylfaexn

95E4A982848D87C6ACA02CCBD8F147FE591D8D445F6C77B3C329F42CF7127D7C

SMS_MMS com.kpknwgqzs.kxlxiubsxq

95FE5A989D807A567E043530B18AC5CC86FFC87F7AFC2E39AA69D50E7F47239C

SMS_MMS anijlzbm.iounx.jpnef

963EE42C96A25F4A5413D8C4C455575E473516AA58C55B575E86A4FBAE4AA3AA

SMS_MMS com.jrelolhuv.hiuaojcq

96445BCEE1C3F3DEF5B64EF5C2255ACC6665BEC29770D7130303C99F374983E0

SMS_MMS com.ujhdoeaojs.keitoigtlx

96A7081CEF4A26D2F93F6DB5FEBAC88D839A1E8341144593A89A6205245E2E10

SMS_MMS uob.sg.zxoeoqhx

Page 67: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

96D7D9BDBDE5B21D81D78B9C4092792CC2B8E426D124F3C25198137A1C6D5464

SMS_MMS com.cexbalz.taiwgd

96E472CECC18660D45C11E8F5F84E411BE0357D66F2B41C1A1CA4827376E13B0

SMS_MMS yqm.vjwgatufth.fukfauu

96EEFCB335FD56E593035EF139225AC149F4FC501F0E30CA5A39A0DA29863850

SMS_MMS aqu.wal.oseeblz

96FB9501C2C5BB5FA263D4540864CA0187D692E5DDEDC36452EE0BE93DBEC137

SMS_MMS com.gqwut.loaka

971568B26262B8CF87ADF1B81165B4660A08A775EA727A056BC587331F438E6D

SMS_MMS com.khpum.jouple

976AB85C3793F4401C3393227F7F9C2A59C1A4ADEE0BE85E746039C52C98AA3C

SMS_MMS com.bvpecarjx.gaqvirg

97A0D57DAF4CE5DF4437250701E8A30F42CD3E362C7511E9504984BF9FC27A2C

SMS_MMS dxe.ejk.jenuq

97C0B9A29BDBB0E112F894317F6C4C7534F54A82A2BC5E2337BE4F2D746A34B1

SMS_MMS com.noijjtnudc.cxtnmawgjuhqcul

9835837D292FF3FFBA75FE654C74E66A23E24A176081CAD63EBC94B5A37CCEE1

SMS_MMS aurzdq.eurbpq.sxmkdp

9845D78191E73968A553F50C13CF781C587E0CE5E624A65175DD49F29511AEAB

SMS_MMS gqvjyhea.wgetkabq.sxype

985724C0A0AE652B5229306DCDDC276722509556464D90392E176942E0D26C21

SMS_MMS com.silvdsoizk.lprefol

98B99A026F6C39D1D77D525AF2A55A93766528FD1CBC685047441297E07D9B7C

SMS_MMS fpj.ilguftmmu.yrvebjv

98D029894241F51E773F442593A8903B873DDFE727F982F3B6CD185B3C9F293D

SMS_MMS ru.mjwztyv.hubkdmslucvga

99074B36942293690B9CC1322F6BF1107FCF0ADC8476E071117F2640CDA63127

SMS_MMS vax.wbzgq.zaecpfiqzk

992E792F25D5CC6F34D03FAAFAB01D43A4F04B72EFC0EE413600DE7DD4935132

SMS_MMS rezujp.apvysg.ofvajqhi

995CB51463AF459E546BCB16CF0E601ED6A58F0F1DF20408EF3E2EB96B99F0E5

SMS_MMS ru.jcugjmvcdmhcwug.honenpdsg

998D9760F8FE6AC1CF8EF804C2E98CEF98AAE79BF5F951CF29EFF2681A217A05

SMS_MMS mff.bankbdinf.end

99AD10DF07ED955EDD4D417BDCE07803240BD3FF08C7D2098C84F61E32CF9AA6

SMS_MMS cop.ieq.qdr

99D09897C739152C98C1B4A283D170A08E74827CAA93F408B86D31F28294CBB4

SMS_MMS rfkeg.knvjf.yjfszpr

9A0F743EF56FBE2DA0F54D027CC8B57A1F720 SMS_MMS ynh.zhhvrrodn.ahqfypbu

Page 68: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C0950DB3C52375D7AC7F20ADB84

9A0F96013437C26BDD515AFD88C54C1507B1675F46023831FA651289986AB43D

SMS_MMS gbakwoxs.poclu.krxzy

9A1F96E99A847E1273E615C8BA291331D889A502CF7EFF968A7738AC303506F4

SMS_MMS zac.aomec.htsdyj

9A958C31C084E40E5027522C2D22DFDB9553F91759E98F275EB4CD4CF4F34528

SMS_MMS com.aorys.wfnoys

9AA0BA27F38F6DF517B520E68B91B5BE474E41EC1AF40356142DEFF0C0706508

SMS_MMS vhadrugl.jhdmnwil.wjxhfgc

9AA7ED08981724E32DF166547C93CAB38E8D6357639585F815BD51CF39887CD8

SMS_MMS com.qohnhv.rfpowxtlu

9AAD8D6022BC401EC9C32DE5A515C5FCCFD59455429D265A3ADCCBE7CFA8A4EF

SMS_MMS wzr.tsiagy.zoqrtsim

9AD667EF8F26E928283D24F813F152677C8E4B85247E6CDB6C9668189DB1D7D0

SMS_MMS fytgarve.otygfn.dqeik

9AE55F20E5DF2A42CFD6390C9BC6C40615C23AC7936EDE1A99D9EF8591861DB7

SMS_MMS io.doiopiqihvkr

9AF38224E1C4E998EA44228F684BDB90036C5963E610958E45C2C58FA3C11330

SMS_MMS com.vxhyzvtrqu.vopsylp

9B1B799491A678F2345786DB1E79443759B0D33A734C8272E0297DEDD39F8D27

SMS_MMS com.pxkae.ajtfr

9B2460324F82699833460EE29D795467C1D5C4425885895F906A3B0C6086CFA1

SMS_MMS iet.cvnawjgz.heynjywd

9B329F75816D309D34415986003ECF9B191DB764E052259D3EE920986B95239E

SMS_MMS com.aeftowe.yuektubo

9B349B03F580D76E493042E79F48731748F78797DB3F35BCBB797703633543F5

SMS_MMS com.jpevhpwr.fpbqzblerz

9B3C6363798C22EA261C0A768CD8B44C017039BF69CA9FE1D0C844CDABA2F6A2

SMS_MMS wbd.utqhye

9B472F569205EE349453E17540F008EBE7FFC2E9C62975B22136594317542A45

SMS_MMS com.jajzks.dkvsy

9B5AD33AEC0AFC4AE37F2EF7C1360E924915D42DFD30215FDB39BFC6A42B46DF

SMS_MMS dzjfm.kmylz.puwjtklf

9B8E720BF57DFE2E6C0564E4DA969E652BED0990816588B35691C241B01B5B9C

SMS_MMS com.zmxotexrh.yoegcskq

9C22D4BB847947E3A7A04BF497E2218CC44F024642D2A2CB0BE7840E605D8D9C

SMS_MMS com.zsztmzkf.dstirsd

9C46D3D51E828595E388EF27239A23F7B96B6509EB03ADB614E460062C6F5DAE

SMS_MMS com.gktpwrmv.gesat

Page 69: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9C702AD9DEF94998ECEA141CB3D3FD2320D42F029C1E87D8BB73C9A822B66925

SMS_MMS com.pdkdcfadh.blplb

9C9B3E47E068805E13EDDE4E8AC0114C810ABE4AC890C2F345D77CDEB66965B3

SMS_MMS com.zbwqchvzrn.thignz

9CA0B580A2ED937A7CC7A5DFA6815D77DC79E2C6711D5950F20CCD3815DDBE1E

SMS_MMS mivbexnz.nmzjbu.nvcixwbs

9CACF1EBA2F996A6C7AFD5B5091BD2591231B62EB204376D04D461C83FC91692

SMS_MMS com.fwhpznrauw.dtadl

9CB75D41ECC3D2DB630B0340C428713FC161D4E320AD54119C5E4AFCE3D3721F

SMS_MMS com.pnwudkr.ksrde

9CCFAB96CB2B148173E6800E86788D72DFC35F9C5CAB8CC26ADF6067F191D008

SMS_MMS nzmiq.seqlvgny.oegiv

9CDC7CEBE4D6014C9041FE8DA285A09C6CC6A79988D1AF439B67C245CFBD8247

SMS_MMS dslpezb.lnujo.acdejlm

9CF08723AB53E56703B4A6EE4B263FAFC2EEB17751D4E2E3F4ED6673FC293B2F

SMS_MMS tnkig.gdmuwosn.ljhwnfm

9D03C6008ECAD6650516DEED5D9B554FD8A94896BD587FB28A4C48DD97AB5F8F

SMS_MMS com.ciclqhe.ivekj

9D229A38C57692512A8870EDD4D6B1478E9ADD00D28EFECC2257756F74B7A948

SMS_MMS fuu.ap.usfxxrk

9D4EA26A5D906A418FBE5541F0AD8D8FB34A3084B2D8A1DB6E2F9282805E7862

SMS_MMS awx.yxnznubap.qj

9D5DAEFA781C16CEBBF7A24624148EC0E6FCC3EF91CAFAB5E2391057ABA6C02E

SMS_MMS glq.eebgcuoq.rf

9DB6BF260DA4E58E13428189EBB29E1E2A3CA697F917364C6E7C5FA2A8A3E344

SMS_MMS com.xayomujdkr.nhasgwafbve

9DBFC1947BA5BFA37FEA9A2780C0D93E4A8BD981B1039355937685FC006234C8

SMS_MMS ru.ytdlhlgpxbwi.hcptush

9E02271171FDBCE0640428B92624A604FD2BB1701A9F4A7C731256B2B3AF5730

SMS_MMS net.dqjjxdinnhhegen.yusoisafrt

9E4B8DCD9D7AD14005237B62B20585CC7B2206A76DA25BB0D33E4954E745AFBF

SMS_MMS pgfrsbej.qmealx.cufswtk

9E9894040F5AAD5A0D54F403CBB041FB633823E7F723FCD93344636DE2AD69A5

SMS_MMS fik.pfo

9EBF045C317C0B249B77134FEB7BAA81B8126C4B29B97FC3EB49BD71898FD885

SMS_MMS jpctk.tumwna.swdzpq

9F00E6401F33B5924AA9EF5084C4CCADE1CE9C838141518F2B35E40279C457A1

SMS_MMS com.wrklj.lawjcaiw

9F183FFD246F5B7F3973CC18BEFCFF9E2D2774 SMS_MMS com.qfepg.tzaydrzvs

Page 70: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

23542B8964D1BB4235960F751D

9F1E1C7BFEA4BF016BCDC71150D999F17281649F3D66B26B182402D8AA820836

SMS_MMS mml.mgugjemhkz.kt

9F2C45F9F356B5F945B0377FC9AE7FA29F41744C5E48D58F679CE4934343B742

SMS_MMS com.ewodemgho.zeqzhfiylj

9F4384A19C319BC57B8F581562DD7A35A905F77E6B43AB62F9EA41F68DAC0A9D

SMS_MMS anzum.feais.litvcmhb

9F4D4FACB44A988A40F5855BF29DDE21A26CCD7B5C2122BAAC7B34BF52AAA051

SMS_MMS qfd.dwxr.fob

9F987C3672861A96B9C5619578F19AD39CA953947490178E1CF4D4314DEBB8B7

SMS_MMS org.ttaeenbd.fpubpaxlw

9F997CFA98E4F2E639433DC582B6E610B7917C04DB25E7C24768B7B8BD60DCAE

SMS_MMS com.gipjtpqxh.ragcxleuvk

9F9B56188851AA3406D154A62FF70011B757D5BF6DE9C44817EC08892D1841C6

SMS_MMS syx.eazngaa.tkczwxjfvp

9FA50D365FEE33CAF5F607D10FA750A101F304760B5D929C710E6F1C2D697A9C

SMS_MMS io.cvojmkmqqj.uzrbbmpjrvwptpm

9FB5FE5A1CD3AA82EC77F918B603650E2F557DC1AF3F74303E42D714C3C65336

SMS_MMS vdq.ogid.ftx

9FC5FEB2A15F84DF84B6610A6FB9E1231E734204637E25CCC795D5E19984D139

SMS_MMS puizx.fvmgz.gkqmt

A07DDB6028E67EACC74AE36540C232068A50BF78A7E372B8C39BD040B6BF8C9E

SMS_MMS ru.iwsycopgsk.todixwtnfkayvfz

A08FC759DB72B8C1C2F43034822E092001FE24720B4A338D7421AF932E80AC01

SMS_MMS vkygapu.qdltgnvp.gzved

A09FF74E89E88A142299027710BEBB6DAAE98FBCE8A11ED6BDCE391B579270A2

SMS_MMS org.etmoqflbq.krgicxgsc

A0CA389E8CDAC257765A60740EDDC2E8E7D7A41AD49C0FC5B869E9E2C0E1F88F

SMS_MMS com.hgtswgzfqm.nvbkxfpwt

A0F149B58FF058220F17B18C5795DFC94B6D56EA7C969DBDD000D42169B96CB0

SMS_MMS com.dfabjo.ugtux

A102355870CA6F42BC0C9429A49FB3BCDDCD78C1A187260B72DFF46AAE10BC8F

SMS_MMS zug.gowptq.yc

A1158F5CCA5E01EC70750D457E98460F673A4FA62E5610A1C259F0DFD3644A6C

SMS_MMS com.nvbckgn.qizhei

A1214AEE8767D10938DF0B93E8973DD9F304366030F53C04F770D73817287A89

SMS_MMS com.ehpyvbhkxd.ihefnvr

A129C6BA038BD83F106628AE2B68D7B92FB6AFCD1D2CE1464456BF00459AF518

SMS_MMS com.zfgobjqjy.ijxdeu

Page 71: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A167EFA6A1A2C615E1EA33F155B3D933666EBFE96D89AA23799A790ED9CBA861

SMS_MMS uaekbv.lnows.ofcepw

A193084920BD885596B15C7FF69592BF00DD1ABFCD2AA1C3610629B1BC2E383F

SMS_MMS gng.nnr.gdnxvol

A1A9A6EA69169B86B90C15B4F1C6C472938CA57E5AE127D9E36168ADFC99222A

SMS_MMS com.bot.suka

A1AF468F70D365EC967B9B0BD060B8AC719ECAE680172321512406AC0B9C2D87

SMS_MMS com.mxvzipr.cskxwqok

A1D661A01BFDB569E849A4A490A030C9667457023C5F4EA0B5D8F50FBB30FE5F

SMS_MMS com.droid.lipton

A1F221786C28F51D4B6EC7C501302036F7334AB8EA108C48D951738E970D29D2

SMS_MMS com.soxqbwul.apltyjpla

A205A591006E1C01086D6E3A58D65758E0D679787F16216C6F097B03F1001760

SMS_MMS com.nkonseb.ruhqcn

A208F6585319F9A05CB241E42C298A733B432972CAD3B6FFB480805B9C8E80C1

SMS_MMS lcbnovdk.etkxl.eyztxwpd

A21AEB6E0188FCCDC95C987000A0C814CD5BACA952C9028978D19921DB717EAF

SMS_MMS org.qlcwtdzsr.qzfjjnjpxy

A222F0126A21C149B257771B21D104FAB22984D5D965E9A36E8BE3A1408337D9

SMS_MMS com.xwedqyz.pjchzic

A23BFA9B9A3F8768E85D626996922943BEAE4B3CD9B5109F4D7EBE53B1DEDBC1

SMS_MMS com.ozuuian.rxbnmjfoxzzge

A2A199B6BE7A40882BB9B60725E7808B9C00C8C0BB706463812F408494C80880

SMS_MMS com.jkujv.wbiaou

A2AD6E8D46D809BB9B7646AF45F1165017791EF631BEE6013762FE26508354E0

SMS_MMS fycvwqk.vhibdjz.reqfdc

A2CB99D75F9C995C02A7A67E528813702D7482A92819012EC23B9C4AC7C97986

SMS_MMS com.gpkdune.hdiem

A31CE5F43828DD6E710400659647AF56F1CBABB1C71E3F9493F2EE47807829EE

SMS_MMS cnjvlrs.mcqjyuzt.mbvzog

A3221148FD055779E1297C97150F92A5F9C328F1D64CC6573F1A85AB4901462D

SMS_MMS com.tcnrhq.hegaenc

A3354F3B43975DF68AA0B0109BF141C7AF65B5ED5932E034F6E911FB72C31B47

SMS_MMS com.hywnuc.ubwibn

A33D18DBD442CBFEB51D4632F0E29C94C070BF6EBEDCC193202EA17361E93853

SMS_MMS net.ebfkpdihob.haldjiva

A342296128423E1F5BB32FC0CCE6359AA5388916F81FB2609D3429F5539D968C

SMS_MMS jfybilt.pzlqvbn.nrjdv

A34F23B7DAE2F68CF285DB2C27AA36F0C99F2 SMS_MMS izc.xvrtjqbxo.xydu

Page 72: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7AB251C5E8B0B7135BA06D575E2

A3880C8E60654977AE35C72D56D3BF13AD73488ED18040460390C84E41A3E4CA

SMS_MMS com.koblnet.eptspbeqfz

A3AC91D9EEBC53A90457F6A49DD6101C7E8C5B6B0766D1D8648EF3563E2849F2

SMS_MMS com.kysrjqdt.zrhtgxm

A3B47203F0B5B221F8A773F525BBF48FCC2709A7595F9670E195A98861831A91

SMS_MMS pjqrela.ekfgtoub.qwmgl

A3BDC7F2D17ECC3AF56CEEDC5F652DD4AA6199F439278FCEF76758B7C0C5915C

SMS_MMS com.ekgrebs.fbtgydy

A3BF822ADC29C1A742EE15906C6C366AB83A34684486E007E8E3418B7922D4DB

SMS_MMS com.ndfcu.iefcuzkcex

A3E5C6EFF5D9082E163C841206F51D2779F72A9DB3E1AA22F422E28272BC7714

SMS_MMS com.vcqesam.szekmsj

A408C0AB0C2C4DA0A694F11F4A29613D81A2F5E845555356F9D5E320708A7105

SMS_MMS vzuwedt.ubakz.ugtfexos

A4168475D0F8741E2C28A40C9F7A41725CB3CC11BB09A8B29F4BD1EB5B90AFA4

SMS_MMS com.znxba.dotvcmw

A42393CB8CCA83A3EEAF2FA566207DEFD963E8F9F93604F62345EC6B7FA8B40F

SMS_MMS ieodgmz.yebhukmj.cgbysaq

A4362B2F2006B16F8B3A1EF71F73561F1D7D70ABEE4129FDE5BCCFC08AE203E3

SMS_MMS com.ievwi.wpvuchesqd

A472F29C20DA9BF27E4B3C7FE7955F11DA26C8F4F1CE83081C900888232E756B

SMS_MMS aui.hzgvuga.bfrrwyo

A4735A67390D2BB2A754210C6371FD1544B4B0744B4EB64D9C8A4DD6A435B63B

SMS_MMS com.ygsrikah.hkubj

A477E7C06FED980DFA269C30A3D799DED72A6C81418C2C097FA0E6F45FF0E703

SMS_MMS com.asrpkybtb.oaxfuojypv

A48BB9183967C6AF2205D19DFF7DC170A00C9466BB903D7791229AF884568C63

SMS_MMS io.bewucugrgsqulvj.wphyurbaqnesm

A4EF6F939269397897ACAC21FF34472FD74A3178C293728D1FB1CF31BB5F5438

SMS_MMS srb.qb.ofxx

A51ECD51C4564DD35FD701BCE6829874C3F10109846F724DEAD6DEACD6EA8FFA

SMS_MMS com.sbntuie.rhuiais

A539D25380D2594DA7BAE86A1922EEF5B042F1B4C5EBF9A3473776DF5420489A

SMS_MMS sbmnpae.srjoku.lusqftah

A545FB22559F20C0C2B0E1E8AAB0309793F5E5DC0E28BB4FF3BB27925AD3BEFF

SMS_MMS cevwk.rspxubdq.yrtzn

A54976C9D9E3ACE39EF080FE69A918C6A2ED72F549D1333E41F81DB0FCE0D003

SMS_MMS com.kieaedu.pfsnq

Page 73: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A558AB2C8CB3F4939895307603D449A1E67FE9206A341871A84D31124DEC093C

SMS_MMS org.ptjjzuizxrogni.xuwizuxdf

A5642856B8DD69C5039D15CF1F9044295C4DBFBD0167F98D8FD32EC6892ABB7E

SMS_MMS ewstk.pmixbw.xonzr

A5AF54A7DF4F1C96C0721ECD762A135E7A1E0E87869F838406DA6398FFB15E8B

SMS_MMS lenjkmrh.zprfjedm.yqtuvefh

A5E91C812C993B75F7062C2CE10F350E532F6AF978E06F0390B66EECCC486360

SMS_MMS com.ipjds.kptnwzbuk

A5FB696343FFD8AEB9E2105DBE46597D994B75E2E61117AA89A30EC485148EBE

SMS_MMS com.lgigiy.cboaps

A60BD5EE95C2858A9A5FEEE58DD0DADB900D8E62498F3DDEB4EBB90EBD393481

SMS_MMS com.pdgiclc.oskgptgvra

A662EEE3C1CD96E253791631DA03990B9DF9061FDAF3D34D312D1755F31F5F82

SMS_MMS com.eplzbik.lurpyrijzvar

A664FC36B5933EAD18E65561B3504DF839A9B8671037BDEB430C8FF36485B686

SMS_MMS com.zmnmjcqgwqtu.aoekevgvsp

A66E1C2452A9AC763868FAF1394BC8BC741B5F16BF13499B6EA67AE9129E79DF

SMS_MMS com.bncutevsumynca.ixorxmxkgd

A67592FE875FE0012CBCA95F36C3BBDEF49B7ABF6451267E62BC5DE9CB775E39

SMS_MMS uomjk.pslxtj.uvnjwe

A6E11E7EABD8053AF29BC40230CC0E4A380B9CE5345044E24EA530C1FB142FF6

SMS_MMS io.kzrfmbcl.jaarhooocjsqu

A6E294B444C2F59F0DDA1FDFBC463DD2826C931D124B990F8A54373DC7BADE3B

SMS_MMS sqpchy.tqcjxodz.ixjuwlf

A72AD63CC21D7BAF5A2B6AEEDF41199975BC9EC5DFC1B6975109F12E7872D05E

SMS_MMS com.qixsb.jnbhwdhf

A736BDEE4DFAF1400FC64085211F9FA36579817F3A1A47C05FFFBD72EE295BD8

SMS_MMS com.yuitfet.mriehswxe

A76A3C32AD254154DA1332AA18C8CD5CDB6E29B6FDDEE51DBEE0401186D5AEF1

SMS_MMS mmd.qlojr

A77BE74C6634030D318490E03A346E741383A580F649122AD9F7E7E7DF0A4A30

SMS_MMS cct.tkdlruyfpr.zyebv

A7DABD7557A66E05D4AD3630B8AF9463AAAC7A01749E14663B08DDE55039DDF2

SMS_MMS lkh.zthohr.xcp

A7EF59198C828A61A318075FBBCD1B9F5DBCBCC6496644B9A1434C633D7B0C03

SMS_MMS net.clnoqqcpb.loebjcdhxqgzl

A80B143A64DCC972BE9830CB414780E5A381A43440DAE315DFF3A671A6A14774

SMS_MMS com.hgjnylz.oyqywvubi

A80C45F900CE32997235BB2DA76219DDE632B SMS_MMS com.lzinbdcx.yjsocz

Page 74: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D0A0BBBFB131A565E965ABEC6B5

A836000E91F7595BBA87DC8531E47FBAF5D550B6450B53FBF7E29FB431D4DD99

SMS_MMS com.tgzfxh.ywrbqcnafe

A839DC60B7DEC05985EF4F149E99F88381C81E1439359C07CE7C16BF1149C31F

SMS_MMS glhxuosv.gdtazy.jxqvuwep

A85BF881EE0A0BC86CDEDC2E0F699421C4D8D63DFEBAC2A8A6E5F222B3D8C48F

SMS_MMS com.lycrcz.iyflqrhdtm

A864989752E5DA99D4DA30030F86277D01B88EE311E401473DCF5AAB395DC12C

SMS_MMS com.elhzuhsy.ohmhrif

A8715DBFA080EA2CB1634F63A144CDEBF68EC57F7F3D0094E43DE9A56DB63E09

SMS_MMS com.uaohdf.zfqejyskf

A87E5F7A8A5D60EF70993C5A213278EAAC03B0FAB6D97D0702F6C170083E7D11

SMS_MMS com.iognglakoy.izkazbdepf

A8E5A30B53525077F8F4E21C183FDDB839E0A7F26752D220F9021DC98DFD7DDC

SMS_MMS com.bvykhm.qurerdg

A91460CE142ACB0F33AD86CFC1F83005443CADC663C5EEFCC24C3C7D4A24004F

SMS_MMS ebz.trqsgw.ekkustn

A9205927A1E5F58E86E9EDE78418C3D0A76877E2A7AC3A458F0B83CED0126CBB

SMS_MMS com.uwnmnperjx.dszec

A926F32A9211A0E627DCF4A8116B45EAA5A1B6A457B6281582135EB750D53BCD

SMS_MMS com.hqtelg.zrwigkbfu

A93E8D268444BE240D982F9BB2C1B0476C43ACDC2DF7F1D27BE5D97327E404EF

SMS_MMS drwbhkq.mdcnirax.aygox

A981A06A4ED99DAAE1F2FD30595300F8D94D745E532DE0B361D836F251531A37

SMS_MMS lsd.sd.efv

A987A76F42EF47CDBF11DB4E0F2A0423AAB14DA0885A13ADC4348024D99494D1

SMS_MMS com.eidsjbl.opayxef

A99AF209D72287A3D0C6240E0DC0F2F32CB587C14AF13A35ABDA0A795D1D2642

SMS_MMS com.ysqwxsibyc.rbnsjyh

A9C6819463FFF69B19A292BD11E0BA96B8281336045A22A3D9F08D4F159AD20E

SMS_MMS jtl.nyjke.pe

A9E53D20DB6802F22F59663376A86681E0830E3E8563C49CAD67D9AED39F2FBC

SMS_MMS digrylh.zxpavs.mazokbrs

A9F46A1EF290DDEC43C278AC77A9CEBBF9596AF25D1A635B4CFF6D970D32D600

SMS_MMS dod.mggoz.yychrkceh

AA2531B38E14812EE24B6D15BF05EBED4725B6835828B1D864DAE6C43733B6CA

SMS_MMS com.bot.suka

AA5E914E7D2542B8433FC8FE3099F4C713EB1E87F4DC7A88ECEC0FD1CF5EA4F6

SMS_MMS io.ckjflscaquqte

Page 75: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

AA6C8419EB2C9D8E9C6ECB1C05E3461746D999A112780A86B4067EA7F29D2AD3

SMS_MMS com.blvpxhiok.mxonfkls

AA86460E9ED19C8DA09CFC88B6F20D8972CC7296DEF4CF566561238E8C6C38EF

SMS_MMS com.bjfofup.wsxulw

AAB20BEA3FFF93C0A3D7D02C8A2B8FEBF1FBC82562023F1AD284038C7B9756B2

SMS_MMS nia.yj.wtuvsw

AAB3B817D94B57F9126BE2260FE1C62768465991394679076A4C22DD1F3B6327

SMS_MMS tzz.xen.qamqhrfj

AAC164589D8B6369297F5F24B26FC5E234C66751E3DDD863149FBC688C454F0E

SMS_MMS com.ahsdphzyp.nmiyx

AAD0760C6C3137F5AAC2D1A539411BF20FD19A4D79BDCB8E61FCD5056457B2F6

SMS_MMS nzbrahw.kjqwaf.pfcxboha

AAE1DCA8414567B4195D606A9FE0856451468D47271F3116ED67B1328E3863D8

SMS_MMS com.igihzs.qnxdepv

AB1E4C126D399EB88F296E36143AAE2ABCE99ECA86E66FFB689370DD92980CAE

SMS_MMS com.ovbomuvgfx.ugilslz

AB6F830DC04B78D9A5B72CB372432F0F7455C005600EA69E700B5DF0CF07BBFB

SMS_MMS fovnxucm.qcbir.iatmfulq

AB8E48ED1772576BCC6E24E25FC55A068FCD66FBF7B12879262329401E7579A6

SMS_MMS epvzoisg.yjesou.kibvrj

ABAF20B5DEBDD6C2A15534ABE2A7FAD5A37F33FA84C3193D0D86F954EA4EFACF

SMS_MMS com.lrpjl.filifqfzq

ABB8D00AAA05F8E29C11A6DCADA0F6435A45D5922CA1A1961D22B9F69C27C281

SMS_MMS com.zlcrgwib.vygth

ABBAF6E8005E9528379EF71F21D8752D68DEF70C364EF6DEE3A7E6AFD865972B

SMS_MMS com.hmzstojeku.nbuesutdn

ABCFF908612F2753ED0BF64BCF4A47D1945540F2761578BE40F7EB2DBC7AA184

SMS_MMS com.urtjlgfyvs.oejctykmfe

AC63C517908A8AA4FF65343FB2C1D721CF0D0DE75153AB25168A58FE65B26F16

SMS_MMS afk.ojze.mbygim

ACA05BEFAA09E38D37FFA8DDD248244657D7B64874817FADA4AEF602CB578CED

SMS_MMS com.tpdkiu.gavqibnjmx

ACA782C2891A8F13DD88DB291AE8C3B08E8465C81C878083873163F5A8FA0AE1

SMS_MMS bujazkfl.giklqae.tyzqnxs

ACB24D31672B9A6C4C5A1CCFDAF59E993E75ACEEFD1171BE8493EC07C7CEF230

SMS_MMS com.opchcme.yclzvmab

ACB2E4E797F8B35AB45584EFD1F39100BAE13425DBCFCD024839633D491730E4

SMS_MMS ru.pihlxju.sjjamhnxwlgmyx

ACDD473C0F68C6B22BAED55A478599D35B44 SMS_MMS com.mxbuan.huqypcdksz

Page 76: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

058D590C1A72E2165A42239F79BE

ACDEC8BF87341E3E128DFC0792416234AA0430C1AEF935A3FAAC3779B144B7C3

SMS_MMS xfzvsap.vjexno.hpdyrs

ACE009E4A85771E0A549D6A3A6D8CF022585AE8E2CCEC89980F49278CB2FF6C3

SMS_MMS mvochgt.mcyzhk.dywrfmzk

ACF7EC3F7818EA40527C9D119EDE590A7F10EBADD2A13BD9E1170FB76F5C4391

SMS_MMS ru.yuinuxvencusej.chavjtmfktx

AD04EE7969B6EC88D3DB03B77368F6A026AAA56D3145560ED304DF40869850EB

SMS_MMS com.fgxrlqjozwxtl.vocnajzx

AD11EC6C057E35DD7723C6CDD9E39B9074CDAC90658DCEA9D150E81A3888B636

SMS_MMS com.tjqosmjmn.eyfpghlvyq

AD24D9B368CC013F0E638D85136BF11A2DBAE43415D7F0AEBD6B77C018AF7111

SMS_MMS arg.ikbwmxmmo.pfcqemku

AD30DE219DE7D69A2EC23C463657AE5BEF4BF6B5183B27F6829DE54C700E73E0

SMS_MMS kiy.pfbulddwg.fvlk

AD435A7F70DE1D4A44688ABA43192FED83C091D0947611A1FD5CD543AE9FBC7E

SMS_MMS qycsrfm.jvwlmdi.vsanolj

AD677C4D3DA66C3936ECD9854AAA31A207D1D959C31CB31C6D608661D8C68FED

SMS_MMS com.etbvgtcvy.krtzqfpcz

AD8302694F8BE2FD0BE966FFDCD63F4F0A02E31544194C42D47E7DD05C126E09

SMS_MMS com.ctivjgk.kcxwyknpiq

AD8AD1FF95263C2BDEF3CBCB6BF2D08920D1AE05FEDBF62249F1BF5133C0AEEE

SMS_MMS yfp.jtyywbrjdr.wccxpte

ADEC014FCF1DF8BCB860EBB3412421BB1B880D9C903207523A8F7D3AB44CD50A

SMS_MMS com.eqdqyebcmw.caluof

AE09EF419B8130338D2DEF8C9D9048085A61A100D6853A7FCF2573C2701073C9

SMS_MMS com.uzdazvoj.cjbphpbaop

AE298A4648C7F7E4E7B9F9C833077704E73BB68CB405C5D010E54FA15C97FAF2

SMS_MMS wgs.soxfdl.jlg

AE49F5A3887546CC1ED1FFEC0B219198F198F233DCF56F4C0AFB7A1D08DF409A

SMS_MMS com.wymjmts.vdwkdv

AE53EFB09879EE967C804AF468E7530EE4446C60946C60283F3DD04F0819EFA2

SMS_MMS ru.hpvxrzd.bleguucdttcg

AE8248319B66559834870A74286DA45C31CDD0E10AA065C5A74C33AB8A79D27C

SMS_MMS com.teajoydz.yzdozwcbpg

AE95CDE98D649089B1074F11C6028AB4076F703E674C80BC20A741B70D7F09D0

SMS_MMS czf.yjggny

AE9FEFB627702ADCB2B165EC63C5E4202CFC594786774F4254C554EEBE0F5029

SMS_MMS zzd.wyn.dft

Page 77: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

AEA2A07095E2C02E8F4C4F4934EBDA5635A3A4D52747F6D303A7705D67A2EBA1

SMS_MMS jwr.pjtebe.gkbxitji

AED2FAAB8958EB61A505FD0C9068D6B957D65781DE3595BB686E05D3F280A0B8

SMS_MMS com.xjirwlt.tdnxuk

AEE8258643D808854C3DFCE42D404E2A5EFEB5416B4BA5E9249B3ACE9CBE764C

SMS_MMS com.oexsjondo.qznjytc

AF035C9027D797DED1D69B1292550A2F53237CD48B615AC4F0488C3DD0A964CB

SMS_MMS axjihznr.tfmdoeb.ihkdpow

AF0A9BE68CE0E3F41D2D35D95D1D38A6AAF69886D81AD56C0A2F0515BA71DD2D

SMS_MMS com.jsbdi.gkthmoe

AF14662D582657535488728D6624D2B1F4BA95A2BC2AF23204E92D526748434F

SMS_MMS pbhwc.nypuxadf.fglwac

AF35B6A6642E4F7DBFD7A0DA397E2406FA9A7D6F1E17D7CE1C0BE4A59D868028

SMS_MMS com.ugelzoj.zvpmfmu

AF369D3EA96F9BB74A5A2FC3A4FEA907C39F45696AD48A723AD1F3BA0103C2D9

SMS_MMS com.ibpxvnuao.mkezbnjob

AF3A493A217994178B7CC8FDB30AD0800F31EB769C91C1F29E034EAF439B26E2

SMS_MMS com.fmbtucto.svqvgb

AF5625E5A6FD1190EAD78CE8C96E6422E13DB69CBF2E06C64FCDF3D902904F94

SMS_MMS io.onyuifozeibe.mxkhkosvqhduc

AF93EA74AFDA89E4991B7B33F4D8C34D538F33C8069AB008B998BC5F24814917

SMS_MMS uiwpvf.ukrtom.argudbv

AF96B6F0E6B8F3EEB32493535C9DCAA7EE4C03F0C7AFE0E543C203FACA16AF72

SMS_MMS com.fkmpzv.lxfatrbjc

AFCDBE5054435F02C668E974DA98215110B9B91034234E76B00B5376EEE2D7B4

SMS_MMS swavex.aqkon.ljeiuczn

AFD09BB5A93D50CAB94F30D3B562A90E3C0684F02FC7348406B07BC7FDD882FA

SMS_MMS nibplq.zpisbc.wonixvys

AFD9771CBA34852F1334798D377DF4409B93CE56D8E2B6D2A2BABEE4EE338097

SMS_MMS com.fhfyrdgu.vuaofhtm

AFE38E1322918FD4E995294AD770FE506D3598BE3AECCA66AB70D60074B12469

SMS_MMS lsjhakoq.tvshcraz.yibqvnes

B03A8F20BCA73E1AD369163872F4D26D74CEC76F7B4A16AE8CE3C0E8D6181F8F

SMS_MMS elk.bchst

B06706ABA8FA633D29A1E85E4D3194F64698A73036FA248B2B8F949EEBA2015B

SMS_MMS com.yzxhnipi.emabtzoex

B0946AEA2FA1ED108D4DC4C9A4F691FB5FC9DE83927671C5104E6043DCDB03CD

SMS_MMS com.xugwhgqceh.xubfiyfs

B17AB68C5C4FED8BFDDB70CF77F479B766D5E SMS_MMS zqbyexon.pvhydmzw.wskby

Page 78: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

23727FD294735066418F0FAB8FF

B17F68BC9715EE017F729A0392077BC90023447396EF1888792E285DADA2641F

SMS_MMS io.tbqiqkytwpkg.tdpyksg

B1863302E35F74C9EA51D6B7B7AF7AE5599E55D0C4AF0F87576C3966B49FEEB4

SMS_MMS com.itntpujyx.fjajagf

B1AE86DBDEA5190F9D8B0E265F1D5AD0A87D90DDEB2D5816B27E15763D398F5A

SMS_MMS com.lxcdjis.cpxhl

B1C8187DCD7DEE912BF0171651CE1853F70BED011FDB524EDE36B9407ACC770C

SMS_MMS com.xqyitmiuz.bonchwtifthf

B1F665800AB0414AF923D3BBB48735B19CB45B655F693E3098AFDF08A28C5B68

SMS_MMS tgb.ks

B23ED99A0AF2F37077E8040C091E30FB1EB786533C1DB3AE8C8841FFB4FCD068

SMS_MMS com.yhnijay.oxrbrw

B25A631573B6F18DD03C18666FFAA77F4BE4909799FC89329399DF8C5388CC39

SMS_MMS qbz.eevlpfl.zhzf

B26D1CF9EF215FBB785DF3F7C8FFEF2DB31F0F2ADD282B303D2017C5FA4B4F4F

SMS_MMS com.suovln.ekfuduo

B284157BD537E6DD5A36162DCF92881C581F97D90D053CF98D822224416CE32C

SMS_MMS ptu.wyszrpc.gt

B2CA7B17AD9832D0506E337710E65CF409D340FE8B140CCFF4A4DE944F915481

SMS_MMS dpqzravt.jupmk.foiszw

B2EC988F2727ADB5CCAB32A7BE0518D93D287DB5C3C5E8BD0F61BC12E0F28042

SMS_MMS gyl.khzlrv

B2F0FBD67EC9174AFB0A228639A63A54AF5BEF980499BF14B84981DEA200C62D

SMS_MMS io.byaqadcawd.nuqrzbjmrotvetk

B307C4E67C67DE5C2F15E8EB0DECD161516A5867C608FF0F0DCD27B42B3750F3

SMS_MMS io.tinjold.iklnfszcoupxe

B390D33E323573DD987B9DDD5446119F893614A1C50B782BCCDA745924331AA5

SMS_MMS xwabdovj.ximwj.anyqrlk

B39A2CB97C17CFF16ECD9761EFB7CEBEB8B8D906837C8C095B17799BEDA36BB0

SMS_MMS com.owuxemxd.gkhrmgdz

B39E4D8472B704AE3700634F6EC46ADCB327EE8DC06C59334BAC5F1BC288D8D9

SMS_MMS ptgavfql.ucjqh.pivrjt

B3D7289ED9F51C9B2C1134A5D52790E3224F9C70DED100987E6A1EB1CB5FD22B

SMS_MMS gecutx.kifbutre.gyxojqc

B3E46F7EFB736520BC2D5FCEABCF976F95A9369884A35E057BB2380A2A1AA67A

SMS_MMS com.krioirsdt.hgbzkivlul

B3F25934177B1D8B5C129266AA06217BBD5A6D9BEF237C6DE6CB547563579067

SMS_MMS io.vzbwhqswign.evhhuajtasket

Page 79: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B40161A768B563A24C9888B8CAE9C9A8207C44CC33BE8123BE9C4DD77794739E

SMS_MMS org.mofoqwoo.eqcsnxow

B40B412E2C375F3A17E55C3CF78BA814562FCBE5C2B5D4C2CDEEE4A2FA469FC6

SMS_MMS zxsdogk.lnxdbzp.vtpgoe

B444258CB8E4023705DF393BA525B8BBA5C9F64846058350DA6A5F0A91AB651F

SMS_MMS com.kymsem.fhdoaywlk

B45FD6568874CFD6CC999A84964248F3CFAC240BCAB81F021EA1731433C4D700

SMS_MMS vcq.mqukcxvaur.kbadb

B472353EB6087059AC6481A8ABAA0D08DE41267EE6FF77EABE420D87CC42976B

SMS_MMS gkzalpj.lmzavnc.ojtnr

B4AA4ECC2661E060F1EE801C2C36F12848A6D011B6D406672A2A8112CD0D0507

SMS_MMS usq.aw.zzu

B4ACDE101D5E4EB9B1326B9DBB0ADE46979EE56FED64187F9A723231A489156E

SMS_MMS com.owhbjy.wuhjk

B4DAFA496C6B6EF88B1218A6A95326DA928159CBE0C1B6E9BB39C199D02C4362

SMS_MMS com.tzxiex.qmqoegj

B4EB92D508F895E5F1823256E8E59EE5731824E2E9C2636848B3B7B0F40F5606

SMS_MMS com.geojaja.gdfbodgezx

B5142632A35A30C7BC3445FEAFCD2D24A596836636E4353E7C4222B2A45D4FB3

SMS_MMS com.vaxfq.gcugibn

B539266370862F988187399DC2586C955E8BAF1590C5D2D3B0D310F27324E2B0

SMS_MMS vmlgtdsb.euznq.pvucabnk

B5868326E840F296DBC6E5B581C4BA0CDA1C6465C0A15F8D089B6FCB71D94158

SMS_MMS com.qpjfuwtvh.fnhjk

B5A8BACD7BC478A38EEB628547CB1409349096246021A01C7DA0D0D93CB92C5F

SMS_MMS dczam.dhqkmcuj.jugqxhta

B5BD1B1607FFB6E2586F574A7E2A034C87CB9C3E95230A81558202367F61A84D

SMS_MMS com.qpmfumbvj.gapjl

B5E31AF964C52C195E28C6DB36D3AC55A2169F89B8AA23D9FCCA6D257CF42646

SMS_MMS com.qxihdl.jznkto

B5FDB0829C264CAC6FBBC41B300E158D704D80BD01AEAAA43256ECADD5C69AD9

SMS_MMS gjixvak.gcikahpj.eqrunyb

B6388B297F98AC8DD0B5027A3E94F2E2F0884BAD4A334E256CFFB920CD992F24

SMS_MMS ayj.rb.rvhvzkodr

B690FBA7E82458E16BBC8477463EB38E080361591A456D65F8AC76172EE84AF3

SMS_MMS com.erysol.pazvn

B6C78ED13861870EE286EC0F473F991DFA2F9A51E22C2A0B2EBFEECCC5E536AF

SMS_MMS xik.lrpwqfni.fxjx

B6D842FAFD08CEDAA4E86EA7526CA1E46D98F SMS_MMS com.qmlphlerqv.rtqdyqamh

Page 80: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2C78F2B5333775860464C0B0875

B6FEF09D02CCD1F90B4AE851425056067F1F0BEA8EB4D81890196FFB78E52E53

SMS_MMS com.sdhokava.yamleofw

B706B15DC8B6D7FF561715F646EE24BE62FBC09165D89841FE921F97235BD987

SMS_MMS hqurgi.rpqoh.ladrnqfo

B72822A5378D11164F3247FE0CF41B7F8E1B4E3D83EB641CEF33720F555EEA8E

SMS_MMS cweaz.whacxdkf.obsfa

B7324F0B829794C4C68E4A343DD2B3D04BF045498F8722B82AED0BE6E7772C42

SMS_MMS com.inoqenmzbs.xbcgr

B75077B179323B8A1F1B7894FAA2CCDBA1924F9780A68857227AAD3D47337B68

SMS_MMS com.dvybykpebs.wrbtmbgqn

B75DB60DF34772A667F8E639A3F0A45CA6377AA08B7C199A346561E20258771A

SMS_MMS com.bot.suka

B763D2F8BEAEF9D17DCCE9D1EE892AA8658373143EFE7D9F0E53F2F235C9DFC7

SMS_MMS qnu.ehycodutg.zerk

B7909595F97E4355F48FF9F9409AF4B39DC9972FCF65E8EF9FCF7F0F99666612

SMS_MMS brp.nddvxajeab

B806F172DB5C0CD74239A85DD258191F7B416501123781E4B0327A12BB27C55F

SMS_MMS com.rpyzlqncvf.fuwjiuwc

B81CD298ACE0054DA40FF872C7AAF80126B107FCD8089FAC4E579FC72F7579B1

SMS_MMS nzf.xyznyhw

B82C61F3F2D093AD81F86683BAF760EBBEFFDE6966EE070D6E678E5FA9101831

SMS_MMS nvrks.xoezcdm.ctxqkbau

B860CEB9DBE393FAF70531776DFE9314D59DFC3A50FE950974FC87BD561EB6B9

SMS_MMS nrtvosj.dyxpoj.lzhwgb

B8BA15D6B73A48628068C68783B3BA3BF704C769B4A7F97B269B1C6481258BC5

SMS_MMS com.bmjprqgannft.pxwpqbbur

B8DA7B93E053B1A5E73D36352BB2D93C7F58D45DD0F47641FE4067A0B509C6FF

SMS_MMS net.tnjokkremixbih.sfxfldhsm

B8E1087D2F2ECDBBFF5A5335B75284C26050BB1F53E49AE58D435D165F9541D2

SMS_MMS zxj.cf.zm

B8FD9BAB9C8D07C3674687D0DFD24B8D768B6F1E734030BEDAECB58451FE7267

SMS_MMS com.wqrsmou.opjky

B9156C6F55BE5F0AB0ECDA31DC1A19E6CFE23E5C7CF94A8B7B3D97A4144CE217

SMS_MMS jumvt.hcsmodu.zupatsb

B94CA09E67F27D6A86B80B822342BA898E726A1EF16A824A1865096AC55B99D6

SMS_MMS gam.aiuokh.fpydyi

B94FFB67805DF0A38BAA5369046EFAA3DE3317D4D4898AC877E1839152781F86

SMS_MMS chibtm.zwgaf.unmozsv

Page 81: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B968168AB751C4A4E78C9653B099EA4AC97F3685C4E9CB792113FABC4221B8B3

SMS_MMS io.ebujnxnvehymcg.quhmffqejjsw

B9736D79C33A1E82047739EB659D4B7200F08B3FA80C1164358B1803531E33A7

SMS_MMS ohc.rg.ggjiprmhgd

B977E0C6E280254CDD5A6B1EB4A788A23FD61E6B6AC409B6CF4CA67FC174FD3F

SMS_MMS lrzxfju.dkgirwm.trmpby

B9A308CC192FFFD0F9A3DD5ACA4C26BC9BCD8DF7BF80B503F7CEA6577A863895

SMS_MMS dfkhvyu.mjrdeca.wmejy

B9E3B41F60E0A290737FCD2D0ECEFAC91A374DCC89E754AE856D4C547D5F69F7

SMS_MMS com.lxudz.aclylh

B9F7389DAAE3E0C59C3DA1015F2DB105C1DAA4C70174808216FDD9DFA7810715

SMS_MMS com.pdvqaq.sqxpv

BA2B04EE34A3365720F32A4FC9350BAC56F00E89CB6717CA8D1FD0A95A163DB1

SMS_MMS com.fdasgunz.nervywn

BA4420AE197F1ED8D851B082AAB4D8A53BE767BE33DC59BD903346AB3F7D136E

SMS_MMS ngaifv.jqitbnh.eunlxzjd

BA576B28A027BCF9B16AC94BA5F55BB81408FCD34A1FE7F1FFA3005A6714A7B1

SMS_MMS rxfqy.mwrdn.pgqtwebr

BA7C29CF8E385D6BEB6745872437F95D24431C219CA71E5F6540AC8E4421FC49

SMS_MMS etp.ghyj.ojislpzg

BAA1C37E6CB5FF2C685F9B0E13EB98AB4038EDBFE1A8797C98149D2CB4284861

SMS_MMS zmc.cu.yjri

BAC7E49FD48725CD123793017827CF444C1A0ED51D9E07D9FB6DD752BAFB5AF7

SMS_MMS io.gtmcsdxjortaiyk.zhzwcswpes

BACD36540B63B2284E1300318CF5BC1EFA1D7409E7C4CAEFD5CAEF5BE9F59642

SMS_MMS com.ifwrkqkgw.fiscxt

BAE1C3D2FDCF7A10466FD24E9B8F226D68DFF910D25C46A9BF607D10AE743E63

SMS_MMS nre.wmblx.mty

BAF63074D744D6CB031A24A9267B11F00A1A30BC468BCBC8D341CA64B5FDFE66

SMS_MMS eat.kxxm.mydliwyc

BB02507926A4C609E656201BA6F2EFB51283A6AA706A2A2BC167168D5EB4F369

SMS_MMS com.ctubud.ridlmr

BB12D8CFAD33F141F0FB16478862350EE1571117A2A0BED9DA9517D1FC982A8B

SMS_MMS io.headrgszoymbkkh.volnzwjgguhkbhu

BB7A40188144701E81D86BBDBD5ABB40DA096055BE7A2F5E6F929E8AFED3A6FD

SMS_MMS nxc.ls.mhkzl

BB7FEB9CDC924C31D1D6A4616936730F42F8AB4829E51236689E22AA22F7A739

SMS_MMS com.dvlxsmqycx.xbiwaor

BB8225F96B7B83A5CE84F2AC1B95860A28023 SMS_MMS wok.ewpydmwvdu.ev

Page 82: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6FA33328E27E6FC486815868D3D

BB85C1D877B3C6596E4E55F48AC69B49EF034BFDE88158189C17A473A5B75182

SMS_MMS com.vnukj.tykwhjhti

BBAEB8B85A5D9549DB437491E10E17ADA882CB49B381E52F3D1B8D51365E7A59

SMS_MMS syhroknv.hybzr.szolqe

BBCD13F9CE140E791660FAB64EE37AC99FE9520B47FB6D4FAA34C802A9836BE0

SMS_MMS yfbodps.szien.fieat

BBD1CB6DC073FAECC6371CB0DB094470AE4C0316424FDF535DAE7D37BEB0F4BC

SMS_MMS com.uxemshsvdv.astui

BBF913011FA344126CD85A7C552FC8964CF38B92D73D44D2AB81B9A33AA7DCB3

SMS_MMS wcendhmz.fvnkerq.xdvcu

BC08307309F8EADA5FF74CA56DB2B95B32E9B423449FA6EC7A0184CD4D1168E8

SMS_MMS bsqui.dlohkbp.ijkvxngp

BC18FE8F4E427CE383504AC70E426215E4011F85664CAFD7533B9DAD77528997

SMS_MMS qeyvu.zwhsxl.hlwmag

BC2579DD868DD850959832DFEE6F45B6ECCA5C57A7156E90809E0C91066501A5

SMS_MMS com.ogzboewy.rmczuhxe

BC38D788480CBA9F63B2845C22F4ED1E76CD894A46CE0A8EF8126FFA9CCFD991

SMS_MMS com.lejcjnd.tdbpf

BC3A3AD1DBD62784E9E07E8500748384E34AFDB417F4478BA51132D52D33BFB4

SMS_MMS com.cumvc.txfivuckrx

BC533D6253DEB5926B0A3874E53569A1734507C9DBE18CFE215274F7C2ED31CD

SMS_MMS com.rwlgbu.rsxpydfus

BC6C40AE67E9834CDDC51AE5D899539F485862BEB6AE7E6B41ADC4D997F8446A

SMS_MMS com.zjrag.cgoho

BC8BE4E7C6DD59C100B04E36F33BE38A9FCC045CFC3ED55C6F603BB86681DE1B

SMS_MMS com.wlteobvo.wrjqfyo

BC92FF8EBDC3EB58FEE185C3A5481D3E398D7258BDD6A96BA25604DBF6E8EAAD

SMS_MMS io.pyzkprqwj.yhovflcgcpbakem

BCB8C7DC8D97A74AF8BAB3A458510AB99803924CEA5DCC1E20D8731C42DAE5A4

SMS_MMS com.fhmqeyrxw.ntbbulx

BCC5AD9A3E87B61DFC0FFB928797CBD3306F21440CACEECDC52DA27BC0F0C077

SMS_MMS com.iagngvgv.ftnoe

BCCC502C5B3A318068CDD65722C9FDDF12512ADC02AAC44F459C6E56A588B351

SMS_MMS com.grqdh.vmbunkalz

BCEFF6BB5FB0D62DFEF1BA9A836B2532A427F73902781B3A1660B3AF4B090D5F

SMS_MMS ebr.mvfgnmdl.nk

BD3CFF56BAFDBB563C8E943D7D7E3F85C5449C58A849C33E3BB496E07C88EA0D

SMS_MMS yhcmg.mqnud.hmgib

Page 83: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BD4C9E54076844335BD3EC9F3BC455A7BE57E9625E3DF9C97D40D31BCA1813BA

SMS_MMS com.razrnijwz.xuixeqxphf

BD5688C0B4A2AC241735EF02A8F72C729E33426843CED3AAF6DB2DC39FBD4D0A

SMS_MMS com.lypjhk.iqxnv

BD82D88B4C7FEE545B4D16B8375815FECEA19C15EECEB566437DFC72546D15EC

SMS_MMS com.bmwhjpi.ojbtre

BDAAE8E7010C882A47C6E817700AA9EC017CB27D8A4DA3012A1FB80815D388AF

SMS_MMS com.jxifsq.kcmyudlzbq

BE09D65F70B9E548A51E353325267CA317A8C0C2A8B61CD369B4FEC5E7C32843

SMS_MMS owzvn.tnxsfwy.jwidx

BE121E98972E8A939CABA3FE5AF89CE8C106C4AF144996214B279D061DA7415A

SMS_MMS vhtxws.edxqryn.szkuq

BE1CEF9EEE5C058AC8C4EDC4C9D69EEE3BE54AC719D7ECA32333D625094AAB3D

SMS_MMS com.flxpadcy.oqhsjdt

BE337E5FFF2064E324618CADB6328D27520646DD0C969A1476D57942EA48C314

SMS_MMS tnlcz.vnakewbh.rmetgs

BE443D7BFD967A6D62358D3925CC5E280128F8E6BD4AAF313AF18F4CF4CD183E

SMS_MMS ru.kttvyjt.tccoynmuwfcv

BE4523FEE9BD792511EEFA36DF2F886DE4744D497B459F97EB46DF2EFF0D122D

SMS_MMS picoja.ymkjghsz.jrvxaouk

BE666FD925521F1944E583D1661842FB463D26ED509717A2444E5D201D427784

SMS_MMS com.bot.suka

BE7B9E5681386C3A193D62E68D91D3C8B3FCCFBEEB772D935A781B1A05B7A811

SMS_MMS com.qruarlzqj.penfvc

BE950B8D1D4B0FC54EF0CA66BABC151177862785908FF4BD7884FF288E6599FF

SMS_MMS fvc.qgeun.pevaawq

BEA553E565212DFEF92E53CEDEE1B26D0CC73A86949B828586D06BC3286817BD

SMS_MMS nqf.wyq.kkdjwehl

BEBA3BF28F9A79A44656194DFA93F36C5FF90A7BF07F352CFBAB0E3734B3A220

SMS_MMS mlvifgt.rlakh.eimhjo

BEE9183F2E3646E75F89E56A4544E458A83F4CF373F3319BEFE1BF6B62067F6A

SMS_MMS rql.ecpc.snhdku

BF00E0D6690B0ACC68F4C1CFFA7A4CEFE3FA7D8BF85EEF34D5E954041F5C146E

SMS_MMS pcnzsvu.gupmzt.xzpdhaj

BF490BCD61696B5DF0F1CBEBF1724CE5917CB8AA57FEBEAA89FD782DDAF5170D

SMS_MMS com.hbvyctfdxp.vexalfr

BF7BC1F60C0A29B3792CD992B6A7B1E58BC17644E955DA30663FE92D8B9F9676

SMS_MMS rrf.vvvxkc.xtlzsgxol

BF90AE211AE1EFA33EB4437FE5E1EE4501F306 SMS_MMS com.rdmkb.lwyfclcfq

Page 84: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

73400225BDAFAC6DBFA85FCEEC

BF9FD142B0AA815049627A91C7B11FEC408463BA4F598B764E0C672F39D9A82A

SMS_MMS com.obrndfsgke

BFA19DB850CAF05552DEC6BA0E2891A49358E5B5B66F1B3336DC91D949B75572

SMS_MMS com.chulhsxji.ojgsxj

BFA46091EBA9228F60C9720F1C18D72D54B541C706B53F0D5AC4F24252C53E13

SMS_MMS xvnubzok.znsbdyr.aukdgsif

BFD1D8C310507DB4042F22AE308266A349623C035C985816F84C70F120974C86

SMS_MMS dae.zchsjmmuv.aacsxrew

BFD77140BDBFAB5F278CA33444E214CA353AE35BBB96C09071DFB940D9D2445C

SMS_MMS com.zenevnkcjq.fazuxq

BFF5B64F639CC94C8EDFA8BB89E08F310567E2404B04A6F65AA2CF23122E35B8

SMS_MMS com.flqiok.lsijk

C00DB3E52D776C6EFD74E090FB6F267B04893771A6E07CBAB3A5258431BE808C

SMS_MMS com.qfilmldui.yfrwkmlm

C02D80EAC9FF274C65DFD21EA7AA7054D8EB20455973932176BB9D0D410BB78D

SMS_MMS avzft.tfumw.yxpsqk

C0C8218EB9BFC65FC2D05670A38FD55B9380D5941F188B0C5887D4114E93EEFF

SMS_MMS yxosrka.vcngomp.groihect

C0D7EE6326A678DB766DB700EFF7EF3D79A58C473EAC416B86BFCB6FC27C6397

SMS_MMS edc.dvnnyrk

C0D9C91BAF514CA8D668B21240AB6E1361298BDD97A6BB10162C7A5CEBE0B202

SMS_MMS com.ctpapdp.skpqr

C0F740921F6A5556C66EC2E6D63A6F9123B95B4F62B2C43D87791BD291595CFC

SMS_MMS com.bot.suka

C11ED9096CE0D0EDE7FA75649BA681BC0607E21E5B51944980EB9C130157332C

SMS_MMS vkpie.mqpjasi.vxsguopt

C127E101E713020EAF1E2EF0F80E46B3426CD3771767990E07839D44BE0084FA

SMS_MMS owj.svsth.uetz

C134A1DDC16930BF570DF66692F4EEC5CEE81B1300F3830534803FCEA7198545

SMS_MMS mfqhn.womebur.zovmcaxh

C142FE36AF31B701E0ACDD14DDF6BD32129DFA8F2D8C9FAF55F3E45B12C286AF

SMS_MMS qgtvcsdz.tgbyz.zuwpjyha

C15F97E27F227478D6B7DDE8B1A8B049AF53A3D63BF54A7A2C63D45695941FC9

SMS_MMS net.nznuospabdmyji.pisycyrvrdqyj

C184D300E0136832370514C4EB1D76787B26C8D3AAB99D74BCDF944B7C5E53FD

SMS_MMS ecvzw.prflzsk.tghudzji

C1879A824261DE873019C58B9D125E3B6C80A9A578BFECB96A18BD9C4C937B1A

SMS_MMS ppk.rnvanamt.qtpy

Page 85: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C18A39DAF799FEB5622ECF3EEDEBEDDFD39E617C23CDFAA9275448398B8BED7C

SMS_MMS com.ubnygiy.mpjynyjocw

C18DA803DA7AE90A07444FF5735064B5DDE07931424FC1B767318AD6003680A7

SMS_MMS com.jzlvdire.ynciyaecdl

C1AA0A2F9EA48F6991856B0462E339D680A119E083998CDFED8F0DB5D7CBF636

SMS_MMS io.butlaonaed.qhvunblw

C1C2BE51FA8AB7691BCAF52132197FCD787663E7A83DFC334DC177702FC0A222

SMS_MMS com.mdlnkx.kyglmvmqw

C1D2E8604AE07E7210B3553E6CA80A50A19E5EDB1FED4AF889DD4D3316DA318F

SMS_MMS cihfay.fdqeb.junvfhw

C1E3F7AAE7F38F1C6822635EB693E549E86E67970BCB828BB86E1EF663FB871B

SMS_MMS bow.wivqegir.atkiihil

C21808E71C2E79EFF8E5A3704BA9DB1F775E141C2C5CBFF4C04D9A55FA76BC56

SMS_MMS ydnavfj.dntaw.qzgimc

C235ECED54102BFB72081C5AA990BCDF92AFECC720A74D8510CF001621FB6F8C

SMS_MMS org.hgfmqwtiquiu.upldyron

C26AA0F2922E4852F3A98895227F1CF9AA5267CB13A007565C7BF730E792B3FB

SMS_MMS com.vodwenniakmfz

C2B1D8990941768667C99EEC147DB33EA48EF1E1C6B26C03133E16C0489546E5

SMS_MMS net.khxurgqlbhhqdq.hayldqd

C2BCCAB304D61BAB7F137B44F5FE994E978776EA292E6F71C9898B1030DE1370

SMS_MMS cqgpr.krjoegsi.kyaish

C2FC641D4B443A54B13318E505D16B90CD2946FEC56AD29BB159B8E137326836

SMS_MMS fumge.mdfvktzy.arpubdh

C3116721E7422FBD4E8AE8FA11796ADE5A744C9679B80A13B92657BC1A1576AE

SMS_MMS agdmo.cvhyid.zlrfap

C34A1D0131676050E9AEB2322C594B2790B7FEE442E7F9E1C9AA77C87451B48B

SMS_MMS tfypro.kovzwa.endolz

C359C2E2B1DCF537CBD84728024DE7673C853944E4B8EF19AA083C360EFF5901

SMS_MMS ldiymu.ugocpqwi.jzcwaeh

C3A22379CA8DBA443B43AEAEB276EBF42280B0CD37FF937F0E7002CF8A4E15BC

SMS_MMS wbezpvf.dmtvraz.yzrfpwus

C413FEDF55955213041FFA1FA9FA4DDE3138C3E8EFD84507B33B3F390EF9984A

SMS_MMS rmfdxusv.fgmcpbzt.joxhkmbi

C44CA6558296393A171445E39E0BE44AAF2B6F5475FE81116AA5A4FED9E00A75

SMS_MMS fvs.ttlhnway.xlmtb

C46A489B8A1BE18B4E58FFB20999B2E35D58952ED788CA7618748A573235A529

SMS_MMS com.lnahycjdh.svbwni

C46EC1810C05CE532F3A011CE91BF5A269AA7 SMS_MMS com.gdfyebdv.ulykarcfm

Page 86: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7A2847CD4752544F119DF2859D4

C486D2106C7E083FF743008F530BDBC42540DFBE3E2C64262B9510BE021733B7

SMS_MMS com.vdxrpso.ohjwct

C48D3B33E020079A0922C6D7DC26DC55ECB26FE0CF94783DAAE371156FCE971D

SMS_MMS grmvyt.fyhibjqa.swtox

C4AD1485BC25C3E9887476124FBB253E7D403C91C51B22D7616544B34B864751

SMS_MMS com.xvercz.fazih

C4B6158ED03D4C5DB302CA311B5C8A1C4684A870ED061ADBA006994658344AA4

SMS_MMS com.mpvdz.fijwxfazq

C55F888C37707492C5264A691013E4569D70A9FE1EC467C91F900F86584A7448

SMS_MMS com.nhkgbrtr.ufcez

C57696AFFCA9BE4417C0D064C75B939F93A92573309A86929FA119427F97777C

SMS_MMS jaz.udabwsfgyl.llfnxaldw

C58F5AB2BC13801A683BA091191A274E483E010D48DE36D5968D7B37C316943D

SMS_MMS com.xuznzg.fuejmekaga

C5B0720F0378D687253B8E7CBFEB06252CBEC60ED1E119943EF4E58CA6F25D8B

SMS_MMS com.kxokro.psmkok

C600D6EA5C0BA1CD0DCDD029E150B430328412780C8F1AB1E275F78E27C8C646

SMS_MMS com.nsuwxlgim.fgsha

C61DEA5440D1231363FEBB9A0EF5AFFB7AA07D554DA82C2176359D7C2A40D122

SMS_MMS com.prurvmrfei.omgik

C623804B24F471AFF80D92C07F810CED27EBD8A141BC1A1A9BD00EC49AD66A9C

SMS_MMS uqztswdy.linauts.ymdqiwer

C62557051D86606308C4DA8D868E89842E9FBA62E4B73EA3FB3EF99551B256DB

SMS_MMS epc.kpx.fyffjkhz

C62B4F3B54A80FF1317DEF37FC5469A6F771B29DB508FDB8377E04BCBD7B2417

SMS_MMS dbvgjxf.cumxjnyd.gxqcfkse

C639FD987CE269CFA3FDD5CC1F79A5C93BDC07AE2032FA06909C438B26BC756D

SMS_MMS com.mluidr.ilthtzcf

C65460095BCD4B29D70FE252A4E54550C6D28AA1120C86FEEC283133B660D86C

SMS_MMS com.kaifehs.zyxepzc

C65BD890C7825D1FF27D600C19DBD21DD40B59E5810BC955FA102610B4FB7F21

SMS_MMS ru.tueizmzxha.qdnwvlzcywtuyg

C6683526D35392CE3E7427213BA375AB9366ECD27FCA3FE1AE57ABDDBD34ED06

SMS_MMS com.bkerdxna.fizhdcnyg

C678DA5A239688738C20D0B8783E905BC67A7ED2D2648293FBE7B1BC2CCD6522

SMS_MMS ru.zsndttpjqkwyg

C67E413A262D81B95FBD42504DDD84CE6AB2086C286D2DA56BF5F2DBB42BC9C6

SMS_MMS com.pvqivgagni.ybpiye

Page 87: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C6C0A81295B0E6438B212CBEE2D1BBD097B2B6A5905D3B4B440B4BAB4291BBCB

SMS_MMS dealmqh.fcmxgq.ovpcyk

C6D51AA569D83BFD458BC6067526F9937AA24B47B21F48617A424DC388600713

SMS_MMS com.whqxa.ntbytzd

C6F7E02B6115C3FD4B3BF18F5190899A144798D6192BCD3B25470854415D3F4A

SMS_MMS com.vlyvnzpkwd.xwiegmrv

C762CBAF315B107526D2D51311CB0A3EA99A907419BF281C7E3B88255514B2B7

SMS_MMS org.xfpuyiz.jiguyfi

C76F13CEF898A75A93A10E8E84DC133EA1431F5151E968B146142FE24C283ED3

SMS_MMS com.pepazgngh.kfuhnist

C778C387E86129F08CBCC5B692724703809C1E7C67E086181B9CB7DAE4A468E4

SMS_MMS uariwl.qfxcup.zstfxbmw

C78D5CB3785ECE8A2F14C2FF9600B951CEF504DCD64524221A5CD7025F3D800E

SMS_MMS scqtfex.ydgoczqw.tfoqungr

C7C2473B92966A704D3BD03A20B9FFA45ECB433BAE1A5DF414ECE6E414EB7A24

SMS_MMS com.qneoxfjg.xmxtaz

C7C38D893FA8FFE9D1BAE86BD083989EB4EBEDF27E1EDCDB1C04A5667FB4620E

SMS_MMS jlkpeo.fniotc.bcomds

C8400246FE7BDC6C88691ADC5F9038DF4FE6A1C9C93BE363198B612907BFF92D

SMS_MMS com.imozqsmxvkju.zxkqfdcfle

C8C07ED3FDF7C42DD05E3A9AE4D2DBBA9984377F6B83264FA2A6606D1CDF26CC

SMS_MMS com.ibcugmkh.hewxhpl

C8C5A56E5FC1B57D6251755C83FD14D0B7E197A84206599417EBB5CEFB9A060D

SMS_MMS com.wyouhl.cbgvfhedzv

C8ED5C4FA642F122EA777B5C3B285E95C16B0D705041900BA6E305128B4B102A

SMS_MMS hju.bqgbznebv

C94E28A63EDA37A730D02966C6CF48F7F1366623F6EFC1D0BDA5FD24A48E6C77

SMS_MMS com.oizvuqgp.rsjyqy

C98D2D977C6CAA3AC50643FCA5E51D9F96E42914EA10BF0206A73BDF579C326A

SMS_MMS tvjqcak.vrndgbwy.zyhvios

C99505A056037F80DAEC36C25E9AA96EF6DA95BB5A06FBC249FA17668A3EC2EA

SMS_MMS com.oqgaigoeadtarok.aislqxecyxr

C9BF5B3BA126D969B034AFFAB5973577C6A429FECC2D5DD546ADAC2D18AD2785

SMS_MMS com.kmwmx.tfzoawos

C9D70CF53508F0229F3827BC83C47D6FB778796C64CED259A3D84FDF88AFCCC1

SMS_MMS com.vecndfsvxb.lyxnyblt

C9EE79F607F974DE0C4A96105383DA6CDE8B04800F89EB24035838297336F27D

SMS_MMS rsyuaj.quxdym.gzovhp

CA00F4D1C178BF4046F090F13FB8978F59ED80 SMS_MMS com.ifopj.xpecjg

Page 88: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

65D667283435B59F162C28DB0D

CA08BC1CAE510C9C4EC6DD993EE215713101036778FDE6240F31561F96C73567

SMS_MMS com.xpmfg.bpvepxlk

CAB3B6F8F5FEB3BD61A4807BCE5E1CE424C97FFB2132D14CEEB0E6F363256123

SMS_MMS ru.htzufnpfgpuje.jycovmdececgllb

CAB88C2C1D439A37BCFAE5C1F4922A340FA06E5777CF7B28979FD864009AE983

SMS_MMS com.einyfrmjy.vhqnt

CAB8A3477796120B12F5419CD2208E48A9C12909DE27B06B49908EDB8EC6DAF3

SMS_MMS eyl.iqnxp.qdwqc

CAC35B884404BAC978E0254BDF965F2B60A1E899D53A77084E884E91BF54EC44

SMS_MMS gdf.yb

CACFF941683B8FE35CA8913B1851EE86085FA77B8A04FE2DF9613B6400AAB00E

SMS_MMS com.mzyzirqdv.phbimdun

CAEF618B178528B525F677B58D415B989764D43F6F8EC9752FFA2F5ED309C890

SMS_MMS com.fjloza.ecamfofs

CAF7C66971009541A9BFAC8F315297DF010408C2C1701E48A2A773891FE83F13

SMS_MMS com.yiuyog.ejozof

CB18940B02186C756696FC9D5E6D20094D69A62F2697E01B5B52220BFEF3D5A1

SMS_MMS com.ksbrob.vgxqxkanj

CB1ED8275CB3E8FF777259BAB9ECAB8DF01B6FAA1AB169571E7A4D3BAF1894B9

SMS_MMS dra.acc.vgzygauw

CB2452E84F56AEDC8FDFF364579CFBFCA4D923CE32D493C12E384BFD5EFF3190

SMS_MMS com.yoaufawf.kaobdiksg

CB2B8130589613E062EAE7497B6B48E54000C8889F8580CF353EBE1F14126B7F

SMS_MMS com.njrle.tokysgoyfu

CB33CE96235CD301F6B6D34ADF04456C298398AA15A4BA8855D86B7793F5C082

SMS_MMS htrwcobm.hptxcmj.devclgpy

CB4313C02D03037F6A44E2FC1CD557A88EA7A1A5CA7CA95B81EF92308C6C0C5F

SMS_MMS com.kydltncoa.beqecara

CB5A45EC69CD64C68630B87DA5B1534C69294B787AF724ADFF13FECC39E6680B

SMS_MMS io.buuvfrbfhzro.evmnobiemlvdvsc

CB82B4B94D11DE9FAA1565141F0998AB1EC5DB0CDDD764255DE9CCC9B1BAD6C8

SMS_MMS yugqvst.itdelb.dzjnuw

CB83993124A46C4842A215BB9E2E01CFA70BCCB1157CBD626570584B6757321E

SMS_MMS gvlycubt.iulxwpro.wfrgs

CB8A47270212676FCF3A0973C1F697733CAAA9598D6EF9BECA8CF49C61B38577

SMS_MMS com.fegjhwyhct.cypmukbx

CBCF9532F8E863D215A00B27C8295F02095D651F07E11D618D27C8EE83FD65F1

SMS_MMS io.knizgyfmtheeytn.xpndaxwndjcpetw

Page 89: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

CC0A27D69F8796A357A257E1C693EBCC6BB14E5C9DD39F8F3FBC72730023CE9F

SMS_MMS com.zhjla.sjdwjmky

CC3C25A332DA6998ED81B19B790147AC7B4B8849E9DBD017E2FB1D6D8C5D2439

SMS_MMS net.zgmucxhaggy.umiyxsp

CC488D1428D72A39C86C0D2954C77EFC12C2067D35BBEFE324E4E0A273756BA4

SMS_MMS rxd.iruny.rivrlmdm

CC77CA3F93CC81858B93A67A5B7A785B9DE5EB1724475823BC46880F6A9C5369

SMS_MMS zdgqwl.vehcwog.mexkrqa

CC8984CBE57E268DA3E8491C17D5AF5471D77C541F060DD8171C6D787062764F

SMS_MMS com.laclrat.zivtqhc

CC8D91463AAA9DE443F24D69F76D1551865990AC60E0CE72AD29E42F247F6D34

SMS_MMS com.uamynfo.fzltrtzyks

CC915E98488A72F838A3D3E55E63204309A07BE9D3F7E9FA5814B96AF6CA2E2C

SMS_MMS qpsfev.hvelp.mibfq

CCE39B09FF3E6F32092E4CFA281548DEF10256B65ED90F54900F578DC8F04DC8

SMS_MMS com.bzptk.hzwzfvh

CD188572098E6C28847236B5682519CAC341D09E43F7F8F903C2E11E3D31E6D0

SMS_MMS net.xykhmuyczklhb.zplqhmgxxfeio

CD19A94DE99D2B3C559CBF179223B01B70DA3F196AFE64AAFE99A38E6D064739

SMS_MMS com.hahfuivstcjw.qgyegkmmk

CD2F48400234B966BD9F0C1125C34B8286B2828B5A47C66848DC643B1214CF69

SMS_MMS com.mdfle.zjvjurmui

CD649FCA72D4DE4657948513449ACD6D2EE7E94EF9ED47FC0239C4BBF9A43620

SMS_MMS awh.vpocrqm.ckorcjjb

CD70EB2D1F30A013C199A698462931C446E9556BD413AABCBC3B5B4CA95CACC3

SMS_MMS dmkrh.ubjgrcm.qkchyf

CD7C9C5C6F85BEC74BB228CC1F20110A22F0D5FC5D1BCE84A1E83AC839C1B297

SMS_MMS com.pyskbj.kofwt

CDB048CB5435B9B20562BA785873403017805D18D15A12E3CB9B9CEB5D6C542C

SMS_MMS com.hwbpibt.fuvysqj

CDB63E47C5B5440D7216226B56557C777FC0FEAA88A1D87D0DC209DBE1EE851F

SMS_MMS zbz.qxvdfplrn.hqpbnlsrwu

CDB6AE3DA04C42A099AE49A12056C10222F62B563A2D42187FDC6E043FC7A61A

SMS_MMS com.jsgujpbi.djqkynpmc

CDBCF118F86DFE8455BD9224301054A0CE85D544AB637521AD5A935F0C70303E

SMS_MMS com.pwpctq.qbcunywim

CDC15B756768BD338A15F6BE3D90A0240B63FD607D7B4AC7AE660BF3674AC3DE

SMS_MMS acvwqn.cjylzhk.xeontsld

CDD6731ED00C048681BCDEF0D796E7A47A300 SMS_MMS rai.xrxtv.mxx

Page 90: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

461ADAB5671760DF51DE51D60CC

CE3E9CA016771F7CCE39E79210E389D84871778811A2BA13EE26B95F2DFF52AB

SMS_MMS uydinoqb.lwknotg.agoqj

CE4500A8C4F4F825755438B0F69E85AD2DCD2F7BD1B4EFE0362D5C281FF67C06

SMS_MMS com.fgsld.szheg

CE83FC161C188A9F82DDF4F4546C0134254F20750E9C53AF43ED232A4467614B

SMS_MMS fju.ewhzf.bkyrw

CE899B7A47BF73F797829DFFBE3BD112447BA6EC282888F8333C0A20D84A2554

SMS_MMS yrfkp.aefgy.oyhge

CE9272B7BC37666BB18E3DFA80D8E4C70E88DBC093A044040BFEBB1FDF713D87

SMS_MMS net.ejdlidcy.tqoptygphkpciof

CE9C3AFE7D26AFE79194CEE537419A9F28AD84EFAC1FE52A12586C95EFCB10B6

SMS_MMS com.xmlcayiaf.rfntespmw

CEDCF2024A90DC3FB2AC06CF23A60EF95A1D24C1910F185CD1650CD999ADF2C0

SMS_MMS com.ydpripoh.znuvmg

CEF6BDD1CA19B9B5EAEEA5FD5C8D26099868DE3634BFB8A7D261DC7861E17F8D

SMS_MMS tnurvqsb.jevnp.aufdc

CF0B6E52D49A7C0BE60EA047DC395999D96560DBB5B6BCF489A1B9DC8888FA3A

SMS_MMS zkyxte.jvlaqbgf.tlchqvs

CF0CF22F12FEB2F6E3D664367638BD876548BD04C215A325619EF9F8214A0F94

SMS_MMS com.bot.suka

CF2F4BA616410E0174AE9FE0FD6AA15B34D1DB15CD1F4A62FC3A83DC3DA5E8D6

SMS_MMS io.oiovscmpndwlvmo.fyykorln

CF335F2AACC1966757429CC47EB703061845AE8E1F4BE0A237960281CF5CF77A

SMS_MMS com.nxfmqv.nadtefc

CF5352FE2EF27EBB43819EBDFD1A2F121AB5F63DF0950E4153F54C90678F8A89

SMS_MMS acwtfvrz.vosxg.bcjefvsd

CF7F1A4BF48588BEB29FEACB88F153493536A2E047CDB932FD654D216B976343

SMS_MMS com.nhanrkcp.vkiec

CF80026F1EECCA7F2C3DE10B76118E48BB2B50D914F90E7C5CA0C5981CA8E3A4

SMS_MMS net.uemdzhjikp.xqjajomqrvtxen

CFDE44EF2F0BA4C5E1203A58CCC4DCC035FF29F060FAC7E1BED90A1B986FDC0A

SMS_MMS ice.oswwdxfz.xgijkcc

D009C04508013A391A12EF9199C875DC66D86DDD07CDB8913B18A4CA3B00CDDC

SMS_MMS com.tastxicwli.encfcghye

D070A9F47907E61187DDE4C129D846458E56564255C910BC1136BA36E67F782F

SMS_MMS fmstau.hoglmnat.qpynjg

D07151348F08C73D708268194F53EE2CF20F1692F10DE18E9DE1F15C4DDAB0D8

SMS_MMS gnq.ao.byfxrx

Page 91: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D092AA88909A93C5CA5B47027EF0A4BE3DD24F296AE853A09806F492645EBC57

SMS_MMS qyb.vyqfzxhh.pxmz

D0C12ED5AE1A055AB7F40CE9ED355711E88D665E0DA01FC8FCC3B36B4770E8B6

SMS_MMS twr.mkvlx.li

D0DAA28EC1C0A0EBDB72407F7B1F715B81B42F3096108EC12029E7FAA1271212

SMS_MMS com.qwmudtbhnd.lquxpw

D0DEA31C894A8E667D57EB841E92384FC71260F47A13040CCE96CFD81D911EFA

SMS_MMS com.hjvlidpbwf.vhjityw

D0F4C5CFE2AB441D7D8115C6753C1083461E1B63C6BE0040A355D2ADC90A886E

SMS_MMS gejtk.mwrvci.dslhuxj

D0F8408592D869EEEABE526E477051E175D5BC8C5F0B63E5966B79235A2B340E

SMS_MMS mgazod.qbndtl.thcda

D1336BA9A4F172DF0572AFCE3EC2A611D92302BED49147961B1DF97DCA5EC2E9

SMS_MMS knt.gqsdovf.hckd

D139FBB627716930E075EFC02DCBB06BD5B25FE71EEB27B4911D932DD79250B7

SMS_MMS com.obgxsytdl.dnqmznf

D1528098126BADF3D502CC43CC0042240B5B6A92F034242B8E34E542814ED4C8

SMS_MMS com.qtpecnqbcs.chyidmtxkj

D1614750787DFD2598219A57A512D93A5679EF8BE9FD0FF6D0405F513947B17E

SMS_MMS ryd.wdxzqakvw.otob

D16279BE7DA06C33AF3AD69547AE8AB6D6E3D9FC059475E665C8E58F27FF4116

SMS_MMS com.tnbwtz.toghzjctej

D18F7ED3C523581AF9126FE897BFAE4BD9A4D616D04E80C442E7566479475CBE

SMS_MMS com.bot.suka

D20416B658496AAA154E12F2DD84DADDDE7E2292D3F21F656DCFFF24DD8E8251

SMS_MMS pep.ylzrnoj.ifyotnjzpi

D25ADDEC14C63E9AD9445AB84A001E38F2C76E29D0164B89F130B1AD5BD4D4E0

SMS_MMS com.whwrsbgsj.kcdoxpu

D264E62A2C4276E0EEB330CB711EB51C2167F4B4C74280CBB2D038470E846C0C

SMS_MMS net.syntuceovwznqy.kcxysntmwtcks

D276F9C76969CAF1AA794E70201FC4CF5B9F0FB50C0588EFC53DFEF50C031CC7

SMS_MMS com.qrkbxje.ktrwd

D28BE34234EF39894B7E77FC974C2BA95929676CD4EBE92AC3957E39B28CFB37

SMS_MMS ibt.evefri.byrmyvat

D2D72806818F39633EC692B4ACF190415037611B0A1E48F42677919B38A07D50

SMS_MMS pgium.rzkljv.odrycji

D2DB3F6C844D2B252924231A5CDEB6C833B8926713EDA41B8073DFCC8A714CEA

SMS_MMS tgbyqof.hlvmcsw.ebikrmz

D31FE4A0AB5BEA200B92421922188EF8D2224 SMS_MMS com.ibycf.zjkntubt

Page 92: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1628D579B2912CEFFB4D1C18FD2

D329025CD0BD6BFCD441D175F680BE9FA574373E1D800EB0240301929DD8F21D

SMS_MMS ru.eoggavnn.vvzblyn

D378E1DDA0B6707B4C518109B9D1ACA81FF3A12ED24F13FF2948392830C88A21

SMS_MMS gsprciju.jmorp.icqomsx

D3EEA569565AAB430AFC75FA6B5A410AB7079D2E3C323AAD90DF51EEF7803005

SMS_MMS ru.gzbjwfyjmdf

D3F74CBF6348D07A3052FE54621FBAEC4BC7E5441F022899A6BCB38528EBD5E7

SMS_MMS com.cdzbmu.tcamwdnz

D416CF787A96F13CF72C847C7086832EE5EBCB930FAF3637E9D0D03A11272251

SMS_MMS acs.wyfjhanonv.lqj

D417FBE2126C9790A4961C9AD13E2A91BD722B633D3C13EC673EF2BB6154FE1E

SMS_MMS bpb.hm

D4646A175751C1F870F4840BB0242C53E0B7C306C38EF6B7139990F687999772

SMS_MMS iafnjt.wtoylm.vkfdn

D4D7B7B2ADD1A50432EEF6BB17A8F0CD738E65D3C9613E953B825470CF9B7D99

SMS_MMS mzbxedgc.egnzomv.hefcz

D5210EFF22C4AFCA583E45BF6B7AFFC8DB4B31648721C013FFFE441C03C35465

SMS_MMS com.jwyhqusq.qyludjo

D521A55E317AA2D57DDE7F84EAAD0E9E6CAD14A18873D603FE8F29D5126968CC

SMS_MMS com.bcjueoalty.bqvobh

D52F764ADFDD2F12CB93D2966C5FDFE44BF3ED30ED9776728AA07BD156D424FB

SMS_MMS com.yftdbjxheb.lejmxlsyo

D54B6A652784675438781FBAF8894C4684ED94E7F0E37631F7287694F88DAF23

SMS_MMS com.zwkqmk.igjfviu

D59107E66E3F9A4D46B6D3391C8A747C71B647DD32169F333141BFACC811B1D8

SMS_MMS com.sluzdijy.neyui

D59C7D862428F336BD9219CA2A6CDE19D71E749ADE21D45E843C59EF50E4062B

SMS_MMS com.ijcimnjei.gpnytwmaev

D5FE3618C7BBAFC86E9834CD504D9DF8CC580B85A0762AE046E74802C658CE28

SMS_MMS com.dflqp.fitkjn

D616E4B1C1972D2BB964B0108D190587F9C8E7EF15FACB97CF7354A028178F2A

SMS_MMS com.lphpbsgv.dhswo

D64AA25567BCC137F8D0CE8D3E6CFC5241A8602CD3A7249C533AA4D1E66150E6

SMS_MMS com.qgedqz.orkeoahqm

D67E43B6D5E9FB47E7F6EB02D26AA42D634FD549B83186FA901D378ACE35B937

SMS_MMS har.kuigktphg.awesaz

D6BD96C4FD466350B6FB4AB4D480A74BDDEC69833C64A568D419FC837D845987

SMS_MMS fty.ancrxuayl.xr

Page 93: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D6C40ECB32EF707CA157ACE205A966CA864F406D2817C14363937D58A212C75B

SMS_MMS qiz.uzhmy.faqytfrr

D7051DB138D70530034D4EF6A834D7FD41617185E06D6BDD56D11030B26E2C4E

SMS_MMS ru.cymqalg.voygmuspwmto

D705E04391C7578CBAA01AA17FD00BE8884633F33E9872AA2E4429B44FEBBDA8

SMS_MMS ogj.ygkvzvtw.qe

D70B29FC2CBD284FC9C116558310716047C09F3908D5676898ECFB9D22533184

SMS_MMS zjhfo.uoinq.ejavbrx

D732DF4A4BC5761F4AD5E5DBCBF33D750E4464A993C92906F6D8212FC52AF7D9

SMS_MMS zbq.mjvwde.uafpm

D74CB7C4CBF486358C2D5DFD1A5FC35AE484E8F59DC4DFC55CC07AABC663574A

SMS_MMS okzrhgs.mvgxrdu.ylnsodz

D76D72A80FF9C9250EBF488516B16FDDEF72335A8204BC075C90766918DE8724

SMS_MMS xuvneh.xmrvwzn.lykcbspj

D79EF315B7A00522DCF5F156EE9550FF71C8295916290391999BC5A85A804FBA

SMS_MMS com.raqnci.xoeaso

D7A3A120E18AE4CD87CE192ADFE8F0F8DBBA9A772E08027C022D2D3CA2ADBC26

SMS_MMS com.yzlqe.czcpf

D7A41220BB727C52E38C051FA29DE1CC77C683C372F1634849916DA3EB65FE2D

SMS_MMS com.yoqktcjg.bqvyeubv

D7A8A453038691A90759CB8CF0CB1BF5F3E84C5C8D86D616159088892800CA0F

SMS_MMS ru.debtjocu.eoxxxdrdabb

D7B609BD2A9F460D424E8033BBA8DBD1E40AD2041C19F2FAC14A19A9A9B48433

SMS_MMS ziotumw.khrez.cyrdfn

D7F0FF6C8B34FFDBC8BB851F973F1656327FC9B733A7FB45A3776D4CBE653554

SMS_MMS com.reygzvopm.vdije

D80836C41C07DBBBCEE1B2EDA5E9A46F74122F3920541CF07D1C511476D888DC

SMS_MMS com.mcbanpyh.tqsnspuqi

D83E39471A5EF4AB61AB4C26DA6FE1661A5767BCAF598D231C1F62ECA4511F46

SMS_MMS kpcuf.rcnshjvo.wvpxgodu

D84EC8E713B673B43BBC1461B1B51190CC56BD71BF2CCFD26F387C698E8DBDD2

SMS_MMS ydunrfta.rtviw.mzrjty

D88B3D07C7FBAEAF1B068C44BE4B07BFD0E627FE7F323D9009E61BC07002EB80

SMS_MMS com.rvncwr.wcuzg

D8A531C64E3BADCDE0FBAEB2153D54E7D08E0B6C4AEFD6C43C5639669C0E3B63

SMS_MMS com.kaeczy.quyhvw

D8A5564094B34D8565F437558D796C04C0E44CB7F8AC613B38B73BD96A388C4C

SMS_MMS org.avkassnqcqo.psgwgljjess

D8AB9875E4E413DF1193BAA59BA062FE68C10 SMS_MMS com.qihragmcw.shsync

Page 94: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DDA22A4E742BDD1F950E7D6DDC9

D8BF4A9F6D942115AE22920FC0C8F853C062655FE7D02511DAFA9458FF7E8B47

SMS_MMS com.qecskxbfst.uhunxevlu

D8E866476ACF22618DD31EDEECCE721C2AD9BF365F4015430EDC8E5425DCBD18

SMS_MMS com.zplpgnm.wpoqqqj

D94F18D1A26FDE7CEACEC53501225C08275AB4C824C2606BAD8DB6E3006092D2

SMS_MMS com.xwykmbgowj.wiqxbqurim

D973A0CD1B74B9A0A7E58B80AB28F79F4EFE09B8670767521BE5CE7494D0CF31

SMS_MMS zqavsexc.tcrgjlx.bopjvkiq

D9AA10E1BC3FEB933D13BB51C476A10BFDB8C3CD17617886CC05A0C6013E850E

SMS_MMS lbmeaux.zgecilmb.ovthdbj

D9B6B761C0F2CDFF4E1CDBADEF48773FBCB2C594B0AB24A663C6F68D2A117C96

SMS_MMS com.eutgz.nzmzhwv

DA166A01C0AFC9FF7A2F11A50412C8009FC6D81D35992FDDBEEA9E16C0298291

SMS_MMS io.ofcusuiiqzirv.zlpoighkcfcoe

DA54FD270116D9148EB7A4DDD0E6D105CE0578614332A5D1209AF0745E0608EF

SMS_MMS net.ixhdmqrreb.yzqejvhxfuzvqon

DA978A589CF3EF89EE5476298C99EEA19E518FEB897171F42342AC59F23098E5

SMS_MMS com.adnkthshuh.vukfcx

DAB4A515E74B0422431A39EC48FD57342F13A94D9CDB15AB53B3DE8CF948ABEE

SMS_MMS com.pfynhwsdw.uhulchxv

DAB69CF93C3878FBF9E750191725C312761A9EE49D37A10998EE67A5872D9214

SMS_MMS qag.vbmgspun.xdwbbkqihf

DADB2DCF8FDBEF1E9D2B1EAEAAB1FEA0B34E0010E1E268D746F39FF006FB6D3F

SMS_MMS mnzuvw.adjebk.zqbetfar

DB0A3EE90AABE1057BF6A0CAFB7D14101C335102F6EEC5CD6FC441413932F3D2

SMS_MMS com.lqxfvm.nbyrksc

DB10097A43BC1B3A8C65DD3A73405BCE7E6DC304BF41C80CC0F469916907DDEE

SMS_MMS com.bot.suka

DB42E4D92A81FF778FF7C05FBB6131306CEBE72A85CC10DC36B489C2935A39BE

SMS_MMS njyowrdf.swygkxqf.qxhmtzn

DB4A961A125A8BF3FBDBFD74A73E91A3B6D3EBD38D5565D75772197812E96D76

SMS_MMS ncd.dhn.ussfe

DB552377C863FE64481CEF6825DFE080E97D6F24FB42347BD4504547C4ECF4C1

SMS_MMS com.mqxjnehc.kyjere

DB5C3A252F75DAFC1D5B76CDDEDBD09720FD2FDC6CBCC7DDF8DF1C08B91E6FF5

SMS_MMS com.cqyokhflmc.cejkjb

DB8A97C808E367E9B22CBAE7F1A3FE643B60618E07A9F482486B8093CCF0B5E2

SMS_MMS xnqmsozg.hygbnik.mnrjvwq

Page 95: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DBAA10B8374FA93E1FFEB25ED69AFF4498A95F70904112A88295E634625FCACE

SMS_MMS com.paljexav.kjxjawks

DBB636941A2005A1DBE0CFE991FEF466623BB4E068875111D6FFF94FE205B3C3

SMS_MMS com.azlasaokr.dqxuxv

DBCCFD26AA09B054942B12F9312D398C715DF424755CFC17DDA166AE244607F3

SMS_MMS hkadmbgf.ydgxlbs.lmdwtpz

DC1CD06EE2C40106DB0145C861CBA8C2FD55087B9EE6160853818C4566C6A241

SMS_MMS com.kmbaosgrk.pughns

DC2D2844B9C60AC319973AFBA8B94D460845554E25DF1D17A50704270936C135

SMS_MMS ahlvt.xzmeapf.bystdjq

DC59650E321C8E769F5D63E6952E326FB93E2F0627F6CB6FF6E3D72EA696E765

SMS_MMS adylk.jidws.qercio

DC8C43B2E46ABD139F48D6B8D762CE37409C55BD66CBAF35068F39431F98619C

SMS_MMS com.bot.suka

DC8EF6A2D83CB141B6C73C44177662F2C77A0CB6801F1E1F78E69010CD535FFA

SMS_MMS qwn.axitl.hy

DC9E1E1524C8D2D36101BDF1913CF3670CD7D057CBE75F77323A84B5611C7B14

SMS_MMS com.icizlao.vmzpskwrk

DCAFEDB639C267A2107A77E5EA6D6E09E685091C7EF7910277D4C8A2FA1E6C47

SMS_MMS gbt.qsd.rjgweuh

DCB13FBCD3781BCFF9ABA22520ECB0AD273B17F7F9C3B9610447F63A41692865

SMS_MMS com.syslafb.uyljscyq

DCB4EE2F94A644E5F219FD37A659117BCA87B7ACC50D171FB0FA318579F1C4DA

SMS_MMS com.pwhectyp.rzlmls

DCEF73F8765A503E1D6FF91958870544F00F72166E0C3E51CE5FDA883E424E1C

SMS_MMS oejza.nmaixpjb.eqtnrd

DD0BCC60045206914F1E68400C4659EEC7CDC4DD720A3341803E0C7B7054E7D3

SMS_MMS io.uzyloxwmbvapl.sqndqyiq

DD156C74A1EDC3716CD579CD9EFFDD3D4AA337FED234741C8433B02FDF0A31E5

SMS_MMS rdjctwx.qvbum.doqmfiy

DD2F10C76CE5F4A255EC6E752A8EEA631B450D9F38EC09648BA5E669A7F63FBF

SMS_MMS com.nivgslfsvk.ljgxtqro

DD31E4F65EEDB647A63F8D3ED66BD417DCD1013A0645E154566FF1975262D911

SMS_MMS org.xeigdaegk.havljliyq

DD466DCB3978505A0D912A0C4E2AC337BE38909B3DDB78ACCA293EA4CBEE93E7

SMS_MMS zyildr.nysojuh.ciubq

DD972024B90E239C9C5AACB55FEECF61503153A6591AF53CB9E95835014655B2

SMS_MMS com.wqmwnv.kynwoeat

DDBDE1B4BB84E99D3F107BC916ED9E83B1622 SMS_MMS net.yopqfjkm.oybjobvogx

Page 96: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D41BD5994FB0B4A988890585EAC

DDE155F75F0C71B2D4BFE030DF736E6D9678CC8C789044C01581C25DD8831B6E

SMS_MMS buq.tfxxrvj.tlfttzb

DDE7AEA16CF31C09ED7CCD1B137C663DA0348225B715167AD0291173B0FF5C99

SMS_MMS kcobzv.vzodin.lumgx

DE0A2E0F79D82FEA0DF6DEE52A2A74EC494EAC297C02EF629E3A6C5D4222E8AE

SMS_MMS com.ihojprjsdh.rwsha

DE29AB50E4DBED61EEECCA5A9EF7B93060169EC92D3B4C87237EDF888CF6385A

SMS_MMS qbwkn.nbgerzkq.qbcxfdkt

DE6F636546B3FE97C0058A418769C292AA045D2B8317261058C70A86F3C6C293

SMS_MMS com.ppoclqwnoipf

DE828F120ACE8DE497D5B58347646E3037B136E98437D02FD20EA4EEF8D9C5E6

SMS_MMS com.bot.suka

DEBA069010123A7E01A4F27AA0E856855B66B9B3FF4C5EA0BC138E931B8B85D2

SMS_MMS com.hjztzab.ailjo

DECF3A532F722E6CBAA3B591C88A7B71CF66638EFEDB076D5617A8094F8FAE4D

SMS_MMS org.brsiwabff.okocgparhsj

DF2849034951EC54954829FFF23062FA6A51F0701CF4BFF00C604A40C4CDF0B3

SMS_MMS com.ousgosxh.chymprw

DF680DBA160AAC631634A0D9AD7F68358AB336757414AD55E89AE04E83DBFDE5

SMS_MMS ru.axjdcxxmfm.fuxgieti

DF95959E93A2E44C43FA0E8A683663023006BF023A388A4B86E925BCDA723831

SMS_MMS com.guhalphxwcjo.grhajkc

DFA418047242D6E67EFCC4D061599DD574974D0BFB2D99ED1932D353EA4A47E0

SMS_MMS nfq.celrgxxv.hygpkwxkrf

DFD1AECE1E9DA37F025336107E5DF5A1F483938DB648DEEEC9AB6E0502F4D708

SMS_MMS zqw.ttysfng.agpnqdr

DFEFB09C890B24912C41349D87C2473859727A5495AD968C5440E7E7F7C06C70

SMS_MMS jfm.zzwboe.myak

DFFCE2917C7E0C9DB0DC79175E0181BF8DF643509FFE43E175CAFEAAA3A46DEF

SMS_MMS net.oddyyet.rkhjjhbyepegee

E014C28C15B4371695068EFD41CAE2FA49B96DA9637A7DDC79F9505241881D2E

SMS_MMS ezn.ruatruc.vhfmaiurho

E0346E343B8F3CC59C54BA61B9236F3BA80BAE86BC23000E42B221C09A67D1E5

SMS_MMS com.kftjnqldy.gbrphtp

E0406BDF92206A5E76EABB1FC56AE1E839AB05E9F3F2DBFD4DB3428C18F43153

SMS_MMS com.gaifxfbzg.yswyusvhdw

E070A87537D6837A907B2733BABF5A07D741EE91C2E8B7DD2608D5619E0DEB06

SMS_MMS com.zfupmwc.pgvtpgwdm

Page 97: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E0A31ED322DFA884C00D54A551AC789A3A1B99B76E6677ABCDD8045C288E83C3

SMS_MMS com.pokpygfmdc.mizfar

E0CF3FA11EE852640D7B2BE1CB7E6AF0FF01AB3D76AA39F14F53DD2F5DFF87CC

SMS_MMS hya.imoutmsvo.vldjuoz

E0E56A71A63FE9EF3CAC9F8A7F41332A6C23CF600172B7180A806EDC494FC112

SMS_MMS vfd.mbdmhvdu.asyuwzwmml

E13D8390971E667E2DD560ADC99E380175C47DC7555F115B7A6F93F44D788072

SMS_MMS ykizg.kwmpxa.dltzqcb

E159C0766FD6ADA88D0E49C813778B102091611BF0D1FD37EE58B35BD9FFB115

SMS_MMS com.koaandmyavvw.sowohqxow

E16A27BFE6194212239B6449CE8B0BE36E1CB58940AC5C00A68169D1EF54AA1A

SMS_MMS com.ueoqvrq.vicizpum

E16CB139054A9FF5A11CCCCA7FFF544AE30366AEF6A5C7D59B0711097798B70B

SMS_MMS com.ztudm.wbgdoxamqn

E1911A94259B81888BFAC53B951180EB6FD2F7EC3E5A22028244869860C3AB6D

SMS_MMS fcg.te.anchrom

E1D4E26AFFBF7DBA43B20C0EE5474BDF574F8024964E529D262553ECBDD883BC

SMS_MMS zmhcg.pbwrsy.lxqgwcmo

E1E747C46DB223AE1ECAEDEA305ACD6AD155155568D4CE02F7249EBE59C1F774

SMS_MMS org.ssnlacuigg.yyrttibx

E216826378DA959BAB0EC05150180F62ACECDD515E27AE453591F0694818930E

SMS_MMS uiwtcfpm.mrpie.ynjirgs

E22AF3B0B4238FB4C123B0F83A78FB8E607C3BF708B6AD253E69E11A5116FB33

SMS_MMS sag.ffdwkravc.eepr

E242E2920EF93B290816AA56D05C8AFE3CAC14814C5EA76E25E14ADD95D60724

SMS_MMS com.vbykopnq.tjdevp

E273B8D423D4B4E3F3B32323D5DAFD9BAE6C0894D33BBA9739B258A5683AECEB

SMS_MMS toawmvuc.vdyleskt.nizwbds

E27EA7CFCCB01C7E7C15D323284AAA16146601DBC74EF5F2336B12FE76A08807

SMS_MMS com.sqtgyl.dzmfeov

E281DE9CCF1FE681534CF44A5B5E46F1835564B924F121E2D03641AAB184222E

SMS_MMS hee.bflquvfwof

E2A118ECE5F599C08DB5EB5A1ED6DCDEF65759E34BD901FE2D03AA7E1B0EB35A

SMS_MMS com.tjkxfsb.wlbexpzkd

E2AE85D07217884F21BF89E30105AEE86AAE189C61D7DB6B01011E04259AA01D

SMS_MMS sakihobp.sbjny.lmtpxho

E2F9D5CBD488538F1A36B8DC061BF8B7377FEFE81A21FDD542420AB58EF96376

SMS_MMS rxvpejha.mzqrh.tizqrul

E3133B8740A18C1E9563F14958A43B5E3FD2FE SMS_MMS geh.kponyzhnhr.mqwjcaex

Page 98: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

440B5B10EFFB13828F3E7EE0A8

E3531CB1F3830E761D0AB9DB1AB87F476FEB3CD68BCF8CF344F05D089A7E30A6

SMS_MMS com.pllcrzbb.tqurmisip

E379487C96E139EB11854FB970ABF54DA835D4E92ACCE14C6198B2C298E9A7D5

SMS_MMS com.ululkq.sqtxeua

E3936906F6D2A321188D78C4ABE40005E2E02E1467B14C3664F72C7AD8042FDD

SMS_MMS net.jbqzflvmravbjqv.lwpwoqnslo

E397F62CF7894916A2CDC4C7165C3984A734E4445882BF4EBF7D0CD25FD3FDBF

SMS_MMS com.knihr.xkxcs

E3A0809B0A99E09B4D29346EC076F7444CE0198D9EE5D373902BE31D2BCC7B57

SMS_MMS com.gngvlc.gknwu

E3A799189E507E4715B8ADC3896970171EFC66AF8F2979D155766DA006666E71

SMS_MMS com.tcaognj.tufdgmsyn

E3DB2DDC34D958243AE8BE59D7392DB7B60180B087FC80E2284C1AC4D33D4419

SMS_MMS ncslzq.buqwnmoz.ahrjpu

E4786AF1D77098B917024514D2140A20E3BC6D17D4305E21716D2B3C69FE8B51

SMS_MMS tdbxrsnc.kjxzvf.oewpcjts

E48B05612145CF642D3E50B98FC2F266CAAE8A7285E50468E37FD24CB1BD0B80

SMS_MMS org.peddfpfxwdnbqpn.xlwstrt

E48C3FFAB6D70E5550F57065F34F7FF0FBB1871382AAC3FD5B08554314AE5A09

SMS_MMS com.bot.suka

E49A9F2CDCBBABDD923D838EFF80B3B11E987045E300F249022DE01DBFC76EC2

SMS_MMS org.hfifyyjmrdxwy.uwnscryrfvofnsn

E4A36C7DE7B19107A335544AA7AA699934DB2C18567E47A5708A169CF6BAF700

SMS_MMS com.enbuxn.vktiqr

E4BA57E203AEBEC502B28FD90A7FFD674C7C3B6C336BFC8E13DE64EFDF6A86BD

SMS_MMS com.dsiusewv.ebvpcevlpr

E4ECDC2DE8D4C7455F28C7BCA03E7046AF144B95DD0ACE0F613E9EC0F6AB45A5

SMS_MMS hykeq.yftds.jnvfwztd

E4F07B467169DDB85E8B0EE2A1FCA486DE11CDDF8DACAF8C59B6DE14018596CE

SMS_MMS yaq.qhukgwpv.lkk

E4FC103C62F09208E35ED2677CAD60A58058BB6335B28F6F33DADDB319F1FFB2

SMS_MMS edubovgk.iougxsy.nohga

E50A113E2DFAB9BFF04F65064884F584B9B0BEE50ECC2C936CE37C10AFC990D3

SMS_MMS com.wmikmg.jfzthclrkz

E516763F478996B380EAE749EA15A54E6E605A55403DEE5B29CBF28E56A06790

SMS_MMS com.oadxdq.kzrnkrtp

E54845333909EB758DA32CE46B9395DB0D558CB255A7600486CE839E7B1CB42C

SMS_MMS net.koyxbzthazrrz.ojkockp

Page 99: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E55DEE2F16532BC4DECDB2932BFE7A100805BBBECB373E85EDF8633CE9E5BEA3

SMS_MMS ru.fviumaouzsryjke.bmflrdam

E5A8782BAECD11BA01CC987650E3A5BA35DED5F498BCBD91BE68EDF1FD312471

SMS_MMS com.ifcwyu.fkvlx

E5BBED10380B7CEEE80761FE323C2B18EFB57E8BA0706F8356750325AB6956B0

SMS_MMS com.jznja.mvywtlzc

E5BE4A09A496B232C0A9DB748E52F30A387A9E128C2CCFBA1BE2B6F04B85A7DA

SMS_MMS com.nrwsn.eplfytse

E5ECFEFC7D5270BBBFA483DD14ADE2417E89F0D266893A854777B4AC6D38F442

SMS_MMS vro.swfkfwptvf

E62CDC86401D157954BD0D0DB2EC12576C064EF9CF2100E72B86ACA1A6A47655

SMS_MMS ktozspc.caloit.unzpqe

E63BA7CBCAD32F69BA65FDC23BA0D25627AF00A658607832FF5143F7BAFFD32C

SMS_MMS kahwle.zpaxywm.jbldkqcz

E642254AF58E126F18C5AC684E3E39AB8FE137E496A0E6A40F0D3FF46EACD17C

SMS_MMS egjdza.ojtyg.phxvuoaf

E64F77C871C3FE802386F2E2219023FE2F5A2470609634AD10A3F89CBC36759B

SMS_MMS com.zysmu.edabgr

E6725C5C3B719558B905D76F30D98A05F47418A1B8479F5B082C614980250473

SMS_MMS com.nynzubx.hckbevkadl

E6C47DE5C08E4FD6FBB1CF0903D62E1E552051D1FE01DA15090DA72E61C5F6A0

SMS_MMS ru.dsqeipeauyguf.ifdhaere

E6E47052D1446E0EBF08BBCD0365B0C0342FA2B8E7D82B9FAF6CF125D1E88FF6

SMS_MMS com.szjoyhmzfe.cvwgtihxre

E713B33839DC7620A91242D1EEE2380F410FBEF6246A2FBD120BAD12BF76BEC9

SMS_MMS rnm.kznfr.ehakol

E75BA331DB9830737C3BF40987B60A1CFD6A8011A2CB53E8EAA1D84294EE11D8

SMS_MMS com.fkuwo.afimzc

E794BF48D4C6C8B283CAE4A398F3F5542493D8BAAB2D17DC431104C5076EB1C7

SMS_MMS com.klxnavp.nfdisxplo

E79D236C9C854F8E4E9D8EDA44AD4058EB20ABA0201E19DB2DA36CE22DB437D2

SMS_MMS com.jhqvl.lcyzyjdax

E7D4CDDBC1655278BFEB86B5BD62E02B8C65C8D9FB7455EF0C7A3A6D86BA983F

SMS_MMS com.sogwvs.hovjfgc

E801561086DD16DF1A592E712ECFDDCBDD1C1D7AD3CF131DC93D52221594BDAB

SMS_MMS net.sqeazmrtvil.yibmgotln

E81560665246C8F4BDD985CBBB38D83A4FA194BAE6DEB515920984169DB9CC8F

SMS_MMS com.jsfypwpqv.flfhfulgq

E81C459D5BF2E7D8D9A506BC62CBE82634091 SMS_MMS com.fhetcdnuy.mveyaf

Page 100: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E425881593B89F1942310BB30A4

E8281AE71C184438BDBB52E23A44E2AF9A83919CAB03D864F0C026A6A9B9527F

SMS_MMS com.zsiyzmpsot.bvjdidmanw

E842350EB9F00A34947A405B8B0A3422AF4095B387019C1BF5CEE3158EB87A92

SMS_MMS com.knyuvsvtil.tcqpohipsf

E87E8415B04E5EE132B0858C10D1C5044CB712B92AF136BFDB8FAD5A7144084E

SMS_MMS com.hzjhfpzdi.wjnrgalouv

E88078EA4E1AD76C34269B409D46D2BDC5C641368E2B9AC4B2DD601F349C217E

SMS_MMS rrk.vfkljxfdym.yr

E8B4387F2B10C856E9B49F6761A7298630D7F6C61CFCA75FD0149AD4977C2399

SMS_MMS bchqdkp.uskzt.zovihxsu

E8ECF57D04E82B437A4B6BDB10996CCCD0E5CE5C99B50FFD78343092B45CD6FD

SMS_MMS com.jmwrmf.slsuoaea

E91138B16D8F593B6A685B67238BA47CF6D8500D44EDD12C54E4B6E915CC0562

SMS_MMS com.estwy.tmkuykbdq

E91B034767896AE5A8BEBD0336F8242F425C549D1325916A977131440243D71A

SMS_MMS siugjbm.hrzfqgcb.sorbgcyq

E947609A840A18EC79FBC132B232840C951C7BE7124BA0BB98CD07D40258B47A

SMS_MMS oidjypl.lkuvaqhy.rbzgpm

E96B4E786D256482E42B8F8DA8D0C3D7A8B31F1B4E125B5B2B6EDB5A0338AB34

SMS_MMS com.mvjrmua.hjwiahnso

E96C8B4AD420024A5D102A3C9C57C5FEE20F9393606D1A0964535862A8F81F5D

SMS_MMS mto.vbeumvoki.bpfqti

E995360CBAA9146A6548AC72A7FD4A45221D24A45432824C5C1C4D7F66608724

SMS_MMS io.achpekayb.qbqgzeb

E9AB212ABB2853A47C00321C2E4235BEA511926D59F31D13AC0AE1FD5B63FFA3

SMS_MMS com.rgaqapdlfnmacp.fwqmrwco

E9B21CEE4AB0970CFA10E5E30074F94EBCFB591CEE9112F928B1DA6D76399EBF

SMS_MMS mjb.ncitlk.forpulhcmz

E9C5B0AA1AD5A55E8B41BF167C2B523D6546D57F6D6A856688D407AE441EEB05

SMS_MMS fyrub.ziqxktve.bapox

EA1DC3E05D5AE2B355BCF26E3CD002C8C55719ED113CB99174E5C9B4FD4D2207

SMS_MMS com.axzqih.bkuoxkgubf

EA37CF4EFF7E4E04775DB306380517EF018ED9BAD49E3C8B7BFCC68681977E46

SMS_MMS com.lhqhop.izjlj

EA93D9C49A17C1047FE31EF37453A9FB483959BA9243B58BFB424EBF88CCC661

SMS_MMS com.tubqvjd

EACEEA570664C4EAB92E5ACDF98606B3974B79A256B9DF1245540DE84D2F8346

SMS_MMS com.pbmoemg.okudtr

Page 101: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EAE9699AF00A9B81BB7BFDD4B4CD5D89641880C9679AF07EADB64A7F6F3A73EF

SMS_MMS yuu.ohgftoto.jwu

EAF16ACA1BCF6FE21438E8E6B1111134317FB4E7900DDA4C95BA7FFA43D81E3F

SMS_MMS com.bizrtndbql.psafdb

EB033CC6482A15455F9615A3B2D1778706081F9B3760312303D674C0FF6C5424

SMS_MMS kud.fvpmifz.vtvsolyj

EB3B4CF0EDE6AC3F8CD1718243A6F4170BE464033EED5E0877A2544FDFB3D2AE

SMS_MMS fzvncma.eaotqbi.gpvbquf

EB405496F03AC1799C88FD150A05115CE3B936D1DAE5032733B00BA76B46DB5C

SMS_MMS exz.kluwjh.kn

EB55F1362EFA8EF27171A8C310A09FC17A9AA07673DAA4403270D817C07E137F

SMS_MMS gnjsrw.pkwsbux.ktpogmwc

EB5C2CB0B182974715E1B7DED3794B8B42CC96A5090E5A634E2DDCD4C95207C3

SMS_MMS kfr.ihkgcdpku.bnakyoy

EB9A1EB560C8688DA30A08D531BDCE5E56ACDB37BFE7AC079021226CEC8D0279

SMS_MMS com.uaewmbilt.ioqwlwpf

EBAE2B35D1E057737D53FEAF8CED8C6C3F87B049EACBCE0D88C0223B514A36A2

SMS_MMS com.sctez.ysroaiguwl

EBB973E409C8BAB615A47E16EC94D637385DA63C8FA9BBA8129136681379F001

SMS_MMS coj.lf.fywfwtzosg

EBE75399A60FBEFFB97E4A01BAA392DF8A7152D81498FB5738090B836CFE7068

SMS_MMS ozv.pqnjm.zvxipxusuy

EBF89FD94EDE1DF1336C7196DF022EB5DCB750A241B17A5DB265156682900D13

SMS_MMS com.czjhunsxnt.gylsq

EC0271E0083C94809426255478BD909FA05A9788365E62DBFFA206C4A9D37E62

SMS_MMS com.nezrkwnrw.zsfrnx

EC0BD0C1158EB480CA52A4FFD8D0E277804407888FAAD58650272F2AF78311E0

SMS_MMS com.dsqurkjgqs.pwuawvb

EC5542809321FFCB372250CA9925D9B1B5E0EE5CC8903B5555362C7CFCCB493B

SMS_MMS qxtha.wftrn.kyqgdfb

EC9ABF970BBE08691CF555E965E57FBE6F22D9F09E8A4861B3A1691C12A76F34

SMS_MMS zbmqd.tgrnzdb.gklqezo

ECA5730A1EC8BF4F30269F1E1C208EDD7EBBE1C19799D181D8E8272CC8B9764B

SMS_MMS com.prbijmygx.hebsrgbtv

ECFF6299B1219CEC1D5D9D888A730BBD07A6E06BB13B9216BAEBB5CDC0357514

SMS_MMS com.hdjgrvdy.dhvfypvfho

ED184F85A1B16B8B6CC44C037088B846DF09FC826E88BFFE518F593105EC5F6B

SMS_MMS com.ugdivdf.fdmesvglvc

ED24F773C3C6D95155CF2E6036393BAEF9019 SMS_MMS eamtdpwq.gvtcmzbl.apqnwzio

Page 102: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C4BCCF113B36F752CEEC3946080

ED613BEE92018D48BC1FEB62EC06CE3231D866EFF23880DE54756627C7F6D62C

SMS_MMS net.jrgcokfxnzhcbmo.umfyfvtfageu

ED7450CA59A56652FC2235B0C0EE20C28229A32155D3A7690FBDEE6AFCE9C07B

SMS_MMS szf.wlnwsdc.nyjhg

ED82EC05BA3FFBBCBE111A4E798DB2F700389F012C4C56AF9C73AA878081A661

SMS_MMS com.sfmkvkwi.ohvzak

ED8BEE43A67048895E83B1E104F05622BAA440E89902B222BA0A237AA4191F46

SMS_MMS czofbqsk.xrdobzen.wvsqpfj

ED9E307C4B6846D993F64FC1FE9A3FFF36B1799D74DCAB9E2CE73DA858716DCB

SMS_MMS com.scpiqs.babshz

EDD17D4EC835DAD77313E0D30F69FABB1D7263BD9050100ADDDC81A9F6F97768

SMS_MMS com.uxfwamkhz.lpxvhfmb

EE127F7D2A2576E01802B3B49B5960DB06F20A461885844055D2B7B281C7FAF4

SMS_MMS bmftghdc.dsaun.pknohw

EE1F3B03D1A144868179C6F6ACB17CF0C00DD5A62FAC7C68ED19F71744DA2C6E

SMS_MMS opuhgfc.stekcf.rdcvxn

EE2D28F850F896356E483AEA7A415DEC31E9780F3A465C56E4A4BFE1E5D96023

SMS_MMS com.ctfsip.pquokfsiye

EE55A79CE116A38E0747BF23E65B49FA98E554DE3E96460A45C2587FCA9E6491

SMS_MMS zjilbuv.zhydij.hwvsilpq

EE96B2C19827B7D3BF882ABD1FCBB6CE03186A7BB1AE5056AD054DB05ECF5AB5

SMS_MMS org.ngenerx.rhqoiknd

EEAAF6B094406FBC998C2D82C914A1FD4856207CA14BF37F785012A1D7DF44D7

SMS_MMS com.hmurq.fmxeot

EECE9423665DF060B5502B3DA9C8A9D938793676FBC0AC2D1656BF5C7F3AE696

SMS_MMS com.inpogyp.svednrzbad

EED135487D3FC556BE611801DBA626569744FB0C2103D6AD83CCA241B472BA9F

SMS_MMS com.vxwyqbayb.mhnpkfnwum

EEE5C865E28C1E053DA9E5B3CEAAE16DCC297E8992629E4389F8BC772CCA718A

SMS_MMS hsc.vjg.gip

EEEDF92DC78EF57AC6ABC0D5E2A3370BCF80D9690233A900C440048480B4F30B

SMS_MMS mew.pjft.cw

EEF60554848304689A9201348FAA8C45A092DC5D88058523A7D4BEF22B310C91

SMS_MMS hgeswmpn.ajfzvukw.lygazdrt

EEFF714AC7BB2EE191122A624526B4037EBF0C78D25245512248B3B61808455C

SMS_MMS com.zitmzbq.xdgpzqsvg

EF011DC7A3858244B486748C5390FA82BEB80CF858C51CB487BD265D06A8C4E9

SMS_MMS com.hrjvawkruc.czonmbh

Page 103: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EF351F363EE3DFD52CB8DD4E82E689C57254A35EFEA567A1C0BD2B031C0627E5

SMS_MMS com.mnpnxzh.pvfcs

EF57CF338162F61599B0D8060FC31643781644F75EE2E928D36E53A2A5849B89

SMS_MMS cmtzusd.hozup.rbvetn

EF596CD2D61644345377A14EE6FF23886F9AE18D4AD7ACA208F667CCF174982B

SMS_MMS vsflaui.savdpy.izyah

EF719D90F16055ECCE0737E655CA592FEABD44F368190BE4E5B35F68A0216E75

SMS_MMS com.ezujzxagst.mgoktovq

EFCBA030FAFE46F6AC18689CCF357AA6530210F5CEA44661250126DFA6B96B00

SMS_MMS cfthiwg.sbcmgfz.zagwm

EFE8A5EA3231FE3B77B45D7DB325D8D6DDB2081D0FFE6472E18877032547BA87

SMS_MMS com.abjljsvqw.ksxjmu

F014B29BA9AC76EE36BD826005BEBA970AC6EE07702DE933C6E243C924AECF53

SMS_MMS ajfqwy.pwfvdj.bvxes

F092B3E67E9EE8786E978F074A0FE3C51BD02C7BD3B5F895D073AF68CC7B2D52

SMS_MMS com.wogkdpy.nwpidvg

F0AC204B9C9F57408895969109E55371B306E376B240B5E05FB69BCEADD73F82

SMS_MMS com.bprpwl.sahyivembj

F0B2ED0CEC6665AF65E70509BB78B752FEBDE69AE88FC4FA5E7C8B3B7B5FFCD4

SMS_MMS com.lbvhpdsefh.lwtyibfws

F0B8044D584BA26F2D945C78F6BFF2ED3266356AD593415EC54B5BA470F10DCB

SMS_MMS com.duypd.ibkjepe

F0EC65B33FFD29130E0D5FEB343F5A245755F6599682AA0E570C34DE06D0CB36

SMS_MMS bug.epvfxbbm.dwregjqmg

F1043420C3AF8E69DE2D2BD67B649AAFA57AB12A0592E4AE9538A219411909C6

SMS_MMS net.gdpjlsmjongrkh.hfajnxowdvdootx

F113FC561ACAA02C590968E2D53FAF794CF559C9C010D03000172E5C1C55A6A6

SMS_MMS io.bkmqnxzzlm.ielvdzkaq

F13461874ADC9717CC552820ADAC96B054D35EFC3F99B4235339EF9032BBB939

SMS_MMS com.cuyprfojxh.otxeqtejq

F1484C262BE4FB8177B9830C0BCEA814FB815C16164A67FF11AFCD551F424B0C

SMS_MMS com.nehcv.kpjgcjpqr

F16266036D963A2B7953CAD91BFD76C934821764B6BB5F402CA6715D230F5CAF

SMS_MMS qclai.mqkwx.tijpfdx

F1B28A97DAA3320788027B5B676F4D17F1E34D940B1B63733A23DC64EE7C0C2D

SMS_MMS hdc.vp.ljhtcbzbm

F1C0CF5F72CAE0FC051F2672700CA59E8A026A5B54770327F581EB05AFCE1E0E

SMS_MMS com.msyfskl.bhnbukhum

F1F378C69C131D0D7C9516D04370856AA367C SMS_MMS org.vmjsnfahgdix.svpznobsetjkgx

Page 104: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F357F45AEFEEAD020F9171DA314

F2203DDE2DAACFFA610E17232DACB30C2074E1CF18A29C29BB9A37E916F383FB

SMS_MMS com.hayauyl.wdhpl

F2220E11FDA6CAB292A5DDBB206DEE3034B654EB1AB87118B6D3CF3334D4BA7C

SMS_MMS javniwbk.clnkrav.ezfub

F22CA1C0ABB9735E53FAF6F78916B3E2968CDBA09DAE28F6570FFBC8F3083383

SMS_MMS io.sgztaiwyambpu.fitkubyqpqpedqb

F22DC46FADC5E0F29DB77129EB6BC3537002240F059AAB94B02DF9BCBB9CB6D0

SMS_MMS com.ljzoctz.zxkuxnwou

F25CE1FBBFC9BECB73B3A24B2EAADC8D160676955E9E90711244A995A0EF0654

SMS_MMS com.mvhfpbci.vpuqr

F2661984741170BEB6A33AB032591322916FE8FD88ECED491BB3CB918295D3AE

SMS_MMS ixkfd.uoqkh.jmrnl

F2666137ECB1B53A2BBC696D8CB61CFA3A9EDD5D29D1F85DA17C16B10944A4EF

SMS_MMS kilvj.lsvxa.brwfol

F27964F8901A9E9047CD79CB2B53CF1871ED443E7E87BD4B6F9BE3C9B55E12E5

SMS_MMS rgn.sqytpygnde

F27F324D8C9784BC47116950F17A18C26A4C2909F0FCFA2C6AE6E80E973B995D

SMS_MMS com.wfcahpw.ulpwbyzd

F293D9E8C8B3BA74B905991B0DF9DD1A2249F9B88435275D362BB5CCF4FA4375

SMS_MMS com.lgwzs.nfsflaifo

F29C05A0B5F7E34A561B980BB5908089AED40DE7F797021996876158AF06E9FA

SMS_MMS com.auvwog.aywalsx

F2FB3FADB8464A91CDCA81FBC0FAC584A5F2FFAF5C2DEEC0BB694C514CFB08EE

SMS_MMS com.zdgqrqb.fvlpskf

F303572C318759689977E094A6F747ABBE99367528946D4566559F5A87788B5E

SMS_MMS twrasj.dzrhely.ngrlmzt

F30A7EB5CED4E9501B8AB4CC7905ACCAE808ACFF2CB63ECA4E724AA5A2387E23

SMS_MMS fzf.relgy.ogzyqnf

F33E7D1CE5400AA9262CCA84AF3D86744815491930236DC96F13C13D8A7E6071

SMS_MMS mxftjaz.gktlufmp.cfzhgbe

F340466194659D92BB140C60F3C38E3428DC1B20B97030CDEA45FCE17A2E578A

SMS_MMS polenu.ykqcl.uywsrn

F3430BBC7B633D35537DEB74BE4DD14FB3979AEB63D5112E67491E8027E50DFF

SMS_MMS pbdhc.wholf.nytzwsex

F34B6558879CE66EDE974BC02206F664B273BBF87FB5D5D9069E2F5734BD00C7

SMS_MMS mmz.jvujd.tmedfcjem

F3724645036455BA7A351B12B998BF10B6B2FE346E5E52B53A48742DAE92BF83

SMS_MMS hvh.ftegat.uzlq

Page 105: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F39C5FB42F9E594A1EDDB561A6EDF9CC2160E1C1AF2E23B2ACBE9634591CDDCC

SMS_MMS mml.fbopidv.dkijl

F3B9E917D9FFD915888A8F92D2314343533260C68F7BC7FE3793D3F8FA824DA0

SMS_MMS dbnfzw.lcdwjoe.jalen

F3DAD7E6B0F11185E0C0FDB76FC5D64B67B92435B05E9BFC478385BE6A5A5111

SMS_MMS com.nmgvrices.wabversna

F3E1F061BD5E6311B431C9733693DAB29EF96141ABDF98F6B4D1461622894C1E

SMS_MMS pvofx.poxgcfm.mlsrzt

F3EE6CDFC0AA2F2CB17DCEC9E2A680197C5954F55E50EC7D74C19B48AFAB3AD0

SMS_MMS com.aiwqtdu.wonanck

F3FE89E6D57C86FFA76F658DC777CEB00E929E4DF49C2C590B04012C8696BFBF

SMS_MMS com.kvgixbh.nusdy

F414D39042E2C0DE17877554C73CA0502F766B401846631A69FB961414381182

SMS_MMS com.pxvsfn.thvbah

F42FDA71811F50EFB1BEC8A8DC218E6F9202B903501AB84F0C1D2047150FB0FA

SMS_MMS wnuzeip.cvwbauq.nomaxveq

F43FB2FB56FB8C1ECFB7F81FA0324A80E105F52F48398F415518E4F28DF2A33F

SMS_MMS uxx.ggyypih.jxpncqdqd

F4498FE204C7A17028539F2DF198A4D99FBF83F20BF4087B6E85883AA31B1C59

SMS_MMS com.jadlmhepge.lalpbhe

F46EE88E207F05A9E584D0FE1F2BB64790B727227CEBF5529D397CD38F4BF338

SMS_MMS wfz.evabftoat.gmpmr

F4849DADF6C8654285E6E38C2726556825ACA5BA094FA6C3C38CB8556FF24382

SMS_MMS com.tshko.jgfwsrjcm

F48CFF2DCCD6DD3C8BFDBE74426AC8923AD819DB60BD45780A945DDC45D82291

SMS_MMS com.upabdysua.rhcvhqh

F4A60277957B6644AEA27977B3F811F7A7067F6B625207BE02858E69E011963C

SMS_MMS fnj.dgpgnkuox.alouhv

F4DAE2686BCA591D7D26D037BD33530E2904EB9D34EC8DB48574DB57ECB74EA6

SMS_MMS phnzjeg.ofzdlbi.hqyuakzv

F50945927CA79F42600B213DE9445949E66AFEC2DA69ECB29D599BFC50FA2126

SMS_MMS com.ailoq.kngnok

F52AD4C4ED40915AED45DA3103871A1DE93479F52A1D531C7BF343C54DBF15E9

SMS_MMS degwy.bhweurt.jrazwfp

F536C3BB7B01533B5CDE7FAE41FFF80715F868F95FD4B6C18E0D90F06944DD44

SMS_MMS uxynmo.rlvtxeh.coldreh

F53901AA8CFD924A0D46C9D1B3D5FA0C7E3691E23C244830B8C50C6FAE012147

SMS_MMS ru.dzoxwfjttbdvdp.xvogvouosvtq

F599F2A7AF6CCDD1B9735F78F062C6F1057220 SMS_MMS wlneuz.xskje.jrihp

Page 106: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2F095A85D9B3E658B6312E28D8

F5F57F5954A54BBAC5BE75C19F3A4D5F39EA72E455594A04F6EFDF1BF228BDAF

SMS_MMS com.waexokcxld.ayifb

F60AFBDDAF0B6A2C920F231DC8F220C94346C498CBA10E56AD2AAB5DBA25BCE8

SMS_MMS com.vxhtsqkxij.kwiqni

F6337B94D807F965AE30A26FD74E34BC529357982177A87ADCD35FCF96BEB3C4

SMS_MMS com.cevzvmwgwk.wozfryc

F63860B0566A9838E9640704D1DFD9AB579089DF6AE527F5A86441C4B171049B

SMS_MMS com.enrcjhqyk.rqxjcef

F63DDBCDEAA3BC1CA51E3BD6767D3D73BD6AE1CAF2AE2A469F2762B2297146DD

SMS_MMS vvr.efootzl.rtthzm

F651F5CD5E66DF94C03E73FC4FC4E5626009868EE8BC66741B0CD809AD0C88D0

SMS_MMS ru.ginhrep.osfyrdshajqk

F66E4C44BB7485E7B02EAAE530F619637C11DC8A916B0F6ABDC832C707E1AFC3

SMS_MMS io.aitcubwom.qyqrjhvufqdcx

F6712F52CF747AB26AE650D643BB6C71DC181AA977F7E24EB8A9A902224C8CE2

SMS_MMS com.opdhvjx.xdudozcrk

F681084137729628CC93BB2E43B5000BD38D993FBD70EC456ADA1EF143B9BC77

SMS_MMS com.aohqbohalc.mygtokf

F6AD10BBEDF4488D7FB3649045F6EE336AAA874650F01EF45543BA37A7C8DA8B

SMS_MMS com.fsimxigq.wskwxyzc

F6CCC89AD446B99370EC5575E68B3923117F40C37B89EE4AB1BEC6D5D0EFCEA5

SMS_MMS com.kbkabrcquy.cztqfzxaw

F6E19CF4C7FE628D50C7FEDD5AD616641BF2E51A679B4A918758ADF5F3081216

SMS_MMS com.whlaxwn.vjacwoets

F6EA2F06CEB279ED59C345F2C2576979093B9D4C13E42A1F5E8FB74C8CB602E6

SMS_MMS qpr.ewprieutl.rhodbx

F6F0E7E019F09FBD5C51556F60AC65A4E718DC83F437D778C594735F0FD5106F

SMS_MMS com.hrvgvke.tboxzwvjc

F7013FE817DA2996C828B54B0616BBD9D112218CAE3085CCC65677063F22C9EB

SMS_MMS prk.af.bftcf

F7205C7BDEF43BEC3C3A108333C8B5D428DF3CF1F0458DDC67F063B42C4CF7CE

SMS_MMS tmeuv.fzqbpwe.elpacuh

F756B86C8BB145EB4C3C09050ADBAB0DF474E92CF4D324948B7040E7A3D560E3

SMS_MMS com.evuzbtrugr.dqvyv

F75D23B5F95692BD441A5755C0B6655EFA0EA370335777534C1B1A43CD9A3EC7

SMS_MMS com.xifwivzm.mjlpr

F791B2716DEB374780086DB66ACB5B8C48DFF94EBBCEB873C6E16FF18DF521C7

SMS_MMS com.nezqurwz.wqhagmepmf

Page 107: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F794F73C27C498BD25D5943F04BBF3E7FD668BD7FF66B2624CBAD66BCD184C75

SMS_MMS com.taroge.apxbvp

F79A208AB578CF08CD72676C0331B8861DF6CDF988B751C240DFD6CD4C3ED5E8

SMS_MMS quq.pm.rgtpkydsfl

F7AD2E75A96A0DBFCF1AA6F2DA36C9D77E629C9B1F1237BA15F3D71F417CB0B5

SMS_MMS com.eiatf.uedskw

F8058EBCD57C6D39C38F219B640A3804194883A01C57896DD309A3B0A6F2B5BD

SMS_MMS com.joxmbptkmsmozdg

F81D2C000D0AA8AF0709C022891DD29B5D75B72A10B51198E091EB854193946F

SMS_MMS grb.bgica

F82DD4AD496FC276D48FE36909478CDF9AA99A0414F0A6406294F6A051C43BDD

SMS_MMS pslaghoi.cvdbn.ohyfg

F830791D1465BDAC4719EC7216C7D841FF7625426779774EF62C597F0A2A4988

SMS_MMS pni.npqkzu.znalkz

F8D930ABE3CC79D87975AB5792BBEA05D9BF20F72F790CA7173E316986AF5959

SMS_MMS com.dpgwyc.tbdtuficfp

F8F24AB835EDFFCB0D4AFDD870689C03A89EB034F67A19EE9D567DB8BC201CFB

SMS_MMS com.zsvasbr.arzmxb

F8F6E5562E19C1CC758AA85393AB28960F631D83FAF5AF990F222AE940B89228

SMS_MMS com.vxyij.mvlca

F906C15B165B06AED0F02BF723DCCA9C79FB736C55E1F08E4A726FA1FD8AB312

SMS_MMS jxqfekhr.qolivadx.vqykia

F90F03D02B841A01EBB6F14BC48FCD2D69ACDB70E346DF5CD2DD14510B03D9F4

SMS_MMS com.pwrobhuy.bdwemazyj

F91F8C552D7E3AA9BA86B02C9F78215F8E04724C586F2AF784501C74B373EE17

SMS_MMS com.gernls.pagphwo

F928CA98BA507310B6AD18B567529570934243DCFF9132581D6C1BD5616270C3

SMS_MMS com.uregxzfqit.rnwgfq

F92E4EDD80D3A2C0D57D21FE549CEE920E41395E4236DCBEFA280EFFC1D516BA

SMS_MMS ru.axennrovesdr.dimhufravq

F95E5F22C8E9BC9D2108703F8A4059701BB94D12653224F9757A3D5016A966E3

SMS_MMS zqdva.chjwqkiy.anztmp

F965532BFF12AAA01AFCBD62D62A52780FA9BF77D162E2C0C2E2DBABA4762D0F

SMS_MMS com.gdotjire.rnvhazszv

F966D098D2AB02EE11E16A0F88D9FCA6F2EAA007E06A52FF3C07B9B1F5DD17A9

SMS_MMS varef.mbiop.nszpof

F9729511E1C2CCD95B38AE61E3BD42688F34B9A5AD8E811E2EDDAF9F43BC0EAC

SMS_MMS efm.qjnnl.kihrmmz

F97389F930092D787A27D26D8991821E94BA0 SMS_MMS jehcds.kdhycsl.hgewzlf

Page 108: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

88583F0CDDA9B01D98875BADD06

F9B5398AE0BA055EDA539541E5D148DFC9A39B706BA7D4A35183F7ED5A557ECB

SMS_MMS nke.eeidjosok.mlmjc

F9B572E35664DE2DB1DCE92B7EC3DD519BCFA4E507E364D112EED255BCC9A25D

SMS_MMS com.snowzrl.rbqiqnoufl

F9C040C40397DB74FE73B7D9AD0A424C277CA65EF38DBCD29EB5C8D48B58CE87

SMS_MMS uti.awt.uycofap

F9CF493C3BB2F2FCE02F3A6044CAB6C4695EC50F8C95B62FCD233188511ABEF2

SMS_MMS idp.tco

F9D117FC313A27C9E5261A610C082EE8DBF161FDE7BA7AEBB73E408A62B0E50D

SMS_MMS xzw.laa.niudjgndqj

F9FEE17077DA6BD22B4331EEA06ADE6B9257668177EBD21162A966AEEC590F59

SMS_MMS com.emjol.xlsfgchbeu

FA20478391746554FBAB02EA671040E80F716A87AF6CAD5FB60A8B142C428C6A

SMS_MMS thbdro.tinasr.wekulfq

FA36EB7AB7817688C6D60B3B4BBFE13C0AF5B9D689FBE6CFDB734FF62FFA4B67

SMS_MMS ala.vqpimbvm.kfbi

FA88A589C6BCCA1FFD677E7EB2FBD3B6C1E913FAE95BF39109438224869E4063

SMS_MMS lkdxhur.hpldjkyg.edrpl

FACE14C7EA1D348E1FE6959EE0250E0181B849502D28905D61B0C65114ACB314

SMS_MMS com.gdavl.fuzhyvwm

FB2CE4988BEF41B80E2FDEB717B90952FFCF5D696152A8D4DBD1E1A1D0003DA1

SMS_MMS trc.auqrfowt.zwy

FB3FF6F6508845A189AFD80768AB992531873C57B9341571FB6459DE671695AA

SMS_MMS com.lwidwu.pceqob

FB63BE4D72E48DA55616688A62C30C7C5AE87553E54B747E7C9C97AA702384A2

SMS_MMS com.pebul.gnhgljxlnt

FB730A5AB65BE96A0137942069C2810FD7CC4815A2237A788A5DC4A185F3EDD8

SMS_MMS jyzfq.lpmrfv.cathy

FB79052AB2F891361703DA704FBF9E286D97F314674134ABC9FA759B7672227D

SMS_MMS jrade.kcoeani.tigomjzx

FBAA2D7639D242AF241EFCDF72683154582152B465C456FA00F68E545089584A

SMS_MMS com.kneqkw.qejfpiq

FC877BDF611C1AFF895C6051E9CEA84DB78C57536ED3025C6B821B9FD590807B

SMS_MMS ru.rbembnrauhc.ephfaupvbsl

FC8DF9582674BF3AA2FB5AA0EB946B3E250AEB42ECCB51D11DB9C8482FBB608F

SMS_MMS com.iksmbk.vnikjluxza

FC9BF7FBFAF8197EC1BF80401AF756EF1873087DE7CB76906714F99CEAD7DD68

SMS_MMS com.dpamezgeqb.bsvyzhxo

Page 109: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FC9D7B1747A5A2C23A43FDF4CBD0F18B5980F01AB884730539BB3D3627EFF585

SMS_MMS com.zityfly.wuzjti

FCA03CE3836AA21F4546C77F814F0F7CAD0415F3A72A5DAEF348E70B37F772BE

SMS_MMS muv.icpubdhmfr

FCA1D2FFAF592278FC573EA96057B82B26982392770644833FF359EA7755C52D

SMS_MMS com.bot.suka

FCA339C760B4959DF9027EC732EAED94450241CDADD6309BCD04BCBC6D61140C

SMS_MMS zrb.po.mqc

FD3DA927729F5E8E0EFB62E1D53D9444B446EE7CBF31DF0A2E65DC9EDB18C480

SMS_MMS vkw.bn.exlug

FD7B032B680E8C187093F35038E89C27EBE070B04AB51421ACF4E2A101FC4F7E

SMS_MMS sww.ihrkupvm.uop

FD89CEC875C1D959B4087811A4232FE1D10C2408D1CA356763FB148E0CCE9EF6

SMS_MMS com.fvdultco.afeajyh

FDA512F2CA3AF27AEF5B404B7E42E719397ABD20663804F6835FA1597E4C9199

SMS_MMS coq.ihoe

FDA887D10DB10C8BE7CCC2BC1B07E15F0BFBAA357F388B715045CC485D814BA4

SMS_MMS com.ozlau.rqfdldc

FDBAF7EBA91BC8C1C39DEABB687E2E197636A08ECEFF24BA554FF07EF97887B2

SMS_MMS temwljak.gtomudz.kpwmsu

FDBBCC449EE52513FB46CC73FAA9AA1057F15D47BA2DC8BF400F90C50FCF28F4

SMS_MMS com.grjrudld.qufinyvap

FDC01B6385666B55549B69D4A84C24C0D8156B080EB4AAA6F80FF74364A61CD8

SMS_MMS com.vyxgsfhptn.etekwn

FE29A4F6BFDD63FF22C71DDA326DF6392F119B70715E6C430460CFA650D16972

SMS_MMS gxtcmyin.uhezo.dscbt

FE47F22D47997F477DF7F2B7B0C53BC7C2ED57B32B9E951CB915E4BE39A79E55

SMS_MMS net.ldwnwvv.wdwxvdhcgbvkm

FE582596C09DB609EF6B00D2949F138DE53BB943D75C0F6ABFC38657D32C21D5

SMS_MMS com.ogyokcwqva.nxvrbd

FE5D623E1A2DB25431377304C2B7B570E577D0D6982143962AF10E757E0CA29A

SMS_MMS com.pmcwxi.wxicwnz

FE7205ED56F93C6658DD779D17425E35F368B217A42B3B721DF6E0F9DD615AF8

SMS_MMS com.tdeipqeb.nablwdorol

FE91E6369BF04CD6D19134F7E18910EDF4278FD1A013DB5FEF19B7B3E38F7B04

SMS_MMS ugj.fpvy.fwnxrbwdf

FECEAB2DD0C5EDE42FBF409D63D9A88B5E248DDF8C5F0C1886F86B3C109E871C

SMS_MMS sec.vd.htkdesxcr

FED1A4C9B951E606FAB8048DE697C26030BA4 SMS_MMS lczos.goxspr.krcpyeum

Page 110: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

47417693B0DB23627F90158FE94

FEF9A9A682AA95ED39A66061B74941DA26ADDD7488B9FC1A60708C4FA9AFDC22

SMS_MMS com.eaiseqnpfx.vivjm

FEFA19D3119C20A28F244DDF3B558705C86A0237DD2F147B65FB6F64E788454D

SMS_MMS xsbvpgn.ymfhlaxe.icghvd

FF23C7B91EB41796DE572CB8D0AD3CB554FC99E29CA0DC56E789245C384241B7

SMS_MMS wqg.muscx.wqvlwp

FF2711B591270CC9F8D2AB8A42E7C696CDAB4C7CE4220695E2D1D8EFD07EE3C7

SMS_MMS com.jgqpkc.relyfy

FF887293EF9B72AAB82DBFA38DF7F608D3A0E5E6742F220CE5E61BC84B4A695C

SMS_MMS ryzapho.mqrskfg.rlsmfnyi

FF8F471591F799D4FCC2EE55E1A6C5CA59A80BA4D07576BB61540E7C7C8C5B09

SMS_MMS wzx.hzyem.ixonzhvpjd

FFB5F00C250E7F2469F60A49265C7D7FE28E22D805B7EFF8A065CDE3084B9F55

SMS_MMS com.vsbktz.dfavald

FFDFD4E7A49654C11FFFDAE13F418F58F6AD3E95121607ED2C397F676A18CFBF

SMS_MMS cuzdohe.chegxsip.hnjuf

FFEFDCFB356E9406180269CA8965B1C6F910A1CC4A68D0D29ED408BB9FFEA614

SMS_MMS com.lfnghi.nyqfol

00041F6AD1F757B93C5C01DF0F188495284927B8D6BC0005AFB5CB6E888C9521

SMS_S fjkva.tsvjfc.gjandsbu

0018BBE679213E137BE12F6226BB67BF5E3D9F7A04EC518968D69BEFFBBF65A7

SMS_S bwtve.bseqlhf.utjgopcxdfsa

00233A1CC673B4FD869C0B18792BA4ECED3737583591963AD621BB39AB895535

SMS_S uzthi.qmajlo.bzgjuwhxsy

0047B986E736C0E386B08E402952A28248DAA1316B2EF11A346B7E62B0694D98

SMS_S hawp.uxkpbme.atnidmvj

00551758C58262B1D5D8AA1E4EB28F9503320F8F90C1EB122B08C2DF086E66F0

SMS_S mea.emydobu.oidp

005BCA4B1083176D1997529FCF4B3A23C08482048D3D6C0EA63023DD23B4869F

SMS_S vbaq.peukzqvw.ogdvjumrzx

0066F230484F4F7033F7BF3C24C963E0D178D564F56541DC240ADF4CCEA1732F

SMS_S qjpv.zblocat.juhzvmyckwf

009E63F208DB4B31F9E06ACC9A580235A0C361FAF4406ED3BFE1FE11DF4960ED

SMS_S wzjp.cxjsbriew.urgivftbq

00A278EC729DF6FDFFDEF4617D4B37B3198A054FA4AE1E1CAF6B87BC2B6140A7

SMS_S mfr.ksnygam.tnhuoglepsmk

00D006C32635F350D392E4E9D55E2115198D3F7474E0B9C18621BC9CB7022DE3

SMS_S nwbg.hidqpw.tzhcdailsuq

Page 111: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

00D593B2B4028A723FDE4F921F755167C650BDE1C814B2DD3F8EAF9B00F25A11

SMS_S yzv.cpgyekmiu.thnjkcqmoiv

00E657F34A0A6C03201D0E672DF2CD493A45364B61D0729CADC64D58004D598C

SMS_S hwd.jpniaro.siubzl

00EB3776FAE9B2BCBA1D6066B0D5EF41DD5D38FBFDF737EFE4CAECC12F504552

SMS_S lisbmop.ldbakhj.ugktbzw

00F723F607CCBC67CB1B345D5B3C61A35C1928AE68D34339D4C78FAADF32381B

SMS_S bkvtdw.jfbgqloz.fyhzsmqcegvu

00F92DE84CF89A93E0807815B77CEFD7F01DAB4DB9D656188E652D5C0A101EC1

SMS_S etz.psnthzu.rivbdmxjf

01010135283557E996F3146514724254EB715439C229FFC4D4C59CC510674A6E

SMS_S nwiod.wtpmdjq.vctqfskbj

01153834DDFC3FE4FF6CEE9A481B87B9EDAE05482122070CEA10E8A47424DDF6

SMS_S lxpmqdn.aurwszx.mtygfzido

0118E9CC02B2F4CAB9B529C5E2A771F8A5427334CC138755CDF511E3BA91B4D3

SMS_S zcrdwl.fbjmzwego.qgwsejlvnp

0119FBDE67E0EB56FE056CA27AF0455CC20A1061A91F83BB316B26CD3FC87174

SMS_S rhl.qacrhuz.ivxztmg

01450BF4E916CA3EF5C7946FA73C8B609FCE08E4461E3C8D152F646C73AD416D

SMS_S kftd.epimbofu.pfiqjcbvy

014A6B66ABC921EB311FC999DC68F086487BBEADE23C2E0C3CAC676C11C6459B

SMS_S jtv.wbgqpd.bmlrufpidztn

014FAFD1EE7EDF3E7ED9726935DD565CDAD05963543C7E8E07B5646EE69C54B2

SMS_S eyr.nuvjoqc.ldycfqajr

0165CBBD1CB235A3717F3A85E0D339AA6EADF04075FC5B1F406E12DAB58B2DE9

SMS_S fbvlpxy.fheorpn.wyqdfj

0184E540093FAE4AE0541CA1D98A246D502F36D16A95320376F75155A28A75AC

SMS_S ohyfxp.nwbqvz.dnqgjbkvzsw

0188B8A68F74970E49FFFCFD1893251C6C3FCA36CCD91732EC49D33DC6AD8762

SMS_S gkbvizj.afizwyb.wydnhtqmj

019D0F92474B90846E71C149E463C8B708D846773963725E5EDE7585F3857F9A

SMS_S irp.ifmjwao.ipdmel

019F3176D98383D1CF933A70107049F17FB3B06ED60FEBB2C40AC79867278FD3

SMS_S rhlfx.wcmefsyuda.dplcftuv

01C0827347B2FE657047C1AB22EC126EF3D818768C24C98910D8F22CE124AC91

SMS_S cukgr.bkjpylr.buwpnjz

01D33237845FDB1A358C213897BC123AAD71F2DD5269522B374A95D365C822C1

SMS_S bud.qagrbhcis.qljmwfetgcz

01D5D84A79BD799BAC48B287D0F4CFD763CE SMS_S etuqhg.blhwpuais.qcizpumasor

Page 112: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C2C243FBD6B71C912C6FFE9EDEB3

01E62FB7FD96CA478FA6E0834C7FC8C2D9A743EA43171C847AB5CFF28DE9F1E9

SMS_S qyjtcz.ysjndreiu.ytjubrlsaizx

01E9B83D71773A4EE000593591C9E167683C6A36D96C52D6C57AED37580C4A07

SMS_S pljd.dgtnblkz.azkuemtj

01F0ED634DDE4CAB6E48261861E82CB4B826DDAB71C211060590F6E5B70D0638

SMS_S xtqle.fljuwogpeb.vitumzjky

01F3EA216AF222FE25568736160F5B02C95F8E054EDA87A50EBD5AD7A93DB785

SMS_S bipa.hoptnzrl.taxq

021AB79AED5749269D6D320A7EF28B6FFC2A7E37077C48641F4BC5D55C59FC88

SMS_S ncol.gsyuoqi.hsof

021BF02D746B1EFFB6A728658B77604B3E4124CB1C18397309A5DCE3FD22F06E

SMS_S dutewf.gupfbw.cseayuk

024D27C817C5F57FE49FAB8951AB6CD492840C7A65F05397A261944B6012FF30

SMS_S vjrkp.sqmuvxnewf.zykasl

025E44C3F7170E0A5B14D81708A2E3D27BC4BAC46725916B8A6CBB94DAAE52D7

SMS_S fovz.tjskgrlqx.rnyehsdq

0262541A7343D60559301AE597F56EA340324CCA89DC5191080E6897BA67D2A5

SMS_S mwfdp.yjkwbuhef.gdik

02645982F2E0EF88E1825FB9D1C7CD626A52D2F15AF1ADB5652A731BEA307F8C

SMS_S vehtkcr.itajzkgb.iewuzrkfx

026EE6911E8A34BDBA2F414DA14040D24860B9CEAB875CBDE67CC34652D789D4

SMS_S vbezgx.cawjyfv.nihte

027530BB23BB9B745AB434B3D902A63CE494E634E0C9291EEEC4FADD283B308A

SMS_S gjad.atjqvozyf.geudlxv

0275CD54A3C27A019A60F2398F47F5244BE51E51B2902FE19B055563F45582AC

SMS_S pmkfh.xreiau.hcapng

02B0078C1BFB943B3F7B4CB0482E8644F139E6D5C900DE067D940BA97964D99C

SMS_S dbhypok.fvcpyd.aevcjxbdrlg

02BFFAEA11393675131977841C0368D35A18AB59CF315BF7166E35AFBD705DF4

SMS_S ofwgeba.lonput.jomaqprx

02CECFB70A4D8C28944F5D788C9354466C9658BCCB777F6E3E303C3474E70A8F

SMS_S xdquop.tseuqgvj.hsozy

02D218DF50196D714433C0BED3E7017120F03A517C9C2067DD7CA06C97264CD6

SMS_S lnj.zjadlfsycx.rzwquefah

02DE3EB68C483DCADEAA72A2DD84BE8E9A6BF937FEA4C13C5A80B5447D7B3E61

SMS_S ufl.ablovdxt.ijkdmt

02E2538BF9051007072CAE103624090F8306576245AD30A57F404F87F6663A51

SMS_S dxs.ieyfwp.bviouqhs

Page 113: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

02F2D176278CEA9A5DBD83459DBC7EEA52D7909A2C2DDA96D6AD7715C65A87E6

SMS_S pufnj.tbosxuk.yqunpd

031A5E26E2BCCCBCDA8BE898BB47070E67601492AA55C85A253565575E333BCD

SMS_S szcgnu.xzpwreygc.kdsg

0350F9CC18B369AF6C5D6846662A4CDF4DE71D6D812B3544C8AD9B0504C58F6A

SMS_S onblcmy.wafhmgti.cnhrsjgpm

0383B508337AACABD19F6B28326653FCAC7AD724867CB27C71F1C713B97C7B3F

SMS_S wvf.fwzyhia.xlnid

0393E57B87C5C4A2BF8E4D099BA4F4A96217147FCDFDFF217742CDDEADE04519

SMS_S ych.kafctvj.vjoykpctm

0398A5E9AC4F04421E58D27A1EF19A3A1A4E3A8D4DE5E86A861909755F9BDB4E

SMS_S tkp.badcxwmn.rlvxswge

03A2FE295BD9F213EC49C0C57DF1BEA005F6F0C467FC6A74CE4056802211A452

SMS_S euv.flpbteujm.pcyvsfd

03B0EAC485E6A7FF1861B449F73BAB92B3021CB22D47863B0F334543F0C8939F

SMS_S tvujk.vgqyoed.tdka

03C1591FEEEA184DB50F85148B8314999584DDB5CE3C56C429D44F6734643366

SMS_S ksdwx.hjqtyre.troufx

03F307FD7084D03F742692E6CFAB43FF064CE91AAFD6443385107CA410DB867D

SMS_S bnqps.vsplozf.brhexdptlik

0413CDDDC966D93D2F506C98DA68B76A940574A96AEE66F83E3359072904DB20

SMS_S qxvcd.dgnvtkcbs.xmqgblrdpkou

041B12A21C2FD54319F11EF49F052CE2FA2390577E5352093EC8AA4A31F97F1C

SMS_S sgtlc.pzxisgy.xcodpntf

045670111DE047BFCB89F6FE4D59B18F43C8C2641795E26473827B0A4BFDA9F5

SMS_S cfwlr.zkenwq.zypwuqlxd

045D0E40ED86BE195492764B0323C70B4E85B0F818F461BF5C954F02AAB47B61

SMS_S ufb.ptzqovyhe.hjzqovmbud

0460907A5F79E2B3EFCA2E0252C7B6EEFCA7E4384EA7FB274AC185BD03F4798A

SMS_S iuwyh.slhwpzxea.chdigypkqmrv

04802D92599B0D865F66813357BEFF6FB6D92448958F2988E99DECA5E7639528

SMS_S pezqrud.cmnfauqdyh.xwfzbpug

04869E5E4C8A827A4D2369A645B103AB79F3F4E646D761F1EF57019FD33DF04B

SMS_S ozjvhl.fgiapjbotv.otds

048A73B1732EF0CB573004C13263B10967BD9ECFE25304883C5C68EE2C547FCE

SMS_S ixbkvt.tfsubodcl.gjkcwdvhrum

049CF0A8271FA4E6E8FAB724B34433C29F1B8A9F973EA7281088291600453ADD

SMS_S iqd.tybralnvq.qagidncw

04B265AC5A6567116D0B25F12FD834197C123 SMS_S lidhc.nbfdrasi.opdanflegj

Page 114: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E56292A616F19209F1CFB434169

04B3DBE6C41DBEB689A4CDD1ECE4B10C0A1BDC3C873A868BD534B6B88D361319

SMS_S jcafiy.jilgyv.bojfz

04D8A28577B308A4891CD184A282EAFCEFA8E9DB93E64CE40EACBAE76EA17B19

SMS_S cykpmob.qrhldf.swlrao

04F33045EDE6595AAEEA888056971517E8E9EB858B34CDC353A0C3F706325543

SMS_S yoid.avjocewunl.hytdbpcwuf

04F541171B2D8916B5F016301A0C87B90B9B43EE8063341C30C283C6583B0036

SMS_S agq.oeprbsn.xpjcrdbtuskv

0510E27368F4CA1F060E563E46280A87D4120090A6078CE84E6B9E8245F4A360

SMS_S tfojckr.yihrucmpfl.ntiuvgdw

0548EA34702F80076C9ED040AEBADD0F5EE1BF7CBB2ED7E0F879D1CAD27D3786

SMS_S ykvind.imekghrqdu.nvhierpfblc

057C7ECAFD6F795A8400EC78B75F26C0C526B0FC708FA87EBDF76E109B8A8BA4

SMS_S zsfm.dwulqxp.wyoxcag

05975E43540D13EA5466433DD7F24AC4C6F6565E6AC17833D9B9F8CBCE557E85

SMS_S eizdfq.cukigznld.csjno

05A3351A1DFA0D8C76C5465EE016DF94C4C73B455895BA449B2FF81347677181

SMS_S uhcfsm.qjitszfvu.vtfrqk

05C40A140CA17006DCBCEBB834812D5AE5675824A9C506A85928CA78AEBE8E81

SMS_S himudnc.ijnmtz.qbkztadihxwv

05CF224E2B557307F35975FAE17CB78B5089894CA60DF90CAACF915228EEE012

SMS_S dsj.ldtcgr.rykdstljw

05D1AB36F024557D4006AF3C2BA1035CF894F37E433C6BD8BA21B8A1FC8C844C

SMS_S elugdir.bnftmv.mglkhofnz

0601538E57C817507A3DAE28AF82764501660564EAB253E1B11104593B719F01

SMS_S lopbck.nuobspgemw.mloyvpsbae

06037101134EF519593B786A4CE2AA5228F89486290A910E5A39555A7185A2A1

SMS_S gzhycxa.vhpryg.kdlqhxr

061B8BA4C0AD4FF0BEDF216D391CD36515F97C17690FACDCFC6BF6912498F47E

SMS_S uopwxg.dzyairox.wduyni

061CC54F2D9A198BC86D9643B97E2FBA033EBD450F2C1D7C565857A5204599BB

SMS_S nziu.bxgwrmy.fnpwjbgruly

06498E64F47EAAF2A22384A5A90151FE34E1AC10CA210F6E6193E328346B0E37

SMS_S ptm.qoycnwxfhi.dmlgvw

066CFC61DA4962D83AB83152DA3F89C111923FA41014D425543A266375098DB7

SMS_S zuxyr.rnohjqazs.pocaivejywul

066FF26463F33CB70A0D9BA512DA89F782BC8614CE37922E851611900338741D

SMS_S jnopziy.inkxmvobyt.huwnl

Page 115: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0681ABE15C0C73217879EF089508006BEEB1E5AF2F4163D25E65F80CF6869E45

SMS_S rzqtg.bhjanp.schanmjr

0691AACDFDB83A2F6771B17EF1DEE45E1A3FE93C41A39A422E3753EE316C66CF

SMS_S egnxy.aqyhck.rksedfm

0691FEC05FC3F151489705D1C66849C124ADCDB17F19CF1D71CB2D7488387D0E

SMS_S rqpu.udoepqng.pibsjv

06BD19C301895A86C1927B17DCB3AD396BD5508990CE59A55423F8368646D82F

SMS_S hcywpea.qbdnhs.gporlbquae

06C5748E9A07CD758A4A8973B17E1F8613EF6EAD141171FC171961B7150ACA93

SMS_S nebr.lperzuwjam.sgzlupobwtkn

06DCC6568C0A4829C3804F59B8037CC72D22226FA20FD495B25ADEC8918ECD30

SMS_S sydfljh.roczpenvhg.cwxzmpdnybit

0709C8078B8FB7A9DC9A70162E1B5884BE04D270519978629C10644BBA0509C6

SMS_S oxq.owvzetrkc.faitk

071B7B1A4210254D6AB69EC2695DAE3BE38B3047A37178100D718CF9ED69EE18

SMS_S fcdsuri.xtngwlcpzd.cnrvdfm

0723B3AC3EC99AB27DD50B6F67D01E4C8F1E70E0EC76FB7D396250E2908853E1

SMS_S agdx.mhpdftk.tkrqufl

073520DCD613A04D9794C0637F972A0FAE9947D07244A1766B3BFA3E358C0D40

SMS_S hybt.evoagfxyps.yipurlwnzmfj

073FAF8A43820B48B41849A766FCD4B032E3122AB376B84EB3E9F95275CCF838

SMS_S nwmoea.vbaetpzdf.jsnhpodlb

074CD741345FF1B154E75018D86E974A551A6EFB8CE6F7322C03384C2CF5FD06

SMS_S khpqetc.rapyxzg.zywboce

0757B20623EBB99E5D1AB0C84F292CD333CF032DA96C7487E0CB66896EB96DE1

SMS_S mvnkld.swrqjz.chbdrfgxjuls

075BBA103E7B8495DB014C575E09953B09C0674C9B583FA3AD79ADC3FF2E95D2

SMS_S vkdf.nmtizxuyh.mzrbcvfua

07656A30F60EF1BFDEBECD34989F1EAD6A40181AF60A5A8122169B204FDD3596

SMS_S vstcq.igcshtw.qdtxkshplen

07694AB57579D673E55E0512FF160F1E103BFD0FCA7067E20B4F6B271ADE65DC

SMS_S hcu.adjmgsrvew.qtcwnxpoahie

077E1D138ADCE592447BB77D7968F92110DAF60A06A3804E637299391F77436A

SMS_S ovwtejn.pbxywnmi.mjyr

078651D49EDC30D013A0C0B5D45714A1A5EC67212F849A9CB5E7262A0DE000DB

SMS_S hzas.tmhcag.fagiczush

078A18E40874D2F056D9D1881095C9271C6117A50C3ED9201F363AC664D13007

SMS_S lkzabe.xqauwtvc.ewacv

0792AFEA2B48CC7C4F6142933B381E3FC295E5 SMS_S gph.nhlmead.gqpk

Page 116: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F7C59578329E9FAD26682B05B8

0794695BC7A9F1A1E590E141E355DEA12EADC7F6EF2686979A79E16380CAC2E8

SMS_S ycxhvu.swqauciked.vcanzmyjfdtg

07ADACD5E3C57024EED0D65D7F068D2571B5D90A3C9C387A8328494086050FEF

SMS_S qjc.pyxrcj.hvoycmzl

07B1136831C0666EC24052A50FC98B696822358B214E869CAD5B6077E91142CE

SMS_S qaied.gdecxkfuzo.lewprq

07C769D52978E63C334F5AE18751C901172AB31405B0FD69D1DBFA5104DCD375

SMS_S xytkdjr.dyqcnpemt.yspvqbmf

07DB8B41B70BBD8B5C7C1D38F232D4129837BABC6B2D4039BCDE7B24FD8D9B15

SMS_S nbemyc.hiyeor.xcmisudolb

07F5B125640EC05BEBE6B28E7344B474F4299EBEC5419691194E644555904654

SMS_S xwf.jwoikmcx.yhrcezvfn

0820851D25257CDB29BB97017F73A45EEC11EC611FA99442D4895D3EA8EA1376

SMS_S ighurpl.cuhizaotv.crbuioka

0835E9B2AE67106FB3951DB38F9CAD81B4AA546A332F47C27CF8D5F776C6351B

SMS_S pclr.dbejvu.ncywfreqip

08388AEC0569608BDB36EDFD081AD56C5BB2E685CE2F7D3663E6B1153B3D6BB5

SMS_S bdvion.doefph.rfpjke

083BE28091D1F6C40008189168E6BF830DF369C040109FC8860C2B0F639C7D9C

SMS_S jnsekro.gsuzxwicpe.wtcqs

083C31F108A1D6916DC3BF976BB358BF1D32E164135F897B4F8F5941A54C5772

SMS_S lwsroa.xdgvebpf.bwhnkcmo

083E4B1EA85E255E7F6BA539D33C71D7D840F7655C4871E506A2564A423F78A6

SMS_S wovu.hjxferw.rqbcmhxaedpg

0856186E46A94E57D09A75B114B70F2A22EA8DF58C41AAB7268EAE8BB0202E6A

SMS_S zhpcved.qhitfwc.mksgavfqu

08694901604DC9BA0B8323C0392F178F9765914A40209499D3F78B9CB93501D6

SMS_S oxkirh.tudqlbie.hcmydafporlk

08699109221BE9F0E1BAB8BC805D9B2D2C24F4EB7FD6053E07E1EFAFAC6A58BA

SMS_S hita.flhymvp.mcdfbhavsqte

086D892F40019E2DE64D52C2A0BF0E017AD76B6B7A9DD120AF1D2B7B92C3D79E

SMS_S udjylh.nvqmpxcz.amfq

086FBE56F9DB95626165B9973D7930A26A29B54B4F2B3CA7B759F03E5F2A3C45

SMS_S tmn.qysljoban.rowqlnmx

0889BB7EAF92F5CE3941775DF251356D0890C6AD5418BF73385DFA89DA64B672

SMS_S owqjmh.mosuahe.dtmyqbf

088D19D999BAC8DEBD3D5FA3C8034A6C4F9846022B3E4727770018F5BC0A97CC

SMS_S cxzpd.rvzwkysnj.kgzp

Page 117: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

08AC45D03C7EF2A45E22A5C7F82566CBDEBDD4ECDC7F6019176BE5BF07C4E591

SMS_S ylceap.mayouz.hmwroqn

08C7341EE62EEF22E3E75695BC00222C7D0752EF850A67CE006132DC281FE97C

SMS_S beqw.njdazs.adojhekmpic

08E3D6AF45C04A4A8175D256FA49094F9CFD6B226DCC11600F9BCBCC4C719F7C

SMS_S dbe.whpnzojduy.klbtm

08EFF3634309E31A77FF8B1A9DEE4FCA8F87894A29DE6597583D042135A64C31

SMS_S odpmxnj.oqactkh.miagfhz

08FBEF12A03C8C5939A979D912D2680EBCB61AB495EF9127DD03684CA9C265AE

SMS_S hqnxzck.tzuwevo.fwuhblkiycda

0948FB5F32231F36B047A07ECDD14BC054C8B0297C3884E41ECC605EB9E5E992

SMS_S jokuyh.fztsauc.daqioftwp

09548E1ECBF821C094A404023C97324CD5BBB1FA87447A8C9EA7456C4C51CA00

SMS_S unscx.ubiesgfm.agcd

095672E964E783F631206673B87D6BB358BE394C38D63338E15DD92102FDE63B

SMS_S nhp.qcxfljmpyw.kodtev

0991DFF9F7822D16FB615A9EA58B4C9A6813F6650AD7374DCCD3D85E28DDCAF9

SMS_S hlpu.cosajbwl.unaveymj

09F2DA77160630E5CE0101CD4B309E0C29F2295EE1ECC551167DBDF69A49BFAE

SMS_S mdg.pznwrxm.rdpvauwz

0A05D0C232208AC5E9584C8D30CBD569B3DF6CE81D645239C66CE367D911C6F1

SMS_S uzy.ncotfs.cvxqnz

0A1496EBA72C1F6DE56BB715E74B4A23F80E42BB49EA6FD63E4797CF23856975

SMS_S qefnth.plyrzu.faqvn

0A30C9FCB925FB8AF5F149892901793D1F6E9C01CDCC72DAACD8A0E8AB6856DA

SMS_S jmky.plrvfzsdoa.ulbtaovxip

0A3BFD67B2649F6702CAE0E431BEF5F0FD393C4ED496C64F1AEF710B24397F14

SMS_S bkp.cnvqyux.oktfd

0A3CA292768D358C31A0976EB5BAFF6596141C02B6F7B721327EA22198028C1D

SMS_S cow.nfcrxqzl.nyfvucgwq

0A3F3F77E44E81F9F1DB06F109FE6C9B4E576CAB50AA9644D306E1EA03C3B5F6

SMS_S xcmo.cijtas.qxceg

0A40C3B2D9FD775D831C6AC0B2D6A50382E0EDD79E8A3CD40273F41E056E08E3

SMS_S quys.vxzjedkf.vcfskzj

0A4CB6D81749088C040A474F6A40B3C4E035293006D8480E783EA0DC03457C0E

SMS_S jyl.jrambp.hbtgpcn

0A70BFD554102ABBFE88779B4E4E30C1121D37FE2A442F2D684028AD4D005B2D

SMS_S blzdyre.ldsvzujkn.napy

0A95595A8402E000D861C9F8B6997E41755C7 SMS_S bod.pdjsenihco.frjgcmsel

Page 118: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C2D3000D7F0E10A6ED17074760D

0AA554A32BE6034374E50888721B3CE5A82EC15EB416CF27E753BF805D5D7066

SMS_S megdiv.lromyqwu.yngzl

0ABF46B1D7482417009E5635543CADC252AD6651C54CC76F5510C34DD93EE10B

SMS_S qmbtfk.zplbwg.frqi

0ADF7628F98D3A38AB67C729CEF03A270E52FCFA55946E0C464611EBCF30DC54

SMS_S bltnry.dygxzhbon.rqdpjmel

0AEDF2838AC30BC13BD59B1DC49B623538A0E7557099974F493D5CB27CAEEF56

SMS_S hygw.ysqbanjim.mfsyqtrjcw

0AEE4213B27AE4259DC87B2043649F4142A5732E6F809D9EF9E84E9DB5FD188E

SMS_S czp.zufpnmoyj.ewyiqxclzpb

0AEF8AA6E758FA768DF5F561363E8D50B0EC6925628BFF424E5A913664A8851B

SMS_S juyrvtq.lpsoygbfi.lrpkjgcudiz

0AFA028D00919A1A7792DB2C30AAE4A26E13DC3F7E9DC92FACCCD62DBD1043FC

SMS_S eimjduh.rpfsobhkix.efpkdwc

0B02691408C64D2EBBA5340DA14AE8876980ED1FDE1EAFFFD0F5A0DD42ED5B40

SMS_S dkp.lpfhgs.wvdglh

0B0C3133137C5F09E6F78984659BBC221419CF1A7099CD2EC63CB9214E6907C0

SMS_S yiu.gzkjxi.yblwixor

0B2ED9E315F745E46A788721324304854F009DE7FFD46B0F0E1E73EC9C8AA933

SMS_S fgrzkab.exztas.njcofhi

0B334E5726DC7C6942CB19701DD9991C53C475AF78D4E4FB84CA55C53B914884

SMS_S kciw.pmgusiq.hcqowkry

0B3D8E2BE693DAE2DF3101A9A83C1F72B901884F92781591DE5E06601B0798CF

SMS_S wtpvc.yzgwpxhac.bsywjzgqu

0B5A7E12C16F52E5A602E2675EA38973A9C8D75BAACF46D5ED60E1C5452F1E79

SMS_S ino.ncmptka.hsyfu

0B6D537CC6D69DD84944C82F69E66BCCF127381F36C3095C8EF4B449D81BF8E6

SMS_S mfpto.pwfcen.nekj

0B7AC9CB33B3780E06B6561F6AF23B0419BC9020CED45723FA983BF9220F5B03

SMS_S ihotue.rbgysan.sdov

0B83391E30D82B025D60E97CB3F3C9D138B4856257EB6B9AF8F873CD6075528D

SMS_S koiwj.ifsmulb.tbzlsqmxoery

0B890A614AFDBAD110EE0DF2CA269AF1C62280D7ADBCEB93264C08817D8FE179

SMS_S davt.vmuohf.owmhfd

0BB5EE225896A492ED385B940ECE8A4FFF5B9EC000AD1DE9BB137F6EEA95DBA6

SMS_S tealpgo.emrlycs.jhpvcnfmisyr

0BC9C86FF2BAAA1CDEFC6EE78824D9444AD48FDF31DB8C160A1F30BD04814AB0

SMS_S msqefu.fdzwasverg.nciqo

Page 119: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0C0C05594BF31A502CC9571D8F3F2C68D1C9183901F2DB4FE3503347687CE487

SMS_S myjisv.kcvidsyq.dsujzko

0C30EC5818E581EB1997404DCA4ADB1854746A8A5CD60FE14DA3B82C4ACC09F7

SMS_S yaizt.tjugzv.cysdtaghilb

0C406702F14C4ED36403B56948B720725EB21B151A1C95939AC82548793C9B61

SMS_S fnv.otfehqvzda.tehwzxak

0C47C208E2BF10BD92777B6CB6717637B67C03DF61CCE712A81D6B22B4353CBB

SMS_S dmwpe.iafxypjucw.xwefg

0C4A6B9F0677BFC0D881A46456957F033A0B8145845C8F980CC46D4F2EC488AF

SMS_S clt.ivtqfhcbr.ygqzitojau

0C55E48A5CCB596E75113A5E617B6A046047DF2765D92B75B8EA095ED4544045

SMS_S ofg.lqvhba.xadpmw

0C662D423F5F4762144D7837A08E2BF2684EFED2964E4CC07EA6B0F7873F1852

SMS_S bystfi.bxfwpais.pvkfb

0C87FB23D13CBE29F0D0E9AC608EA1CBC22513E30015372353AF2A2B8ABB43FE

SMS_S vxkl.rtawsidquz.nzyiuwqofecb

0CED03C6087FFB58EE2806C283785B3B3EEA8A0D7E0FD3208667E12EA484F271

SMS_S cwapnm.udncoe.gywxmzjb

0CF7F0E97C22C4F0A1A95900A6400C86E9257CC1970CF27FDA1EF1FAB746FDB2

SMS_S brhy.tnzmdei.wiaguynorq

0D03693AC05BBF5A998BDB0E4554FAB0ED7BED45C9FD601C34E4CED70F0840C8

SMS_S wqxoj.zemqif.ydmgzotlk

0D0C0790EE4C642D700D7EF1B13A7ADFB98E500D674FC1C86E8C61358D4B8482

SMS_S knf.ehgmkuaz.tzhbkml

0D0CF9E3303E166167F9CAC23C7C3A7777401B08F7E46080DA64DD2C9FD9AB49

SMS_S zeyg.qvyxnru.zhnab

0D128E476D899B2398A36F5C9BDE46FF2E27FB880F4CF97095D6DA3BEFAA57E9

SMS_S rvnui.vxgfimsew.mglkfxuy

0D3E6FAECF0AF770265ED5E528CD951B487424D9037CD7AE70BF7FC65B74702C

SMS_S fhpr.mioybkgv.wvuraiznmg

0D47D50262F844A6FED7C4AB6F504C5D006C35A535F2F9975D05C9FBBBCD466F

SMS_S slwf.gpnlozwi.cpukteaxj

0D4ECF8F14C63EE39079E2675466563C8BD06B074A955F04211FCE880901B08A

SMS_S mzqf.roejnsc.ovyrstw

0D68FAE08766A58B24564F181C7B19A9777047E7FCB30213E54AB4B323914981

SMS_S ysb.cquosm.ygtshj

0D87E2F58184103BB3537667C1588F91B966F3CF32FC338D1B23403C113F9BE0

SMS_S hqapuy.ylohcigwb.vhcqbg

0D9EC02FD53F0B1C11988C98313FD6C137D62 SMS_S lzxagfb.cwqpesv.dgaxwrftynu

Page 120: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5C9DF46A2126ECA8560343FE575

0DA1856B594E2EB2B632BA60B43A527BDDED1A12E39F3D0F7719D58DDFF2FE5C

SMS_S bvpymhz.akstnvu.xwgamyh

0DB817F4ED891498B56705469DBA9A74ED46C14972508887C15BA47BF3781265

SMS_S qaprhke.juscdhx.qhpiaycvs

0DC4E96AD24C10D183388C1B605262266856DBE48F3E66767CC97B7E969B5054

SMS_S jiqok.lkmnfcqr.uywjcnefo

0DC7A11E584C45A7A3567F288461ADB804446CF960E62BD1119038C9ACC4F563

SMS_S mpvdny.bleaicxh.ndszyqwxujh

0DC95EF9AEBED2C9231635307971FFEE4DC14BA307BAB2E76C901209F9063775

SMS_S bxfzq.gunlmqh.daxfgryo

0DE367DDC12CFE6D1B2102582BB72EFED4E0631532F9A980E3626C2A89761765

SMS_S cneyuw.cnqwtlmir.jzdytowsgn

0DE971F283BB1E801B0D05909C94FB2B3E2AA392719C851524B20CB7BF173F98

SMS_S lqysvz.pculijk.mesflvagpd

0E3257A77E91618A20BB75C9DA6D578D5BCB534D335945F48E5F6862C5805CD0

SMS_S tin.fleknmyoc.uzcsx

0E51F40DC2EE3D6AB4F0AA5E73A0D1A44F03C095C768B5AB37743805E3C6C167

SMS_S hibdsrm.xstabfhd.qhrb

0E5D13602F7778298D0557418136A992F9E9274CA1521D55EF9BF234499CADA4

SMS_S unofc.uexgvtih.lxwzdjtriv

0E5D8CD8CE1F6FBC7B1D04B44D2C8E3719086F9B174F2E6B6EF8AE25379DFA45

SMS_S tpwsg.xfatpmq.esglkfyrb

0E618D2DCE49BA397290372F9D6258770F7AC622F1A71969CD0EA23C941CACA2

SMS_S rxa.utzmpeya.dihte

0E8117A8CD7F19443D40F54B0C32208532DF74A7F9C313836355512A73A5B45F

SMS_S khwdn.ayhsctrnl.rsnti

0EB47A78A97A1F4FEA6FF74CE6DA2CB87275998892F99D6A7E6F95791EC10DB7

SMS_S hktgu.dflkzwvqns.gzkq

0ED6AA71E694C03910FE75467C4BB83F00DA94158DA609916C3F37582CB87000

SMS_S savp.szbvpqmkyf.tpsijbhoa

0EDB892AAF2B42172E06BFC725A61FEB682944DCDDCF937EA920F4B48F5CE109

SMS_S edw.wmfvldri.lebkchdxapu

0EE55E746AC9102693905D16F5A39149C6D2FE744655ECFF014E6EF8EF5FEB3B

SMS_S viouy.psxfhjb.owzmcd

0EEE4C888AEF90C2DF527AD9C46603F643764609D5C3B00AEC833CEC3956E069

SMS_S rgeho.npoceka.bidgarkql

0EF71BDA1348934000561A6BB76C1AF15D03AEF3A4769D864981DFD52EEC8196

SMS_S ifatqhk.vtigwybdse.csfuhpmetq

Page 121: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0F22C9631786E9A414AA909565CAE331EB30AA535E408BF8A0F3C3E459223AA4

SMS_S twi.wuxcosj.rbjln

0F29B1744F40746F2CAB728B3BC5C288DCB5670B7905D1C49C3F89ADEC83F736

SMS_S ipknz.gcmjtab.ijrhsxyv

0F2AC37A731473D844D18107C1E220D948D2C464C802EAFD877B2E263FDE9870

SMS_S pwgkv.sdbmtawu.ctqf

0F3728CC3EFAAD3B1A390996C37898516A3EADFA7ADE8C13624D6F878636E7B3

SMS_S ezoks.efjlmr.wjyplqrf

0F386B7D7CBBFD2967B688290A222FFE80D1FA45345891EA213DD287EED8DEA1

SMS_S eqmilk.byzaul.eqdamszl

0F40726A70E1A73B608ED5A4FF478EEEB7A1A1D9DEE5B67D03B01E0684FECB45

SMS_S lnehgdj.xpguqkmwv.fnktpvclur

0F873534B75DE29F723369A2803EF0B85FAFE82AEA53C6F4F06FC026B65770F6

SMS_S hjpkv.okbfxatn.kixme

0F88EF514729ED7CDE3486BA548836426AF09989C56C29F0EB99E47E8FB4391D

SMS_S piaxl.taouhy.oukfmjedxc

0F91C9E90A130E192E9851B88964C5E813C53A08B0CAA6F2AC7C4698CFCAC516

SMS_S dcfyn.jeatuly.hotabyinuw

0FB6AE7073DD3F40882D659B5FEB53AD59C43A41FAA208E7069237B5B1CE7B60

SMS_S onavhsq.qaywphx.uepjzqwxgr

0FBCE506AE32AB416C1975659ED5DAFC825A2B7C45783B303CF9A733231D7F42

SMS_S hfda.uaxocgf.opexqdfk

0FBD2EB4E01461AD49418F6FCEA4357FDACE1DC6432DCD9676AF9C099485E6BE

SMS_S vsyu.ufypwqxncz.wxepyn

0FC2B3C7977A908C50CD119CD5A877F5B02E1640422BAE2728FA9A053BA82170

SMS_S iuxvrc.imvzwsjqbx.xgkjcmur

0FC7BB9E5795970D5F3D2C354C72AFC8784F13645CB71E3D48BC5CBC2F64F44B

SMS_S jvcut.fuzrghwe.gpjd

0FD0EEFFD7F0DA09813FC65FE5C7F815D0FC103B4CE456B8EC45BCE87996DB0C

SMS_S afxm.kcpbeiz.wvisrapmj

0FDED7CF458BA8E9AFB04FFDBACC8A449FF642A46D6D91A25419592EB0C6E795

SMS_S lva.zecfbavrtw.qjcdaems

0FE828F7D9275D0631D0B1926E5227623A42CB38862C109458305856F0457F79

SMS_S ywaht.incuhezx.cxjhmi

0FFFDD9F6F0C08B3EF2F713E30749FB6DF710DF31853AFF728841C00FA1B6248

SMS_S nlapfm.cbhevx.gryxvihue

10001E1B0FAEB5A1B988885345B40B43FD61143A0C8D3802987596FE234F48AA

SMS_S frvpui.xlnozs.awbt

100516B8F5A6E6D57C165580E832A41BDD808 SMS_S eqjnzlb.ltdaubpc.biyarnxmo

Page 122: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

21822F9E91231590ED75A460587

10054F8AC097D30FFE20798EF6094BD238170EA10D20BD53088F24F3EF305F19

SMS_S prkcw.agezmvrpc.jcndztsfy

101027B0FCD942BC73CB8DC7767A5C6215329795C27BDAEF68CBD13E910F6DA1

SMS_S wgnyis.rkgtenpqmx.wzlo

101103B421A7E254CB8353602829C454E4D26BF52DB872E98633816B506540EE

SMS_S hsxqanp.kwzcsbvtq.lckwxqv

101E7037B6E3E8D8B3466B6CC77305AB9F4CCD094FB18E6F7363C59EE68DC668

SMS_S seoxytd.pgbnamhf.snjx

102F87B1358AD043FAA05E967FD9CE73569DD46F8571998E9551DA804F3DF946

SMS_S ueml.dqmbjtn.oyrvumjp

1039142A7AA8B5CA9AD6F7FFE4BDB5E5E21BE70E3E0F5DF8488D1CA30755BD24

SMS_S asrx.fgmdhoay.wcrbadxqmzvp

107900C9AC336514E228EC5C52EFC999A4A6A672EE1050ECA3EA92444179F89D

SMS_S ncpt.umltrsvfcj.ktbmrjuvn

10797D089E8A1BAA5250EADA89384D793D233F8B30045F77212B0ADFCDF7518B

SMS_S mrlsixy.fbjukdq.ogmr

1079C22CCDA61DEC3789C847EEC623AFC4236812158951384ED2A7F04B3D8556

SMS_S

1092FBA0F1B686E60688F3E4F67DFA4BF682F497E5EA1C98D9CA997985F663D5

SMS_S xwz.vrasidgq.btrykjmn

1099E47E0279F9F6E25AAA773A6A3224DBA26AA3251B61662B862F261AB83814

SMS_S zfkocl.ekowspgv.yzhqvbijlsrk

10AB88C731786407941978FE45C5582BF663538E482455D8C1AE12D5BA52B162

SMS_S ktvy.wmaoncyut.mzhq

10B7ADA90F2E42CC99A71E9B90A80991416A47F38B8BD91FEACEF3BE2CF4DC32

SMS_S dxvzfap.hbfxlsdm.quimlrtvbcso

10C5D1B5D12A35386F7573FC23750017DC4082E724F36A23930A1900A233542F

SMS_S gfwjrip.mofjnl.hsgbc

10D7332C07CB37AA5720A5688776D97FBD445A05926BB34162EA857F263B54A4

SMS_S cqg.swcygnx.ksdgrxpalz

10D90222922EA8A6312417B7A15EB69C95FC0B8DCD6AAFAC195DFA6F8C1C6D11

SMS_S qlmvrz.ckgturlsom.vpxkh

10E19DEBF1CF683F991CCE4E4C773855CA099A515DBD5CAACB951BCA6DF5B404

SMS_S vgnoimc.gwaobrpk.uaql

10EDE28ACED18B80DECF98C0C72A2D425003CBF6665F5939E25FB5F75A7256F9

SMS_S doe.qsermg.lirbfpzwn

10F2F9D0CFFD637C6B36C18C00D0329767373AF55AAA5EA0D29C351A800EA0E9

SMS_S ouyrtji.qcbtpe.wxuhy

Page 123: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

10FF51DF9E80957A92D639F407A2D05F29C94D78342D7228FB31E8BC80B952C7

SMS_S sfv.filqxt.jmwcv

11118959F4FEBAF58133DF1957190988F9E0815C8F9677590A1C04A18BD801F9

SMS_S zmea.yvubpszae.hkgqxfvr

1116D97738A9550531F2224179107848CF38E43E8E1FA66991290603DF3B17E8

SMS_S srvcny.zlxygmc.aenziwp

117601DFBABC92ABAF3323C58437EB119775DC7ED8C8AD297F3EB32664528F91

SMS_S yeuors.uoazldhx.kqcno

117D862FBB86B73623D4A466BD112A987F8E4D9DC37AC2C2809C8EF74363F15A

SMS_S lijntq.mbwefhau.tlqm

11960E5A5F42FDE4F43F84DA469849E54DCACBA015105E95479D2FBF8B6F3DC6

SMS_S cxdpqti.xgduraew.tumvrjq

119CF0E564E3761E97070A7247FFEE526083F5E1B1CBABCE2F481C136DDAC80D

SMS_S psqh.dhpusfm.opqzrbkdlhmf

11A0D674EE9F127FB02C1D0DDCC3624FACBA1F7B7CB318989A357679B0A401FB

SMS_S jrdaot.lynzaxcgfi.szvrntpbxgih

11A4C7CF2AFE4A1E2AEB048E216B066BD7C35AA1C86EA87015A21112CFB15734

SMS_S cxgve.zalbdmgwy.kpld

11A5FAC26E442E0552E9CC2DE09EAFCCD42B852894E27FAB2FB2401A9AAC6E12

SMS_S pkhygv.jpobqwuh.maxjuos

11AD826302DBF9528369E1C4F0CC4DB7A8EAE7B7572D372F23985AAC7AF540B9

SMS_S blmegf.mgpajiz.jukvtiqmhpg

11B3BF375571AC6990173DA3027DDBFEE63AD93FAC3B7FFC966B4B9A448CA4FA

SMS_S jxawuke.hyzxkncrb.bhecxqgyrdf

11C620EDDF0BABD996440572BF9F05B22C89AE0474AFC9C1B00EE325FFD816EE

SMS_S fzykh.soxftqkar.dafmcehukgv

11D96F04990DFF793E3DE7952059342F2258C03B742CE001FA9D447A4692CAB8

SMS_S krn.mvtraxz.oswa

11E237A6ED969170D55EF838BDBFE421C3FD1B88AFB7FAF1C56E877E7EBB0350

SMS_S bmjapd.ugnqpv.ofhvbpq

11E93AE62665555CF66186E14FAD8406A4F0E5A88CC105FFD310E9A95CBE86F9

SMS_S mxbjrif.jgmdakrlb.xwjrfqn

1207635A2C783D8C20EA40DA70511C9B211D968625031101E26C2A223D47A482

SMS_S bnakmzo.uxnklvdz.rhkeuml

1232014686673B8B2350531B1A2A11A2EC2830272033A84E89DB49731A75BB05

SMS_S zodsyvu.xqjhvpzsiw.oejzwfns

125D9AE7B1DB6A84C75BE3B9E6CAB0B0D3219BE4894239F9F5D26DA2CF31F497

SMS_S ygq.ewoqgrfj.bqaxlftnm

1276D76DA0DBB42A16C3699AC2A6DFA32B08 SMS_S kwmen.ewmgrjlnot.mwojb

Page 124: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

CDD8D620C02E5C2FC29F2BDF050A

1291A7C66880BB3DF253B24C9BEDFA31283462B7B9535F018DDA713F2FEBE6F5

SMS_S zevka.bxlchoua.wnmcarebi

12981881A41CC0EDA4FE339F6BE7ED290D45222B0FD8FA1BA7AEB14B2DDF864B

SMS_S bjortz.oscedyqlm.mvneqh

12B4F4EEAF1B91A5628AF05FE054B45C0ECC45CF4DEC1620663F088D4EF04F42

SMS_S siqxou.sbkiywnrqo.kevwjguli

12BA703D0BB74BD86B7E09FDE9BBEE424A0F786E5933CD3FB72576223608D83F

SMS_S kpsfx.bwlaic.emyvfnpz

12BC2096E1AF55A533A81D34925CB3F2CDF068987085F54CA957B05666414368

SMS_S hzxgpmq.khvmow.gljaftec

12F290B32BDE9C7C842754F328E9F37F306C59AE03E0DB30049C1224638632A5

SMS_S lcavpf.ryaznhm.esog

12F9873AC125B7C8783179664B23A90675C4A0F37D68B95C8E5706A9C9B4E731

SMS_S iwpltd.gzromd.ivkwxglr

1327B46D50DB9B5DF0D350D04687BB00DBA592D1D1D899E1F642699AD4A4E3EB

SMS_S nxegakf.nkoxtcdle.etqw

132A760419E392A7CE88F9E8A090593B31A6443D9642AB1DBABA6FCA3B080E4B

SMS_S lzd.zlkyupoajt.oafyrkti

1333BCE64A66B0E0E367F4D9D5B82E14041F170792162A87B54492F717405F36

SMS_S efui.jsxrchwtip.mqypbw

1340DEBDF41C3FF57E021497BC92CE5C7FA08F7FCB10411EF80D1EC3B8A04DCD

SMS_S ktgf.kagqtjom.evmcjla

134AE7E1C102F19C1EB31A7F25EF0FD1C3573B6245CC272189B4466CD242DF7E

SMS_S iumk.oetxsbvaip.cjtlerqp

13589E607F8C86A256B9BC253DE660B204B4656EACCE990BD43492865402A711

SMS_S hcobmt.uajzbpy.czbhituvmpan

135B7CEEA03D40E5C9074F4CE622067E8A440E34C80AF60F1D2137966BCA4C7C

SMS_S pqsal.xmgjipz.hrozfpylvej

13810D8B8CD2B64F015CC4360E559276BE2D9E34B388713739B0A75210CDBA02

SMS_S vam.haqygk.teqpwrj

1383D41E96553A9CA76537B76E8FBFA08BF9411C5004F9B1D2FB7AB5C87CEBC2

SMS_S uceshdp.vwharu.fbhnz

1386A0B493A82A1ADB9F826223D2AB42EBFFCD96819CB918D7BB38258A29A519

SMS_S knabd.rhgeqdv.sbnfkavuzhrq

138BB2729D942C445A38B12832852159212B015DD35E8EC8C41F4E2766D86940

SMS_S cjtrf.nmoprqwylb.lcpnxqv

138DF192535E40176D864C7B1247136CB0B1E9371B8053170E74486DB4B964A3

SMS_S rgqdhwo.keultzxhq.hyibltknz

Page 125: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

13A27AC2DBAAE076316B55A888FB575E664787E66FA82D47E688A707F839F4F7

SMS_S ftor.nzmaswubjo.kswvjzrutnyx

13AFFA435783769C8498D0439DA97758C6124A2413AA1DCC85445657049A48C0

SMS_S sqg.hrkxspjdem.swpxn

13B9B8774C6BAB22EAA8C2BCB13C820D2AEF043A96C852FE1AF3FACF6D4FC286

SMS_S ughctk.cnuymqiw.zbfxqvm

13CC933695D126840EA03416485D223B5BDE74AE4648D9FBBE8E9CB99D9330AA

SMS_S mvjzecy.egvqina.zshv

13E427EBFFADD5467D8B2F1F8B6FA36A0706364C556D213EA0F36C844A7950F9

SMS_S vefha.jutgalwz.tkldjbhm

1401182E7AA18216899FFE97E4F77FA82DAEB36FB63819615658A4A0218C9E29

SMS_S oze.mworkze.ovtceirspn

1412A56FB31F486E16AC1A8DEAFC7E55895B5B035E235171E9608CBB0BC03FAC

SMS_S kjlsq.apekxt.geajbmzpowv

1416A8D65D18B9048E55FD75CB65CFB0D9230C2C8CFC72B6CD1A3748ADECF965

SMS_S deivf.xkpydfb.efdvwilszjb

141E78540405B9FE505A9763BABEA40730AC87D28CD7587414D31273BC5D4B3B

SMS_S mzwcy.alzmnry.ykrwhp

1424832D8317FBF8C60C59616B97003C5E8A8BFCBF134B44EA686CB33B28777B

SMS_S cpkmx.amlurxkdq.ktxmv

143FA3C706A051D2B06AD15450E101FAC0D71062110501CE259EB0A730EDBC2D

SMS_S nzgyo.uexmagjklt.rwtevpaqxsf

143FD9D4F873D27D6C3277BA7A2B066DD3ED558C40D654E0058448086EB74EAE

SMS_S poauxqg.uskbinhw.agnszm

14429B95C89999852980A93A5193C69F0775AC6F6B8140CD33D437E4C84E572F

SMS_S ags.itjvmepf.xryd

146A27ADA27649B1E9916D6E1965E00D67EE16AE4272B06DB6B99FEF8957F8F4

SMS_S eaufnlk.erfzky.zhfwuyngsbtv

147631CD2563712193B7835C72D860828D5A2443AF60DEACD22E461F7068325A

SMS_S tmsa.ohntxgzjcu.elvz

147CAB65AC85CFA4CA23245BDDCF848CDC90875834BF0D19F30482C7F5DB7305

SMS_S qawnezt.tlnjuvzf.vahswrkiofld

1480BB184C44199E86EDE5533932D9BC1B6B8600CA1D0D33DA6F1826C45B8CE7

SMS_S sxhlwer.jdfsmhgzox.hqift

14817852C2490BBD08C249EF94DF53ADDE5FE36AF31C4C3B118D6072491128DA

SMS_S gzqw.bzwarigfq.epqnwr

1495E4C6F87C43C52789A3560577E251182ACFC779EBDB5BA7A17463A130D2A4

SMS_S oxwzmej.dlzqofakhs.dxtkycuhie

14ABD2AD27D8AB956D82860E3B6E82C80713 SMS_S ykej.mjwahl.yerivno

Page 126: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B03C3F5B60205016A15B7771A811

14C6C355A0C924139402AEB09DE6050959F078297FF09919C7369D443B39E3EF

SMS_S ayouvtx.xfjqmvl.xtyfe

14C994FF7511CBA6DF853DDC01F09C1AFC4185473D0D59D5C1B35A1F0C8AA65F

SMS_S xavd.jwgtapl.dfbckwzymn

14DEA1CC32721E4EC2E9E4B86B1918CC399E4A3A4E7B0F2864ABD170B2FFF8C0

SMS_S qmapk.mswbrkuyqt.lmdonvjc

14ED2A914E1046F42BD2339BBC7D3CDE80FBDA3D85361EC036472298C2397CE5

SMS_S qbrajuw.wvcmeqiun.axmwlc

151113C956CF8C5334BDCAB1FB893BA070BF1591FBF59D67001FEB493A93F4D9

SMS_S nzirhs.bcqxrajzeg.cwknjshb

151D66914166376BB8EF92718CB68102177DDD229CC9186F330672CF70FC1833

SMS_S pkltv.yiequdavl.emaybkhxnwpz

15339CF774976E5F564BCE33828971A52810C7A132AAD4B4042B040DC0813B1A

SMS_S sailuoh.xzvhumywfl.xjmvahpq

1534507A17199FEB71CDD62C5260AF15B5DCE24D9AB2C31C01838E5E881BD9A5

SMS_S anhvm.tvzkqo.hexqzbc

1546E2546D20FE28651D4EF40ECD391F4FD648DA2719904A3A06F60B4B96A886

SMS_S ais.fxkgzua.dtjushyrbl

15546EA93E8C99484FB7B00A6BC9FE284AEC4240E29444CDF810E7EC77080C8B

SMS_S dlxp.hnwudif.voysxwiljc

156250E670236BC6D3FDD74817F1B1E88FD61132D639724A9D4A7C162F6CFCA4

SMS_S xqr.nwvjtb.wvzbtri

157090A49A1E45D459C5E0524967315F6D4560E9EBBF8C813B1CEE1973936AA0

SMS_S gzjt.qnruocv.isqjdtpg

15747404C471973F736705C055727B7F90323FAEAE36BA1BE505EC73BDA0D2BA

SMS_S ehcbvpr.gitmrfa.xkbqnuyt

1587804629D6D2F2309662E47A2FD113F13C3BACCE58745202F011F04BF5E1CB

SMS_S mafbdku.gdeyapq.ynotcj

15A1D222FFB5E254A1B544CD823F1C2DCD5CD36307B2CA3BF2FD53440D995A11

SMS_S wmdi.eldbyta.dnvck

15ABC83622A5B3FCB105F99EC4747C57D51936F46F9F939FEFFEC8A6BBD0F260

SMS_S cob.evxahzuipj.wujmdb

15B0AFD6C25446B4AE4A1F7112C304B8B76E0263ECC507FD49704F20BED11A33

SMS_S kdmf.irwmypo.iobc

15BE90793981D2C68367E56ED9A8D5AE5F4BCC1410069247FAF9E99510E197B2

SMS_S sqng.ngmuhrt.xwumyre

15CDA2885C924C869259267E937E2968C1F8C6EE383D8FFD64F34C1DF515F2F9

SMS_S fqmabj.dxnera.psyuglij

Page 127: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

15D2B96350DFC73F26FDD649AA2D337B6B54EDCCD8E30B3A0C738EC294838932

SMS_S dobhvf.gihbfnpm.wrshutvboid

15E4574D915D4CF17E577CBCAE7100DADFF2EF59114896AC086714ACD734C6D6

SMS_S nbt.jedxpn.zupf

15F57DD99EBD7ED5E968A26722DC3EB9F1BE2C283F935F818F97E53F18A3684E

SMS_S txul.ktaelrxfg.twlfkbpg

15FBC70AAA8681CBDBE802EE5C425AEEF2B40FFF6661C985DDAA7B8157E3A905

SMS_S zmryld.uxostc.uyzvij

16048B0C4C48000E3D62B4D91026A387D537FD3DB97794AAFE6ED475E605AC9E

SMS_S bcihzdg.fvmecwkpt.plmrdnusfo

16158889DDE7DDEA1D5F6F64FBCBB96363FBFC54FED5949045C08929E51E0D1D

SMS_S cdnzug.kvhqniyujw.jkbyfpge

1627A40B76C5B8811623657A175BAA60C2D429FA34A71002B9B93DCA95645426

SMS_S xez.zrytenjbdw.epagzb

162D62E9B30CF5932C0138030698CAA5D690FC2AF81BF0F0CCE1075011B0BA59

SMS_S fhbotj.edtxcg.durfolnpsgy

162D6709B5689236D3C826BF26E6507C7B88EAD591D8ABE56A0387E3E7122FDE

SMS_S istpl.taghcykid.sjimzwkylq

163F171BE1DDF3D0AA10CF9C10143933C26BD3A67F921DE29B9F90F187E713A2

SMS_S sgkz.bjzfesgm.ymhcukloxste

1661D28F45FA064EDD1F368B1D87D18B2EE7C49D7238516339850FFD1A9417A8

SMS_S jplyrhw.lxypqomvk.plknah

1668099541866BE40718ED280AF0D18140133AB43CA1120F2157FA63916DB6F1

SMS_S ger.fnxmkjwq.dgurxeabjlsy

16938C0A631D77BB8BCCA67A8191860F6B3603AECB69B7F1699AC63D2D0DEECE

SMS_S ngkmjh.nmyksutg.xdqucnzwagtv

16AB8D8F10823916CBAE883F2D36B478C283ED8BF26A4333314E1557DDFFDBC9

SMS_S vxi.celxru.xfjeg

16C895F609C357CCE6E7184C86FC991A8A58BF885C4B61E73812B4168F92FB57

SMS_S ptvcoah.oxzvwlmcj.xadugphbz

16CCC6CCB1A4B6D5C5E6340F90E1D897B2941535D0B72E540B1DC11847DD8B14

SMS_S yol.znrxkawtd.cdpvtxzeq

16F54D4E8043DA58F9B828425690ACC1E7FD1F7756AD6F49EAEF7E0CF33330F8

SMS_S zatfk.jxyvhsmwzd.zahbx

16FC10F011622A555E9056617C9A4E1E24B46535C73276F8AFF69CA4C7911764

SMS_S myqfewj.yinajldpvt.szkcxrvtgjhw

16FD8BCA59764123B1D512EFB419C600887FF285EFB71410ACF5A2315D88794C

SMS_S klm.jmenty.vrikob

17089541ADBE2B55D597DE6BDBE18688FF923 SMS_S wdzsl.yertfwca.wtbdj

Page 128: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FA837172C6DA6C93EEC56F31733

1708D5DDFDF322514B6E014C7A086F8F50BA56443FABBE561F7516FF55B81CBD

SMS_S rel.gipnarqdj.efxhktyncgp

1731D553BA8E73FD5B7592795CDC3EFC206530B56CEEF93DE8DF6995A8556017

SMS_S fucikhm.bygtsowqi.rgtkyvoizuls

1735815CB37CD76851EE6662A74BB3E1B94065520E49A5021BFACD2AA654344F

SMS_S sxavfq.uwkvjbz.xfwvcq

1758D163AE83255B43C5C24C8C4871216C8139DEBFAA24EB52E96E43BF377073

SMS_S twzx.nrmlgh.nukaofs

1764B94F1BA7D18A6D853305E3259F3DFB98BC868E789543155C4585EAAC7310

SMS_S bkvp.fbqurjv.ikabx

176E119ADD3C5B8EDF011E17449F6FFCB2ACF7A1167E4D6B3589EAA0F60D9CB7

SMS_S puaj.tpdcyvm.gaih

179378FEDC1038DD9000EFEB47F4DA4279D94C51C88B3605C2777AA3001A1CDC

SMS_S hgpuzmn.tmqnzkpo.btkwlojige

17B1537A19DCCEDF6F05AC27FBFAD7E60C64069BCC9901075EB4F7300CE18538

SMS_S omfegu.ohausjc.tzeoumjqny

17DE28E975C44AFD8B2ED6093E7643E01E2E838D643CFDB6689386ED7D33ED1B

SMS_S dtnr.gyaviu.jgtkumrdalf

17F68369090FC354B792873FE8D44344E9E01045788A758DCB45657DDE2C7CC2

SMS_S vzgna.vcujwlg.vnsqywzkfa

180672F2E70FF42D0BF9F9795D734CC019290FE1BC80879328AD367926223F93

SMS_S mcw.cmftqhjiy.abxtopvg

1813EF1C9BEFA38DDA37B76D418518AEFB69C7CFC4D8837D05661F4F4AE210D9

SMS_S lof.ogivycrmxl.qdcpuevibxzs

1822DBECA99BB64D4EFB9751EE4F74F468A082456EAE15565D41649B5FD9AC78

SMS_S qzwfeia.kvodsr.caqbwklevyf

182D7BB266B39B3590D344330622E277CC94468AEFAC1B8E4411A924A75A1976

SMS_S gsnzf.gtbjoqphc.zyelnsc

183B916A3980F80EEC9B4BAB2EAF5FA92EBF49BE1396D4F49A428B194CCD7801

SMS_S cngrqvz.vfwpgndk.ylmazh

184AA1E72C4E84E6DDA98198A15E4D49F911ABD3735A8E10ED694274476ED110

SMS_S gitac.mhnxdeu.hikmesu

1852EC9F5E192A9AF4FBE66CBD961A97E387BB2DBC6A5DEC62E39968A824AAC9

SMS_S veputi.gacmosfwiu.wrpe

185435466301D70D247DFFE4F49932AD7FFCF41F88FCEA1EA8B0DCD293C02949

SMS_S osgjm.lqpbrxwu.mrnxcbea

1856516153E99EC7A0EA5F44A43E3DD9118811FF1445F3A05670B9499010CAB9

SMS_S xfeasz.vmjlwiz.bpycmsv

Page 129: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

185EDA00D606AD81550E3BD7F97269FEDD8ED3A4D4162A06344E9EFCACBF2372

SMS_S vlie.nlvkyao.zxrwhcientp

18619487AEEEEAC821D268103ECBD6F7CEEDA49AAB784E4AAE2D70F7D8924335

SMS_S zxqfw.scjkilmnvd.jvweirxpydsq

186BFFB1352CFF21211E5C83FC98EA38E39DEEE8AA5CA3DD4FB38262DC3EDFF1

SMS_S tyj.irmklwdpa.eysbwdczir

186CB8F800D08EACE3F5CBEB80A723176D5BA014D67F1B28CC4DED9B322F0D7D

SMS_S fbcqdix.koqinepjh.yczikhbp

189A86186B088B65F7C355D0D44A19186CAB162BB9ACB56B37CE8332DA7D9FFD

SMS_S csku.dczagos.kquihx

18A0DBFBAEA456A000AB5992D157BB1879717FD52EF6179C22401526DCA230C5

SMS_S vrokjp.uklzgv.loavp

18C1AD1B77FE9004305F28A3CC877B5B3CCF4599B1A78EF8BDBE43C4062FF0B9

SMS_S edvuo.yzerql.iefyntpud

18CEDFBBAB02AB418095A8E355857CAE1EE92AD822D01265C46AEF02B2E92D3D

SMS_S yujenw.migkqcs.knzawdcqru

18F2653026BBAC91E33F73F17AAD5E2C0DA821A92BC7A08FD28C9C4C45AC18C2

SMS_S vtq.dwitbkr.ntisgmaqz

19012C97A9FF962DA5FBE7CB705F7E306C0A7493190037D03091CAB380CC4A39

SMS_S npitoju.oncdlbfh.wfvam

190AF9D62D6FEED54EE26C64B2F99100F773919908C585BD1439814872199016

SMS_S znsgclr.rtjczqkim.xfzthneaws

1926382DC2F000A623B329D25774EB4E165E8BA34E18203F93B27D19241ADD59

SMS_S mhxt.xfpkbniyrj.zbtego

1937BAFF389D01ECB9EF38F5383F089321467A69C5EC9614976D1FD54D2A07EA

SMS_S fev.cboadnh.tewq

1945BBC2A47083F3E7180D3CF1D19518DD870D43377CAE33CE11B6106A939EF6

SMS_S uplqicv.jqcumtdf.preaugvxlhi

194BCE89E10029F22C51F8332DA5A28EEE79907D6C0931CD39F3552AD4E98C7C

SMS_S bcn.gpvaordn.koazvndtle

194F403FDCA1416C3A96C18E922C9A6535FE5781E1101D7EBC9F991C66834714

SMS_S itmfw.eiozxft.cojesixmnv

196EC9CE91B915808F006E5116A1268F5AAA06094F7BB2E0DDEDFEADC1487041

SMS_S tec.fahwboz.hyje

19953D81683DB00E4C97C4BD8100E10EB5068F4B8A29D54F06562D27BA6A8BA2

SMS_S wfs.fcslvnea.hxcmpudwn

19A94189DA55471280F236E51E89F7654AB2EB7BBDA9DAD2F9A9F60DAB1CDF5D

SMS_S qjexs.jlmxnzi.mpjovk

19B56F1DFCFAC85F97F5590BD898D42DD9140 SMS_S xkwobnh.fguiwvh.gjvekt

Page 130: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FBF26A873D9AE1B461C7E094F24

19BA3C1D3F8C13982C8674F0FFCEDF2C7AF7797484A26AA1A74DA8E08245C007

SMS_S ykdejl.xnpolrev.olsvnqczfi

19BE800FBC2B089D0796304896D8C92FD53D981E78EC130009778F2794D4C033

SMS_S uitglz.imdyfzwsgp.yeglop

19BF26933A8663F39AC8571CAB4A126AFEB9251E4094B3B9340FC1084587E36F

SMS_S cgbxvw.firldavmcg.mikqjnepzwao

19EBE4518D070F86670CD65C0658415AC708C3CE6F5261B9E5B61C8AFE2FD9DF

SMS_S iqvo.pdjkfzrx.valudsfpxbcn

19ECFC861BB255FEA6FDDDA9746482F6AED3634392C64DD3A8C69A26B061615E

SMS_S hpsc.nuztvi.pvmuq

1A09192198BFADB5D3F17C5E9F7F38E9D4A3484237B2C9543B90E71D705140EC

SMS_S wtfyrz.kzdexrlhp.xgjaewf

1A224EF312A300E0736377AEB7CA0E34CF801D65CCD5B432409EC9B8E9FC6D89

SMS_S hmds.hdkcvoqrg.sodca

1A237E5010B7351548A234585C20D360A1799E28C20EA0FC6448C1313B09A1E7

SMS_S gfob.rfqcyxjgnk.tpmzdguovy

1A2F06EC0B23D2BB4B62C814A48A9D52196CED3027ABFD8DFD009B44B2649677

SMS_S cojnhsi.zplovi.rxfg

1A37DB17C23D1614D70CE452D6A723D23E693B58EC3531BAE193972C1EC86F3A

SMS_S lek.ejgthpnl.fzcieakqwr

1A7695188A26C537FB62873DDB3013348C8D1EE8EBCE9290DFCDB2AAB70E40CE

SMS_S horl.enkqlh.ykrejw

1A8C37367DDD75CDF6C80ECAAA9FE6CB7C3F5316F2D6F77ACF8C00003917AD4B

SMS_S xlnt.hsxuajnr.pmovbgjicd

1A8F88407D85C11775975CE8AC8130D1F6F55D6F0E4B2CD90B7AD98C2FBF87FF

SMS_S yml.oaxkhgjyst.lwbys

1ABCCB19EC28FD2CC249F1AC24D91857132E19D7854517C7C4C5CF3427CB93AF

SMS_S ecjouq.dzcmsqbp.jblpihwx

1AC30D0769B61B072B06B71E5F0154CDD8F6D2766B9B47A10AC0C2018FB4D329

SMS_S xcopzst.wikbfmv.rlehmjup

1ACED61EBBA87065742669FE3DD030C6678F0B5A9F410121A875F9A939EE6482

SMS_S ljcbd.cyhtxgsb.lscih

1B297AC364092E7174AC21E4FA70EF003E03A96FD64E1C0DE228FA2C65A5630F

SMS_S jybrumc.zcynxa.tucahsf

1B33537BA2BDCBD9F330C8B81986D0C6F0BEAC786943C8564BC3DF39E5284065

SMS_S urjfcza.xpuezsft.rzeuyadqohng

1B341645DD861A397C7E5C42CAFD8E470EFD51EF6B508D737126EE80E43A4E46

SMS_S eobzmj.gdhtun.axpkmgde

Page 131: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1B54CDD1E8FEC042E30569F957977DC0E1170B5426617AD389186654A8FD34E4

SMS_S hczvgp.ewpgdncqb.yjrnsvclo

1B584CDAB16A95CFF3DAACC48C76976AB5468B1A07242592A6ABF18CEAA0E73E

SMS_S nrctsli.bjelmp.lfbysrptgxv

1B616C0420067B3A378A04317C77EF6DA23BB5F771CAA8A0E33B7F5DFB6C405B

SMS_S swajqyx.ybgncxlpdv.eakldxpjc

1B8A2A7E22A3307858BF43DC8A4E0C2A1D4B83BF3DC3AC1F05572A601DCE107F

SMS_S zwgx.ceaolvzt.xblenso

1B93352EC6B988F6A542BD91031B76EE7FF39BE6643A651CF511739B6BADC6B1

SMS_S uwtqm.xveqhzml.qvslzfwy

1BAF2C3667FD64F5C45E6738E53248479689187BC9D7E292EB21E1E064293D7D

SMS_S cywhmk.tybezmvsdj.qfsvuxhkwtap

1BB51672035A2D030F8A68E0C19CFAB1D0329AA2201664838485085162404B5C

SMS_S qoj.aymocxj.yknfiajpbg

1BCCF212969207C8F5BE40A5FC11877D26BCB44960AACC991364F941958234F6

SMS_S cdqkp.bhmgzae.flzedxg

1BDD7D7E2FA2DDCF357FCA0E4375A540DDA8E95F53AE076F3E107F8AE2A5EF9E

SMS_S nictgo.xbglto.toneivjqpsz

1BE1816C73A96EC3530C18EF0230C5D6DA6B6352B76A08679DCE1D25402BBC6D

SMS_S fhctu.ixzsqn.omxfz

1C112A91090B606A6F71E2CBD523D20062D5451B99AB61C5C19381D33E2C6316

SMS_S tklzns.pxrvkub.fbzktmdol

1C27C3740467AAEF8DA0B3F9C8D2E2249CE6FA4602B04FF8A312F376E3176F6C

SMS_S pjklw.zwgtpuno.solreacpuwv

1C56F5A6315A0968C2134F5CB3434D18C87CC7365EB01FCC495A3DBC19FDD63A

SMS_S ely.ybjrpsewdi.uzmivtrs

1C5D7B16DF12DBD9833CD3CB01BD85324A490B1E6FB34830A48C14B52CBE8767

SMS_S mcspj.btjcaezuf.ypmf

1C72CF806936F781EB4D0C602F88D71981135062B3F9102F12345903D18ECBF8

SMS_S gwq.jnetrqv.malxcpj

1C72DAB5941119AB935B64A4B0D5CC0B62E82C71A87384FB93D9C7FE6EE60DD8

SMS_S tlimvu.fjqskxwz.uoxwvpsa

1C84E217703F0D6F7E50CEE9E8DD6326E11B7E9C9CFF5D5FF8566413A9E745BF

SMS_S wbqsz.omubzcgpw.rywumvb

1C895510BBB323ED662659785ACDE1E056C89BC888F6E232158988A63D97B883

SMS_S nwdatle.cdzxpmoi.wcqbxlfuis

1C93D6354A7FBC14CFAD2CE2375719E9199CE29AFD40FDAE4D73AF49DFB25573

SMS_S xed.ugmejwn.soatv

1C9AE410268DCC88429EEEC3FE875FDF10729 SMS_S zvpcea.jsuerc.oasgmfh

Page 132: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

AC36E5F737DD7625380F5095CBC

1C9FBE15DDAA8565A3E67A63F6A681F7578459E5363ED1CCA41AAD63DBCC31AB

SMS_S fjv.fdhiuwx.bhdawfskrey

1CA4107552681BA0BCC9421D2158F8CC5C2C0A264FD9034F1F0B3BFEAA15D4E8

SMS_S vmglset.jtshzbl.ctvbwo

1CA84017A7D3ADEEF66EAE4D75AA372C3E269E8FE6D5D14CA8D8B6A13C1F69D6

SMS_S pwzhd.defpclkzy.irxeuya

1CB1AA14AD9A873991021B1007B4419CFA94FD49133ABF858F1C3CFE4261A5E5

SMS_S ciqe.lxjbcupgk.qvued

1CB55C80E4AF0F71469DECBFFE92F050D0D28CA177BB343F10C29D7440581BC7

SMS_S edfkwsx.itouxpld.fzpeqla

1CBB8C4EB3EB52B223F5CA41CE07B3CBE792B050124483D9DB889C9D5107FE9F

SMS_S fojhbxi.vsaqdyo.ikdsl

1CBDEA04927346E0B641BB43249A75EA16E285A01E146B8C99007DB7401C899D

SMS_S xao.qdbgyc.oyesiqajbw

1CC45AEAABD54E1809B18535533B1783070F96FC5237B4B78C3A7C7156EA53DA

SMS_S zhcb.nfwdtus.xhofszkd

1CE6897870400077444C97AF1350FB6CF87F02E0FDB0AFBD2D5F63A1C56E6E3E

SMS_S dtqow.sivyrwalob.dypi

1CF79DEC41B2182A9533F19109FD81672008119CA19DAC6572D123613B5A167F

SMS_S pjua.jdoemhc.tsufyzo

1D2511AC2C1240405DCB236BF6825FE8D924017B5733A789CC77DB9038B4B555

SMS_S hsd.nxfjckqz.kgrcju

1D33713A4601C3A946CAC367BA231B9E07B575319B8EBDD2C061790973FF86A4

SMS_S lrbce.rudsxg.gxvfdrcns

1D349691A50680137E1282B5FDD4A3DE55BED6398FF3987F128F54692A594FC3

SMS_S pwytqn.wltjyaek.pnzrxdqkg

1D3E9D8CE9C9BB2C5D84569CF4ECD6E6B11C02486EEAFD194A0BC5320F34C1CB

SMS_S lyjh.mxyasp.duqmx

1D4F91B5C5D66A46831E94CAF11B7483E819D5A3CD8D3A94D6BE58A6FFFA6BFC

SMS_S cmqdtk.sbctpmn.vpotcd

1D674ACE51C6810DA07CF7E9DA29CCD65C6DD8138DE33F6004398CBEDA31BC47

SMS_S bstjyq.pzmigcanf.xhuqlnyobfi

1D7848D0C0F1D0ACD9A731E2A065F0B1B0ECA55F826F935640C7EEA28CA8E503

SMS_S gickazx.tiwoxpve.bqjh

1D7BB25561A81A52D00A249D1A4B20E01E081C270524C73C147528A6E4C2F0B7

SMS_S ltha.izawecjof.vtriaq

1D85BA70C3BC6322AF9EC8B1678BE524010F4AF289B392E6B2A4C09B62D43BCB

SMS_S ajemo.tofvmd.yubkjpoea

Page 133: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1DA10D36D166CA62472AC6CF4C22E537CDCE6E936AE1D361AC00C4452F64132C

SMS_S cyfmae.jialvy.fpxmz

1DA66C2C145A6D333B891C2531BFBAEEDAB5040D03AA3697CD14FA77049BE957

SMS_S vwe.aoxrlfqbmi.pdtm

1DBD57EEC0FC0327245A08F8045BEDBC4D708AAB6EB7DBE478AA17EA656B5E9E

SMS_S wzclj.ncahbtsw.oiyszfxbt

1DC150B7E5197E6456414ED2D2D441AB92F73D4C30786C5135BB1857FBEDF209

SMS_S msu.rwclvit.ylmbxzrp

1DD0A35E00B44AC7282061EBC50E0F04367343E292D78397C814EB2A91380B35

SMS_S paz.wibyousfc.olhbzgvdw

1DD8471FD8D6525B93EADB9E0C19B1F7AFFEF3DF1441C29354EF0A1C0FECCA36

SMS_S ajwxdtc.qbfwgimr.nqvwgxmtljc

1DE5CDF012B3F1F9593D82A6E8F275FDA7E52DDE1496991106AD737ED73A0AA2

SMS_S tsyczo.adfzeijcul.vknisjcxu

1E041AE2495D57389382F5023A763AED485BF90EB14F8361FB2EB62E28FA2430

SMS_S uyt.kilwcjad.uzfrxeymojpq

1E0AAF1920B12532434E7DC82B47654DD229F398F525C45715530BA7317BD6AF

SMS_S sdphn.sxteyr.fmnuasrthi

1E19DD9771B936C17F1528E9D323F9E93AC16CBA61FB685BC2B2B258C6D707CD

SMS_S qhbz.ambrfw.luszk

1E3B7C95C6670797690AE7CA8C82E36B7B971C447A308F4F9A9EF523A3BCE950

SMS_S hvma.scodunf.raeoxf

1E3D05E02DB1992F177CEF56E83A75E7B3E19C6266B26F0C139A5F6698510DF5

SMS_S phi.rgmtzbup.lzjnatfck

1E415D4E887B163EB6A5F8743BCC4862C6A03DC1749D9AEE236ED665E3C989F3

SMS_S tniolmv.mvzfsk.ycbkzxmw

1E44B9CB33E5CB15DEAAE4DE21D194E3D9731FCBB039D1902948A25434874D34

SMS_S gkdc.qvbrlewy.ewjrhvxpnb

1E47FD4C5919F1F1C549A3E72AA60A0E72C0C7A9C8FD8C0BC46E6F7B15FB43A8

SMS_S gmqf.hncwzx.rbcasfq

1E5B7AD01FAB3845DED73D83D00DF3298408728C547F8228A4E985190B855228

SMS_S zhyba.xrcfwno.uphlk

1E65652FFA8236E4046386378E7B37CA2855FE87E543F112A0A2DCA55274D9C6

SMS_S jwcrag.ndkghva.azwym

1E91A1B2E81ACFA0BA1C13E7C56B4849501A44AE1BF8119F8C759FB9861BBCC9

SMS_S ewauk.qhblafyo.mnof

1EADC85051448B3C7DFDE45B5D89E0E3DCDEDE9C0D5070A8921D19B9BA1A751C

SMS_S hfcalwi.lpcemyux.hgnwexmur

1EBDE8AB8FAA2F7BC1C530C22E179E15DE9B0 SMS_S viyj.aercwmo.ynmxogijw

Page 134: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

986DEE19C9B5094A84F72B0129F

1EC0CC01A0A346400F6D7BE99A72BF763BE6665890A3C696F2FBCB7DA79A54EB

SMS_S aboji.xhiwauspfd.okcnamtfuy

1EDE4A8B020FD2BB758E3869AB6222B40C240BE3843CE0441BB0F7EF7A706688

SMS_S pqsd.awjcugkvl.iezu

1EEB4CBD1C922F7BDFEFBD6D61919C6BB65A6CB79948E49A16122D1968ADCEF6

SMS_S gajwtvc.ldfxomhi.sbghoqymxrc

1F18B142BC455FE876D274E3BBA8CACDEC8E0D064DFA8ADD87D01B67D15CC4E0

SMS_S vxbnaoi.gdtwxjbe.tnlxdqzsjvhu

1F46B43B082967EF80CCF4BB500DF90DE871728F7331BF1C0072D813BD3038AE

SMS_S ogzsbqy.trqywipg.zfiygj

1F5586A5BCAAB5B6BA8CFF6963EBE3D5B35AE74B5CDA607EA147C58CF99E3FD8

SMS_S abetis.pixcnaul.hdzeabrutvi

1F5C3CF339B0722D3E17726F067948908B75CFE0B4A791AF1003571D6FBA32B6

SMS_S jzcko.sefpkt.outkdc

1F6AEE3FE5C1E61A7A52C819E2584509C78DA3EEDA453D095C27605D4A2F4548

SMS_S rvt.dcogizkq.lntxphsogcqj

1F83B8119F6D6131408E0C4FFA5BC710E8745C5B7D79616992F5DD5B697D913E

SMS_S viu.aerpcixqfw.ifuoyjwav

1FA9F713F0E92C207CAB136AFD61E33809AD1F0EFC5DF2547495FA421A7EFEB9

SMS_S pow.fmxqwap.usernh

1FAD3AFD18F1DA2980E680D1847D4997E8C82864311DC52349669C8AB9C53821

SMS_S qmyof.nhausdwgj.dsaxeitmjhk

1FBFB9309678DE819FF2474FF8B7D7717E8EE69A659C0E14342AB9B724A05200

SMS_S zxp.nuyidea.utylicngw

1FC23552F2C9A2A189596B113CE4AEA2E3E1ADC6A68123FC6EEAA0BFE3BC4BD8

SMS_S uxfi.ineotxwdqy.gdnrybf

1FE1BD5A72E5F48B1C78A8B733BED040F949AFE2202B189E796426F8987A527C

SMS_S eqow.zasqidhmfk.vucd

1FE3D10F090C0734AB9D1F8F7F7BD98E2EE99DF10936AE6E92ABF6E3D3958F8C

SMS_S pvcurz.jqfyltkn.mrcogn

200673C20BEF904D75635D527B8CFD1BD2E570B391E4A447A1FB8E29AC554B48

SMS_S gkqjxf.ybjekncotw.bhamldgytj

204DAD2AE5A244E3345D9906D84F5A13EBCA6295A63167ED94034A18D9A85F61

SMS_S yktox.guctyri.yhpjrbfait

20593C071F969EEA59BF9AFD8B25C742A677C962213A9CB9FC32A1300519FC7D

SMS_S rsnfvom.pscvmr.ecxpj

205F883AD121EE40502982DF05771F2F8EBD7B46E759A4F1F57C4B9471F87712

SMS_S ugfmdqk.whrxigscq.faceotkxip

Page 135: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

20945A72DA39C40C664E8054932020B8AF39CE7BCCE3E22C2AA058614CD9ED57

SMS_S kmfo.hexyvd.szclydp

209AD3F1B326905E995098B380F0CC0F9638FDC66821AA9F48CAF3A766D1AA61

SMS_S fuoks.flhncakvjz.dmbirngcaz

209B4794D9EE8C661C3FE3DECC2D2267EE0C0B53B9E7C0A5F7B89967E2FAAA41

SMS_S xgrjons.rxnwysbfu.ygpb

20BB2F74FFF496AA1873F49A3973860EC27D4DF0B9A3B22026A5D6AD34C63288

SMS_S bjevsy.dksavyfuo.vwxd

20E9523A00216E01A36FC26C70F6052B5858D37BE5E73323DEE740DBC58F6F40

SMS_S xycjd.watfsv.vxhwudsea

20EDCA0BC28848D1842B79CE3C9DF7D898E6219AA2EBE9FCC0AB62A248A39BBB

SMS_S wbgomce.fwpagojyir.hmytg

20F43E08E1B07ADE9531BD62AD5EBE011216C628E444EF7C4F282999141F60AE

SMS_S akxow.jorqal.jnaikmcofutr

20FC85DAC8870F622FAB9E025D3A954FE671E4007E91AB6458562EECCC9D053B

SMS_S fwx.nvykpd.vqjhws

2106933748CB3E25E870CAE87F7E1099079BE3DC4CF751BB0CAC527CFFEF7CA3

SMS_S tpm.jqfwhnzmtx.qhaciolsgw

21124B4DB1A5E64CA7262989F71F904F20E5DD3C37F946F957578492B41E2E03

SMS_S dsg.mgraodps.qpurfbntgjh

212F6A6E954912098ED4A9C2878B6CAB3D5254D090BB18FF22F033E476403763

SMS_S pyk.cznyxd.pyszqajfmbio

214512D3462515738227C4AF6E589EE966AF12536FC551298D6CFB4422B7304F

SMS_S pcjvxf.dzvosxkt.cxlysudgwzn

2146511049FE32E88668B6742A30C4575BD70A2EAA553AC00CD18D80FFF87028

SMS_S xpucvl.tpuaknhr.kcquwxj

21498B02DDF706B73042C9CAFB19008219A3121F8C8EDF228D582E14CF7C3AAA

SMS_S cjkdm.zghrep.yxsta

214AA06BA4894F9F8EB8233149D915B1F45065E170500328266B019A703356EB

SMS_S snx.gkloyu.zfxkgchjib

214B63B3E5B59B5AAC66827F633031CE5E7F0575D7B27EEA514E984CB50AEE98

SMS_S urw.izhnpfy.wure

2172ABCDF1ECD186DA0C988E565F48A5C6BCDDF80F1E50CC589F0937F8E6A66F

SMS_S jwosu.uhofxrv.zstl

217FC73D24B6BA17A18FE838B3C1B2B3A4AC63D75B15DD959578ABD5A050EF56

SMS_S gstynv.toqzsiy.iaorxdb

219966C72411AD9A84CE6FAC23E9915004A67E22A2EA49AFBEF9964321D6BB2F

SMS_S hypqek.potemk.ajticklpzmh

219972958766E6ADCF134183D54A86BEFB86B SMS_S jgai.vfmcntqs.hzgtfojsx

Page 136: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

008C0981FA9B023B6AA09BA1E1F

21AB817025F6DCD61AE15C39D4027E70A4CF0DB0A68842B201EE2C0C41EB54DF

SMS_S rexuvz.hrukwboy.oewnj

21B8EA4B2B8E40FA03D20F9BBE335C022662F76842BAC6A2AC8FA2EF03127400

SMS_S iqtc.ztplmfg.aoxkunrm

21CDA1FC43F3FBB98D1464CFA7C597919BD7C9C28FF65CEA08305570A8A944C5

SMS_S hjto.tyjhqmlbz.sfne

21DDFAD8D1F693DA9F8A92CCEC49FD4015A2E39C5A0A8A486E8F4AC006D31390

SMS_S ulrazwb.iepdronua.gpuy

220542220757ABD29C642608E08E4F54C604395A5F1AB7C7867C5030FD3DF979

SMS_S hgao.axzcsthirv.mjxnkeobsvlq

222BBD357E42EDAC8D11540180B24CEB276A5B36335F99E6F536CE1DF9B86277

SMS_S wtkx.jaovyfulwd.bjdusvnl

224B4C5F1B800F9EAD2C4F52AC7AE63E0A28CCC299569E98549B0D0B653F93E5

SMS_S xmywp.gwqato.xjqhzwt

225340632BE773F7E4E2FAF18F79D778CA485BAE84F25EA626EC750BBEE201AB

SMS_S rnbow.wjlzokyxf.skljtipuvn

2258E18EA9B9C0188A5200E096340BCB9C1742EDAFFDEA5709CFC01FE25ADBE4

SMS_S hoimk.cuvzypbjmk.uqywznh

225D92CE7485E42D537BCFA6A3092A160AE8FF606CA70C950B7CDC864C73BD9C

SMS_S lizcqj.pwskvgfr.vcfkzoey

2270A13EDF60BDEA98353E9428ACC00FDB9CE766528534DDE2111605AD79E3D5

SMS_S spbj.ahfwykt.yjhtup

2294A51F3FD61688E67A9E790A64FF68D7B76A308D09BDCB04365ADC1FA9B6AB

SMS_S yaz.roxnewatk.vftzyxsdc

22961E6DF1CE991E40CE4F745870FA117E1FA9C2198794DFE4A80C0640193C08

SMS_S veltrw.pzjewbfyxl.jgibcwperk

229BF6F00969C51BF35ECC8EF0EA032B66CE4EA56F5DCBB015CF9CE662097775

SMS_S aeo.lepxuhto.njpehqkvwgyl

22BD3C9B22D2D45D0FF7F48DA2F0D34FB274F34B74547F791C8923A65704A309

SMS_S vnyr.jkiwdsmvba.yfluoiemzpgr

22CB3809493515CBC18F22E013DB970822E1262397AFBE2EFC39EABCF2BB7487

SMS_S jwcg.wjphyteon.elbhiypzxa

22D2179F763D9783CA2DA7D7A2CAD6C61DD31766F25E3A45EC72B6DA3E02570D

SMS_S jdwx.jpdmrwtlza.mhsqz

22D21CDCED57FC4B69962741288FEBB4FBA7A4A1A9ABE7F5907648B9B980B952

SMS_S semlb.fnadwtq.tquladojxky

22D99789268907AF778CA45263168F64FCABF2A665DF9808AD1FD45AA794478F

SMS_S acjfkwb.bjdiaqng.ptahqw

Page 137: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

22E46050E5211F038044DDAC91EE222674264114A6C9B2C163964ABEB1475B6F

SMS_S src.fdvtjao.umqxfeot

22FDE3F1EED5E76E10E3CE784BAA0235296C718E2E4680BE5913A9B91BF0675D

SMS_S ounc.mazwxfv.stxckoznwl

230D2A62A2FEAA14DF95E2C6E200E359ED59BBFC0FF1C10C0B22D45A09E7E6FA

SMS_S xovac.mskjxrtb.theiklyxpocj

2315A1314E5B4528920E61EB3E9508B75BA8D6991028920E32A878142176623E

SMS_S uwan.kscenhu.rolgbpa

232277B91F4E8B4C360F375355571ED94EED8F2BEFBCD802A4E7BF7C2CC8520B

SMS_S xlzc.pfwqyg.csdan

23253F5EA0BEFCD3437A0F56A26988713A48D27DE6DF216740D4E2A7F77A81DC

SMS_S tshi.monvjt.hkdzq

233A66888A68AA927CE8C30753909BFC8F307EEA57F91E9387DCFCD205A8D46F

SMS_S fiuey.rxfeughdtm.negat

233EB2F14546ADDE337C7274CBCB676C96C264B26594481C748AF3E47AAD486B

SMS_S akfl.mliyfqrgs.acwbtsly

23430626827C943E0624A3FD1BB83225090669084061FC4958EE2052412C8BCD

SMS_S dxgi.ngyimrt.lnhzb

2344FF6413716B801A7BECB6ABB9FFA18DE583640919EF81F64BF03267C9384E

SMS_S flzmke.lshafbjx.sbamw

2359FC31C1A2C64095557B3FF36BC112B2341ADD365C7E2709D574A1713C031E

SMS_S mlv.dizklmrs.asypgcv

235BFC8381234D13B4EDFD76FE0D4250EBF3E65A57B057719AFF38969FA5979B

SMS_S grc.xmhejtfzuo.ipfkxvrzyou

236027FB920DBED470F787CABCE0C4156EDD9D06FE3F9BBD51885D8463F5C734

SMS_S nblmog.njlvsgdk.qopxvykjmufe

237F51D438B4F96789DCD1FB8B780773313590AA9276CBABFB2A2BABA39AAB0B

SMS_S gdnivm.rnwbxe.fjwu

23A33581E68C6C820CA4156E5A5BAE576B29BE736BB417C8CF0D61E0CA9375E0

SMS_S nlsuwh.mazgpv.qybn

23A502DE5EB685FD290E3421B4AA4D0BFE9B6CFB205616C1A594D5E875F18376

SMS_S ortdbze.mxojtieyk.eprgztuiy

23B20FCC1A3B1F602B97960D20FBB4785C4D5670050A4D398748F5548FA4508B

SMS_S cksborx.oiexafvh.vokfy

23B2CDF0B5BF51C895CD018B487BE1077EEF58ADB58E1BA30CB43E6D2B1E0BFF

SMS_S qrso.gznlfkx.bamfitq

23B653FC5AA24EA7E350A267AA6A6E11EDA27AB5435E84A5CD147255294BCE66

SMS_S qhtc.dfksair.xbvq

23BB2BE3E39C387B83E0315B5D80B3375FB56 SMS_S ucwel.yebsah.ugyasoxph

Page 138: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1F1B18B2C3B62C0BD4CC1265A08

23DF9A3952EA024FFF3A0C4BF06FDF2620977719366894674B192595B7A28955

SMS_S wvfg.hfbwtdy.ismqxfwl

23F39666FCC26236F6E56EEECEC77AFFB5CFBAEBE22080F0A5D5884EAE58AA1D

SMS_S vuek.qmbhygkf.kegn

2400D38AAA4DE57FF5379C6467CAD5DD0D26AAAAF5CCDAAFFB2BEA70DDA2BEBB

SMS_S zuoq.vaucenbps.pqrzfnmdyekl

2404668EED2E131E63741E73901A709A52A92DE0A52B6CBA04697E969DC3D4BD

SMS_S smu.lzowjkryeb.zjfm

2404A51301D2F17BEF15382C3BE9F65B634DC186A63E5CB0DEE70FE7F55DA5DF

SMS_S zdnr.tiudbzjsa.votxmbylgp

2426115E9A1E40105C2A5FA57CC7F73FE8FA7DC521A5FA05B1BC534A8BA09236

SMS_S ckisvom.usjkecoa.hgeqwln

2432895D261278BBF9124DFFDD8CA56B09D5E37E93036734AB8EF72E2FAA7A55

SMS_S ikdum.eiqcujxgdm.eimdbkqn

2441CD219D93DD23208AB9D823B7F048B425A49246D3FB8A26CDB292F997A807

SMS_S ctsinrm.rtmqzs.otnkx

24477B97C1A908F84C71E11071EC8FBF79E7FD2FC1FB593310CEF538C421A7F4

SMS_S obgx.ihrgtq.lxev

244ABA6F4C2319BB19236359F09604215D640ABBBD7791D878CFA13946F8B8BD

SMS_S jgqfwnt.dyjmvu.nrpwhbdge

244F40D5368D27BF906FA28FBBC1BFDC7B05E908FE579715928D5E5E75EB87FD

SMS_S dnr.ndyjasgrkq.zhcq

24515A5E426EB579FA23ABF64462546EB9F56DE26B889111E8A25C171FA6C37B

SMS_S qadniec.qyhdzicr.dyic

248E11768D00ED4A0EFA1A90AF7BA6132181CC72BBA70522DE08923630E1FDD5

SMS_S abkjy.yzjtdekps.atxw

249BBA9C068FE2A7D4AA97BF306E69DB29ED8A9615FF1AB502B945E847F4D1C4

SMS_S zioh.ajhmkgvd.hzgkmtfwr

24A17DBCAACC745219945E230FA92652BDDBD48FB3E703ED35412B4D1B8EA3FE

SMS_S lkmd.paydit.vxeaiwqyubfj

24D7422472A50703320110DAA0495E464507A9811BE78869BD6907532C34F2BB

SMS_S rtvhgu.zlicogu.zbmexdwj

24FAC9D15C14CF596410F9E0887429CB48F4F5661D689CC09B8657F49D246722

SMS_S xbgew.pthbsjldie.mjdgl

250AA232DB353B28B18DF062069FF7B626B4F0C77842D3F3FD1FD82060027B10

SMS_S ujl.fnqmsbxjao.mfptryjsgxku

250E427FE5D57D4F5074585BE3275C617FB836F231A9860DA08887E7DEE10787

SMS_S gmtijap.msjorke.pwhbsmgri

Page 139: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

251DBF2073AABAB4EF81D8E7390DF5C9958983DED292A27634CD9ABD4CC93533

SMS_S zfhosy.xaoqsptr.kgxdpoyqm

2529172A062089825A3E7680A517B5212F393C20635A2544E7DEA09896BA24CC

SMS_S jav.serodvckb.mxkpdhuvelb

255C3E7FEB418E41924BCBEE3A497AD1F8345B0FDC51FECA8CA92B2EFEE1CD98

SMS_S crax.ivbnzlwocf.plxavwodbrhy

2569D4B09D16308C629F8AB55D48C49A2793E8DD8B6370792BDCEDB63EA3D2F2

SMS_S fgmo.ihvcbkrfu.tydi

259372767E9CAB32E18BB1009993909BA8CC4DBE5E9E27167009280A72B1FC2E

SMS_S zyxs.mlqtiboev.mgilr

2597C7942B5C6BA8063229A4966C7DF7174F645545C7CD9DB5EE1550CFF248C5

SMS_S izd.bvretmn.xwqfhkvcg

25B518E1A8FD34F2DE2675B68E239E99A943807D5ABDEA9C2653771994AD3392

SMS_S sge.adnqrmtjzl.fbnw

25C02D76BED10360B2DD7F545D274AF2333A426CEB2324BD24A19A2C91DB5C31

SMS_S xqgdin.yxoqagtv.jakxhnuvmd

25C390E807872BB5F209FD091E19135B14CEA4EA9DBDA313901F61771B80D3A6

SMS_S lfiu.okurfecnz.avfmexd

25E3E448CCA7DDE999BEA7470DEAF490C6451B31ED4A29887C0FB3C107A7D76D

SMS_S daes.ervslan.tsxgqfay

25ED7688BEE3290AD20B4B32CB4FE799ED1FED53E17AE03DA6F124C368551B40

SMS_S tebqdoa.ynceldxjb.mvhxadkp

2600E957BCF04BF5B72CB795BE40FDD512F536B3AC3BF44E3AA06625275B19CA

SMS_S qfbhvi.ntzixdjf.cugtesqpj

2614A6B08FB2A991634DC75C21543D21E3D069BD3C18C6BB50DD7795528B6607

SMS_S ikpgr.wpsljxdtu.runiw

2619E6A4A8A4E701D4AC426606CBC6234E8AAE499DCAC51321A62EA254BC9D19

SMS_S lbjfhu.wvjhaylbrx.pdwikbgyvlc

261FC32BCB9E0263D3C83E247FDA978A0DC64647D4E6A1AAC3337920A15814A6

SMS_S okqf.gqjrspvkn.zmspjnw

2620D5F758850160F5D2F3E21F93E9C7D39338E2BCD8C12A919D60EF4D6459D4

SMS_S qfkt.tkcguhvzy.jahdgy

2630145AB7D25769CEDA01966EB224370EBB51ECDB836F1EDB9F716191296310

SMS_S fbt.rgnomda.clkwyszt

2657F1F289C905CE866D5FD9D704D57415776B4A0DE135A38811C02F7E0DA69D

SMS_S zdbxfw.wgjstupvi.vkbihjp

265933CA55ADEC28CC0E538F5AFD0297FF6BBC4AD8D14CD3F77CC72D555B3630

SMS_S msqgnk.yjwgucr.mtycvq

269DC3B1418576EDCC083846675B983BF2539 SMS_S jwvz.dthmqlwo.fteyubjiqhz

Page 140: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

153415B619BAD1E0EBEC9F854F3

26C242B48FF52E89840B4A1F6DA441C2962498340B1F75C6415D7FF4581226D1

SMS_S nisa.cnpkxbaf.iphblftd

26C700CF62EB419163E63A860C1E77C82C939AE6C294029237009350E99C9B75

SMS_S lycow.rgdivz.hspukmej

26DC67D5289BFB1B75373B749E05C349366AD97A2C572F347F66E369629288AC

SMS_S yhnuq.jxhcwu.bhtwfxc

26E1EB609052C5C9D1D68FFCC9DF6531158BB57BF7268E0FB52CD8B7BD1D9A65

SMS_S xzitj.gbnmhzlfxj.frabciuj

26E91E4DD3BABA57D1DCF1D283DE50E38DD7A3B8A56A3F524FFEB9BDEAADCA6A

SMS_S pjke.zvwmbukptl.tpdg

26E92FDBA03D62E78106E9D9B9F9267D31F47A3E47E0B360B1C9F9B14D022019

SMS_S rvue.pgaqjx.dkxyjashuqtf

26EA1A8E63D71E29733937836744DA51E37B9F41A9D55D54743318BFF56D7016

SMS_S qtnrzpk.qbyugz.zglkmfxuthn

2752F96B662D9BAE72B2C9EB295CB36CC46541BDC5083773E0BC62B1EAD18F23

SMS_S kzi.ycpaewvmgk.yxhps

2769B38EA2459AC2C8B014F8819BAF7DBCB89C48D99DA55E08F102CDB4C96133

SMS_S xtd.lhyzvuk.wfygljkber

276BA37BB682CE73FAEECE0817BF9126A76C0F7514469FC2E25B16245EF806D5

SMS_S oznahil.hyizkn.mwap

2775663C2863F8B679CB73028EC4F94F89A56C61EA27BC4EB41B5275D085450F

SMS_S odbwm.yngilujch.qvpjrugnl

27846A18AFC184AE3502356EFF0FB3369A035AE240814D22983C250567E526A9

SMS_S ebqhxa.sjcmdgh.ickfun

278E37826FF6E6FFEE49C45D8B3A9427756FC84A2818CFB1A7E2DFDA51AF3F63

SMS_S snq.vlwuzcymf.lhkgqbcpm

279F3B0ACF221437265F53CC929AF9312F706ADA0493630709B8F14805F64995

SMS_S syepxbn.ztfvxpkju.dfxuswezcgl

27B73AFAFCFE60C71EBD0FBC6399EC66F82359DC8D8056D2471C89E65D9748BA

SMS_S aksbpdi.wnzltksy.itkeyhqxsmb

27CC1BBE37DE8AF6D02E74EFF1F78082296C3B24396B46C5CC4466F82DFF6C1F

SMS_S nkgmhl.dukiqcxtgl.mshqxvpl

27F7FA4D045CA37FCFFF97BD81EFB977F475F44F0058843613E03E593ACE0FB0

SMS_S xvnzr.khyscga.pmdkr

28088875EF068BA73D4D11923DF375DE0012F556A5941B158B685B23CE2031E8

SMS_S zilgj.gclfpkt.rxzdiqlsct

281FE6DEAB8997F847C0617A76B2527EDF52E8D44775B06DB101F03E196FE5C7

SMS_S znhjw.rapetdg.rpbnxmqhksc

Page 141: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

28309288A1D45CCF6A23BB162B3FBD3BBC194B746481E79B27D6671135379CD4

SMS_S uvpfr.gtvolj.yvdipsqwcmo

283E05ADB40E67CB667751D7D876D776E6D0DE2C6F426C805B8AC46C481A686B

SMS_S otxar.gvymxaqreo.urhfxgdsloi

286465C36693D1C268689C29FD91826C11988E784798CF534E66F6CEE50056E4

SMS_S dvxfo.bkzfgyde.yowzxbj

286552038757EB6CBC0B0F9F0EA020A0501C244F97C85D7D6C2B5488F97CC957

SMS_S xsojv.odnlrc.vfnxpkobu

28810DC67A6FD0305A8E95FF2B28E25D7AC79BC4F48D3642BA4C7F892F190572

SMS_S hblrwag.irqsldgh.fzckmp

2889ABD0B402BEF1CBEDD425052C2476465C0C954E50F70AD9DAF68AE132CFF2

SMS_S viwfm.ckjwin.wobnatdpu

2889B7601DFD1922C1D794A807B196544AF552D3AAA251EAA0D16B649D4ABC5D

SMS_S idc.ijdoswmc.gfokxlm

288DA70B1860D6EA974D2E32885675B3F40F997BB952C51FC918D781AB0A0E9E

SMS_S xfetmc.riakyfslm.rlitc

28900A3104CFBDBD95BA3C8F27A609FFF57A496E647260D71BCE967D689F24DF

SMS_S lwkzb.eywhls.nudhzcwmp

28CB8FF4BCE6039E61D82D322510C5D4A6DEF266273AC160551D9365FA22C18C

SMS_S jyxgpkc.yuamhdjbzn.asjpihoq

28CE87BB937E98F89A81FB2F4336BDE9ED7CD1846D7C2FAC472478FE9E8C9EB5

SMS_S rctbksd.khsnua.bafo

2908939F4273DC57D7B5777C3875B9E34FA85ADF5513A4E6164171DFD273AE5B

SMS_S tqp.cmfiydzw.jnkwh

292C0941E79BEFBB344DB9DC716F59562F6D809E7FE1F12B516BAFC10CB64B6A

SMS_S szrqm.ypqcfutx.eclbzmgrdojx

2934F370974F95FD9BC5D3D54F5B0AADA0F9DBEA73587E2D9C56F18065E02400

SMS_S avzdqgk.aoculhpmi.vznrlcthm

2965C40D7DC03AD039006348359C81B932B3AA51529F198A31100B074BFF601D

SMS_S brk.fmpoqs.lgjobk

29667F9F5117547773678A6DB3FF68830CE842A149B5FF5FEA2AAFC194C578C0

SMS_S mfa.jsampqogw.kumcbyxg

297058A3B891215E6B45F4729C1D514AF4FACBA4EE0A9180B273348AAE70779E

SMS_S svfptzi.crutmoqyd.quvrdtny

297101C11C059323FF3D9053FC1592DC8056CA5D5DAD6B59BE03E772EBB488EE

SMS_S arv.vjokfl.ohqisfczmkdb

298B1605CFC8CA6E3A9688281C6E3CD7CE9DD2AF2FAA35A6452F542F32353501

SMS_S vercy.ltzyqenga.wkjlca

299D21B0F71C1FD21D9F7759BB3961FE4139F4 SMS_S cougsav.wpsndmxg.hkofbumzsa

Page 142: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E962939AFE15B1949BD7A9FB7C

29B0512071334C58D60ECDF1FE9215B2B5C36826CB97E97B6C31969A3D2C571E

SMS_S rhkyo.ijgctravhe.fmgp

29E9690DD46C4CD9E110655DF2DD43FCEE60803D6AFEA3FA3AB195A30D343DC5

SMS_S vwfa.weusnicf.qzpu

2A0735A90C4DD1A84C933F3A0A78BB38A9DDD83333553A575353FB895BAEE28D

SMS_S ugqb.xcsrvajeo.raphxw

2A2004D2FAFB95AAA4E67ED125911003A9FDC963FB00C23E0C13AA7900BA605E

SMS_S pdjq.tlgcdsw.wkra

2A4D6FF63D6675C3CA2539D163898F5C4EA3E3299A563AC1D293444C127CF86C

SMS_S ukdna.ftopwd.lfyqkntivw

2A572B2A91CD2E48E568B535FBFBB2E2C757AC9A611668D6CF2C8792B1FC36D6

SMS_S gobr.yhjgzfbkw.qwjusxidoyml

2A617DA0F8CE6B3F440647536EC0E7794373D3877FD8804893BBC9128EEDA767

SMS_S isbhz.cdylenx.cnusikdzewpa

2A858422B249EED5B3BA5D56B2969A5AEDE48DA06E363290E78FB614E75094C7

SMS_S mser.yljvps.kxoqzbdrfjp

2A8CC9B9461CCA6DD58F6539BC00C01D7C95ED3FE51F25DEC98041CF1241DDF4

SMS_S jxcsde.qbmufztlaw.trhlfjo

2AA557BB1B36CB7C783D465C27C124FF655E19B3FFD7F62DC5E9B2D26A881E5E

SMS_S qwxsh.bzxluc.vgpya

2AB78851A4D01A22E84491B045A5EA0D147BEB7A7DF43640BB6DC72367004278

SMS_S pykgjc.rhyavgl.ixmfpkletjv

2ACB98D5FE8976D8C61DA9B1FF8B546AC618DC31F825A383D372A6F8C2F3BF0B

SMS_S adb.ntwxzfmqs.dsaeiwyjgk

2AD2319031A3EE106B2F0EBC3CFEBCB6D15AFDA84094BA7C2A217B78F7C75F19

SMS_S vqm.ghlwzf.yqmrzg

2AF08E8200D01F66108D2F744AE825854F8AB1D790FC7E170C48BB241B2D181B

SMS_S swfkj.istern.xhatcpe

2B1766925763233715A62EAAC63A2BAADC480B812BAD6FEA6A9C25AE374CD209

SMS_S kjd.vlznwud.rbqd

2B1F46F2965D49E1BFAFF5014D5836AC16491540F6B9B1B9CAE507150AB3AB22

SMS_S gkdv.swjodivrap.hgtuj

2B1F8FA51896DE17DDF4D4B2A77D386A342EA5754FFD875EBC957275E57F82C9

SMS_S qyik.bktgazrc.uxny

2B352F5F9E8D63B35615A39A896D619BFED55E2DFD2B25C5F3D82D4D59F53197

SMS_S tyurdk.szaumirhjx.zjglkhdisxa

2B414382846807C1A71B4D2D34AE6CB8BDCE95CB31945785A813A880AC38C616

SMS_S myud.zyfvtxrau.mjpxnbtyhi

Page 143: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2B494F8717F31C751971CA72DC182A099138E0F06C5D396E0BAD8C3FFD2D4E7C

SMS_S iwfxhl.qgeicfju.tyrdfcshkvjz

2B59A1D48F8E502C33C5C04F711A1927B0315D6E1BFE6F502B8D292E1B76FB8F

SMS_S dhbkfam.sqgjtpyfwm.lhmtgko

2B640D9E2E9D31703FFF122E70D5127D0D6C1905A0A1673F873D01B1D0F29AFB

SMS_S idyop.xidrlq.dqjo

2B64E99646300FF01194CC6099F74A763E6853CBA0987417974C99A81A49C274

SMS_S luo.vnyuafr.rtouaiknzx

2B65131D567261D337C1EEBDE7F7FD7E0BFA43C9085EB4D6794A0B46EEF6AA2E

SMS_S trqs.gicdnsjmft.jyzefqncrmi

2B72EFF360EFCF494131D38FD675858FDFD4ECC123DE8A2D63DB710783AC886E

SMS_S hykpl.tvglnazic.omksuezc

2BB2A94698B6205E0D0AD30C720E8FD8E7FA13BA7DAAE78C2AF2CCAC0873C095

SMS_S tjnql.vudgyjw.gfoxmrdje

2BC2048404EB176144F4E274CDA1215AEF7F743D5F58D6A275EC84363C1F56D3

SMS_S cvf.dnvulzaew.sjnqb

2BD69FBCCC56535F4B899CAC6AEC44AE2CDF140580828847E47893749B24B120

SMS_S gpqzb.byhfijlx.idgutzaofqb

2BE7CD207DBEDACEE26E4F3A41654178FCD06F93DB01D02923F856E76BCD07A3

SMS_S pvak.jqfhdaktln.krsycjhbunx

2C1EE35C660F4F1FE5E749AA00FAF7A8A9AD0105DA93212193800FD3456FD88D

SMS_S gfyni.mzgpvkqi.fvoqrptbghk

2C22C9302CE5D83C453FAAF18ADCCEF446FDFEE4E3B1754CEC5413F13DF7E460

SMS_S wyngxd.ctpbyoi.bhviekaxsc

2C3D7D6548A67EFA9500B973FDFABCB8E9C632455F862E717D8A3600788B26A4

SMS_S giwfm.ilrmycwzgj.tzyuqeosir

2C9A474AFFFE5DC017491B39D4AD08A492A477D12C9C895A1B69FCA7BBCEEA43

SMS_S lgiphqf.hlqinpsdb.cytjwplsrgo

2CB43E889E013D70DF62C5D0E103BA5298405B7105E5749E98A46783F4386C31

SMS_S lpqgvae.sfumhy.dsnv

2CB9329DB4A8DBED28E879CC644D78202FEA79C5DC22018ECF93EF8A4AD0A9EF

SMS_S kxqjaf.bnfyschu.yzojvacu

2CD4947FF061D9EAAAEEE1BEAC0B1C73552C1D6FEF58F448AB7A83D0F5588563

SMS_S onfbir.cjhafqbg.kzmu

2CD912C87CEE18576095948F59891217F6AA40CF9F0E9FBA2ECE625C20B730E2

SMS_S kwcnd.tbpklzyqu.cykbi

2CE026145822308ADC325558D5CD9DF3975B98DE061BBD44C27EFA2A21B19CE3

SMS_S juirq.jdtgnyq.zukjhmscydob

2D0AAAF6ACFCAAB41617480C94B8430DA8D7 SMS_S pfw.gthoalbvw.ysukxemdwvbt

Page 144: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5FC8C3454CE9A36D909EAE1939F2

2D29AD2CCE40A1F943418B3C1A6E9AC60A6F4A73537537B7896E96C31DF350D8

SMS_S ypk.jlndzavkgi.lfrawubtisyk

2D2BD686CFAB839F11144BE5E3784D588AED55F48DC8663B1F713164910FF335

SMS_S agr.fishwnqpmr.wrjfqsdyh

2D57BAC027B5854C5EB4C8B48A1F241170696DB596A294EB39FD52AFC829C16C

SMS_S eiytv.yvcuqkj.eqbouzsgn

2D652D9A636953201390C18C71D223047E6B6F7CEC3F090F601801603F2827A8

SMS_S udxqe.tljobhscrn.nxid

2D795591AC684617BB3660AE73D7ADB311EB366471E911F8E3F65F0C1A186C47

SMS_S pjgnisr.rlgdivxho.bhcpdwz

2D8938C43F8BD17BFCEF83640B1A267819F57204E493AD450905B64881ED7F9C

SMS_S htwqm.gxepoa.jkzutpbqn

2D9D933C4ECB3669438149D2745A5E751785C5B7812384AE2B30D485314CA195

SMS_S zbhtswg.jhbneasl.cghwiemxtn

2DB4F9F94796F33837585F487AE1F7B766772E013D770E55DD9231C1AFCD1031

SMS_S syqh.wnoasbyp.gckwfybz

2DC30BD85E5C3C28E07251B60C156F8F99C5CA5D5A7539C03C2795F4B6AAE989

SMS_S tou.dhjsrxqp.aghqe

2DC34C4780523858D19AE2FC09DF097479613C00A33E4474CDE52E9DDD57AE2A

SMS_S orhlwve.asxclhk.uxsrqb

2DE20DA1C60853FC26285EC6BB3497560D07803077027CCF4B91E87BF900A63B

SMS_S yekc.znwlygfaou.uproaemxnts

2DEC675ACF3111DBE7010BA30983AEEA57E1564EFB690CB472C9571FECF9194A

SMS_S styr.fngmpjz.tnvzxahrc

2E18BD18895C1BF7EAEFB7B76A9E04C40107DB5F02C591175490D933B1D1B146

SMS_S focqlvi.jblfpsemu.dfzrkqocupsv

2E1CAACFBF66D05AFADD22DAFCB2529729A8866EBCC2D302FBD669E32C5D1107

SMS_S yjrl.iodavcgsz.crwan

2E202CD87EB10E32DA27CB94194BBEFA293C90E46C7FF0E711A3FC6AF00378F6

SMS_S lyqn.hskjqgwfam.rcqpzau

2E399A513B5645BE78DCE30BF951FBD6D7BAC9A2CD0D73706A451888C7D8E4DA

SMS_S ijtnkdv.bjonurpv.omfxujlygazn

2E4F330B2A674F026BACEF760577DF7E3A18A67BDCBA366DC322A6B1803DDA7B

SMS_S dzhg.rnoyesxf.pjefbvd

2E58DD9B3E9C49061AAE853C8B620EEB9B58CC2479C56AED32C12A97F31FD928

SMS_S nmkuy.lnudowsqam.gmeayicd

2E714A039BE16B850C2914F85175465ECFCFCAF7E59308113FE6E696036AA9D2

SMS_S jiya.nlxmvftsu.cfbupxmszr

Page 145: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2E8667489F691976B7BB09510297431536B3FA8B99B659F12D43163FB8895E16

SMS_S vpyukm.hbsfaemw.wmjezatsnhub

2E914FB533EB6EEFF35178CB7FFA9EED5D8720F1108C7F1A8B09519170E25FBE

SMS_S udam.yjuwfa.dmfrjsxzu

2EB6B543FA9B38AE49E58A357EE9D72FB5D6548DE5DA16EEC4C1033EAE1056A2

SMS_S yfj.fzoqiytcv.hmzuobwid

2EC6D331FC6B0DDABB7105AF0F647424A6ED780627403C369E28D586AC3BA3F1

SMS_S pgryf.phezsr.gvltdqamnfxy

2EDC8BC1340C4323AC7DB6F4FA429F8C57754C16E49E2B020C97512ABBA83363

SMS_S tykr.nowjdzutac.nzile

2EDE5FA0ED03CC3E4D1C5B0DB4536C21BB6F27B705E398B026B84A7C4ACDEE20

SMS_S bxmnjtz.fyegxrcwu.qnvu

2EF3E651457FD31328AB093E7C315C11103BDE109DF6FD28E1983119C69985A9

SMS_S aulztc.cvkrsxfmep.ahwqtjzybl

2EFD0A632A4E8800C2CACBECBF27105AF3DA4772DEAC4CA28B4D2F3ABE0DB637

SMS_S tvizq.mjhpcvba.tanfewugpi

2F01EE2CC8E42EDC925CE7CF3C276F2B62B42F83FA10E607F45DA9D5787F7737

SMS_S kmzqjg.hnacrtsvbl.xjqmertlah

2F22D08D6ACCA226193AF077BA8BFCA209F7FFF43A69DEF9A31FCD953F8E928D

SMS_S fclsbq.gvksoxejqb.wsvdqak

2F37409E0D4615D9852C92D437EEC3BE9EDA4DA61B544F7313566D3E859EBC52

SMS_S gidlmsw.lgkimf.isevfqcjam

2F51B59469AB717E6EF18A1AB118BEAD8AF0603B119175D0A0294E3C4E058A0C

SMS_S drwm.cyniakesxt.kbyainxhqs

2F6925410411171B048FBBAD66CBA2B6C48F2BAE4246CA8EDD87B74CC0C27ECA

SMS_S vnog.krxftcy.zrhqelf

2F726634CC3B018C3A84CAEF26CC7F7386CBDF563E4140ECD87663D12F42E468

SMS_S orjta.ezpcjqmrnw.yexwbm

2FA6777D1C58A7D6E1202EB4B1477D63605D83AF845F19DB592F8ED9A174D5A7

SMS_S zjy.zuyenfjxri.pmxsbuf

2FAFC87F07AAFD993D0F2951AA7A217F27FA2FDB299B6960EF322D57788D6A6F

SMS_S mpz.djrupq.hqbyn

2FAFEDC19CCAC96DFAEDA4DF06F9F80A15CBD5FD3D72AE4FE136C2824A220E70

SMS_S qgsjht.xepbsy.hlxpif

2FC3CDE4CC38DEA981D67B019B45857D2B0874177D33DF15774E85300E5F27CC

SMS_S ucw.ymolskaig.uqxojms

2FDDA44320F7D1C73C2F9D93837D22EB222EF04CE4FDDF155D9DC868FC4222AA

SMS_S xbeyi.synhvq.hzcpba

2FF78996BE5F91A17DFF6A050CE72CC6750E64 SMS_S trnovkz.fowjdirt.qcxgkorlayps

Page 146: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9E1366B7E394C722503714FCDF

2FFD61986BB75B75DE3B2CDDF6286CD97D72F797BA7DA90A8089B40C558A7230

SMS_S qerxgs.tlnmozq.yatxbpoe

30016734A872E25E5FFC41879CAC15A9B301CD65B4CE1E6D7937691DB561687D

SMS_S ynawl.wpforynlj.zucjia

3017DB8DCCDC9427FF60B0FBDF9C79032E3DC946405B7CBE2C4A53773A8898B9

SMS_S vzpy.objpevkimn.kdazwpigqsry

301FF41F31E2ED90765820EE006414A8E73F2B684EB8AD7C53B08836B2E558E8

SMS_S wex.ancwuli.ybnmhdcuo

302545FD18E362130DD34E92C262D2F9C4A2A587F911F000EB27DDACF1958DA0

SMS_S uiwbv.xlrhcw.ojnkwgduay

3037D63FA29E83840923C914543EDE3E5F49A5875D1A1F3204734535311F0664

SMS_S zjb.vkmnby.hqodsfwaivtr

303DCC25327B09C02B66222D582923D245D3CCD2C4E4CCB6A824150F8917E9A1

SMS_S ywcmdg.knlyczd.mitaovx

304375410EB24E38B858579717D990F513C0A76784A6BB41772F9439ACC9F2A9

SMS_S fmhienq.oqnzkwa.mvefs

3054E4D845CEBFE79B2977FA1CC1C253FF5A3ED8D5BD9EC72FA892568708FCC1

SMS_S pxis.jszyxoebk.kplhst

305AB3BBF5A142993154C9768B3F440D3FFFD0EBE4220C61B221A9ABF68749FD

SMS_S wom.mcibwfxlvn.wqrhzpstujxk

30653982EE9EE382A35B2612E016EC7C7EEDF2616B6AC8CB573062AF8385B642

SMS_S jcwyo.cxnjsbqlgk.umzfrabkp

307D0C359B91B33E7039BC3E92D72A7671705A945E6F4B4C9C71E2B947478075

SMS_S vybhj.jsknqlfwh.qzarcysvo

30B7739E845BA18DD6573E7BAB8FC6B7F861C7C6760E3D931B09EED290EAD891

SMS_S xcqve.jskufpl.ifuojbxtrg

30FAC1E42E09C92194A4D86185DDC1E417466301D24AF52B67B0FC95DCED75AC

SMS_S fwlihk.muxgdy.qeah

30FB7FEFE9E2167B6239301556313BBCCA7CCEC2B99ACEAD3D3121450E9449A6

SMS_S nibwp.lnycbdtgsp.wgkajyli

30FF0B31F988FFA3DEB8E794AA69D89E55EAC28D6533F5C9FED2C7275FF4853F

SMS_S jtivpgx.hxstgc.ulvsrhbtopga

3121140DC1CD0CCB2ED21028C15E16F977EED0C4FCB5E2D58E55674E0833C526

SMS_S vwyj.fulmdjbvs.pbjuzgkrxseo

3126451202F3DEFD50B5BD3AD3F8B2399096276765BB0568B5E5FD6DDC06CBE0

SMS_S xsy.cveudp.fateizmsku

312B4AB8A847CC00242EC3495D69381F301CE4D32D110F13B41B5044EB451450

SMS_S njleuwx.cepomn.eswmaudjgfzx

Page 147: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

313C2E792E37E3BBC707C0C4AC5F9F44A4262FFB1E40F2AEDD3261021F92D7B5

SMS_S bxi.gihxaor.htcmu

31700CCDBE6D69DE521EC6C4BED347396DD510DF6764F0F2C9CD79111C4B471E

SMS_S wxad.ancbgdspr.uwoe

318B9F67C76A0C11D843CF6FAF1171B39ADE3C2496969EAF2F3521BBE570C566

SMS_S briuape.qwirlgj.jfier

31A01A795CC35741FF6851FA2BF0F9930666B013AA590C9D0D9D147B1506428A

SMS_S lfe.vngzkqmthe.iuzxrthm

31C03DAEDA421221F16B30DA339E1A692B77E9401D947CFA80A24C1C0A130A5C

SMS_S swhbi.afxiyrow.vwrmqo

31CEEB3B3AEF2C7396D6C36F1FC2A901362690B0947D4E5B46BFAC4F4A80D571

SMS_S wavfx.ckfspvegdh.scrkmpeqgzib

31E2BDEE5739BFB960BDB843DEB6EF146D24D2FA5F01AE1751EEDBFE268F5C5C

SMS_S kposxen.indkqlwgbe.vlbnhupzam

31F5DA31BC88F72A49D93664E8583BF6EFF09BC98E6413486CC612F58F4BAECD

SMS_S jsdn.tmgfnyvhq.fjryned

31FE743160ECEE2DD51DDB0C2E820130240D4DA53EBF9C342A96255B4809E8FF

SMS_S ahcbjmw.pesyal.cuif

32115382ACCA6D22508148A42D201C8856C0C6091B0B72DD559965D1C878AA38

SMS_S ozpwla.lbqpnsuzm.lafexqrdpsn

32240F86460FD3D52D196D3F82FA8ED55E79F8BBDCA01EDD57AE561AA436D09D

SMS_S stplubh.uhpljd.ancdju

3224C10A28AA764172B6CEA42B109C2B3C7B2733E64B42CBCBF6534D0F5E20E4

SMS_S mhriaqf.yqgdjtbn.xkbrw

32259CAD30DBFF9613F70F04319B9CD1F824A34DC1502C504FC55AD12A87E05D

SMS_S gcos.phsaymd.rqpbnkizy

323EF581E09A7E6C1355CFAF603D6F1ECFA52AA481AF972F838907CDAC033146

SMS_S biq.bhjtfyiwk.seprg

32496DCFB1932EF0C5667ABB7559CB91561F4EA2500626AAA3290F50FA8836B5

SMS_S kvnce.pnrbykmd.hkvoxjfagcwz

325AE3441DA0765E392BA436228F9AC09E3C26CCB62B33DEFB86D1DC6EDD65A9

SMS_S ncdb.npjgoilx.fjad

327A20514DBF59C4654E5949B1C95D63973CC8401A311F31D91C797A8C283815

SMS_S kly.mlukegz.psrijnlwm

32836951F6575F9F90357DDFBDA6EF8A4E31265597A0EBF1E6E0BA07E79112EC

SMS_S rpfhts.oavkqngy.snrgmjpub

32859B52F649929713617E1146B3622CD63B4781ECC15EA699495468EBE4787A

SMS_S qngelbs.wgkuhri.iwmruyhk

32A8082BA02AE32A863A546E26B88E3622380 SMS_S fvuag.zgtrnbfqaj.qeilxzcw

Page 148: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DA9DDADEC5C62739D16D3063906

32AF515ACAED1F2FF3136F669D4D8D28051878A12DE9B585E07A0587B8E38EE5

SMS_S hfze.jwahzegbr.inwvp

32BED2F92783027E8269DB0FBD632ACB42BBC443B6558859B78EAEB2ED4F6B91

SMS_S cos.ehwjglufsc.vqlpgs

32BEE2968B10B3D9028982028D6FE224EB4BD39B6C443C0ACC64D959EC82F2A6

SMS_S kyzsx.pnkjodmrt.joks

32C4B1DD7E8DB10BDDE0A8885AB182A8D7B90BEDDD154AF8CA4BBEABEDBBE4AF

SMS_S stlac.zwbjegqlh.amkh

32C5F0E99767F890470BF2E1C4DA729E20438A384ABAC286CA8CD92B0FD1B372

SMS_S ogxevd.tmrlwiv.jozynsci

32CE8FDD5746FED0804FF77125FEFEED840F1D8134B1DECFFDD1D84CAF26EE86

SMS_S loq.tmhpdl.qsbfic

32D51200144D158029BC72BF52AC7068FDCB34708AFF272E95CD74F9FBA7D976

SMS_S snvqgd.lbrxthsyva.lxetuajzpks

333808145A574A5EA687DE88B750B42A137E99FC8DDFDFECA1EB15C75CC03D6F

SMS_S ycnspjg.qihoclen.mowifsgp

3344770FF66CDA9339BE82486B977AA13BAE82C056BB4668443D318B870D30B9

SMS_S rkjscu.jwazhkrb.xsgaftbnmh

3358D57595BFBD85500291DB667D998D08ADB24B6F8F4779F708EB8F383C4B86

SMS_S mwasco.dnrgbxuao.xshmrogazfj

335BE670F699A02378CDB28D00AA6E1D5DD3E6F491D30E3D6799EAD5F576CFBC

SMS_S udb.vcgbmijoha.oknfs

33C941E2044B0A939362F2E8233B2F86D2233B17E3371E71DDD88FC3E0E0EA3A

SMS_S sobnr.hfqdeuygk.iagpdmnjl

33CF889882D5574698299486F4FA0095BC18B5D381B6A77635064789F67B44AE

SMS_S yivelp.wqbxzjef.lqzrdpfwuge

33E326234539495BA0D1B2DC214D7F92172D4B707F9298CC5686DDE829B425F9

SMS_S ozh.usbwadjvgn.bjlihm

33F58BF6582C9BC782ECCA9384DCD5E942AFD409AB3C20066ABC57357E017E0D

SMS_S ruk.maeudhny.wniczumpr

33F6631B746A0BE923A15A40597B033CE8AEDD4CDB2E4DA84778613B780484A2

SMS_S kvp.ujkvizdw.fnzxcbkyq

33F66EA37DA7DFD572BA0EB54E7A5D8956AA6CF714A512284E8CA0CD171D80EC

SMS_S uwydbl.vqodjuphtn.drbfxgj

3408FD560F728D1BFF1CA0059A44E4D3B54BF4B06D8A7F6CCF69D14A62CB76BF

SMS_S vdekb.tuvhdbow.gbetzwqpakhi

340DF39D7DCFAE2A4BD7F94443FDB8016FB659CCF96AB70F980CAE1D7F9BE058

SMS_S rcolpx.ftdchm.bcthrkfojd

Page 149: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

340EFB4C2AEF36B3D3A0C10CF20C2CA4B20751C462F7885E5A9038F44E26DEEA

SMS_S rytu.lwyxniczb.yqidtmg

34124550742D53AEB65FD43505A34EBFEE1C54D8018685C66269FEAA35ABC3AD

SMS_S ajtygh.hwcdijks.fmegsrc

341E84EFC945EFAEF1AA65004462086EE2361A37ADEAE30694BD85ACA781EDED

SMS_S ucmtya.uojhlscvbr.pdtgzrwab

34381346F7C34AAE95EC91C083919E7A288503BE061F9D05C3F952660EFBC7DF

SMS_S mecif.jcapqzg.yvil

3444679BEC7CEDE74B94169F159AD56D400DFB0351E952CCE431B8DFEEC79A35

SMS_S eugi.itocngqah.iraucbwnz

34517B126A2D4228D6FE5972588FAE932F8929F94314AF8F6B0FBE62E179E2E8

SMS_S qoi.tihwyrn.cthydw

34529A71CD9990251722E4A7514D8D0733F4EDED8589D8D9E7DA849C6CBE1D41

SMS_S gps.gqvnrf.cymednig

345303C6DAE3C808F0E3C7B79E09A2A97FF334D89F623914C44A7BD51165D00E

SMS_S xejromh.noiyrtaeqg.xlvqinpw

3456A7C84729A482C7AA3F624DBD546402C958E3785505720B74E7C54922BDD4

SMS_S pqva.bgvekjolp.dxpwkouhsq

3469B369B70E427560ADDA51A18A8D657478ADBCF087E5A581126FB3899F807E

SMS_S bglwmp.camjnpr.iumvnh

346BC1F4BE2F2EF76996D52DF5D399077F60BB37459C65F2B57FC1F0CA10E676

SMS_S nfaxs.jnwvral.wemoinrfy

346EB1F1345BDA056FBD5A5A67C0C466FEE7A8CE306764AB02979FC0E96F5FDD

SMS_S phlrk.reoskvqa.ztprxkdbu

349618F5AF7B0E610AD86DB222ECD57980A34193C1F2BC62F1EC466285E49A0F

SMS_S kwrzyd.bitjklq.qgeauindp

349996B1011FBF16715D823F5FCCC1083B8C0CC4093D79E8AFB96E0581B0A0E1

SMS_S yuhk.ghqkvmbd.woczev

349EAC45C44A0C15F362F804868BDD67A70DE849F80FD7855F4CC9BAB884FEF1

SMS_S iknawqs.dmeyzwobn.gundrpwvsf

34A69EF3A50F6E334D9B836A8CE68FE0D0C8F8CA12C18C1B1B36CAD43B585E25

SMS_S awhds.ehzmvgu.itgndxal

34AFD455A6C76F1779FEA67A573D503863C4FAB0D26F4D1842FEB763B9C48160

SMS_S fltv.elyxgsn.pabdulexizk

34BA49FF30AECD9CA80B621A435DC500B8B06D82CFBE74D58AAD62D65A578A53

SMS_S tecwxdn.bqcoxdinsr.imfhywot

34CFE0869DCD422D34203294E0BE3B8D27197B75B320D1F1B1460788B4C0D299

SMS_S quprf.zeatcjohq.xfpowtcybkn

34DB0C87B16EBC7C3368A0B2C344E088DEB18 SMS_S zrp.hcqbpm.gkomzs

Page 150: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

438C898E31BF8123A659CF9EB8F

34E5FD16592DFABEBBB3ADDF7F1DBCB0491CC21E305E47C65107B1B91099DA1D

SMS_S hfz.jbdgtzvuiq.pyxcjz

34FAFC9577E1F70FD7F353001E9C720BE578BD0EEC550E80DF9155319FC432DA

SMS_S rmetxsz.jsvdrzxkqp.jwcvbhqs

350B96E0C8D2254001888CECAA5B64F93BC6595C4879021EFACAABFA642DE5F0

SMS_S zuh.hljmrfu.coug

352F9D019D7559DDBC9A70EC5860249AA307B135FAEC4ED3A8735888B77D70CE

SMS_S vepd.ngmysacu.krfzxihcolbv

3557C0712341EA55E1B2AB22856C15CA22F464F277A3948210B77D505D92C365

SMS_S aifvudh.pnmbagquk.ciams

355A4C4D9FF8D8FD77F8AE37FB6E3B92314676B2B248EE76242B69B520B67019

SMS_S egkucm.ykaeqxgw.nlagizvumts

355F2D9113D357E08642DA6C049230DFD1FF36FE9A6BEAB17F34B60C7B3FE123

SMS_S bjqcitw.rlmkezvo.oxewlgcu

35627E5E5E6835E653F6E0EB562AA811A3F67AA9266371422D8F72A4ABBDEA61

SMS_S aue.zkxpfcqahm.msygclunkt

35729DEEB87C81315216D196DC157EB66EB9F70F0C29E47BCCC63FE2E7B3BFB2

SMS_S qnjmkei.pmvybd.kvyinfwlj

357B33C6FC8FE1C90A45C385E660757BAB26244759C29333ACD59C16EBDC6A84

SMS_S tnuxr.xwltnjsom.wglame

358E4FB0E2E0B1909693E448611D40B3264FC6449BD4F0B9C3076C927E057455

SMS_S godmktb.xvbyts.cmiojqg

35A393DA08B144FDCE24328605F2D8701ED9F2764BBF29DF440532A043BEFFF8

SMS_S mkqx.neykoqcpb.dagvcmrlpuiw

35AAF68FB70EF362FF30DCEA33854806AF0A209093D0D9F63732E45F300DE284

SMS_S szeyj.rqlgmv.hltcdf

35C1B36897818CACD1571F24910ABD1874DBE7A93390EF7CAF0E0E687DFC4244

SMS_S jbw.fzpawhuiys.vptlog

35FA60922EC66C13A262640998887979813159BB618C1A5DECD5318030D203F9

SMS_S fjhlpzb.cioqjw.prfaujcd

360241F4908DAB6CE733F44760A15D09B8AC07C1661A8B10858C715EC0139DB3

SMS_S hsmf.nwflpjuy.qmygpodhfe

3614012E38416B85DF18015BFB703009B30DBFF27A9832CEF2084272053E8AD7

SMS_S benav.gfrvlzm.rkldewji

3624975C92B796F265E6ED5A37737D5D109EA783E804B45B0CF0709A8DD17CEB

SMS_S aykz.gcwevxtuhy.atkyflzgu

366CF9C816910B9F12557EB327290C5C657D257F83F344FCC7ED3A707041C6E9

SMS_S vozkb.igkocxsq.amolpuekxh

Page 151: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3673EAF614B45EA33931EB8A9A67C17644B4C2A2110B91E4211B7ADBAD93A917

SMS_S nvuiy.xkvombglf.qkurayxomlvf

36814C0E10D9060181068821B0E45D1639BEB530D2F2813B9D529717DD9295DE

SMS_S tesfgjv.aqjpilk.duehmsqclapr

36A030C0912EC8E9E7EF76EDFDCE1277F1C1EA3ED0645EF36081FE5DD8935B3C

SMS_S ohkmajy.pmtbafivs.xavfheucl

36A5243523E09EE57A802CF48E80AC39C829E5D0641F544CCF7BA2A11738774B

SMS_S azlpkn.vdwhip.wbksah

36AB74BAD3758C0AF8982197E1772D7666E61D34A2560E6C1409C6628FB47EA0

SMS_S adn.edpmkjlgb.zvfhncwslqmy

36C10B09F692B8AF21606BAFEEFBC3868811431ACACF5E5706AEFB1C1F7F6A4E

SMS_S rbikntj.cidlrhekq.yoqtnm

36C935DE58C2EFC8E8B98CB46072073734BA0F5DDF546C33DD3503B50C0DEB93

SMS_S lgxz.jiuhxtp.ajnkfegwvl

36CBDCF58F807970552334CCF2C8D9744A4CE922CB7DD473CE11E930BA17AE6D

SMS_S idkxl.xmkwjvlfbn.qlpebisc

36CCB8B2FCF2E5F772AA14F6C110759AEA4C43AF086C28EF5C66F09D0829F1F0

SMS_S wtlmz.kbpudshf.ntcqlhbfkzir

36DDF22D7521341545FD42FF40C391C6D294E8311404A6776D8C1BD8205DA968

SMS_S yrfzgx.nqripy.jgkf

36EE8B4C3A09326D25AB3C0858CC0EEF2F5C97B972CDB428793C4ED0713B801B

SMS_S bpmd.cisaoue.ckfgwyerbm

36FEEDA0F7A704BDE694F143D04B01F9551B475BEECBBEA61A6115D2BC7002F9

SMS_S ahovszx.ymflushvgn.exdtjoypk

3742AC0823B5D55F4619CBD8632A1396CA0E295680A9DAE6FA243A5A4717DBC5

SMS_S mxboqjs.njawmyuk.tzucpowyq

3744953B20BCC9A6B57DC330FF9987EC4E6E9A10F71B01C3C79C20305565CE9C

SMS_S hxskv.hseqnfrcjk.qsig

3756F5EF56AF90BD6434579C7C61F51164EF6F7EB99D6BDC8A6F1C7FD443D1A2

SMS_S rqu.pozblsyuc.jrbst

37589F7F37AAC9D2044F2EF6F3E899396833220086764009165C187CE9898B91

SMS_S lwx.tqiarzeph.zfanx

3779709B3E8F19ABD08AA0A9398874EC75A5502EA5D4F6F7661ABE3ECFF7F72F

SMS_S vbnaudc.kimaxenc.wnbt

37A58DA6FE6DA74EE689C9B1125D0232E911C875770C12B61E03E4BCF4366992

SMS_S rlui.juezpfxs.xsnrvfiulp

37A7E86E9F1B637FBCAFB5D403D367D24DC95A6E8A8A0A9DF743FFA93CB40091

SMS_S bpvzn.jcouyxwe.hvla

37C39A6BF58019504B4D623D20EC44B21F82A SMS_S dpexjwu.maoebxuqck.hexfo

Page 152: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

17472A1BF363CE25AF3266E8419

37C69514A7573B1B5E08CD4207569B942C502B5D85D13037A73035F62DF3CD5F

SMS_S lnahjfm.rbmgzvixko.uaxgpv

37CFFA65BE98FBE57898CD547A3E4EA390908608A5CFADFA35BD268B33D57DCA

SMS_S kjfvu.yljsvu.rbtu

37D71D282DDE1D7D0D22D1D5CAAFFAF6A1064FDE575557788A6C688CBC66DB19

SMS_S bztds.wsqtrmduxz.ugnahsykp

37D9D10156F975BBDD18CCD677B3894003D9EABFD4063026D038F5EDA9861984

SMS_S sqc.jtnfsobd.krsmit

37DABDC487902E564CED4BA8A5DD2615C44761238E200B3F4AF87113282D1742

SMS_S fmoirbz.kunshvgc.odifvhtslc

37E3B6A3BD9122F82BC3B0F3CCA94205AD52DC653435332148D3D0AB92D8E46C

SMS_S ezrgmuc.tgxcjon.fnswqdagyum

37FF35E995B1129C2B275DCF3EBC7B5FDBAD162B4A3CDBCDEA72BAA8705DB36A

SMS_S grcbla.gyoiksjph.mjkaclyozhf

38014D85617F238403183ABF8DAE554CCB91040DFC09989FD91E6AFA2B826890

SMS_S hejxo.lgwuen.mhzfoaligp

380EBF55C809F0AD91F238ED6EC4948F9C5625B99E82B7DBDD6A945E3C9CD0E7

SMS_S payg.iuksyq.uvybshnejf

387E405C130962A5C76886E091F2960DD998D3B3B6E83D0EEE85D55411BBEF53

SMS_S uhczd.btnaigd.vwjsyfdme

388CDDAB1F5EDA7AFE546BF260EE95C24D7096E81618D008644DEF804DE96856

SMS_S nykv.shvbrnk.hqta

38AE2ACBC2CB6EEA26A969A713AC6906D63F8143484F3599B0385F29DB6F27B2

SMS_S iolnp.uxrjitywz.kebmjnvxly

38BEFEA7E2AD88EA36BC96DD7F940715AFE0A4A3D5406D50DE1B64ADCC4FB851

SMS_S miwsjo.sjwzhomn.wxobhypglzj

38C360A921A3BE407C1B294E2D6ED6EA088DE0CCC9776A5B6D91EC797EA571CE

SMS_S wrazqpi.kazrwdq.ajgvxtpqs

38C3E0A4F8CDDC755BB4AA60ED47AD9170070210251C8127FBED7DB5F6E0A6BC

SMS_S xktwbjm.ymckedv.pmnwzolsqi

38D8A8F63CC0A02F7C38C943267E2AC23DEB035651DE092D84DA583E19B753FE

SMS_S gyjkdf.rwzbxja.enhwgduypj

38F60D999C6783031B7DE87E952C235CECDB73DAA11F6AC3347E1026FCCC8A85

SMS_S oebshm.bvdoki.lgsef

3901ACEF422B0C8300045D3F32FA4C9DEE909938EDA61480FEBD49E19ACD5BCF

SMS_S xjgs.vymqwo.pugzrb

391C2FB88F3E5BDCB2AF923259194328E0754A9C12EE8E17DBDE0F989CAF8AF9

SMS_S itwfx.ncgpvs.jfpdumokqvz

Page 153: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

391E3834E3B6F3A8E7685AEA1BAFC8572C453490C300FA09A6C38BE51F25F3B3

SMS_S drftzbu.fnzsedwpm.hgmsoekflwuc

3932F96BD9A0CB64140B16C38C67F6E4A107767A6B4D438622F98F19E73F17FA

SMS_S pyq.zxokunbqr.dncf

399D8E71FE5AF1C8EF8E82352ED8B589CA14806BD94A9E461526CA0DC1B70A5E

SMS_S kpvh.wmypozrae.oylgr

39A2F1F078F1864AF4201929A6B09386381BB75E977494D5605EFADD82D34E1B

SMS_S gis.khpjdwir.qaglrhmi

39A75115DAEB108939AD2B88CB7AF3778A5FE0484EB1361918D29F63C033A1F0

SMS_S igldrxw.razqfdpx.syihnvafrcm

39BAB6E812B058EE224D35FC5FE082B9CA73713496CB5B615EBDC2A9D3AC0C81

SMS_S rig.omwudqgxk.quswxo

39BFF25301C5DB500EF470F07ADAE1DF5970269C5898411600DA96658ACB7F09

SMS_S glwdv.jreodbngvh.omvyjkxt

39C0DE33FE4F8A13F205623FBEB4E398FC022FE6A23BE7F8F60321B08543B293

SMS_S wghqi.jlsokzgca.bmurtznlcd

39D02480844DE96E15ADC7C0E1C8A07116AB6F1C64E9A70A0C5D65993A3AA9A9

SMS_S trnkhvo.xwkcafejts.qmsoixdzy

39D7202AC1115FBF44A86615BAA95CCB4E6268B944F480965006CA06947DA307

SMS_S trf.rpmiygf.otebufijp

39DDCC75782DECFE6D06C73179655BCCD25668B3AE8047B5B67049DC5C751B27

SMS_S jip.mulpywnc.xbiplhqu

39DFD30D6EB56A7D4767AFDCF99B2BC8FDA14898196BDF0E3C2D5FE17352E296

SMS_S khz.ehvtur.gwymvljzhqb

39DFD8F99D306B8A11B41A2FF9B95F133B018476DFFD0901CE920484372D856F

SMS_S cvsq.goabvj.hiqun

39F70E17EBE5E9B19FCA8B87D3598B98D66802D8EDC8336A393ED528DFB37EFD

SMS_S fxrsjh.eshltqcvy.lvpkncdy

3A00185A35622EBE07D699114BF6B26490F4863543DE93217EECACF0F7ECB94D

SMS_S gmswnhc.qhcxpjyo.axlkfjgwv

3A18E200AE116803638D850698DA3745E0718BCA8E038D052430B2971A474996

SMS_S gvqli.epvwdnmo.kpagxie

3A1900D7E6809D2160B7D519FFFF3DA068400B507AA10750061DCFADB388DB27

SMS_S uefyv.pjmnaxret.vutgeolsawx

3A1BA2FE791A22BF411A84381A6A52CA66899D5BA876C9CDFD71C59DD92DAE44

SMS_S xilck.ayiuqvczfo.oxhq

3A359C64123A3CBFC4B48D283018BD36276D2742859C75E62FE161707162DCDF

SMS_S plkn.synoukh.fxldugpnkm

3A759E929AF2FDF9DA70F2FAFDA56E239B9A4 SMS_S scjfx.zrxtmysknw.bclutwmkh

Page 154: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C94EFC06079D860C9A9B4ADB200

3A80ABCC09238185ADAC373BC04224111D8F20B11403047468F20D9E1DCDB77F

SMS_S fhoqtr.jmqdts.xdlwfmn

3A9F635844BAA0EDB76F227A1EAC5205664D44214466BD2F223D3309EC1317C8

SMS_S xchmiq.wpbrhgv.xdgnb

3A9F80E008C5F1692C56913FFE15CDDA57C1B002C41FF045DE655703A79276C9

SMS_S uzblv.stwyqbuecm.kbdmfgn

3AA02D2132E5140C1B9CF2CAE5AFF2D6F19E61F4161F0766AC3763C48BAA734D

SMS_S sxc.xwdkpthuvf.esnvkjhlf

3AB5EF2F478A8E86392D4CDB4D60FFC1F8C849F22C64A8549CF51CB2B951A04D

SMS_S rsnvq.gbzqrjxitc.obhmsgyzd

3AC2198B3792C3484F441FE24E13FBEBC30434B9B7890BC90A87EC8CB3AF55C6

SMS_S gyci.uvqmbyea.jius

3AC2A95FD4ABE393D2E5F45AB2EA9487CDD6B25DBBD76EE395A59928EE984F60

SMS_S cbokman.baihzvte.ukabewxmpn

3ACDB2B7BB79B90AF27EFBD4415E01FBCA3719E23A321701A74CD422593B1EF9

SMS_S oxh.ynkarstv.vqwukitegp

3ADEDB991D11CF678F7650444CDC600914EA39239E1B67DF47D04B0B9DDA82BE

SMS_S oejhcr.cdsjamywfo.sltqmeaoruxk

3AE4E0575AB3AEF50F493CCF41872B120A96A05D2CDD68881208142DF3A2CFF2

SMS_S ykt.boxncgtjqm.qdztbonj

3AEB71AD689E5FC23C4D3EA0E84D3F828481E03E60E6EAA4F0F402757E573099

SMS_S fubj.ruvwhimbc.rzbsueohw

3AEC9A8F7A39BF26D37584FE2C5D5FAC6B6143501BFF84BADD31A61B1CEA1BC5

SMS_S sya.klorcxh.frwdcjoyqsi

3B0C6B34D2350258D1FD1B0529AB965789DAD622AA9BDD740D5766AE4672C95B

SMS_S yir.cpmbseuain.pqbexcijvyz

3B1A589C3CA6F0AEC8A05ED2B8A5E963FD04368B10B15EE1002D431F5500294B

SMS_S kozbrpj.dlazqk.zvldc

3B1BB64C3B2384C4055FF4D200C013978C5CB272557A7935C186B46FA96BE028

SMS_S sadtnx.rmodqznhxt.fieyhgvctpjl

3B316DF4C50EA4E5A6C7EBEB5C6805FFF817D8448960734C09EA1ED7AACA2F0D

SMS_S vaj.uyrgwk.sgvzuntkpcqm

3B340E56A78500D41ABF22B507EB1B9AAE1AD797E2EB58F6810FB780A94E27E9

SMS_S lrh.pfgrmnzyq.mpjabvfzwlo

3B38B26B8472A10DE3EF3BE2B8B90CC3A9C06E6C1CFAE650104CE6B56C6AD5B2

SMS_S wvuxj.azcklvfnty.mdkqfzwrgti

3B531F2D12B70C6D075CF91139F101173AF484BACA080FAC6BC39B450EC1ED5E

SMS_S xvbsei.poxyhnw.ohkubsli

Page 155: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3B5560266AF6B4E5DC904AAC803A1E101CEE1FD148951218083FBCD747B00CCA

SMS_S yztonse.fbucqiazmt.wxgcrhnmt

3B6E20BB6ABF81467DBCCEEFEC57D713612DD37D9168982337B592CB7665E739

SMS_S wdpsr.itckqp.vpwrfqixh

3B765672EA295A528DF45DC0F5796C8F17879CF04E192E56A48827B4DFAA9054

SMS_S flndw.bypmwrfqx.aubxvrsmkw

3B7D73444FE97A9E719F29402E0FF85E889B062DA128684F64DBFABB505CF3A8

SMS_S wqyravc.npwudtixar.fhcbvwlr

3B83E1DD2E6F0839B78699C1F7F99879F779E91067A38821D7F992AC7A745136

SMS_S pqmxg.vunpjck.cybaxgk

3B9062669DCAFD15D8FD3BA204D6AB47D42FE9E2787C696AFD45F0FFC5C216FB

SMS_S izm.dlaebkoy.peaksvu

3BCEE486A0B4198FAFA0C262CBA624059C3711DA2301AD121E556B88E020579A

SMS_S fmc.enosdapcm.ithwjnspbx

3BFBED7C34C90721F9D81B84441BA5774D27A3A9224A195B5BC9240C93615F7B

SMS_S dxikzqt.ydtfrvwc.ftqjxvc

3C01F22D933711E63B830214ADC6F46286114E991E81E37D8F7C37394B653C7F

SMS_S ewnu.wljgbio.jveksmzocta

3C0AB52C9FBA42D4790CAFDF16A14D85E0CC6959FFD50F485E024EE7A92A3C30

SMS_S gziqu.osjvwnah.hgjopwknzusd

3C34543A376A85DD7BAFF3D005129EE7D71757A3396BC2163C0CAD723D6B1406

SMS_S dekpthm.whxifv.zuxdrinkqga

3C375C4D62CC8547FB9C3192C7FBEF8FCADAF8579135D696FC6D89186EA25A88

SMS_S cdoen.qjmacpuk.plbxto

3C3960E98039285099D30D3A4D3AAEC43D0C55B426B3480A46D582CA55B5D5BB

SMS_S nmuvf.piomlkgnbx.nlxrwcuypqs

3C3B44FCA5392889D4237312A9751DBF4078BD8B6FED7261637FACFA783C3174

SMS_S syqnw.qvzwrct.xemdvycwbk

3C3C3F15DDA1E99F8CB416C982E22EC8D36A587A0AD0436EEF31F5B17E682082

SMS_S

3C3E1103573EB67AAE0399E2E9043822D054A7DAF1F481AEB839F532ACD3880F

SMS_S luojvyk.vosibath.djimwtsezno

3C4900E7FC5A45181B81E9709B962754B666CBC016C1004C17EF3C29D30487CC

SMS_S qrv.wrscqjakg.wqbfatxgnemi

3C5FD9BDC3954F0BD25795E458052A8937C54A323464F71A7B53C8C4CF3796A3

SMS_S yil.aroisxk.sdonqcfkhyv

3C66FBA104B68285FF451384CF80CBB3C3419EBB707C0CF4184B537B279CE230

SMS_S iof.yjdzpnvw.znprxu

3C815B5A844EE0B32BA8A6E638840BE7F2FAF SMS_S mjdvkp.plrcwukd.qzwdgulvek

Page 156: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

AB1E3ED1592942132E05F2352C8

3C828F04E1E1D3E6919F53E2A651BD1486EB59A262F3D89C70FD33794229422D

SMS_S lpne.layhcbv.rugai

3CA34D532888384595E4015D94ACB1389ED29FE3A3DFF386AE3878FED064BE97

SMS_S ztx.txvmrfjui.usem

3CAB3551BA68A06545CF307E5B47D7EE482D9AA1AD89E854432580541F5BF245

SMS_S lqpv.yjmczp.ulin

3CB13F39D7141BA8F00D51877919A9039379DBB6188C8EFD06546826946D46D3

SMS_S ivtz.pzhvtnkuwx.rpinwgaycbqm

3CC114A1ECEDA9A7E61E35DEE75FC42ECB6D3A34896791088B7109FA077D4CC7

SMS_S qcxhn.kwdvzgsjei.xwqsfdoi

3CD97AE30EE2C28501C190935EAB023CF6C9377F104B0AA543677F998922ECB8

SMS_S imz.tczbrjg.nzhuapvfoc

3CDB8C19B0C0F044824980AE54569EA7FE35CF96D3D5449FBC7FA1F5D8CC21F8

SMS_S duavhjl.lkzbrhmj.ruqmwashvf

3CDE09434DD8EBC48DBAF113094EC9543211D67C08781C4B957D574A057E6EDE

SMS_S dlqt.cgwzhdlqox.ixmvcwqdt

3CE6621BCC16669D3E22297C46F049C6B38AA64EA22191B0B61505293CE9627F

SMS_S sbwq.cxthkndvmb.djzfsipbxlw

3CF0E6B4C33EE6CF5252C42373C66BA39BA7732B6DC90D96E319432F393D192B

SMS_S dlfqtu.ytxqigmus.gtyachbmpr

3CFF8576D59A644C5D01F78D09C1CEDB37644D68098AB25CAF18FEC00A282539

SMS_S fwrz.lutbszxpvi.servhzdgiqy

3D01680F72B75014BF7FBBDF25B45B29879B05E97AE00417976057F3CC4E1222

SMS_S tdvz.tcmbrdi.esvtlkru

3D12E40A43942059668CF147CE6D4A89A7B78D3DFF83FE8987EB7F8E3B6EC24B

SMS_S vltj.zlidkhqx.fmvkqizu

3D4E573D2C8B2180A81F62502AC396BC1F2FCC4558C434CF2C94E19FF947198F

SMS_S xagpefs.mouizceqbv.hfcla

3D5384AA5AEFC53FF25CCAADFAFA0012D8DE94477ECF9918B26ABE26742265C2

SMS_S lhps.zuvtadgsq.bmkxcuaejz

3D6FB78F7AEE5D6DBF22811B267423DB2167D9DEC5636FB7C818A2BE155D1C3D

SMS_S dmtvw.cdomnerk.xgbqdnpwm

3D7A3FF3C7BAB5DE311920D3EE0ABA507BC297118B38549F75079CAD23A8580A

SMS_S dixsjwn.lwifdohnuk.jgyqkidtwx

3D84F38AAD526C759379873C9C631A00DF6FEAB3C340F7637C29812D666EF1DB

SMS_S eztlo.zxgjtdo.iwfedvpsnbcm

3D8564CDEE51532EFBD272CBA424D44B7CDB4F001C77E29497B95C76B7E6BC88

SMS_S cizuax.wenoamc.jdrzqeth

Page 157: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3D98309CD7CABE4B7173813CABB7854B5E9F11E3BB2CDBD2207DB4F0059B7DDD

SMS_S dsop.rgnoyflcw.oczslw

3D9D175F5D640F0B8679DC329BABCC92BB9764528BAE3177FA55203E21BDAD7C

SMS_S exdtqr.idshqlr.soxhztejk

3DC7CF32E4B31073A7426F1FBD855F7B51F82F2EF1F8CFBA0EFB36507E74EEE9

SMS_S welctz.shafknj.eqcgzvrplfyi

3DCD2E8B53A9064D9FD20D2D7C8BF0CB152923829311F2C9ED8FECC787F65DC0

SMS_S szg.skpidcte.rdmwu

3DD3775F238ECF091B5D1AA9E18A00C822524F07EA0FE225F79D6A368854C44A

SMS_S awzj.gdorce.nuhclpqj

3E03CB708D5AB8C98A9D9BA514FBBC1D2CD0CE3945F219C7D93B379769EE8179

SMS_S rxqc.xwtrbqn.nkuqc

3E6A1273282C5F2024C48C9749C5139C31AB669DB8ADEA208D9D3DC48DFA2A38

SMS_S ipbvhw.ybwavcn.cabikzuwlxhr

3E73513EEF1DF993EDEF3E42F1CC6C8552B02486A71144A26E33253ED68B46EB

SMS_S kpyvfw.ahltjcfx.keazxcvf

3E7A63F02F3AE6D07A67F6961E2011B1F15BD986C8613F9217872E6F8083C045

SMS_S dsukvf.kimhlp.aewbf

3E86ED56D60B98927B983169CCA9F659BF8BC1D4D837A004C4FFE2256F2496F8

SMS_S wbhqe.mujhesvd.ymgqenahpj

3E8B1E6087CCF1D2FE621A020E3EDBADE5EB54F4B47494F2A725FAA25D45E0EA

SMS_S aenjbc.zdjnltyxvk.cuqvkdmo

3EA347CBB1CDB45F65A8AF3EFF3EEB705E291C4E98D33B6C7898C6FA2350061E

SMS_S kexv.edozaw.pkzgy

3EA5EA13B73214C5B26A81FBD7A0D087E43029EBA6DE1D45CA5DE7294A7B6CB9

SMS_S lqjescz.vteongmuw.vkygfzehxbni

3EB16EAC3B769D7B574698D4552AD1E89475E39720E11A9425B4CB20B15342EC

SMS_S pyod.uepjncx.xbmicewzqtn

3EB9EED3B61C695C09EEDA9B9719FC24A2BF49387B40F8D476397AF80F2521CA

SMS_S nyl.esnkdu.ixudagz

3EBC4574D07CB32CC4B158FF34B3909C60C8718209875DFF4075CE887ACC9C9F

SMS_S teo.cvqkrupxi.hvdizafogcp

3EBFD2E3FD9F757FBA6D3554C12C5A3C28C2FCC874B8974856CD4AD7B9E882B5

SMS_S qtevuh.gvrecuq.xksnumzvcjlt

3EC14071A5B09B927DDAE0CDC82DD5645AB0DDBFACC2DDD8576AD921BB669CCB

SMS_S aphu.kblasydz.reqnftyc

3F091C3F7ECF74B95BA5BB0FCDFD33A90C2855386404F519FA8E317F07FF2EE9

SMS_S ustrbk.qszglfaiy.uovkwtzhqra

3F38C89336B1D087341E716A6FE40A913EF7E5 SMS_S nbwhyr.lxeaikmfoh.enxzkug

Page 158: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

32ECC6E8D03E4BAEA591EB8708

3F41362A0CC43E05A3CC79DC1D5FE3B80400A094309B0010363515D8822924B3

SMS_S tzode.cpwjqa.khaifngosje

3F49D70067E7B7EE06A9A03F8FB729C94B15885942507ACE41BD5988C222B0E0

SMS_S ugb.nuqrzky.ymes

3F7ABE1923F2C4B457DF2384839D359BFAED5E799316A567A14F4F94A6765784

SMS_S chbw.cygstbh.mwerd

3FA0DA0243282EF28C4D8BBEF3C1BDFA10EEEEFC35B50C6171A81A64D779124F

SMS_S argqyf.yluiqagos.wnkocgehuf

3FB73CA9743BF3A8A680D80B0C87B3815634E64F5AE6C69FB1DE98FF039D4A99

SMS_S yexdvat.zngqajeiop.sqjwznr

3FB8AB1A44F514927C45088EA45C8C9B9D2B59C108058E77EF4345FD8FE663CE

SMS_S zyu.bexfgalvs.qwtyhzobanmk

3FBF54EBC2046AD17355E9009508193D2F4D2471DD1ABE537E907775FE5355A9

SMS_S fvczg.mbfizkqeag.fyvli

3FD03A9F9C580CFAA90A03AD140BFA679FB25093800F9F24D9B490CC43856F7F

SMS_S heq.egzaorpmjq.qyco

40178CBC688137A1E4DBCEA16B0693D919B616ADA56B756B79CAF50938324280

SMS_S psk.jecuzixysl.isxw

4042D2EAF930FEED9BCB34D6B850E4CA5371D9F0D6DB120AE08E2B05AF243DFA

SMS_S cmg.adpvblow.edkf

4044E25FB6E023217EF4BB132CE05A3F2119ADEF5DEEA6B81B37D907C9127EC9

SMS_S wiu.zudptnyvek.wpyqag

4049410F2C0011DFD1EEE08850EBAE64B8D3BAA80DBA9ACE8ACDA565F2C70EEC

SMS_S tsaqbcr.felmyb.jhynmip

4057500E9FAD2508BACB93AF26A3DBE0DE23F5106E81159EAA561F0398398EA3

SMS_S phngcrb.hzungpdb.zgefjaqhou

40646E17CFF80E4855D84222AB4C142D6BFA51BED4E623B53F349DE0B175BD82

SMS_S vrq.cwslekr.sedvynx

4073305A1906538212A7DCA42F6E1436EE7521FFEBA930E708BD8FA76A072846

SMS_S oxfp.hmnwbo.uxqeyizsgpd

4094A88DBB74D9C3787EBF5BEFEF7875E3A49771C581326046CC37F76FD529F9

SMS_S dgckm.maczwqjrkb.fgncixalyqv

40B350F7BB117F27427C9BC80D4B070244A6DBAABBFA37999070AB2CFD374AAC

SMS_S xlh.nvfytuim.blcxdqpyam

40CBD19EE21101292E6CD6E8CDB6A841487853FF92825708676A2DA6971FBFB1

SMS_S qmbln.dyuozjkr.dzhkwaqgj

40D257E452B945F515F888928260572CF850B3FEB51CA98F65DAE51B66A21255

SMS_S dqmr.sbqhcadyze.axoqg

Page 159: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

40D3D5EF210FE43AE6065A40F7E6A7E4C6EA75DAD38B9F149353EEB7BA266503

SMS_S xzpviu.zirehkc.csxmkntrg

40E0AFCE89476DE18A8C6241BF5D147959DBB3C6C276FFDB2CFAD33F902886DD

SMS_S jipztn.mwndgptau.qinklc

40E67193DAE0C3BBAD0A5A9D11DA8A7000567B19E87C9D42D533081D736E424D

SMS_S omvjh.jyeapmsg.ueoqydnxk

40F2DF6FB5D9EA5A003A784E492D62A359EC6B8C2D9F4B66BF48D7D8823DA3D6

SMS_S pyagxnb.vaeoidc.irsnvayot

411417633BE47A929E0A8E90E89CE5226C94A5FE917C89A1F9B36967DE8C1993

SMS_S eyxpbv.wxphdujvrs.vcrjqynadx

4127BD02AEED66633DE86E6646FED29755F5649E4405075A1097128F02F82567

SMS_S cqpbsrk.ixkade.tljmnz

412E2650FFC31230B72261DB6C80BF46BC8EDD677E399477C0868D415B4AA351

SMS_S rjnogi.icpbgtv.ytcwfuqpvri

4154381ED30ADA6476886F0DB5513B917AC315AB076E2A61DD6680E5C58FF2A9

SMS_S mlsujbh.jgrczv.spkl

4154437BD4D1231BA77F129E09E44291EC62B6CEB92202C43EDD357E50629AF0

SMS_S bozji.rmzfnp.jvhxz

41562A9CFB9AFE646F03154DC468F89CD1D3D868C9289F8D79366D54C5280786

SMS_S yatcvd.jlazosd.hiedzwynto

41685152C76A760CD3A1DEDC06BA767AE39E6DBAAFDAA25A2EF41EA8C71E4986

SMS_S mwaqcpb.hsojbtz.fvoeuxh

418048BE0D736EFBA909D419437844B7A494A121DB387B6CBF83250D24EDCFD3

SMS_S xaeqvpu.kzpbjiumv.xolntreg

418C55D632A268E11653536B92C99D5654F41B10A43D6F680618DD26A9930EB3

SMS_S iga.kqsgbpedi.ahtw

41918E83EC7A18E071320FD79E28C4AE089D4B145ECB9836E5D1C0AAF5A1CA55

SMS_S juzgias.eyatohnld.hnepmwud

419920534D936BE87720691F6CF88EBA15E17D37B69E2E677BE4EFAC054B5955

SMS_S uvycm.ucpesmbk.halrmb

41B577A044C8675CBE43A0D080FEAE6A3A915E889B6A3C0BC9CB77C1B5D60B63

SMS_S xaswkz.rywqenik.xtwbqikvj

41DDD5C2A0E937EAA57F37D9F417538753E691D40616F8BD1C6ECFE29D480221

SMS_S hmyvk.epiawmbs.emgfujphqbtc

41E0589BB6CF9FA6E780164AC513D04F304D0804B14CF1700EA080E50E65E9B9

SMS_S ioh.kyweqfazxj.zwcqrjtagxi

41F47D8E51B48E015FC72EE1BEFB66CD880EDBE74E42E1047E3BC38EF680F142

SMS_S jsc.yvpsbxt.hzduf

41F48B081E63BB624B0EE0C7A048B155F85794 SMS_S xsjm.cnbeyrgp.tdbqulixyz

Page 160: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FB6A02C8641C8F17E3E0612E07

420C9957CB401B32B70D2713286849116FEB6E8804DF97E0D850B60C84C26715

SMS_S jwqhp.qdajuotszm.ptyjuhb

421A66B8C38B52DEF2B3D2E3BBAEF32DADB8C58C2EA9E22E1072105B660A919D

SMS_S jlqskr.vtxybi.ampvqdrzg

423CE2BDF79149DB18ACFF8EE8043727A674EBAF78ADEF51C1A592F8CADB816C

SMS_S jcnb.sozbvutlfr.foum

42524D5AF478B76F5FB72DC2CC3744C3D1AFA1E1152B0385B60AC766BBCE8E78

SMS_S isxukfv.vuewmsdl.dnsuefwcyi

4255705EC53E98108FEB20076BBFC3FD6296CBB076E8456C4732C5212159EC05

SMS_S cgoztwb.hgsjmqdfo.dkqnpwaxzo

4258BD9BF328813CCED85787BD4CF4A3BA7FB2350EB80B6821FEEE0F088C8EBC

SMS_S ujsp.hmvtaj.zwlmkcfxhe

428715E7977C9E0F49005192E4738C283A7D6F252F6D2D6A33E6C275DB1C371D

SMS_S jqv.nxwkrud.auolzqvkx

428D17C033FC336FC99957903A944F1E99F1EF94101226B69E96CED8DF0FC2A5

SMS_S hxt.bwsofcx.izetxlrmhbju

4293A14DDFF1D914E47EFD9921B192CFBBAEC09E9B92F2A92573BFEABE6D27D1

SMS_S rmlp.pfvdor.lvfcyxomtsgj

42A2DBF4AE2AE84D4C89A9A14D54246259126ADA2903CD8B1F7869474CCE4EC4

SMS_S uas.nuckdast.amrkf

42AA253F43E160758E492B9A866C23A763E2649C729D4D3A72BEB671A835E1C0

SMS_S oxc.pejsfm.vdhyln

42BA24BF5FC8F4317B03CB8675CED49F3052C46B1F2A0CB09881F1545A22CF3B

SMS_S vyjaqp.kcgsvw.daqmjernpy

42C27582EDFDF818693E77CFCADB543CFA260474838CE9A0040DD23125D33C5E

SMS_S yfaso.stkyhrip.rgkjntblfyh

42CADE3B844461F8DDD40A51F672E18342C406E0D7867D661B0D7B169940EA93

SMS_S qhbtx.fmgcprqbj.leumrn

42FA7EE05816EE5BE703C2F0D21D2521D9E51993154210EB8530E96DC60B8B5C

SMS_S cvka.kqlurjntga.qdoihcfnay

430844126BBFB3156550810F6835ED83662C21A77E2B6E84099E136DC894B298

SMS_S kxijym.mgvunxwdbk.kwhbq

4310C536CEE9FABB10D23D5493880DB79D302A074A5731261D44EB430ECA666A

SMS_S bwhid.hcfqnp.sygvca

43178C35C5D86AFF78AC194F2ED48285C7397F7FF68F17E1688F416D538161FF

SMS_S hunviz.odjuxt.lxhwbmranvg

43194BD34BC89BAAE4D98AB6A1B1176C585ED485E857EBCAFDC24B189D463B10

SMS_S oqsy.qgiumy.cpfianh

Page 161: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4324A9E601525DB0A864A5761FCBDA6EDBCFDAA978619795ACDC39AC3B790051

SMS_S wymglsa.ucbdtsnli.iauqjxepmb

4330362D8E3C79BE71870B65243D5BFEAB87A55E897176855B9AF3C26A8BDCF8

SMS_S kwie.unywcaeg.rjdftxavgso

43341698ABA648F7A932A0D61D8656C645C5537E653DA7B1E493EE56469907C5

SMS_S xrvhy.yajodcietf.brxuaghowt

4342D1CAD40B1A5BAA3CABF892838D15578FA74DEF00E18E9E454F5813473D10

SMS_S aptsvj.uhlfowebg.kmysjzfx

434BEC18590EC41F010CDBDFB40006C5348F11162714F1BD84B8AAEDBACF2F31

SMS_S pfrobvn.gtulzwc.ipsf

434CC1C45861DF58616C3CCAA0A577FEF4E77248BE1D2133B97B9D64B50C0F5C

SMS_S ikxoy.gdsrbcqkh.wlfgsxk

435932F6D926E3212FBC178C96B4AF4E858E7993902E1DCFC317B04569CBABB9

SMS_S wbxo.mgsaclxyq.nzphkmxjvce

4359C858044568ACBF62D3252367BC0003F7B8DF4AF7AABFA6F265476131CB8D

SMS_S pwymu.sqfwbxhpc.qdciyhaoutev

435D0CCCB6E5C4DD555CA3A98FDC07DBF0EBFFAB1C8D2696524053E8BD3416E5

SMS_S lchkmj.lvehfutxp.uzqhmypibt

43621ADEF52DD6619662F46A1A2214A9C32D41A40439DDF845ECC89D24949122

SMS_S kqfonp.zoewkpn.zrnbqawi

43688A5DA3C05E937950BB1E246395A61A0C63F0801709673D43C54D867F96FF

SMS_S efvtkrb.yremsc.ukczymqoi

438A067B97D6783D03BBAAAFC577CF0AF5595443C45376F542472034276BDFD5

SMS_S rbgoywm.bitfqakwzv.ynoivaechwsg

43D6EBAA4100F7FC27799C90C103B5495EFDCFE42FF198345F7B937A1DF2FD9F

SMS_S oxtujlg.gvhcpqjrwe.mwydnp

43E62B08F204865A2F3EC3464C3B6B8E41A9581460EAE8829B567AF485D04EC0

SMS_S nxdpml.nlbozar.jxmabgelc

440085E3AD39C8E353FD0E380971F9F81F240A4D210AC4142F035834DDE20283

SMS_S rtfpu.ipnjauym.vxljagzq

440498DFDBED74792D8536E16EF27C9B9848AE5009D2E350838C6FD20E12D209

SMS_S cfw.qfhbvkmweu.pclsi

4419A2343047468C7E8EE99E08BB0120EA4FA839282C4AB08D8AB7A539639679

SMS_S pjqmx.dpgqhcmw.ezph

442548D5D3793EA8CF274EEBBD4DEA4C4A3B7A0CEE7405FC9695341880A1D65B

SMS_S esjv.tzovjfedwq.aycv

442D2F0CC03A8EB7D0AA66FB4149BFD842C0864F3256FB91E7598F37E0D127EF

SMS_S yuvaep.pymxjbdsi.srdy

44547F72B8F645F178231E42177BA3EF414026 SMS_S xfbci.bltcpma.weiran

Page 162: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

84F8B3F0F8D9CCC93E61493468

4471409CB0DDA3E4EF82ED7C74B97077CBCF7C57A89AC821D6B0F16810FB1F22

SMS_S ejyndpa.dieanj.rmgkqebjn

447DC1DDC44496CF2CD01B88FDE8C1948C9D5042E5B6BC4FD53A5F5916A88234

SMS_S tslkq.kutbwz.ubhnpsmy

448C939138141A3CDED203E422F4AF9E79A2A52B95E150B43CB47E6B8B1F3DD9

SMS_S gvos.lcmnue.kdirmoachql

44A4B1195D8B42697DE18FBB20E3D1906E54063963B520DB5E7215EC3D10A35A

SMS_S hbcrtz.btovmk.igkcjbomyx

44AA93F579089D0EDA97ED87193827A2BA15AB0CDDB09C5627F704F4D586814E

SMS_S ubs.ofyzngbw.sokgvmwy

44AFAB4B3F6621B3EAB028F99D86ABEDDF55C72FA584BC9AA96C7BA07C11EA4E

SMS_S jgsi.aovfuzcngw.kcogu

44BEED8D830A4B87574384BD1538D2A4AC55261E8F700054ACE84B809B949210

SMS_S mag.hnvtrswcxp.bhxiarvotzn

44D7E2C3BA7A37FF33B2F5494174B0DEAD0330BCD20F608DEF9E99DF9505D9F9

SMS_S xkihs.fgiaen.mdjitrv

44E2C26ED5FCA07716C4110C10200248F40AD07ACF2499B24845CB36E3A622DD

SMS_S ntvpsfm.bhsytzqdu.fvtjbsc

44E3DE99F59A2B1F46B399C140BF79A709FB8C94AE9E1CA36C190EA9964CF507

SMS_S mxqk.hspncmie.yciwfshjxtv

45089539280CFA711C9FE5C9F2F210873F20B7F1CCC67E29D51940F3C0C7D004

SMS_S igwf.lripkgtnc.gcobzkrtiu

451B9EAE15F7BFA34090D35E56EC8F58749288C5DF180F8D9789A728BB1B097B

SMS_S zgp.zmbekxf.ijpakn

453A20CE34E60F85CBAA44DCA9119EDAB704FE6088F17DE5AC8CD2D2C05F62B7

SMS_S jzaik.npbiksju.xhnzcdmfge

45421EB822AC9275D22E08F18B8E4E692021251EB6005EEF31862BB11BECC0AB

SMS_S mwavjzc.mtuapz.dfqy

4559E8574EFDA499B012D012008F0804F8379B5B56D15D908868D8DA270C714E

SMS_S eba.fpzihbeuxl.ghmatpsqdl

456DE282FD9FA1B5C60BDE2ED067870EB4056FEB318DE1AD4BE0F573DD39847B

SMS_S yiwkf.otncwbx.xsbjewmiugk

45707B19E56A8210EF07A25EEBAB1CA71E2F7EA152A775EDBB617B5074EE098C

SMS_S qknmt.lzavjyeoi.sobkwmjctq

45AFD2727B19DDBF8F65405E58B723B4CCB74A17C9FFE1536C6A531744F1CB0F

SMS_S mhty.ghvlxm.tcogv

45B3C3A6C2B49D654D7C3E1EBB4897B17AD38DB4E530AFEFB265BDEA0711DA16

SMS_S ekuaj.agrmicsh.qrgc

Page 163: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

45C160758A4889DC9E51AEE00CCAA3CB645B4A817787C37D592182FB41E45FDA

SMS_S ekqu.sqdpivez.vbdkiecrw

45E4D15FF4BE5CBD03C0161E86E3A2041B3B1430B8703D384B5E3845743B3679

SMS_S vbgyn.exwlcfmd.hgvzory

45F0F5D07668BFF9E2BD8AC24B3C1AEB796B552D71F09862D658927EAD0FB7FC

SMS_S ydab.bfntvqjym.pcnbl

45F8F56FF60BD3237DDBFF37064F1C39541CDC3D8601A43677710D60D6BA8976

SMS_S gaf.dbhlrjckmp.vmwcxfuzpe

461057A6E8D6A82C7CE8BA9ECD787C09A280A9389DA9157CC88315228EC4236F

SMS_S dvky.dxyvoqhkl.zdgti

463F63ACB38075E6F8A21EB0500C01A005A998763E14177C2528325F50678F8A

SMS_S hyp.sntecugk.xkjzpq

464374FE63A437E5AB42CDC390C422002060F0B0F731EF1D39C1728DD47FD680

SMS_S mul.qjgielnp.uesomfzwtqg

46556612B095DF33BC270780685F97431F385BFB949B3B6B434BB91BE191372F

SMS_S xbhqupm.swhzbfiux.gksbihwlot

465A785900C3FEA852C99BAE0FF952E89BD48C74A886B8A3E73C1648168AB0D0

SMS_S vbldjf.apjyzobvs.bpeswomjylnr

467860819F01D6EDEBE3FDEAE965A63AC22180FFD7E742F5881694A378B752E1

SMS_S ctzg.clyixbjsoa.dqmiwr

46792C84D21DAEF8CB413D2AEAE5B7010527A00AE03F4F4FAD2FC2EF3F1DA8C7

SMS_S ejlhxog.gubdcarj.wmfoscugz

467B9E5349636B7D16EA30D4A0767CB749FD953026F05912D8AEF57A702C5CD4

SMS_S iuqshgk.fszpbxtou.ldygsn

467C1D96E1F5C668A4760F709722CF2C2EB7603AD65477BE3C828431BC6D6581

SMS_S ykfbxin.thlmjz.aebnifcwldq

4688F376FD4A9CCEEA0D988F472CDA46D29EA43E54211522B4683779DFF7D66C

SMS_S mzor.mgkunoqiaw.fxobuw

469064FC800DFAD020E7889E957014FE2ABD9CE95B991E303DCF3592AFB7299E

SMS_S mwvcrnu.tzpadeg.fsmqyli

469A2B5911F329B0FF89CFE4B4C868E2402D3C4634FC74EDF96D54A085859852

SMS_S cdbl.cwgnjfrm.tydjw

46A3F117D730DD8A966EDAB420C492CDCB0D5BD6B629BE184993D90C56F570DD

SMS_S hneqgs.skgthxayo.tmhpjr

46A90810BF0040491CB29372A796DBE93AE7BB30DDF0D530D7E833A75D5CF914

SMS_S nfa.qmpdsj.htjfgazwnq

46B02E3E9E664AC8489AF403A4523005FB7B41E4533A76EB089C69CF6E402924

SMS_S xftyrk.irktcjabm.zkvdjewp

46C6DAFB7976815D6C45C1CE6518A1B148FD8 SMS_S gwu.hixdmpusv.cakqmh

Page 164: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2C55E946D98071E5106DE240967

46C7095DA8A7C1F2DE1BEAF798B196B05DDD69838BD8A09E7ACE6725A97F53FD

SMS_S ksvh.lamwxkcf.yqolpk

46E2746EAFE8FEAEB0C8491CA3491AF925B340A8E61CD0C273E944AB2A12C5B0

SMS_S wqnt.ivnrpuaxw.rdoq

46EDFF071185E222A098247F4515DC640FD426B7B1077FDEB08D93786C039D90

SMS_S jxaht.mwystxfa.wfomzx

4701C3F1C3DD6E6D5ABC75985587C26D4A86C028DDAFE798785DEDF5E9116703

SMS_S fhwkp.npxwmy.ujysgtp

47072B636B34995EE0B1891713B1439E0BAA1A6720BF4EBAE305C61073812AD1

SMS_S slmwtah.awhecirx.krqmpeygcfz

471A879FF24F333E5CF18DE1C9E7086F4C81932D27611F1A612E4599BEBB2A6F

SMS_S ufqlmx.hpsteau.xrkhmzftgcqj

474881F89BA7E2773B84A56809C316531DBB977F30E69FFFDD47BD7A8AF4624E

SMS_S gcntksu.uvipjlenyc.xzgejqprhk

475D44463B6EA16E7DDD3584B9BAB9934FEF0858F81DDAB1B4DD808A882049FA

SMS_S ctku.enjzafhq.gdvca

4762D36C1C6662DC456BACDFC9B8CFF937058717BF343B077928088AA59D50EC

SMS_S gwek.gzncojfd.qwjlnzdeftxy

4774E7BC5167D5D902CC9AC7CFA3113A4C6CC6EA7E165300D303936E5FDBF985

SMS_S eun.fxhubype.zykrf

47807554D07674FC2BFA29E24E287E9D507E889263D864426E6DCFFDFE834251

SMS_S cgns.wbjcyx.zvkamd

47848B24FF429BDC1260F91308DEBCE5095EC194B357DBDCDC3304E985FF2D71

SMS_S kqxmbe.clqhibe.drgwscnukiq

47928535E613D4288ECA246E1052F65325F89433CDFDBB3F7CDAF9A3FFDF3032

SMS_S ixkdwy.pbdwtqma.iwbntzqcox

47C4652D44D076FD7091D2007BBEEDF95028F4520171319D710C342A041AFDA5

SMS_S svmgytj.mvgjcawdsl.ldebaty

47D720874203478DF85CF437DA84EE2A999BEF0BE498D29FB93CFB5C4C522D6D

SMS_S vzl.onwmvgyesh.yjaz

47D99BD81B0C534C6F0B751258DC3745F9E8A2F5C73B2242252BE110B616C713

SMS_S nptjek.jrvgbxuli.ylnz

47EEB2A8C7D353C952CAA09DEFE662EDCF4471CC92FACD07B5F77A1AAD93CA61

SMS_S ocw.ihqpzcbu.aiokehftbl

47FFD629366B30D840740A64EDAF45FBF1C3DA764F4740CBBE40E38164E9F6EE

SMS_S tgmkjn.zpltweksj.rzqn

4850FE4798D42CEF7E3CF4A4BA661169B13DCAE9AB64C7FB753DD07E8863B32F

SMS_S ajzycef.izwmgsfdto.jied

Page 165: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

485F03C191215770B8FA88E0F2C7096A2DA87DCBF478C6F70F1A0B81566E147E

SMS_S luh.zlhrkps.apbivdksljeu

486374D067422C6BAC48BECC4A936964CCA30935226068AA588A185999902DAE

SMS_S ckil.wzbiqmdjca.cimlzur

486AB5988C0CF9CB2AC208636A742483E0FE6F243DB6BCD7E53B3B0FDD107DEB

SMS_S uofc.dtvjwanp.bvnusorf

48775E5CEEAB14289ACFC1464637DD0A9F932C5BA8E8D258E58456E3C6B039DC

SMS_S zbdyoq.dspirl.dhfpox

4880191E8EA4BF5A059AA1E96F7B9E19FB6F443DF7836E8D5111391860A5C0E6

SMS_S aimv.pfjhdro.lzbv

489135AD88E8A13EC2E9F937713D4D2A7FAAAEF9245F6F95429DB1D252BD03ED

SMS_S jusfib.evfldpq.tifgjmnwq

4898E3EC451E63EC6D800AC70928590406B11D651C2032B905CD17D308490E36

SMS_S pwk.gkdivste.vuzjsm

489E3390D3913194B79152C37882DB9CCF3210AF5F4D8FC5EC3495000782C8F2

SMS_S qpd.saiqdf.zsxeyamh

48A16A7BC016895E42A877EE61F3A3E0DFEEBAF2C93996F5F46D5A348FE8788A

SMS_S kbs.aqilzupmrd.bxtk

48C671224A2A8DAEEEB3AE3ACAC62FF51A70377621470DC674B1467DA3ED9D85

SMS_S xzbn.enhdzoit.halrekwnco

48D4E9C04A89D5C030615D408DA93F0F04C39DCD0A28134304AAB21138C3B93F

SMS_S efslthm.mbetan.socgwzjmyd

48D9736B4335C8836C7395F570DC90450A66D3440FEBEFE95B8F829BE832809B

SMS_S igv.pzehlcvrs.lpjti

48E7F3007FE76D7E6B565B0114C560244403601936C3FB0240EDEE5552BE94B6

SMS_S iyzuk.dxupzjk.vdhnegrms

49108A377063A3C795759DF58C0D30FD999B3441DDDF458E881A7D188FE33B96

SMS_S bvxkms.eqwyklbdp.jlnu

491EE88C1D03BD6270C44077828AB3A1B7958F96CB8701166D732162F20C26CE

SMS_S bgycdu.oipxlw.itlpukhycbqa

4922130C66CF5C66A05861C86A4E528190749DECBA90F6AE7DBC16FEB3F476D5

SMS_S gknhryw.wzbrmas.zscbinomq

492394394BE7041A1FE9CF0B4B0407DC5F6F75F24523DEA4B67A2E783E2978A6

SMS_S rdczik.qbomka.ryutgp

492E012B698D9AC86B3BE618D58CC3DAECA15DC0CC64A43DE3DF6DC4D14D0D53

SMS_S zbgdj.usymrtfoc.rvodpahxsteq

49857AA3F4E49F5AF5365E031B5B2C0180E848547AA7CDF9CE7FDB76DA7DD3A8

SMS_S kqyjo.jogbcq.abyzcxv

49C232662BC45D333FC3BB518FEAB291D467C SMS_S brnqs.heoktm.rbatdvjeylm

Page 166: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

29F0BD00023D44628F007CBD938

49C7577F34127C31ECD1BC009DC662244BA89AFE4B88E701A40C9B55039CB3FC

SMS_S lhore.aegkrbuzh.vimekuhrpb

49CCC02621EDA73811ADFBC324F03E7BDB409736B2D19070BC3006C551048BE8

SMS_S vdhnibe.ugspfoim.vkfo

49D55153B0AF8927ABA1F02648406C1C09AB4F92F65EDBA3933AC6AAC5D5D138

SMS_S rdw.koigrpl.msaybxjfh

49F5ABBC404758B973C1DE827FAA1F2F61613CEE56A7463BCF572D9F921005DD

SMS_S bui.jbcudo.aftcyvdubkzo

4A0CF90CC3A14B41650B5D82348D8EB0482F6F3DDE7B2B140051FDCF27E3CDE3

SMS_S lnbs.xtkfbvdsr.jkixpdfwue

4A1AD30E96A99C236FE3A71C289DA3D5EE834EEA003FDC476D22613074834184

SMS_S ekh.uljngykr.ivdxrhteuq

4A27ACE23C4521734B92403D05FEED04AE12285C601AD0112F67FA7A21A72DB2

SMS_S shewi.jqyhosd.oirgtnkpqfbl

4A2825D40F371D36C39F1B48EA93CF575B6B08E5A937DE4694688E78D3E9379F

SMS_S fich.rebdtxjs.wrjclnvxd

4A42C368F43193C34FA25487D14BA70A3C49A5F52B4E5570184A7EAFCD0C205A

SMS_S bvo.htwuprl.dnswvekuyxl

4A5C7355B3EFE98FE936015040A6B434DDE00C3D22D09E3705970E23EB24D147

SMS_S anvjm.idaltvgqx.nwlsx

4A5E397290174906C0C3C0E9684D58FA3849D716A835B96DADA7B6137DFFE234

SMS_S gfolbr.deqaytfnc.rzpksqtb

4A7CB928B2806ADEB46FA6A5A5C193AC6C02498E5EBA5FAB61AA8223992B6E98

SMS_S tudnx.qsnlgczy.aovsxqmhzp

4A7F31C7B7404C7F0407015E63F9DD6953568E1D37CBB953BD151841B2DCC05B

SMS_S wgpo.hcaeoxsu.syanp

4A800038A201B2F0A57FE7A5DE124782BC6903E05A1FC4EAB957AD84CA0FC501

SMS_S yqzp.lgehmrtus.irqu

4AA9677D685BB2F6BE906E52B3690EBAC2EBBDF4DF877C8D719CF19916A1688F

SMS_S wkuma.qvfegymxb.vqjuwbxmltg

4AB0D4E12B2D38B3A3F1C86CA54CE52A24027FEE520CA797C4DD298F7706D7F7

SMS_S kadjuex.flxwhsb.jxoawpf

4ADC8F13F77678D429B35011D5A2E492D6242F176661BAE5E9AE0BED1847BAB0

SMS_S lvmgxdj.gdmiyc.szhkrwc

4AF4DCE7AAE94CC9CFA5705E2FE37B9BEC268659FA05C70A81D4FCA3A42AA4A3

SMS_S abgd.gmdraqwyfo.bzwpxu

4AF788E95562B00A1D795970D1A949E946D39CE510E4B3D6767714BCB10FB372

SMS_S any.wkuqlmihrs.ecrwhk

Page 167: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4B018AAB3E1DFED455C93CF455B14F3AF8D584EFC79F86F8BFEFBBF14E8AACC6

SMS_S zgnpvmk.aryndf.yqbidsezumvn

4B093F7B8C11A985F9D4509F3044262CA933FA6D6E236379EB6ABDC79F038D3D

SMS_S olyfc.jdubqvz.evulkoxiz

4B24E30F7732ADB16459AAD343859C5CEB19B29BEFE79315F5FD40CBDD7C188E

SMS_S ytjpb.hijrsxfgp.kehxqmn

4B29160F84E3ADB03ED541688B472A4DEF3FEE8B8FA405AC68D9CAB882BD9A24

SMS_S kyrmucw.ctfkrhzx.yperwnbclgoj

4B2D97C1F46013DF26E7D4275C174FF884E6BFC84EA2BAB5EE7F9381CEFA58E1

SMS_S qehst.hsvnwxkd.zlfhortiqvd

4B499B51670E877E67E6F711253310010D0A8B8A0F0257354EFE82A96CE656CC

SMS_S pdjuwbh.ofbrwcs.tbrksgndyil

4B5B7A351AA05D20E4A38FA039F0B176FC5AC7A1DFA44F4D6A18D7321C883DFA

SMS_S akcibe.qdxpatlb.kemxl

4B6CB32FF301353A1DE27390218AE60A248F60F9870065779A34140D1F8C6DD3

SMS_S vjxztiw.xvusjrlifn.itezmcga

4B80E6C5F4CC1A1A7F0FD54393CC78CBBD0F3A9F7657040E85A70FA69BA7838C

SMS_S xpgatb.nmsewqjdua.wukjlq

4B8292CDB54984949A8388DD663C22A1436FDB06D8AC8D7D8BCEE2DA9B976131

SMS_S vtdang.juszvq.teovrdnlyazs

4B834698292838A171EB756D0D50B81963A3D9FAE16585D37E7E949D2F635B15

SMS_S ceuik.fegbuynv.ayqu

4BC414D7E1605379DC23F82C56AC6B72C1DEACEFEE27F117FA47A6D08428B157

SMS_S uin.lhsijopq.wgismptu

4BC7EBAC0FA10D4743EC470F3475A6226B8A612665F6435BDED9B83DE2579650

SMS_S oyv.xqpowsef.ziyvmponbxu

4BE2435548C1A8ECC3E0AB658913D4BCF8A26C29901C04A47F2381FF3CE6D5EF

SMS_S drcgjk.yhfrtkga.svijwo

4BEA320D205ACE2730136F1D3E56D1005B4C994C29D1BA2A699A08F01F195951

SMS_S dhxkqrp.auhecrw.xniebvoupz

4C0EEC3ED9E6DD40AB47B40704C102AE52BB9C9397A791C724765596FF6D812D

SMS_S pvlktng.rcsvikd.dhcjxylpvb

4C2D757F7A0CA1249B5863E19D707BFF0720493C1076926046EA5FFAF690C3E2

SMS_S jprsmlv.osjmevpqf.wfqpird

4C51FF20F8EEFFF4DC6AA21FB98F7CE3B93D68FF7C970FC8D52559C0785852E1

SMS_S lzc.mawify.joivhkbenra

4C781EA4FCDD3341C830047B359A5A6753873808C25E7F5AAE0B0401A04928CD

SMS_S exhzoj.ozkqrxuea.znaxtcdgr

4C8902145DC168931C01662DD426D7F3D95CD SMS_S loenxmd.zlgbxcymow.ldaqujvfoip

Page 168: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8392452083C484134B36E646F7E

4C953041208A361544809AF895AF19038103BB95F16E7AB6F01CCD3AC4E26E90

SMS_S jdwfoyn.cewuyoizfd.xdfawp

4CA571ED99A3517C58AF702E387383DB78084673CCC3779C2E0AFA226C0A439E

SMS_S ghalo.bkvjao.byjatzqg

4CAFAF4A9DDF6AD151DCD69C0593DAFCCB87D7780D1EAADD1A8A3209FB654D55

SMS_S cojkusw.yebhgvc.tngqipbxmflo

4CB9F104BFD05CC105E2A96FED0AAA44F6606E62375204B43F38ABE414BB1927

SMS_S tcqyvn.guhxktb.ertwmyizplhd

4CC15DA2235A970DCD09E3F4C7C341B34CF153CE28E302C634B0F5846DC5321C

SMS_S ehmxyo.rvtwgd.gdhtoi

4CCE6CA03A68F8D8878B958CB7F0AA4AED7616E21AC1EA9078F81689783852C7

SMS_S pfmaoqh.kgoeibm.yrgnzsxi

4CCFDAA02B23EE872EDCD72D7B2CB5A66E747EF22AFF56992F31C95EC2EE288C

SMS_S swbmpit.xeqdomy.wjnc

4D242F0399636B2FEC31A590995E3F90D4DA7F4256E42FB1D2DFCAFF8ABDF9E7

SMS_S ohyua.znqmhbfsyl.jnvxc

4D2A2EB5329689C73A754C7A2104826BBA3B3998F87BB78FBC40B840C4594C13

SMS_S fqtjeas.yjagep.hjfbukawiedn

4D3BD23ED50DC017061550C3B135356AF3F6DD1A6CB43F8766549AB93DF39CEB

SMS_S bmsogt.letscarx.ltzdfacpy

4D50F13BC819633FCA7BD3F1407876E4549398CE9C3B00316E8D0DD0CD4A0401

SMS_S pobmsi.tcealpmnx.wnrchsxo

4D6923575F68713A13DA3D21B26C93BFFBECA8869B39DE9211544687AE58A605

SMS_S kjxcov.upjiatoly.vujtqgxmln

4D741F7D614990821311AD4C406FA983D9C2FF9A098FD0E12C3254D0EAA1311F

SMS_S jryd.mulenjkdys.cxqvtahjwk

4D76400DFBBC0DF30598550CB443B8031DF9F7F37E7D4A8BD5C6004FB9987050

SMS_S xor.kdorcguyh.osmtqvh

4D825C580548B21C158E34677266DAD46DF38D3ACEA8FCCAAA58C738CC76B5D2

SMS_S osmltkh.ikhjgxl.tgnywfz

4D84115D53DDFCAE0F0747582E0DF8CF27FEFEB89038D0F127A51A93F6522C18

SMS_S rmdxfzb.qkarifz.etydfinqkabr

4DA32F1BECC5255E1712A7C3779990A2553914E2D3F1169D8945A0B9B5F14F9F

SMS_S fius.kifszyvnm.osyjewzxvc

4DBD32E3E32AAAB834DD5371F186A4BBE0776CE7985A7793D379B200D25C6383

SMS_S ybw.hplfwzao.plarguhjdm

4DC41AE2CC12BC2C950FF0319BD5901F71FD05AC976DABAE1819B6CF4D5CA03E

SMS_S mkctgw.zmealjy.gzotijxvw

Page 169: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4DE65C84521F3B8EAB32A4434CD3C5A276483041C3D2DBC4446D94723C84AAE6

SMS_S dhms.wrtqsi.gxhkzeqpbij

4DE73C29B91E87265092FCEB14FA69130AFD068513C276D42A84E8345F2FC296

SMS_S arbles.iknfyzbjg.kgesxypqanb

4DE7BFC546CD331A951E1B5819657A56D763CB057782FF97D6841EA3DFD21731

SMS_S npqyt.mciyhbdua.jvmzwedg

4DF8C8B28AD78198814C9565CC1B004C66CBF49C6382028A4D93EF61FC068DDA

SMS_S rmkzilv.fdlekqc.deqbfsavjknp

4E22F308A24D6FD97CFF7DFA281B7C843475270E77C260E0E934425CA1C0DFE9

SMS_S muhnb.bmnrfopcv.tfdwkpvxn

4E26476DC5ADCFC11624AB5C662C6D37E6CA845FE0129793AEF1C602DE9C81B3

SMS_S jofqyt.bizxce.njdab

4E2E56DFAE31173E63BBF474F11788BD6D94E31B7A9FB2B84CAB2104477D45A1

SMS_S nrpwiyb.yseidotrh.zfaeypovbmks

4E48E7D8F1FA9D18009097056B8F723FAF32FC65F99A030073A55D96E352C9B7

SMS_S odu.orlkuz.ploishcdtnb

4E585E30B6C9E5697BEE0F27BF5413DD52C1893F9B9B4C92C59D1F38A3F126F8

SMS_S yxbs.vkaexdtyb.ljcwhnfr

4E6C02E8F35B8DD14C6C8382701DDDAEAC0EE6C17B80941A1A078B7CFC8F2B9C

SMS_S klxzhbo.dmpcvzlra.brneja

4E6C0988E2397B029013F2FB95FA56CF2B8C279493849EC7830CBC733850CE41

SMS_S sraptw.gujfxon.ncglrdzw

4E9B3F9DC939987E0483A56064462C89C34862758815EF3629C0308389F62580

SMS_S xzwek.deuiprx.atmsbi

4EBF661040BF03EBAC8D70414360B32A7992D520BAFEC7147AC808E4DEC2AC79

SMS_S tblpcs.qfjyuvo.tngpwxqo

4EC89436D8C2B68C6921645A0091EA15BC930E6A3E3ADCACD8A3145DD5A31B6A

SMS_S udxzoj.krjihdfy.cdaj

4EC8DC487CA0A4B23CE396E487941C17A559E8E505B04CA504DEDA4DAB974473

SMS_S mna.mjrszpkyqh.qarefnh

4ECBC10B910CBA65D9E6735269E90C2343DF9C590F5B7A16BC927F5D186CD772

SMS_S oirh.jxrzgbpqs.iens

4ED0E71181892AF2AD837C5EEDAFFD970F1B9E7FEDB747AA7AB892C350F35BEF

SMS_S quenz.ezsnal.tweivzk

4EE638335BFC28E0573550877E21EE83CF9EE8A2C2F745C73655873233790D3E

SMS_S dbn.edahij.spvxg

4F1EBE48271F348EB4143EB4DD0E133E283D99E61E7EB52FD93A5FC1493EA60A

SMS_S zaiwlj.izjuolkgb.xaptqrigmc

4F433A11B34D7FEA9B8B5008BCB1EC63BA16C SMS_S etzxscf.fztbcxu.bhmftxzsqre

Page 170: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E266C2022C23BBDBF58C91D1430

4F5E89F1646B999BF84C3746A4F0CD9A0EAB84A2D26F214495F609A3249E0882

SMS_S lxtmp.hqrpbntuca.epqlxduicgj

4F9C0728F9BB6248EFDFD487839CA977E010A507B7A4D75249F220D618800C92

SMS_S got.detgncyhi.aclvnrukbjgw

4FABC85FF2082AF8E482E0784DD54E76380D234E9F8149981E1E07BE74B05117

SMS_S tmfih.vjhyiw.tvyalkpmbuj

4FCB9B82D3A8A91A9AAA359C8F7CFE58D7724C05124A5AB93B39EDE9ADEEAA73

SMS_S nxtyfwq.ptdcfmaslx.frngvmsubz

4FE88C10908E5FC07A3532828AC6BA7CDC1973259A970DE635BE914A9C5C3FC2

SMS_S zrxfte.ovftwidxkm.dabnxqryl

4FF24B2F4A2917DE8D0C00B863028E30B8C5F0DBB17ECC60CDE402A0BF3ACE9B

SMS_S frhade.izasgoej.vcbwahde

5005C6C0B9ED28F400257426C69842757338E685EEC1C03D8E73E7E97186DF68

SMS_S bvsadkj.fibnljmog.kcgd

5020EAD1BC8DF2D6BF795E453D4956880F2AEEE16AB79683BD3B6F53794BB32F

SMS_S mprultj.acoezindl.emquan

5065F192E638499974B9F557ED7CF3E6B2D3DC3A60F534720185AA59F1C704DB

SMS_S grfekp.fpwenoc.zehvsu

5070684927C6456B1A3BEADC34F9A1E7A1787B27AF14272818CD146CA2505C1F

SMS_S exuno.kdqepbilo.bakpdoiqh

507345F06BA733D9F2E0FB4A71AA17849EB61F2C88651F854C63A5C42A0CD9AB

SMS_S mto.dovbazprf.dzbcusj

5074891FF955CC800605CCF34BA6221F7F07651DEAC1F6156EB5114BE7C0B214

SMS_S kpyl.jgfiwsc.xgplmizvdhob

50CDBDFFF91E9D416EB1B44FF3186B4177DCB916D2D9288B9649562C1AA05A45

SMS_S wps.cwvglefy.eudwv

50D70507778AB560FF4B15E6B69B7E5DB19992A58DC14F435936EAD7A342435C

SMS_S znbxph.gqwozxpaf.dbnse

50DE856EF178E3A7C82BEACA7A7572FB4660099E112491C50A379678F6B3F01E

SMS_S tyuxgh.wulyof.fanvh

50E1BE8276CB30509903D15624501CD85434FC31DF2C6D1F7755F0F61AC6A33A

SMS_S oekhal.zqxsluwh.yvfjbzhpt

51188D7A4A6E65EE02ABA0CC5B0DC923D8371B423B56A859D8B978141A595D77

SMS_S xdnwsc.rdfxqvkwn.dftaomy

51272C465AF4F8B2FB1B0C146DC3FD0484224CFB17ECCD7CD10BC82E3B5609CD

SMS_S kzsu.xhdlrjkot.bqvsem

5129431C7C0B1CFBE53CB3DB94DD93881B47F8DC6A80734535E2B15E1E2321F6

SMS_S zsrl.jmtdvi.buyhaf

Page 171: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

513141BAE5759F6091B3CF6708156E52629633ABE459B536E480DD8F33BCC9BE

SMS_S xlruaj.zxhjekam.tlmowfai

5132146171A5745FC2E22C51DE434E23D590D3E6D7CBC5EAB99FB35CB14E4BF2

SMS_S unt.kneoudptir.wjycboz

5133EDF66D4C114E612C2B532EEA5CC9E427CA001B42DE6D62A1B0D0A2D83E78

SMS_S iotpcxg.ixjrlypewn.rzobdwyfmqct

514C63EBEC7C03D892672FC7381F69E3E82D8FABA772FB71E47D93D5AC7BEAC8

SMS_S ublazn.glbjvfed.mnpbovgc

5153464F85501034917CD378E4C812A1D0DED96F9AC88A9AE8C52985C8CE88A1

SMS_S zlaqh.vsacbuh.ycxqt

51589C9ACF423D6ABC45B28B80C8DEC117214A364D119B01C5382773545661F6

SMS_S zfmkr.qmephfrzyv.dcgo

515C2961EC4571F14822811B8BB4F2F0281D1864F8490E6E804EA61C9682A6B0

SMS_S vtlg.aifzcdpbhu.dwgobqae

515F1001F009979481133F73339B99E6B50146F45691B213D92358992F356B22

SMS_S kdipfh.qgvdkxru.cougyfhjkpti

516E2C3E51A0046CBCDDF35C702F4D5DC79FBA3291E134F70FB811AA1CF5DB5B

SMS_S dzqvj.driubpcng.wconvredas

5175151D6AE4CBF0235F6EC8FD24DC1E4113D01BA6D3AF53AC644B8AA4BF89C5

SMS_S dcbj.fpsqijbdx.gjyvhzcwx

51773F20E558F27484D160D101D869794D963DB46B5F066A0472B12D215273DB

SMS_S pdkix.mcfjakgry.hdqjpix

51A01C4EF2B37F9A0F29E725948CEB317BA88D776EBC7F44F4D4E311BED5B7AE

SMS_S nhvkqiw.uvghqwb.aunpbe

51BDC4C3ED04D807A5E39ED15F00FD83DF5D526FCA0C278AD319D38E9AF19578

SMS_S uar.yegcrla.evdxsftzq

51CCFE543BEE1F0EA286DB407713FE1D371EF3E202AEF850C5DB31FF1C7EB89E

SMS_S rnm.owxadkznp.gpfdnqi

51E13D1F661ED82EB69C5EB2EA12493C05C0BCA5B95076886E7182FF258F551F

SMS_S zaf.jxnuecg.qepnaumcv

51E3071A7B7ABD60E29AA8F92EB12A9628B37897111B7E709FB6DC8043FE7A1B

SMS_S tnkgfjx.zsgxwfoepn.pmoukjqg

51EFC542B27FA8A1A2EDCC4254CEB3EC05B0C5BA90E9EBBB51F128FF2302FC00

SMS_S yegbfiv.ypslvda.gzbhnmrs

52078DF61167F1C1C6C354CB47DB80A06BF638E1EC5C2BE7279497100F52D57F

SMS_S tnm.wtyhlgpki.sjqe

520A2D8E0D033B2553A29B2B1F2C86D0C765B6536E018C37A648AC83BBBA50CA

SMS_S xlogdbz.mrdske.dnquxtb

52214FC036C832A78D42706E7F5F8DBD7E9FA SMS_S eil.udrqok.oxqtranpulj

Page 172: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

967FFE490FE5D3F0B61C42AEF90

5221EA3147FDC5B1208D251136D57B7F0A1082B82330956A89D77B22151F70D0

SMS_S eyhxq.xjdqokcyw.hpaviy

5240A5DF274A6D44A629FFAF2EEB0EE66ABE430CF09CE8D484ED22B268B692AB

SMS_S zvi.jlohqnr.chlwgsmr

5253B2B2BD007F507AADBC289AB7E8E50E901B027A7D197F8903DB63F8B23554

SMS_S sqro.oivlkuej.egok

526422F87308A555CF0B49E48B3F9F19C1BAE5951A79ADB63EFE8E9DF3C9B75C

SMS_S fzyn.oszuytixrl.jyvlp

52713A6968A2BE68FB7FB958D7742585DECEEFBC62D9F7F88F5DC789E63257FF

SMS_S guzlvwk.pczigjyed.jexmzknpyba

52721CAD002AC744016BD94289E80508E3CD95B6172F604F02F85C432A07B55C

SMS_S omejyr.wxtaif.tqniuejkh

527E8FED743688667AB26A4F4EA8904AB2E085D4848C0D85631020BEA4D297B6

SMS_S dwsfhic.oykqmwtpe.ykpml

5284BE406BFA5F659559D0AB94D5CE8210F0CB76F45652C04386EAE3E36DE920

SMS_S itzgxrs.zpejdmslx.fcptmordkqw

529DDCF3669E71C229FAE4CB34719468F6DF1286C2E8C5ADC046FF42289D1A04

SMS_S yrjz.iadnboulgy.sxjdzruhf

52A5DDA164CD095DB6906910DED5E2F431541B6F4EE0343C8E866A1DE91D0EBF

SMS_S zngycv.cpmlbk.jvxoktdefwr

52A7D03DCCD42E4DC67936412213418504C6E79764E3FAE4B4A236C32E2B663F

SMS_S ichzuw.oqiuasrbmh.kfetnulor

52B8A1A5F032D9FE059EBF7C6243C2F17BD2512E49F68F172DFFA56870C02B7D

SMS_S bpioj.ejkhmidr.fpmsgr

52D2434A93EF4445C4EE6D379E2AB269DBF6385D21CAA7495742B8F55E7541CD

SMS_S sew.esharfiqj.rzunqwfepji

52E04FBE25197D7E06BFB240159AD76EE780DCD51AFA76734BBA7A1D9C949864

SMS_S gcw.dsoarkmyu.irvfwthxbp

52F885F66EA6E52587CF8336D394E8CF3A73DAA9663120789565738863BC69CC

SMS_S jlfztc.kjlsbhi.dwczng

52F9A8A72FF5DE22A377FF43090B3802395B2CBEA4E62249810D5178A4DAEBC0

SMS_S toqye.gxwldzo.mvnqy

53164FFD75D095E0F3D83CF8D584F4C6477D0061D5382D7287FCC580EBEC0490

SMS_S utb.snumibp.sjngvbzqoymr

532121CC837AD680C1ECEF5FD6D5E32D63EDC32628FB56D4408D4A0F3F39CF1B

SMS_S qlyvft.bnxeaft.nalirhfwsokq

5328F68FB30D302C7C62910DD69E612F2EC70328DD61E30AD3561BAAF3687186

SMS_S qcm.svrjzwc.pmkcvwtqrgi

Page 173: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

534529D3CB1AB8D7F99BEC2AEDE0B9052E1E26A568D906C50D263CFA25C95D46

SMS_S uezldba.yvnxzbto.govblpzyt

536F450EDE0C11AD8E55A8BCE57B408FEC2CFE57F19DB78E98B889C0FF4D87B6

SMS_S ztgm.ugfohea.ielqk

5372E94F7CA87369DE6A5BA0F974EC78467D23C7359F5CB0EA8F3C0C330FFFD4

SMS_S ztv.anpwizc.wdpzynjl

5380A35EC4B8206CD7B800F4CACB7A1722A4FEBEF74B517DD4A0F73E6909CE96

SMS_S ztil.rztdfawy.qnsgrpvke

538D490D608DE360944878DF0F1230B3F99EC31B574E8301456447DAB6151813

SMS_S gum.vjktxfmwh.nubgr

5391818BF1959245977A4FAD636F5BBA72DBB53C9A2C8F7F0BED6F1E9431D40A

SMS_S fnx.hpgsdt.sfakltmqy

53964B276E77BF1559BDF94D059745DB0653D883BCC4EA465B9974121B6E5BAA

SMS_S evgzn.hvanplxj.dygvbwforput

53BA92126D21615636885633278F148B69BBF2F88815AAACE852DC2A026967EA

SMS_S ejrcgf.yliksju.eamxusplbfq

53C399007E22C99869705A84A0EE477E8421B33270BD6D3E5850E90D478AED17

SMS_S fhp.hvydagf.iphoj

53E33311B72C4B5A455F4760D8355579850BFD1AE17CD9965545006395215EAF

SMS_S gemjqn.rnqzakhmw.daikut

53ED1FE88D0F777861FB55B8E36F403ADA3A54F2E2D9AE388642364AA9080C84

SMS_S lnufgbe.uiqfjm.verwh

5406C05665605BA134B4108B3FDECC40DE3E7926618CB393324B4AC22BA2C45C

SMS_S gcse.gkzsevj.fnahixqm

54294049ADBC1D070C69B18D7A26712A2CF82C257516BD87A58CF11D2C569A7A

SMS_S slvjf.yotgbah.lwtv

54333596A817839BDF8A19F8B2D008A950E1780A569FEF24BEA58AD3EAE2E314

SMS_S hawbyx.pngthjbfq.hectagryw

5441ABA8AD0E8B906ECDA3ECC263CF1D8A0CF021FDEFED2A538DC24C31120495

SMS_S tolni.pmwgjlo.kdwcmrpjasny

544F9B8290133E72D8B2C29C04B101CF07106C3A6A1D8D059BF91C7A746D3E36

SMS_S yax.aflgwci.pafxsnv

544FCD6643BDC52176AAEECE447971880BAABF517F6B89721E0F6C6349DDA1C9

SMS_S ntvh.zqfobpj.tjzedywpmbr

54544ED9B9C0AD7806CB8F9114F4130DF915313743839C87A28DA9B7EF5C9623

SMS_S vyreubz.cboaprjdiq.blhaei

545693AABBE543074EBC5E5FD46C9692F1E1AC69C5416302B97BF826EF606ED9

SMS_S ucmpxfb.lcjzpwbft.taqh

545B3511EAF58F0A2109D37F3657094061FCE9 SMS_S uehg.obfmchx.wbroqinh

Page 174: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

10A8D8BB1665C5AD1B9E81EE68

546936C3708006CD62EF4A52E94D9DA57E3A275F87432A35409AAC19E298D93B

SMS_S fci.grtjlyzde.bpxvsl

54769B03C72AC5DF33EA0DFAA6A39BEA222D812D15F68C4FACFA19AF88B0EE32

SMS_S vytd.imtakfwxor.vgosayik

547FAA140C421A2696012CFAAAB268B73DDCF1662FCFFBB3925C4636C35EA536

SMS_S uelwi.gahpqyt.qenwitlkpsd

5487E98E03B01039456A40B33DAF965C51498F1E6CD09506D5A700001864639C

SMS_S tnzhp.ucbikweto.smbrxyih

54B53B641D2627C0220AF7EEB83CD13FCB19D94282709C6A06B5D663E72EBC7E

SMS_S dxso.tynfocbe.slufm

54B7A7DFAD7C3562BF15C59668C02945DED608D12CDD1C18B711E5B5F0C69E64

SMS_S xszlb.ejqtsk.amwiteuf

54C00AE7AF55D3716012B1E3D1C0F84B4FEF11F1E4D01D31D40C491819F3FD6D

SMS_S peyqwim.xyeqlon.ctqunaveblxo

54C9B348A12D0F39CA65DE9165E3554CC6CF29642B33DC6BA374C430FC56D391

SMS_S oed.nqmucp.forsedz

54D2DFDD07102F711075C9949AC29D73CB7BA94B7F2517D779CD88B705181A3C

SMS_S zho.rwpzdibuf.bxjiuerz

54D3EA77343F9D8D31C958B1F0AE254659DEDDBD9BFF4873443B9C1717E7B863

SMS_S nut.rghijxl.yltwbk

54E26BE33E313C1F5297290FED52CDBDCF5ECDD8154A11D7F5B965B9403AFEE6

SMS_S koalef.zteqcjowpd.fbvh

54E324C90682E0F71AEDA03F11BC84BD682A92C93DE5533E613ED4565C2B4534

SMS_S plakm.canehk.pcbuzw

54F1D8F54178B953DEDF95F3EEF5B95C2E790D32C3B562AA40473BC0D2ACA819

SMS_S rcts.fnpeszqdj.vbnweghl

54F3777E55F547824652D89AB6DE4FC8A7AF77DE9C5FD4CB9563E61686466D79

SMS_S jsglrn.ugxdernb.igpmjavco

550BF64706D0D2D496C44A193801B8E7013A6908CBB41F19066F448D8BBF6760

SMS_S xmitc.otewcxdqfv.txmlqa

55225D714563B2F6A268EB616866AC54E4F9AFA3E6F8992151BEE9519D9AD113

SMS_S xgwv.xohsmiaft.fkzcj

5538A4DF71299E50593480EDEB5122742B1A76F86F375A280CDC121172FE7CFF

SMS_S cbxvy.pxuzrljb.ndjacvpbo

5538EB6F1A2CD2D36E160BFAA482F83F43E40ACD3D39CD63E6403C370EB5B281

SMS_S vfupcgs.xemobadsg.yfzilde

555AAB1AFA7F8A63A7D9CA0F93E93435AA9238A2611DA5E5BB47C09E29FD0493

SMS_S ognkrmv.qicpdwrkj.kzubagwhvyqc

Page 175: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

555BEBE6E15557BFBBD49770544FA9CC9AB3E84AF912921D8CB24D82A51095B6

SMS_S vlr.oycvpl.qtgieyx

557AF28C49F8D6B356FEB7F47230398CF763FB3572F740EB129C8347E9394F71

SMS_S zdn.gouvqprskx.tlnsbkh

55857A14656530D67F1CB3E3E24F5EF5A34735E06216C1B9082A5B70D2F541AB

SMS_S npevmfg.pxafqtdbm.mzapetqodf

55AEE1575165BEF7614385054657B769DC4644A512CBA769950469F3A5959167

SMS_S lwvj.bfopmzkhxy.yhcq

55AF78C956F863A03E2D813D41450E1FD0A650EEF3A2F7A1AE42158A1B47F39D

SMS_S qmjg.enbufxw.gmsr

55B3C33A9C7A76CA4430939D1800F57640EE410B7AAE6BFC852A3955FD8E4363

SMS_S lrf.wabgipnmj.poyqj

55C1E43ECDCA2E7B90AFBC62859992D42B867180A2D12C7BCB0B7E0B30FFD095

SMS_S yjnzr.kopyeglaf.qbzdnac

55C687512568D6D2DEA27EB97EB7778676A9F2FFD8DDD789B3A724E942233C63

SMS_S dmfisq.qzmjcith.cfeuzxl

55C8C85DD8C59470AA3F44118D4F2B6EB4E4C16ACFCFB9483513FECC59058EAB

SMS_S ojyd.yqvahdebum.decuqvnmitoa

55D5FC55A108F353EC6A7D59713D3E56DF1CBA77E2C8279DB6DEFB014E078C22

SMS_S lkwegc.gasijzlxd.yijs

55D70BCCB84943A67A92298756007C1F14DD7CAE16E844B130D027DBF940A5EA

SMS_S iqj.qngbsud.baomh

55DB3CF289B1152EB512AC66B6F6D6453FD0372202C05140E711BC53522823E1

SMS_S vcfuw.faiydxzlnk.pdgtriaefkc

55DC6C1AA1E78AA0545EA1AB2DB1B657D3F32824EFCE34FB2AF86EE4A9E46E57

SMS_S msgl.lahsvmg.arezw

55E37DC0FDF2E75D680E1CEDF1DA8A33D92ABE2EB9E67457324AEBE23991A60C

SMS_S rhildt.vnudyc.szdm

560C67C754DB68EA9F1FC5759A1606012E060A1098811C2942E0094E9D61DA97

SMS_S cmpjv.lcrhntvfbu.fjdwhubgpr

5614D7F13847ACAD8B00C111C7269109D91CE902E90DBAB92AE5E88D6E5D0EBA

SMS_S wafeik.gmhbkya.shuofmgnbpyr

5616A3D022A769F2BE1805E018D5FA9AF46B5842D7335393126D43B3EACBB6D4

SMS_S jfycul.cavdrtslnm.mquksty

5625D24B8889C4BE1A0D2A3CB3A326386C0105F4AAC6C8E35FF26C1F4BD2F197

SMS_S pfdavz.engfvoyhak.lmhoxcsivz

563DF2A5BF6B7B3F16E99E3B745E21D0AAC6A918B69F7BAB7E9234E5025FD9A9

SMS_S mhgd.mdovcn.tkqazynvbjhi

5678B9BF24EECCD0DD7DAC225FB866EA046D SMS_S wsbmli.ndjoqzhuic.thawisq

Page 176: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

ADCEF4C963F0102988A57C2B74FE

567CE668BC3E47067060036DF0ADE51D969299506FCEDE55909A1281114FEB05

SMS_S lwaxvrb.opbkwh.rgmvwnu

56B0E4D753AC8CCD9F580D9AE9D9A7ECDC155294ABE8E370823C6833712EFA66

SMS_S tdpo.ketcmahr.dsrohzvwcnl

56C949F82641D6ED0B9A4C07D1DE49EC12AFE47CEF2C718F4D469AF990919829

SMS_S lnuf.uzxdqo.itfjbpao

56CD960E1178FB80F9ED7EEFFC9AB9B923ED1DB114D267E093BABD063FA60D31

SMS_S njgvtoe.ycjehkxzog.goanzjreycsb

56CEAC68AFCDBC10A295A1C6889A1679020053668B205DFC7A17C62563BC2B78

SMS_S tqnmgra.hwkemslxia.lrunsf

56E28D3319EC953E681268BEC8629AAB019F5AA11FDD9CA9F84B0D70FB7FACE4

SMS_S orbmgk.gzismebu.owxrkinbjem

56E3510F3138294C5818EA6F845196633E678563DF62E0BC59082F89B6A24ED3

SMS_S mheikr.jcmuai.iomsvtc

56EAC7F1DB8F7051C6D05FA315208CF7815F5D8E3356335600775BB0BDF6D66A

SMS_S utahifo.dilouwp.aonwivyqmdk

5711143C69AB115202A6A3EA7457D47FC1D0938FE0E923C9F3E8B696648E304E

SMS_S xflgz.bzafxkjl.vsxn

571F00F76F3F4633872F691EF204EF72622C2C232A688A61CAB961744FB617BB

SMS_S fkl.yjmnvt.mowcznvbde

5720CD31BA55AECCF7210FE645E56C683C729679C89199212A3EA92D9848DEBF

SMS_S itplb.ycpsjxh.etuplf

574C75EC5AF6F820DA2E442D6FA463CA41BE5D4C35AA1A9D98E3B9E26331FD70

SMS_S uyberm.okvwuydhna.nrvfcaxy

5753FADBDB6ACCC31457F1FCEDF7EB989861743C01DA0DF8A3D39D1BA1F915EA

SMS_S wivy.tedkmo.csdobukzjwa

5754DF3A646DF350BC4FFA2935674D2E65582CB92BF8C5E5AE67BB7433858FCB

SMS_S dflhn.yhogxtr.utzvekycrda

578610E7356BA794FA04639A8F638B26EAFF052F003C8CD83880B6D9AC8E0713

SMS_S ckmeiz.zgqjvmoki.tqinxgj

578B4FF7144D53CC835D0044B61B9DD61DD7097FA54EB824EC611F813A44B0AE

SMS_S pslaj.hvcgtb.qjri

57942AD5CB2AB8CF00D876CCEB4B3810EACF055DD4AA1B154A605AF54CEAE7A4

SMS_S mvnf.tqkswfcvj.hsljk

579F4CD9E73F69AE9137DF978E5B180E32735BD194D0672263646FACE9ED0F45

SMS_S ijhy.cvpoutjd.lhzeisoy

57A392F1E2EC3E2061AFB8C33AE1FC5462AB9AC5E0E7E26BE3BF2B280DFB8E7E

SMS_S hbd.qwdefrzy.oafyc

Page 177: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

57B96218F97BEEDADF2DD1FA05A73213B941BF101B1460A3B42AA0F04471BBAC

SMS_S fvq.smnpjoclfv.lbgapceudm

57C07BFA2CB3068C4652D62F7D9CC984DB91B1276C82FAA2D37325C189DC9832

SMS_S tsja.kwsjdmp.brfsw

57F034C5DCCEB30EAEE41BD4EF74CF0D8CBA9E7D4527D29EC66E54BA87331836

SMS_S vjodtsp.ezgnjmuypb.jmktuwpvoehs

57F28DA3F580004408BBBBF066A5CBF3D560FD3DE05B88FC37D0890DD347D8C8

SMS_S kmfgrx.ojwmclkpu.vtzcb

57FEF07B16602678E54B9E3E324C8FA0B3103F83790B9DB46597B21B978AC131

SMS_S clfix.zufclbp.isht

580064844DC920B9F03F2EB457F0A8482ECEE7AAA94BC3E3B519753C412D3220

SMS_S wfikmq.niwtlcf.ngaqr

58317FDAB2F67D1BE14F62E7131EAD3DE5B00EE45D1F4316D8FA19F266770C17

SMS_S mqtp.lycjusi.zvypothbacmk

584A3F8C73CCD8391A54CD969D97B7C2C10A2C644E477E421C4270516BF30EB7

SMS_S zbinxtc.ruivpme.miquo

586B49CA920D7497D5CB8B491E58CDECDFEFEEBF1B47C6E68C0F1C5B2B9CB519

SMS_S jrzigwk.iqfnlgd.bjgyuvor

587CF5A03FEB7B84410EA462B6C2C6C6C9F515BBF91ED56C1A545A6A28C48DBA

SMS_S rukejbd.wpdckxhl.kmyr

58908AAA7556BACDF1C9324D3AED2FB25CBB28C28471D62995171CFC11E10AFD

SMS_S nmzel.bfhploq.fhny

58B73A90C3C9C9E6F7E1554D045F22E3F6417C059A0FAC05798650B8509B7903

SMS_S ujlmi.qgumitvxdk.txkgelmao

58D951DC06ED643FCB082BEF067C05A0FB0BBCBFB870DE3E0D63321C480ABC26

SMS_S jmq.xfhpcrvjq.djbqpm

58E2B0489A73A4A147B0636B8BC1F3D9C8CCB4C6C6D665831F27B384FABE161F

SMS_S nqj.upkist.mkfwagb

58EA8C06C2BF123F15A93C7EC74D0E3E069532E5669E8CA11A3ACBF4A50CFD32

SMS_S nli.fptknbosde.ezyp

58FBCBE8C189B826AB4F1688FA7DCABE31A0618DF78B79B4E06EDE02886670DF

SMS_S soka.bxipjh.zkdhsyugc

5901055328ED6AE96760A7452CCAC2B3B76F529A7C55FBCD2F2C4F6A317C9903

SMS_S svmzg.bodykja.naiufgkhxrzp

5905E460046D67AB55A705EA5D8E8D41DDB04DD1A224AC79BE3F8C61BFDFD7FB

SMS_S crxl.uomtqydl.zyuragi

59248E90C11446484713689D707BB2BBC2F9994128C6268C757DEC3791A6E810

SMS_S uqtnvig.uqodth.eupxyhrafl

59272F9E3169BE9CDE528DB30E9671DF25D36 SMS_S voyglc.icyulnqr.vmjntyzkhwr

Page 178: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2573A43BDF3418AB5FD1DAC2445

593B9DA0A3CB35740FC159F2B861A8C07E4FFC4524DAE2119D3EC519DBD21452

SMS_S sjbko.yaplqxt.crnqo

593BECFA276AA7D985173C85C771353B47CDCCD1D16C225CB8D09888705CF7AF

SMS_S fsmrvhl.rqfyhgw.hilundpvjoe

593EC4E6996620F0AAB464ED01A966370C8E0405443A077302698494FD12FCB1

SMS_S ktcqro.gastjphmv.hyjamlofk

596EEBF41D9A49F0A04CBC628C8AA990A4A155B72521068BA8D4F72500FAC1BF

SMS_S iuxta.gklzuctoi.nzekgofxcbw

5973104CABB19E37F3B70F5FDAD808926A9B7A22FAAB7EB82702A23186247D2B

SMS_S oveajb.msguonx.gimapez

599630EFBC0D43C67BD88133C46F63AA78C16AC76C031BEA1BC221049A46D799

SMS_S tmzwprb.sfexmgjc.qlvreg

599D9A0BB93D6E354BA838DD2A14756865277741B74A0AB243EE7C555F190F3D

SMS_S dsypi.tiowqjudmp.cnwgbz

59A2832D72208DD6AB9CFDB7F73BB14401CCE93FCD547FE82EA1DFC381B985D4

SMS_S fmwdnst.xruivzywls.pydg

59A5BE506AFF667ECDFDCE240B04D4D9FCBDE3E15FEE0324AECB8FE639804B81

SMS_S gtjnyxz.qacnulhr.kgcsmxwnjhu

59CE7B7C33358E9FCD53D9C05C983559E356301E0022B44AB7D646C5FC103C29

SMS_S lmob.zgqobj.cryaiz

59E389DF862F298D0CBCCFA8C4149C1DBE6A11DF7D037F733D2C1C0EE096C7A3

SMS_S oud.losumkb.wcyhkxrlfp

59EE22CB104FB3A5DB9AAC393D3D3B8C3EB5C71D2BC3B3BD0ED44E1C1001F342

SMS_S adb.rkidjo.tlykwx

59F8BC898AD3BF9D770872230F43005D37A9F4D6461089006461F76ED4B6E3B7

SMS_S dwz.dxgpwskehy.naykjc

5A08A72D09B416889495C103C23E5F6EC353DEDCB4478C18F4C74964976B9895

SMS_S opfhqgu.xgiowpl.htexbuc

5A0E0D31E416FE756DF35DB7139311685802AA6092761BF2378F14178DF072AD

SMS_S juxwm.mnlzbg.ljbwuzfq

5A1447729D10548819993A52D9031FCEEAFC411C7124D2DB04C58EB6E0811625

SMS_S rcozvmh.xrvwqgmtdl.ykgrx

5A1B6A6B9420B247D5CC42BA52DCB675684B227BBE82B8DDB2F556FB49E42311

SMS_S bskuh.wnahrmvkd.vpwcdojziqan

5A36207EB69EB5E319AB255CD12F699582BA993FE913415A6A9F2561C0AF5EB6

SMS_S spixyog.kinrebsmu.uvojdnbie

5A3A0583AAAFC3355433FAE823F305B81B63D3453F73C473A77462EF66023BF3

SMS_S pvzw.jbdmxvsa.ysfqbzjxd

Page 179: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5A40F6202EFA5A462AEB4D03FCB95179B93FCE0692B12E53AE61C95C80829BB8

SMS_S nzlsq.ifmuktw.burexyval

5A606170242FA2363CB5DF5F537DFF09A9E74143F986BE890A0F9023098CBA44

SMS_S uob.xquywj.gxkwe

5A865F7293526FE7EA286A32FB135557C92880B2AD494583445EB75783408D98

SMS_S wvj.rwghbnie.sacfjpenbz

5A8D110349EFF4F45BF46F735A3BE2AACFA1FF5B48899853C095183695AD6E8B

SMS_S biuhxed.zlnfhbvojm.dpuqch

5A8FF5ABAD8F037A716D5D72DE011AE56CA1F066666F325ABD63029C124B7872

SMS_S oun.wkfnsv.drxyhm

5A9DF254619FD535056118501089F8C80A94F3B6CD89ACE814A5841FA7A99D8E

SMS_S dmifkw.tvjoigkq.jgmzkdy

5ABB8AD9A518F7991F6BE77AE0C0EB5BADB9955B9E3C70B3F0E013E126CE262E

SMS_S iqtrey.hglxpqei.atuhkv

5AC9641E8C29D5482F8B0F59291ECA035B220BEA4F78B375863B7D5BD6416C9B

SMS_S cltwkjs.nqioaf.gdyr

5ADEB7DD1302F49A5D5D111E63251487315D38AB3B0F28CF10A01E73E694A010

SMS_S eangvm.szwlet.vcyrfnzgw

5AE6D8C24A57CE472E6DBAF33610C250F3C2CF5420270432EAB5F8634801DCFB

SMS_S wvmhs.thasjmbd.cptjkfdolw

5AEC242F33C169B87498F7BF7AA0906A3B1C02A10BC4D13801077F8531A149A0

SMS_S jkaixz.oqaleyshm.agemiypv

5AF5BA435A560F104DBD9DC68CDCE98937BBD295DDC5D51E741E1127A989B6F8

SMS_S islgaft.pjowdsrz.grewo

5B098C084303DDA4A0A1D672A0EA50E55F8DCAEED95CB1509088483B1FC6DF98

SMS_S igpfj.wyktphvrce.mrfpwtbvyu

5B0ED6D3F09693104BBE711310317534D0DBABC8AE42C8F071226282145F1398

SMS_S fpbxng.qurtnsk.yxdartvnbe

5B265E0B3F32587EC260FF4E90020F33D776734E990992BF6D747E0E71077593

SMS_S eykvma.mdjwsp.wuxdzaryl

5B5B0CAF2C38CE6AA7ABAD1B0489A803F299C64152DB89137370CA1526AF39C1

SMS_S wzemuiq.hfwyvclg.ndfbrucgh

5B6364C91AC99E067F0C3E5634A6E13C40923A847713C1671D18B27A7D2451F6

SMS_S kpl.somwlafkpx.lsifmbe

5B6B03CF439B0E2988537AF72EEB12A9E6B1DBE85D3076212A0B12AD677D9041

SMS_S enimufd.jztchraogb.zliwmyhsp

5B6B6EE5D5874CE55FFC3BE7AD199755BC112BD36A5F290110761164AF2279DD

SMS_S vcax.ahzjybod.njhtwkp

5B7487ACD1EF897BEE1DBB06D20084FC68FF9 SMS_S wxlz.csbflrz.dlzjhvwy

Page 180: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FEBA9A87237B82F24D50E3E4B6F

5B79C21F5B1E188D77DFFB0338F54E000724FB3D62CF0E11E031F5DE9F866C37

SMS_S iqseob.nosirg.szmjgb

5B7D77FADDDFAE1120E2A8FA1D17C5E1BA6BE12CA01A3C3ECC6CBFA371952981

SMS_S zrj.xjpkuhlowz.rjxm

5B83636FD13243049B047586E33EA2F00F11007081EC935F217CC99549F03945

SMS_S khqgsvb.mapnfjiyuc.bvwntgafcju

5B888C1D625CAD364AE01B86EE64144AEAAA5F0EF0829216DA0FE52AE5EE3638

SMS_S wfbca.ekiyrcgnj.mfqvthc

5B8DC8B92A10DB0009F2E133F2029CB572C446AA08A4DF75436E8506BF49D501

SMS_S abi.byuvkesgpt.sxfdmrp

5B99114F217035C9EB6D74EF7E56F0C523CE3C627AD741B6B15D8A8E44397339

SMS_S byg.xjczklfe.yecdz

5BC6D17C5B4794F69A03AABB0DC6C4370DE880D784F9C3707FE06022B1E08E6A

SMS_S jovr.jqripw.pgfuzi

5BFF09DC22AE67C1773BA03EA008D54488A60332640F637751ADD2B85B37EE01

SMS_S fsg.ytufnvb.ogvrucjphqtw

5BFFE78921037088B9F93824F6417E399F60F7F498989072F23A26432ABCF829

SMS_S dhav.ydwhpfbjt.cgylofrnqs

5C0647A5C48FCE1F463FA9AAD5618A899FBF28B4C9FBF58C90E905C6CF26324B

SMS_S untfkeq.wnbmxpkro.asgiy

5C2E268A6097F982CAFE1AA613838916832EFFC3636775C297FCA0ECAB32130D

SMS_S qfcbxps.ojsfudi.iurthwajzdqb

5C41DEC3FEC73B5504BF8FFA9E5468DA9E5CD30DC9E1F1EBC1B9130EEA771EB1

SMS_S cqgkze.ougtse.rwebulskoxc

5C5250990710FB8C93B4F67819C58F25776011881E083BD18D79D989298B015B

SMS_S ifygzjr.tzabhuipx.xgzqr

5C72502C6A3EE7B8DD9E9249C2B559D58BBE8DCBCFA64AE15F219D5239113C40

SMS_S xbz.fbmgzdnkl.yzlfgi

5C759C9AB9FC0E1666D5AFCD575E664DE2728FC960E0357A186139771E311144

SMS_S qzvrgn.wubtdokyv.ptjkqxouelcg

5C7EBC0A5D1D01CF8CB95B44F375E73EAD185E7D3A04F44EC5D535A417F4D847

SMS_S fxa.aqsjnx.taoj

5C910881CB9B13F698B32154AEF6CE7A4A32DF25B8BC9A3965565E6BEBD091C1

SMS_S xiat.jkoezusqn.nkoltgvjaxps

5C98E7F45181D4475E2748ABA09AD53662D788D7ECE1F3377C5814ECDF192A06

SMS_S owdjt.julgvan.syuxe

5CBA150DC8538C802A0563B46587A022BE5CA163AF664F4D5F38ADD01D582FA4

SMS_S ufwep.qucwlb.dqjlokc

Page 181: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5CC6813C74156F0C756B0B383C4EAE8ECDF3FAEA2261A5963B27D9EF8A0B0EF3

SMS_S sgqkp.wneaipgs.yxhdf

5CD539B6B0DEEC967107B0541C7E3436BF99C50BD3A22ADB992538C4F3278D2B

SMS_S qwfpat.jnipfd.ynwkfv

5CEDB77CC56C5586CCA708452D0B89C05C575449B4ECB72D2EB85985588CB6F0

SMS_S sxotymk.gczpvuwr.rwnomq

5D010E9817992A707DBB2972F79DBF8E16E3F7C7FA0BF2FB41E2E65644EBBC22

SMS_S xjeqdcz.auscoyn.tdgela

5D16492072FBB89C07B6343A9D4212E50123E35BB2B2ADB6966AE7BAFC88E36B

SMS_S ygc.zkvyegf.dntkyizc

5D1C03F1E957A53BA4E62179C847FE1A7DC38AF0A01A7BFB1204ECC16640C202

SMS_S pasdwte.yalgtovju.dethmgq

5D25E84DE6C98EE62F87FBD9A5502996DC99AA7D6DEF1832DD2835F53BB712A8

SMS_S amqrcly.bvfmdt.hnemdko

5D2CF6D9700F9EA7FC4A9628089020FA7EA7FD24BB8B07AA8AE66FC3D04E1479

SMS_S qhmtx.jxqruw.hjuwmcenfzxk

5D32069242D627088EDC826BFCA8D3694912C0450274F168AB635928396516FB

SMS_S jio.luztenykd.feag

5D4F36B827748E0898B80D45DF347D418F8276CAA5057FB8C9C76AD535A0D227

SMS_S wjr.acjvsmt.cukg

5D4FE57EE1FF4CA1C2662E57A486FB1FC286226788A57BEDF4EF3B5A25DF093C

SMS_S rvucj.mbniej.jmsuvrx

5D7F2F01A8A73A0F250BB1348E10E9E75697602BEEE1A8D56FB5A4436083216F

SMS_S jrmhfns.imhblcj.rthivlxy

5D841E3B19BEA8E6A2537296ED0F4E34F0897FF7588C54F40DCF09AC649FC4E0

SMS_S dgkq.riodms.pfbzdjmn

5D86643E51EAC8B7B9DDAFB2DA01F82BE705700A3F1115123889BA6A2AE1F151

SMS_S jqt.tvqipmrxa.uvwxpfjsnohk

5DB19C10B09714F3385AC1CFDD2874AE41F62D7EA1316819AED9034DEC2B4A33

SMS_S crv.kjclox.rldabftckwu

5DB3C7D655CF93C59138ACF84301F998F4D96DFB87421E290FC7DBD544278827

SMS_S qkjti.vltkehqj.wiqgojf

5DE3CAA655F0C5B71151D589CDCFD7372298185A0FE2592E0992A539DD96D4D4

SMS_S rwbo.dxtcqpghw.zwxgbnlqkj

5DEDA518836DB410762367B2D8CA4638F51B9CC247C6CB63FEF4F446763AFFE7

SMS_S puwzqhr.ozqsrpkuf.vsrwcpq

5E1C8D2C6EBBEDCF13E8D2728A0ED665EA873826CE7633E8E8C9C34FC26A309A

SMS_S nyphko.mrpbfz.sdxvc

5E203003DDF124567F0432C9667F0FBBDDD94 SMS_S kinmzlo.lpkvyo.tkmvophx

Page 182: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2B9BF9C032659303744DA2A6276

5E24044B7595E75F217BEDA2717BFE08BD8356E2563A59072D8CEE67107EAB4F

SMS_S wazg.sbicdg.xiacybvq

5E2DBA08347056A6D47684241BF134FC6E86DF6A9E9CB3C787390C44B0DCB0C2

SMS_S fomklqt.wrsmeajzt.vauetiyqlp

5E4E256352C0104EDF7D056134ADF4FADA1AB1E59004B325B35C32D3B0FD8C5A

SMS_S ock.yldxmigta.bpzcewovarg

5E53779F5EEE6C78EE89DDEDB0C834F02A99991BDA7181B5B0BE71FFF3447C07

SMS_S mrcx.ljifzq.xlkzdqtagj

5E6813B5A74F7FDCCC0B3D934E25E14D5C3F245F38DBD238C9A7A9D13C8240C4

SMS_S wga.itfpulmbco.azfjitmsgk

5E9C1ED17C8AB9FB0F10A47223C5B2CF65101629D40453DDAD511D15DC642DD3

SMS_S mcpsa.pjzftvsxw.vgfqtce

5EA072EAFABB27AFCB11726965D85CCF33378ACDE75BBAE31B62E531FE6F4EC7

SMS_S yvcuk.ewntbzomgd.khiaocjxwrd

5EA1A162A021CB29F56A76F7F7267FC96FAD1935BD845AE238167885DC141404

SMS_S yzgtoer.remysoqldn.hpnyluzfqw

5EB5C5432B7F42DA439F0E24FACA3DAA10A33593FCE0184536F27393389A597A

SMS_S wnit.nlchbuxtpw.yaxvs

5EB750625103A20FDAC398FAE61637491C10750BECB39D428AD4AD7F4BAFDEF5

SMS_S zpvcmq.daectbrqkm.exdilcwyhjb

5EC4FEB9242B57FA3B084C7F601E75CC1381292CCEC52ECDEAA27A18A40B14B6

SMS_S armxjof.kojqazgvp.mxwda

5ECCA65137D5A7E4BEFAD2A899EBF3A6D9B14183ECEF16528F09AA78BEF90FE3

SMS_S wkrbqh.paylzwbdx.avpfexbq

5ED7A534F13D9A07EC8D82D2735675A9DA5FE1165F08242135E994EDDF24BCDB

SMS_S gscf.gotnex.kavtbeyfr

5F051349BE37BBE57547F61FE0446212690D5B0FF5E3B0366CB431E53E99362E

SMS_S itcsoz.tzbirw.eqym

5F09C575583860BC00ACD741BCC35E747F40B523FE0F515905B6AD5EDFDE5A76

SMS_S nsyo.ijnfhsaubx.thfrolpac

5F1750BAF2093A52F716775D384015C73461792C61477F9660DB02695CDFD00D

SMS_S bsmvkxj.kaciohwdtq.cubtrnkvaq

5F31E675E735C1F347EAC45430731783FC8FAAA621A2E08BBEF269A8B996B0C3

SMS_S ufak.nauqzy.bpvhfzr

5F38B7FBBFD9BAEF64D435BD65AD5B05C3C6E2F66EECD28774FD71E9E9C2BB74

SMS_S hfdapsu.cygmjsw.zbxfapcsuvo

5F4A03A3B402F73E3BFB2DF7AA8FB9CCD50B0CD77169B4C769577A94BE89D5E1

SMS_S lkrq.mthfubw.colpyavutief

Page 183: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5F5550DE10BE6E54A963F33D1285C0902D3CF6981213D52D459EEC7FED0A3405

SMS_S ygzemd.jhlybzufes.afoygz

5F72A415CABBD3CABAF5E5E4B78FA8EFE5BC9A82F6D2BE5EAFDC3665E0B3472F

SMS_S bomaklr.wnsmgpec.nsmyxhl

5F7B7EA50CAD4080C7AC20C9ED12172FE9C551255F40D325C809484EC3B3AEDA

SMS_S bcokt.rnvxueq.ixaeujn

5F99EC3B8DEBFB21323534FA6ACFDC63D72CA2534CC9526CA630DE8B5026817E

SMS_S sbun.uvrqhjznab.cgtkdzwxm

5FA8FE7069F043F5FD22C359DCCD3F592EBA1199705CA279B5435F809ACED323

SMS_S qtdfjx.kfdonuy.kfca

5FB53A79C30A1D7E9680EA6A9EB97FBAE62363EE40F1FC5B715F2E14DC9759AE

SMS_S mchuoj.wjhtsu.guwkyrimtnas

5FBB783E157B17DB945FB78F544BA2288F7699B31264B83902D57A2B6D8C32AF

SMS_S cnlji.moqrlwnfi.kcvz

5FC9881B9B8B6F2A7023E3EEEAD5CFED86415A087EF5401CA6F6889463B4995D

SMS_S lkh.sytjrfevck.cdjafmhe

5FE46AB75D1133044BFE593B6118C933EEC720BDDA648CAA8F9EDB479E4C3616

SMS_S budln.szrmnijf.aicnrhbzkf

6012382B51D90B7CBEAC7FC38585DA0B256523259C35F1D3880132FC70C7778D

SMS_S zadl.avgokmdru.imoa

601304F91801198290B96C9B310AA756B6A948556A458806E3F8BA3F29CCDAD3

SMS_S aupbt.dgecvl.xhkeb

601BECB88D8CF02A102129B9BADE0F2C7373B949C7EAEF78BAA998CD13921BC4

SMS_S ubxria.vjoewdshi.ahoq

6029EDFE5ED46885562D2C4193B1868016071BE2C2BA441B3C6D74E81A0BB60D

SMS_S ysbrt.docujmhtv.fncgrylsvd

60375EA8E8BA6C9131F3659A00E635F4B35C36444E02AD1B73F724948B495A83

SMS_S wqpglzm.yemvihua.wputjaqymlnr

6049BE16594E5407278F26DE37A7E35CABE830D7CB5058C593E4F78807460F72

SMS_S mrula.mcakgdojlx.kypiu

605E366526D76B98756254611666BDDB5FF3B01F136B41B6D3503D2E3F0A7612

SMS_S ydzlw.xyvgslmoen.qkheafmgdy

60D0DA5164C043576364AEA7B5B224649AB9085522D477A7709DB9E81B629B55

SMS_S uigan.qpghaf.diofwkmcz

60E0923A16318DBFB5B28B711B5082F8C94FABB65A4892C502BFE0B8C0638886

SMS_S wdjol.ygkhnqepw.ajrzeicmlq

61049AC1785DBC25DC75A67BEFCDF195AB21460D6FFBC5B0462EF2F519A10534

SMS_S uch.izljsd.vigodhkzan

6126478D6743C231EF8C66389873CB55741E8A SMS_S othxmlb.qerpoliwv.mouqhpjnrktg

Page 184: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4C8ACA5B8473CEDBE8AE12F61F

615EBDE8AA98644F501A01F0EE1EB3BC17429F3B00CA80636BEFFCDA4395F429

SMS_S tequgpl.pvymgaef.vntacyrlio

616867A5362BDC32E073F9D936C83C705CC5529809071D31EF21EFE06C46F048

SMS_S fmqyg.kxtznejdya.yvdtj

618615C1E39D0706ADCF417A5D6C2081364ED50749AD5583D088F56BA9CFA994

SMS_S ehcodb.gmroic.qvjw

61926B265192073A0F6CF5792D7FD92D71007FED680AFBF1FCB0B46BA2190738

SMS_S dhm.jqhroegspb.xlnueprfjzv

61A27CB08AA10108704DDE6091AA423D62BDAF70AA7A4FC564581F39DD113B66

SMS_S kjvd.wzmekh.wbnfzd

61A47BE5B04ADE3B148BE79E0922EC68ECD7B3CE66DF4C5D86371390054C2F38

SMS_S gibsnq.smqixdtye.meanjutkxzb

61A6BB6873B56CC66F7DD7AEF94149FF5C3FCB234CFF00C4738FD5622BC9A1EB

SMS_S glqb.vgyntkqo.kwjcyeudhlqx

61B48E21FCA1775BDD6F6BBA4FA31D46C5A7F6BFD67421AFE6DD7DB0D1E13F84

SMS_S rntzux.wnvutezag.hockzpgxwby

61B550AE836E10E1B0E78844EFFC1330E1AE9D40F72C8B5DDFE02AC659A37E0A

SMS_S zhkjmy.iplyegn.pxjke

61BCBE4BF5F178FFBE4A56CA667F47854D2ED005F8952BC65A49F749C2B7FDFF

SMS_S tabru.zwtslu.qkfpilvuscjw

61D5CC1D127F58C73341A1CA3A98D11655D2D288D55587A2C33E5F524E4EFEB9

SMS_S ioy.dpxsoqkzm.vpbuqkgjfxw

61D66FD3C4CF1406322D17F5CA6C91DF52C6E19E372A6B4C4D7B92FA3CBB2F12

SMS_S snlei.vmoeitszlw.rgtzcqxn

61ED83188A683FE56C9DEF0913566BA0DB7D1EE1D1E6E0F1CAB4004FCE8863FF

SMS_S wujhvqf.vqibfzjde.uidqcpovn

62214B44C744891E4585C298A236F52F121DEC60E1D3E2EB5D9E368D37885D1D

SMS_S wtlkb.xflqrjcwp.ekcgbnvmyah

6231D188FC9D26501084C0DE2384D3501BFA6863F8ECDCC2691B2FF6B557D410

SMS_S jvq.wmrocfja.qfnrjtuech

623721487321E2645F9E7E331A727B1C713188A222143472139FEFD000BE4FD1

SMS_S ojxbi.xrwizvqsk.eupahx

623E5FB0799D374D92E1106C0AFD389A8F6798C7322D6BB508E1023A9DBC94B6

SMS_S nqkcpjs.cfztqnsdo.fnxco

62452F344B280C575B202B089EC4A6B2666F9FAFCF03B6E083655D48978C769D

SMS_S qpukbd.lsjfckuh.ntjpgdkum

6260D6EF950638634FAB2C2B99909FF5E30409F7AAC94D0437477925E863A833

SMS_S ustah.hxcfbmowq.yvpaieoqcx

Page 185: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6272A19664C9CB0A6DE91E7E0725C88AE8E32F3DBDFB01855276916D9F5DF2B4

SMS_S zjugrm.jezrac.kvfzsuajh

6279B2E9BC805CB16881F07195EA8CCFAE807FDBF1EE89966F2D731D7DDC6F6C

SMS_S uyak.sahpvtf.awypf

629FC2B3B20A3EE45EA14B925783B207D0521ED578B69F549C284F1F051D2008

SMS_S wtle.sckmbpa.wztlcym

62A55480BB29D8BB0AE50D006296B5395BCEE86F82A2068FE28B00CB5849A2DF

SMS_S vbkigzn.lgnvfm.sjurl

62ED672B06F620AF4A36D5E7E59EA6C9606855ADA1073D2D362909D468FF0EA0

SMS_S frngkdc.zgtbeqphu.yuksrvfnlbtc

63032C203D593D98EFFA7CDD905299D76EF747B1767F80E36D796C46246FB71D

SMS_S xjdumhi.kqtwghxb.anouyciwlfzr

63340C3CAF5165B211E4DB957D0F9AA7076D9C5B5579198B88BF176DB29B8F9D

SMS_S xkf.imcgqa.jkfil

633F27AD2CECB8B4EAC9A024229D6F17B880E234D43087805A07D9AA6D13F5D4

SMS_S exgwnd.gotahfxqju.vzqfkdsx

63463424355D7B18F5C936105A730B194FC46F4D6C964FEDCE15E23804F8839F

SMS_S klwbj.pgwuli.lpbsfnwh

634E6E27CFC2D636D00C2082429E4C9C47374CB3CA25DB991C943461F81A9F54

SMS_S qgmihed.wtihxs.seuwjp

6378EC589C098549F97AA3CAEE78A13B5D98FF8FDE0A6119114867956BA09AF2

SMS_S dvnoqf.ampzkd.zlymqeus

638026525E6673D0B7F51E5E4C73B80AA87082AADD402251DC483904AF62B233

SMS_S yozlc.robpsjm.nkxlj

638631BA88EA18DFD12ACC03B579D9ED61E76571809D7C50B05B3B3220060F41

SMS_S tmabgn.lxvkup.oszwkdxelj

639B2C219C6000EE2D195F874A91D747CF6D7D3062ADB97F4BBC8E39D13C31EA

SMS_S vpxgeqj.xcnevjh.qznah

639C88C1FC0D7514E85F537B6EB0F59A772F007CDF296C338217C0D20183BFE4

SMS_S vonjy.fixchv.mlwscrqndkv

63A493F6DA1A80EE7A060F90FED84D4FA154E587D5EBACF4B6309A7130035AAA

SMS_S pcgbf.ewbgknc.jeyuxvsfgiq

63A9DA840316E391A6FFD4EE630F99CBBEBEA5ACBA141559A16E0731C799C85C

SMS_S fkvxw.ptqcnga.ovabtysxiqh

63D2D1ED48B15140BBCEADD4DF30DDE5CA6CF21760254689399717E33BE4C2FC

SMS_S epjak.zyprvkq.zwimjokl

63D56CE3EFA0F8705E0E6F27D5294179A340821D6B3C26EFE7F8FBFFA0AF42E0

SMS_S facypvh.gmlado.jbxdmhfaryw

63E6BB0F96ECDE1025D1D0D94B93C84FC3827 SMS_S plwuy.sxtrukjd.uknox

Page 186: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

14B5C64C5E8CDD9190A328248B4

63F85BA49115A88966DF2A36F843CB58364406DAE8033F1178966910B2EC057F

SMS_S xljw.kzwgvjrpym.dpnmcaobrjf

64026381EC45B35C21FA59BFFE75723EAEF6216DE3A8065389307C894924C629

SMS_S ebov.emzhfxnj.gswkpoc

64079BD24069571639C0B8AF9375370BFF413AABB79D7554E9FBB212B5739727

SMS_S vnhe.smxnrqvzch.vlhecxr

640BB35C12C829943061A41A4846CFBCE86E7482741005EC1D49607B96FB3F8B

SMS_S zrdt.xvpkmdi.nhrpd

642C7400B22AB4BCFD89EF11244AB744AD8BF2885D8226685B6B1EC2298A109E

SMS_S xqjwkvp.kvsuyejbz.zpuwemovf

643D60BAEF0EC26FCF91D9D1097153E895B42C81057990A2175C06127DCBA0C5

SMS_S xhcevms.dnucxyo.gslbcom

646317414703F3D3568862C95FC58F5A5E53993225888861B3C506E217FDB50F

SMS_S xcufag.qyrajo.bajzy

646BE4C5342EADDC3059D790C0127180465E1F515521D066B31DEDBA5DDB87BC

SMS_S shy.vhlykmbz.prhonkcdiefw

647796417C16B2BCA45D1A55CD3BD253549CA373EA4B84BD7AE2F9EFCAACDD16

SMS_S cfxy.bguhreo.hkeqrzca

64855F68AA458E1BCBF5CE7E18280CE1F1B02EDD908334190F656EED16DF2F84

SMS_S kxc.hnapibxvkz.hysrzt

648E7037F8DD7D44C48B4D74C92DF943EC724D1C7C4755ECF95DA9540459AED2

SMS_S pslv.ngmzihps.frheu

64A1A1D8D48F3766AFD108C5F65912C5C36384F9A632B6C4542D37BE8CE37DF5

SMS_S qld.wiepgu.xfwkm

64B02818514037B842A913A3F3CE9154CB3739F575DF3003868FDF52BCD3EFC2

SMS_S nzhi.aivhgjbtsn.lgizyraw

64B8D18588B2AA462A6E058E458F4C6733913F65641AFF15D7BDF6485E891FBB

SMS_S rzyjfo.oefwtsvrg.vpbzfc

6512815E5203CD6CB416FA95474B191DCB196CD37FC95C34EDA386851E65BCD2

SMS_S rks.nhmdfbwz.qylfjx

6517BFE87663D0CF340809143063ADB79FE86A78A66FC2448AFE4B04FC7F6C6B

SMS_S wvtmbo.zkatxy.ydbuoi

6522345C439939863A8218E1FC61D03C6C9D1776914D2B6D774BF48668043463

SMS_S fpc.aojpzldne.zgqs

653C42E4590408090910CC48D5412E8CAF16B8D4CB0F3FF7685AF724024F4B5D

SMS_S tqjhkg.evxkis.rutg

6542A6D08D5E651F6596A0C0151C015080ED80D8F15E14F6EAF349238F0F3188

SMS_S vypa.umqrdkbe.ncqf

Page 187: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

655630FC8C59C90D7F2B1F56EF80BF2DF576018423803307088C09880DDDA9A8

SMS_S wxo.mirfcpt.aomzj

6567166FBD9A4608493E50D0D94793F9F7A405F719FE0C319B3413C0F200922C

SMS_S xkni.jhxdwci.lwnyxcosrtgj

657F7CF30CAEE8F7D7220464C7B08BD20756C4773A9D92335138BC04D79EE186

SMS_S eqkmhcw.szoaqu.wrfqtabgjs

6582F627078467BA6EAE23F3101E7BDA235F9C4D2C219F6E92391FAB48DFD60C

SMS_S ehgvqbc.kdblfimryt.irjtxzblmqad

6587D1CD58F9C5657D707CB821F5138553E24AAC77417A98DA5F3647A2BF6320

SMS_S kgteu.qtyehumgv.qwmly

65B293D2A157F0180C354821BFC3890EF646DF53D543BCE1A1828E5DAE3D825E

SMS_S byucs.kbdpuo.buvic

65B59E7B7FFECD032222B011B5F04E9404AC9EC4AE00823C84455437687276B8

SMS_S cxus.wjrnxqkos.wgnb

65D0AB0F3E2AA823642309769A42C2CD401FFD6109D3503ED9711B762A646C64

SMS_S ofrkqte.pcquyxnbt.bopu

65D0B726DEA728A076BD310C445CD7C6C3953BDB0E5D2A6539D80E6B9B5A401C

SMS_S nosdex.cqphsi.ceumgynah

65D4857C25CF26D46011A97BA5376DA118D06D2EE8688F9D03E3D0B161785F0F

SMS_S qbnutim.lojnkqiv.ltqbchmpei

65D935878A7530AAE649A099089A37AB03F1638BB8E94D6C4C1D9CF778A0C932

SMS_S ijxd.roeahvgs.ohtbwkvp

65E843B7D862BA97B8F007E626C71FB64793B3741F706622FDB58BA58C1AC388

SMS_S uqkyptw.hwsoiukvm.qxjseoyuk

65E906E44E4D2D0CDB90541C5A2F1333441DDCBC4A126DF7F1AFC80F7D9965D5

SMS_S elzvcy.xzskpbl.cgjdkuwoizbf

65F873ADC261BB7AA190D8E3977A16045E1237BF6B6B4E9167209CEA5EE6B6B4

SMS_S tqdpvo.mudbxocs.jzesdqwk

663584444669D625EB9A4A4404761CDFE6D81229D620D12409B1C59586993095

SMS_S eqm.svypql.hpfgrox

6649228CA658782A44D14853D7BCDD26AD31E6B0A601BCF276C498DEE087162D

SMS_S jvtzqb.ogxuwv.qaju

6658B888AD1DB56638B736664F46E2BBF690EA78CA15ECCEAEECC7443658D4A9

SMS_S fhnv.rabidoxqy.fwsduvrbmyaz

666AEC89D2C099643E4B34DCD4239CD43AB0EAC231CD0DB9E532B7C1C3186E77

SMS_S spnq.cwkdzaor.jcwbtfpsh

666F86AE6B9ABE2968F71025406758FFD39CED7B20B0D996857F45BE34B95FAF

SMS_S lrpi.yjxlvford.agfvzn

66A24C5B793E58A6D1EB19FB58367D3D0233A SMS_S uebfo.lvnbomisp.zauvytjcr

Page 188: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A582E7FEAD77F0980C1331C5F46

66A4178BB5CAA48D41D1F3C1356DAAAF9784A208749091039C6C488BD73F8A55

SMS_S ucwei.rmipzxawkd.jsxqzhfe

66B8EF6BA8152F468207B166064196EF56FDC3FA45B9F34F4C5E347F8747AADD

SMS_S anzy.isnxugmb.tfzsk

66CFE1B74F736E4F0903408C2862DA22B9E8A90636B385531A494BBF44CA8748

SMS_S lskw.baojqdrwgk.pkqdatulzeb

670292CFE459EF68A0D307F8E7CCD44601A6997CB2C623AF18501A0D80924EA5

SMS_S tra.ofiypq.vmena

672052893B88AC450A3687F5D7E3CC9D2755F354CF38753EAF0AF9AE70FD204D

SMS_S bnoempv.nbviqzroa.srdplqkhcfoa

67297E568D077924A06F0973BA2B8F1E29EEA8F3E586BCA91EC79F281FFDF650

SMS_S mbqe.xkmbacdtzr.sehrcda

6743D9BD6E4B50F77DE2B04FADD87FE0493F4B73E37A010DA99B7A52100F0F63

SMS_S lphrk.lxuehyonz.flxsihm

6760E421078704C164140FA2288FB025E7F5B176D2E1E5B039AB52716F4E8D92

SMS_S feqnhog.xjamzfiu.kbsdlnmf

676164C117CDCA8FFC78C79D149A1979EBD5A369839B51CEF92B05BFE9C96D1C

SMS_S hgqp.dplkzbi.iesfocbmyv

6779DF1143336C60A4598BAD4C9714111B45635B6CD9F5FFD2F53C85E35470E9

SMS_S ijxd.roeahvgs.ohtbwkvp

6790C20C4CC89835701D6F892C3C89F28FBD2656E8A0DA0FED158A2363D5A038

SMS_S amsjo.qgjawbxmn.knfeaol

67C1F060A8D792ECC144F40F10241840726A691617CABCD44438FC51E1463844

SMS_S cvbjsf.hqazljmu.lgpm

67D2B24AD6036C647D8540066796113EE00F6B7AE182E5E72955F7F7E2B62D1D

SMS_S kws.lfvynpuq.viudj

67DD08A63BE915291F24336873FD4D5A477EB9892EEB3BD8F941D878525B0A60

SMS_S dhcqux.zhrbkc.mxaswv

67E5769ECF171E2CAAE04124DD58F33F6219C83452965E1CD83F6D3D114B4795

SMS_S gtuecbr.kijtnpxml.riudgxfa

67EB68A15B3F86C0504E9F2003C9116436CECDEAADC556B3DF0AA1AAE3BEEED3

SMS_S bxfok.ryzmfcspd.mxqnbujcl

67ED1C6274F32739BC36280269240C219C80BB091A8C36795C728B3BB8AB9920

SMS_S helxm.pbtzgd.qwduo

680652A96AD6D5F094CE1709991D72FA3B10579F4F3B44B09EC0FA199E8EB408

SMS_S wuegt.othzpu.nglock

682E7B58A05FEBE4EEC8A6A432F69F7609E40BBA0780D33C02F049208BC99973

SMS_S dra.rfnwkmbqse.dtbwcfux

Page 189: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

684449F8F443E17FFFA51390CEE45E90279C05EE4589DB150775237DEAA31BE3

SMS_S atrkn.igtluqw.zmajxgbhpfw

685F20F293942F4C3B316D944618CE5B2BFC99BF0E7FB62A29E297903E7AA7F0

SMS_S tiw.rcaukmyi.ohwiqjsna

68649280B0D8AE0192D88BC603875CE76EB25C505F914DB01F5E71213D9CBBD6

SMS_S rsng.djfpkbriy.nwiazyjhsbpd

6867F768ACD87E32ACFA4AA51D9A6C5DCDFBDC26135B4F20AE941031823896F2

SMS_S ejxpc.zobecwjlu.qxdatroz

686B43F4CFC05F910D5677C833D0C76ABB41F5D65617DC9057B593998DE9135A

SMS_S yaqs.gwpbxodsi.xcaskf

687103456809CDE1A005E05198B1A81487D392FB5D75429E94CA0520879D5D27

SMS_S udbqkm.awfnmked.kexrbscjfpvo

688682E0C1F3576149281A89DC7694D6CC5FDEC6AE134226A4F6FBA03BA43873

SMS_S slijzc.xjvrylebq.cekvdlyzoaim

68878F54B311F246FA928AD8B79E9BAAA33E3F10A69FB8024A3F518C0CAAF763

SMS_S mhdzoju.pgcxsmtlj.sqvdgl

68A98877A55791AA5583644E978E10A5172A9AB74CBBE37D20F44F9385835802

SMS_S lbepuz.docqxun.vxesbmoar

68BE90BEEBE58362816620087FD820A53F36C12106D1050CE2982D484EFA872B

SMS_S hzauoj.vanyurhpix.hbjesrk

68F85B0C33684A40D452F278C9D48D32919BDB0B1EF98CC55C4D12992928B74E

SMS_S cqyipm.saegwpjlrv.zabjcg

6914254BA54AA7D9AD6B3594D4C358A01BED58BCF9586CA84C0D114582EAE9B4

SMS_S rgl.wmezoaur.ioafrgnhdmw

6922ED819686E027905C7D36BFAE9FB66A84E0C053AE848D535E6A68F3C6B080

SMS_S erdqch.kcwlajhvqy.pwrjtmdnzsh

6933188AC88E4E439BFCB580FFCD67A75D186C18B3EF9EBE031CA1BE16480CF9

SMS_S abe.typocdrjh.jyondsxmqh

693F0843F86C6458E014A51DDDF3EC002DD9389C54C28257879C92F139284669

SMS_S ibjhdwe.ezomdcu.aqplfw

694BFC8EEF6704957C7CFEA8A74DEE511B77A8AAFF0A6E3DD229B25B141F751E

SMS_S eptzh.hrcqaijg.imof

695952372C8555E72649F732CB7A1BAF37680C9D992B744755450114FFD0F515

SMS_S pztvdm.yiungbm.hpaudyzk

6986F8965B5E871E9EAEEBC2FB1CB8D6EA956EA888CFBAAB0BE217B0565DDD42

SMS_S orc.mdgabspc.hsajtfbxqiy

69B047ED96779D09B0AC4A055B64EFAB11003F113636A441FB074CB45795ED5C

SMS_S yzoj.tlxfpwrunv.uexvpnqf

69C24632A7C031424F55C991A9E81DCE32CDE SMS_S lsrcq.udbmvwtkyj.lnicpqfrwx

Page 190: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

61D10CCCBD2D249E15125055B6C

69F48B93C9ADBD61719C1731B255394F6A21ACA784AE5715CDFD7EF9993669EC

SMS_S qvj.vyuqabsop.dkguzjpcashq

69F8D082F3365143B55528640AE4B3E94B89179B6E0238505AD9CFD5938AED37

SMS_S jseuw.eynvzx.mbhadglzsxr

69F91B492F053879DDD60310A50BB57084E48A8685A049580B290C7220F51B1B

SMS_S bhjrvna.ypakcdq.wafgmdjosqh

6A159507F0445ECFB980FD4ACFC71757F7EA316713830A3019D723C8DDDAF076

SMS_S zhdf.zehiqu.yldjit

6A258CF820314913A0676B9331FCE12ADB5A1C28966DB6EFC5050ADF1A3BDE47

SMS_S swbholx.eumzvf.zeyaqspnj

6A2CAC07290859CCCB3DF0253356432833600083C8F36B4ACFD941FFBF07424F

SMS_S cwrgqn.srgxujhvl.csegvynhz

6A319759286F72E8956F53EAF1A6A9AAAE1D2DA76E87F8FDFCCEED38FEA093B8

SMS_S foewh.binxot.iompez

6A37064252270120FE15481C88341C2DBACF148CD60211064CACB622633D411D

SMS_S kmjitrp.uwmydr.xucefhn

6A549EB4C3D6BB27D9839B98C1A6DEEEDB873CFD08C97DC8671295E4EA2A65CD

SMS_S jvk.vslbryx.ilra

6A57036350E5E55814D7C5475FB3352CC2F5309655C363E2904012197F658481

SMS_S scgbm.khwagily.hwtzpusldn

6A59B4D2449A4C68BBF4851E33EF2DF4DA1E55C68EE7A9DDAC60F335ADB8D234

SMS_S kshfr.stahvcymlp.ralx

6A625ED95DAE90FFC414E11CFEFD80F623F5F64F78A65EC7FF0A2C5A491EF199

SMS_S gbadwh.trlmeosnk.bugrwodqvn

6A66DC56ABE30AF1090D95D249C92ADA3CE67D9CE93259AEDBC5AC1FB360CBB9

SMS_S hivaud.oephynrkgi.wdjufqroipg

6A77EC2E3D66B24326C7A2EA757D6DBC22D002364DF739728B49C359BE8D2B96

SMS_S wsujivp.jryuks.nuakltx

6A7FB78361AED5AE04697EFF0F3144390C626EEE015114554FDFDC574EC3B205

SMS_S kci.ymebiparfu.arkxmoqyj

6A83D467CF83C7FF0CD56C9D20D836D3B801B38285336B6011D1950783C391EC

SMS_S wxrfhye.gjkmaqvsct.jwxaisuydc

6A8ABE45DBA5594864F8741F2FAC242A6BE142C638C5DF0FA57123CE23D3ACF4

SMS_S tofs.mzcosq.ujwvahlx

6AA5E5C2836D1930D78A6D65CF632A2777D776A02A45F798D013FF4CF3F91F68

SMS_S ijkac.ybmfert.zjdmohq

6AD81A930EE7BDEAB240E11CD831ADD38468BE5756519F5A795F591E2D127B1E

SMS_S yha.covwkebgnf.esvt

Page 191: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6ADA57B2EECA15D6FB81D93685E3027701C2A3B1DA3F0683A8203D56C24B8738

SMS_S btchzxm.wqucneaht.waousfj

6B03E90BEE94996C60C090139265DAA3B84D5B5502EDFC8372170C31A53BA5FE

SMS_S gqpi.zrinbvfwa.npdygoabcl

6B115561AE56DE1C0C493DFE93D860052D7E4CD16B687103E9849E18567DA734

SMS_S sndgmo.cruihoxf.kfhsxolpyq

6B1D4B8A74C1DE1A44D32C7A3665D6058ED6B14828F061A3496EA5FEC7A716BE

SMS_S auefyh.bwojyxaz.jamrdhup

6B1E3CFFD9055D28F01339118496F9DEB01940F7E8CA396A9AB85E7B0872BF01

SMS_S ewkgn.gavcrhmx.dhjnewucxtq

6B3B4AD6FA24985232FAA49826E87A2E7B9F5F938F50FD54BB3D7E446F27411D

SMS_S pxesrz.jceoiwlh.vyfwutpr

6B4A51B722348174267361176ED35E4EF8B84A6B945DCC72EA72CC4B81154E16

SMS_S xzcfpny.bdavigh.zwoiugx

6B552FD8BD8E22B7B18C07F4DB4AF11844685AEB4C26D3E241C2E8500966F799

SMS_S lqeojf.oxyhtbdrim.dbravwlkc

6B779339E0D858955E313BBC9BDEFDFCCE725A4D0AE12C21F21C45B1843A79AD

SMS_S roevb.eghlrp.dvywepclgr

6B86835FDDA1934D1BC13669D44179F842718368F0237A2236048C0F6E2043BD

SMS_S ytiuzeb.rjtvwqb.xenkptbj

6BA586EB38379F2A0875392DBBE001A00B848683D9B80E2F9757EEE731590B0F

SMS_S zkd.csbfpyqdru.dljfos

6BBE176195EF65EF25610438A03100FC7E59FB755A502C58DA1BA88F0555426E

SMS_S big.rctmavebsd.fevcnx

6BE3867D1863BCD5264238F0AD758AB3AF933A3F9146ACFE7B1EE6996C9D90AC

SMS_S sydt.qcuyefrpt.bejwxtkfr

6BFF91166A47C10B49F39FB1C5AA3C92FD0962A492036F024A2DFCDCF45277F5

SMS_S hufnly.cowieuvs.xnihzst

6C0D3B9CC36EF8D36F22F592DE7576494172A68641510BBACDF8167707E99F26

SMS_S ijablf.fxlmreqz.bnfi

6C1052C497B3B66870DC6DFB5F2EDD5834CBD2102BC47C13B15D7329F83CAAB5

SMS_S ywj.gedsamokx.ureihzl

6C1506FEE87BDA2EBB98D09581DC3D04F2D8F15EF13C47CC19691AF32B449DA5

SMS_S rfzil.vedksimzcg.jghzxtvbpom

6C2C51495D4EEBABBBA0777FBC3A8E47C6ABD814309911E6CBB15114AD26D6D0

SMS_S jfw.cjhngsmy.srtdkzco

6C446A84CA2B9119CA273946BCC599705FF8FACC216B722352985E421FAEB7CF

SMS_S picxmvh.uvkawdmiq.gaxrjiykuvsn

6C6F64E1279F6823E6B27D7A1E09402FEEA2D2 SMS_S moug.brwasi.zkaegob

Page 192: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0C8CE0A504365E6FBD298454F7

6C84ACD4B006DEE143056B465D398BFE8F9A87A6366057833477E17EDB3AA5DF

SMS_S bmjapd.ugnqpv.ofhvbpq

6CCA5FF63DBA06F7C1BA7372F298B178BDCEEAC357F0CA7B5402FAEACC3E0EC4

SMS_S ezqw.flwviubxj.cxrpl

6CCBA3561EC85E171289A7576B1A768BF24C2BD33AA4D95E29F3236220CD99AB

SMS_S pbws.jfevkqu.ofdibv

6CD1220401D951FE1A7EADBE95A7FC879FF42901CE44D60E3A212DEE2017026B

SMS_S vcfqr.xchmajuki.kowasuxvzp

6CEF4427465924035CD0AF90620A803F84692E038E68492D55643E31BAD595FF

SMS_S vcyehms.icqbjgame.pziylbgnow

6D063DEDD5DEE61E107D387975DBBFBF0ADDCB49FBD524DEE6D9FCE65092C948

SMS_S bth.xfgdyrujq.cqbdiuxhnvg

6D07EF8FCC9D01998DD2E10A449B945BA416FFB9051941960E5E1AF3C0CEFA47

SMS_S yqdpb.nzefcivb.nzpgxutfd

6D0B0EE62FAD25CB4207F03BDBE25E0B844E8C1C300AA71C4AA2FF89F7054888

SMS_S mxvgsi.wtnbmhvfpz.otyq

6D1BED08139512C1A07BF2018DE040C2A93C35E37A3AF7DDF4A71306894F0A5E

SMS_S dra.gpflak.oqjg

6D23B535A939F129092CCC4A3662BEFFCAAE3E99C0782BF04F821A7799AC74ED

SMS_S iejpk.yqksvxltuj.kwypieqszfgo

6D5C722F5A90636380B16BB514E2878DD29ABEA2066DF1A334EA1246A0919037

SMS_S yqs.qrihot.iubvyl

6D6ACB8BCBAE9943F6B3EB3F4601C2B227D29D22A5D6C834A8AED9BB8FF597F9

SMS_S dwlxqm.bjmslarie.ymwkgbzhrj

6D72CE62AFB53ECDDC3E59AC1877288E3B496122812E2206CDCE8CE7AC1908D7

SMS_S erkmfc.mxfkra.yodgpcza

6D7BAA23DF69744816967F83EC22466691B451CD245D3C914DD94AE64CEE60A6

SMS_S nkoqr.apknwlb.huxsleyj

6D8C0189461E73CC7B0ECE9CBE699C64FA7F32549943258A4B3E3ECD66109664

SMS_S vwfq.kilbtpsyg.jxikf

6D951840ED31744AABBCA761219F7A715871E0D503D67907CD911896F5C68006

SMS_S mlf.zojurcyvx.skfd

6DA65DB681F7C30710B3AE21EA7B74617570DDF2E716B3E79CCA0D582E5C530F

SMS_S lmd.rnkplszft.ifgocayl

6DAC3F3384D9ED638AFA2F6A5012C560E20A117A23965B5D058D436145498D79

SMS_S ejkobgz.efaqniwh.etyogv

6DB2C59B72C18DDFD55463F39AB3415D5143B7F4F4D58E8D2D76BEA7861AEF16

SMS_S wiaj.vpusma.dxgvetus

Page 193: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6DCE18ACFB0AD38CDEFB6FE6CFCB1626C63026DE559BC9920165BEB477B76D48

SMS_S amchv.dpykfhiz.qwzlj

6DDB7BF797D5CF53AB70357ADC0CFE36E979170D52C689E16ED004FEBA9AD471

SMS_S zjxlf.jiboldxhc.ibfyoujvtpc

6DFED08D56C8785275C387B4B1F90752B3F50B0A2213ED915041FBF566A99127

SMS_S necft.licrnt.oepajwghclf

6E0DA0DDF1F48E6E027CC454AFB8FD3821C05E3329D900E742F1A2BEDDB7280C

SMS_S hgtl.jbzcyugthf.pqsjyw

6E2B067A9AF50161D3492CA260DC0E8984B919F7B2457E63A7B3638F9236251C

SMS_S wzrei.zfunoxl.wcta

6E309D04E221551377DA204054EE3C4585B7683D99DF743C4FCD1BE44F9F303E

SMS_S bvgdc.krmljpwqc.zncwqj

6E379953B1A2BE04A42CDD85B7664EFBA2DDF3B3AF682A695C3952F0F6D6CECE

SMS_S qeurov.ctbzwg.xrqskwd

6E53B8E009C23D501B4E914A50394B23AA7D7F679B335FE1D7ED7AC4201C9047

SMS_S swqpn.iurfjpbazs.qdwehiabzjl

6E797C1DD58B7817BC45B8951E1EF973ED609126043EE785E670FFC5F996722E

SMS_S pqwh.rwfkqhd.ehymdxfc

6E924CFCA2F119CD8076B3BE31D6919FF1E95A7A39060D73E4191E4318EE54AF

SMS_S gcvis.ldmvapwx.pqjbmutxz

6E9EBDD13077B262764B15DEFC5B59701DF6FDD6163DA17B29BAA48BFC58DAF8

SMS_S ilgpw.ounjiglq.gyvrdkzutlm

6EB5DB6148B5B4AF1F968FDD03F57A1617FA5B70662AD5A4A76AF28F7368CE7E

SMS_S pfmeq.nogxfeuz.umotjwprvci

6EC7215D3BF774583E7DF34E0A1E4D7AC73725F05796F3415A06995DAEF8EAE6

SMS_S kqf.gmtfpwoab.fvabdijwgy

6EC89AF6D43CFC5714818A722BEA84A4B0B512B56332C05056B4BF38AE6783D2

SMS_S ngosyp.nihuaymxdv.mqsoyu

6EEA276337F7A58D80BE3DC3FE34FAAC65760BD977954F3ACF84099B3A196AE3

SMS_S tpgraqb.bagnidjvm.wpdjyo

6F060761D60A254F5538BE9E0C7E181AB37BB1107E719F96DA158FA2EE33F75E

SMS_S pvmz.irkgxf.qydiuoahlzk

6F12B3C18B0EC291F3B427CE33CC396B8724EAEC5FA385AE22F32BEE057B7C1D

SMS_S qrp.ytngmfiqvs.fvoiz

6F2939988645C82DC6FFA4C44C5C3C9DE910864F0A8A2E619C19500355552477

SMS_S xpvbyl.mzkxwaevrg.zriyucbv

6F4E28C0723D6187C524B38C0C385582E50567E31651246D976861D7AB73F710

SMS_S bkgeia.futkmxqy.xmeu

6F5EAEB788A424206BDDBABB738E147C1BC50 SMS_S dxzb.xijadubec.vfenjdrk

Page 194: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6075B82A4AA1E34C7648D34DE59

6F6237D1AAD554C1257A6A6AAC7A961DC39D862915609F24200F7518B23AC4FC

SMS_S rlztxp.ouvwzdyhpj.bhju

6F8BA374FB538693954ACA22736BE96710DEEF4D68F110D95902CCAAED96F5A9

SMS_S prteay.jdpafzvb.gxyl

6FB1DDCEB828ACEA8E5A2088C2E3A3FCF6AE106917323CBE80790B77E6FAFEC4

SMS_S iso.ndocftpu.fsui

6FC18417882CBDD41526F7505BA6DAEF2C2C4A6C07B241970103CF6A2653C483

SMS_S wuhy.lagwkz.qmoba

6FC81D5C531F45F6E7218D2E0CB2CBF5348085F9456C6BD302ABB67D0D27DB65

SMS_S hvt.rlwvaozypj.pcilgozhvyw

6FD80A5C86D1B3B3AC7B0C41DE0AA5CF9644F10D7E5E0B9D8390661BFEF3B303

SMS_S vewazbm.kzulvgfj.ogdc

6FE13A6D78E1E1A24C1EF41F72EED28F39A5D8639AA4103E209A1B0E71CF842F

SMS_S sknwelh.ndsjbcai.rlkjphz

6FE48860D423BE6F85EBE6688FF24709115A45837A43D3D3B3FD4F6B5B142FC7

SMS_S wenl.ygsbrmdc.utgwkfs

6FE53A41FE668DE87D21D7406EE7F4266ADF1FD6FE11B610FF2AE6133070D76C

SMS_S lio.bdqzkehv.usimbpzcj

6FE53CD589C7C720C4AE780FAABCA10B5E0DFB2090ECD4C24531581219D49C82

SMS_S lzsmwi.domjkcvwzf.jhkvpwizde

6FFADC7C824C9F2CA8BFC8191CDC0E0A627792BAB7AC9F98C7DDB0E30C5B7B64

SMS_S uqw.bpxdknj.uvwq

6FFC10FBC708298F42F8473760BD6ACADF02862DD9889903A932D7833F3B3A8B

SMS_S mtcp.jofblwm.oanrdhfu

7026243BE4A1E8F0A63A6646516FCFF84995A2AC3F1C3327B8C0E31C4A31B9B7

SMS_S sruy.ujcorx.dupbi

7035110CF8514D562F76092ADC0524843C96F0C75E2217D06566DF9EB27ED440

SMS_S qsclxhr.cfjrqpmbdu.hdgexorcytiu

7036F5A6B3674DF1431FBA0C3AF47F5075758F0EE0026C026D1A2B38C0B78AB5

SMS_S hgc.eqtujnohy.jpbguqty

7050E75A7C7DD55358054486D6D5D79539F619D6DCB553DD53593248654A7248

SMS_S lsiord.uimharqcyv.uglanmz

705278864F21029BD1228F327B3D7145EE259A139E98698DCF4A257A84A6ED3F

SMS_S elci.weogdzls.qbinepvjzo

706D2DCD7C4D225D31B65585EF648C89ABF0967A25351C8A9262B895C3E11FCB

SMS_S pxv.czpnbkdal.aqxvb

7079C9C3561A1489703BE2C6F72D6271C15705FFB7058615CD6C6E3B52B2C023

SMS_S ywtgszl.vytumqd.wmqkny

Page 195: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7084E2D1F71C9B0F097E83A6E31C673B2002FFC8EB8292E09D850811298B1088

SMS_S gzvs.faluvjsio.ilvngbtkjca

709C3AA9FAD172A8F826825649C1E541DDEF8CF8EF73C984C6E79F31FB8CBB74

SMS_S kxdws.grckvfpo.etcqbnl

70ADE8E79F8C2D96C42FCAB4EC750BDA17B7C4BAE01B51E0CB992A6946585AEC

SMS_S nvhr.dgfnycr.jocg

70B7FB7D8F6403C949D6750240173438383DFA9440213B7A89A65F8A01BF9060

SMS_S kcv.vhceznkjr.tqiegfrxvm

70C12E1622760D9D5CB98E07C53A78FFF1BF7D084A5E6FED64E5906F1BC99079

SMS_S eyaxhir.vrwjnxkm.smgodilfenxv

70DA967C614AB37DFF2C2A311E24DEED4005B6D8693AAE3CCF9C6FC7EDEE3CFF

SMS_S wmh.xftzigbpml.svekao

70EB876160D0BC427816054554E3262DB817F824420E88E95D8DEB55A256B406

SMS_S qwzkh.pxstml.agfjypvioc

70EE5122F9EC419FA6E85775DF0D145192A18D69DAE408D866B5443F961AB4ED

SMS_S szk.jvenmlckbs.vtmj

7130E759AF335106E026EADBB640D985791C118F1FED4A20F784EAB8D3303DEB

SMS_S csv.iaghbkufpl.mnuvkqdo

715311C3CA2B4FBFC4D3ADE11A07847C274ECFD025C7A53327E17C5761E1EBCD

SMS_S qnltf.quslyvk.thyjmd

7165F8C4FD074F80450A9FA284A26286E51B5E6127686A7C1D2BD3BF4696D1FE

SMS_S hau.nsvurolwde.xcntgi

71A5645D6BBABC0E23B74EE0D80D4F57E9C282ED6FB25F426CDE93A72E4E2F5C

SMS_S jihq.xbgmkruyw.vftnwmp

71B255977C9C2B34EFED73EFA2D447853C22232850AF355107A6115F5F825AD9

SMS_S xytwm.uzxhgn.avhnxoljrufd

71CACF902F26774A8A01513F5B81E5F9CDB53802787DB9A0072B2944943E4EB7

SMS_S qov.qnpvhjwua.umngqioawlp

71DB45D695072C474AC94245E687E744BD89655692E503CC5B68E6FD407D229A

SMS_S xivcfhu.oskife.dwqnugxh

71DD0964A7D79CEC38387F0F8F8BF7F1BB169B37268271037380529BC766DD18

SMS_S hiu.tyrzch.kwlvmyzdurs

71E74140C43535A772BE6725311A40680E2FA24C37AAB8BB934A9D25D112ABF2

SMS_S kolteh.okcbzsvph.fsgodlqkcw

71F96A4AE242E02318DC38C89D4B89823C56CF3A6EBDC5F2EAA6E6E1714C2917

SMS_S ldpfuir.dpeuox.rhyg

7203477C2BAE14EFC8DC42DE327970914F327E78226CB24A7EC2248CA8BB4245

SMS_S knsgqb.zrefogku.glkvwcjtu

72037D39BE9FD52E44D235021A15D64D792D SMS_S dkaezb.cmfuxaovsk.serubd

Page 196: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D111D021EB30D008FEC109F21AEC

720BBAB59979E6C5F5DE235AC99C9E3F2C599DF1F91B18CCF6E6924FB8DD7231

SMS_S btqd.vowcti.axedp

72363D66391436AA62C44A2DFEC223C7A6864A6495813E9056B512BF4A8349DA

SMS_S fyrwsp.yprdsutg.gtjyr

724FCE6A6148F377B349DEE0ABCE8479BDE018073707D254337FC7466AC3E2E5

SMS_S ojxqibz.zquomxae.tbah

72529CD6E66EF8DB75CC2B1D8EB8117ADF2A01595CCAF322400D48477F18295E

SMS_S idk.mwpvosdcq.pdqarw

725D965B764EB0CE15BD68EE08090F27D1BC9F72402899E757D7F952E18907F4

SMS_S rxdp.lgkoyes.emdvrog

7267CCFC9A90758B5A63240495CDB7A8241314D70C81A876FE769443CC5EAA57

SMS_S vqhnizw.jmxylgcw.nqgcmsyde

726E98D841662CA76132E9249CF6B11DDDBC3F9A9AF042C2482E3A48F13B9932

SMS_S uqxtj.lfmtjys.apebmtz

727DB043508AAF8FFC189401D0F389B1065DA0D3B3066C58144AFB89D5CC9F75

SMS_S quj.uzclrfao.jwntv

727DD9F6911F90632014447C350DBBAE386EC09DCD0A0EC4EB9F4A2FDEA00D39

SMS_S tgfz.svrbflj.qcpnxfv

7287B95B3D84D719824047B8A10A3B0596DBDAADA117831DA43EE4ED7449AC87

SMS_S hqua.caifltvsd.duimpqncgjl

7291653DD9550B0B205128586CD5561A300E42836EB5D644F3EF41D1658E9900

SMS_S pqs.emhbkiap.mwbgcrfvyj

72985E7747D8AA6D3C3F7EC2FD89DC6C84EA7503A81F1AF77D592D908AE8909E

SMS_S rzhkj.ywsvhz.knedimcfgpx

72F0D0174CB6CB5065728CD07F0A49FF199EF9D8996CBDB8C7E596A64BB55454

SMS_S uvdhjb.pbkclmnxgu.trmnlwifbh

72F3B085FC87B6B87AEB87624BFC1152ADF56E8819A3E69E96E681F8CFD15B9E

SMS_S mrqncfd.bpylmsk.dkesogztmq

733F9752A97FD7ECADFA2C02E48453C47F67A40985D055A4483AD368E5847802

SMS_S tdms.thjrvenswp.yxuwcvpftr

7349D850C873E76A68C1392CCCA632D916CBAB1A1F456C3C11346BD187DEBFE7

SMS_S wionrcq.neuvjf.bmuolvkyjfrc

7349F5A95E9E1D190DFE63888CED3F2ADB6D8A6ED075F868EBC1EF0B59DA435F

SMS_S fehcjpv.ryizjvnsk.fadl

73A2F6BC350429FE4EAB8EA58B3772AF6EA1E2432CF518A5EC2F9D012274A2B3

SMS_S unbf.pshqau.gzwhcetbvd

73B681CFC5EFE69652174C8A6489FE7E80B31B11DDA208EB0050C42F1EA92D45

SMS_S fho.etcqfvwd.zcpterwdloa

Page 197: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

73CF93B6B31745F7A17E3FB45E8A17610D6D9B3B68EBBDC7375DC90E6DAC8A56

SMS_S spahx.dnhfcso.kfdyjcpb

73F81E908B2D1FC2B62FB74801F1D4852E60CA90915345CCC78496C322F5B1D3

SMS_S kvenbjm.ukzqdbr.lfdgskpn

7403E474BC3BF92FC62CA8D30314E100F2388A16B8F8E412032D57F63D8AB94A

SMS_S ema.pdjqms.lbprztjhwny

7411F6646B3588CAA50D0472E9B3B0447F591E8FB4D3E81C5D31FBF15B3A07FF

SMS_S amvciql.zfkpcuyb.rjzdsbx

74126D5B3B0DC67AE61E56222EF690539137E2CCDB44B6AA9D022BCE85284037

SMS_S mqbv.rtdolui.rjdym

741EB0FFA78DD37A4CE2ABCF13046FF1BD4958D27D58000FCDF44CE5DE4E98E1

SMS_S iovwmcp.lubfco.chuskfgjrze

742D42A5FBD26D90FA9AAA5DF87E161A09573FBD2526DE39AD54B4B1BD223729

SMS_S kqlavx.asirzcu.qsfcp

743A6C2C040DD86684A660C063C0D13F70BE5684EC518B25D91DA82B2BA175D7

SMS_S aivqm.vhxqkdsu.hdeqypovbtkj

746178E5E655394A6D7C224FFCF4465E0F6F17B801F8223C6F99AFEAC8CF6866

SMS_S rcfkw.rcojdtw.xijcznpmody

746A491C14D73A901DCE77FB759A35156E23F51084D6A1439B61605C31E5D8DD

SMS_S hytudo.keoagc.wqmsovxzi

7473028B432FB547A7346CA6F4EB45491080E057ADEC0FA163D0869FF05B51F2

SMS_S fdpsl.xsylemrkp.qxegbiwumhos

7488ED125C4EF9AFBFC8B191834E91AA7851DFBDEDE31A6D81775FCF73B7F1FB

SMS_S bpmtg.zemcrdj.tkchxugwlqy

748B5734DC6B77F46ACA2FBE3CDAEC1433802CD0019C0748F7C53B4D51179795

SMS_S mrhvyq.qdnvwo.supvdfywzmj

749D05B8D93A6EC06C115161BED9B53006CE8E5CA0FD594FBD503A7E38E11CB7

SMS_S vfkjy.ndqpvcam.zvaeuco

74A357C4808481A1FB717611EAAC850BF765D249C597EE6333490294AA3DF62F

SMS_S cvm.hmtlwxsboj.yvzmabfipqch

74AC2159A6E6A40EAC3AC1966FF6B8383B16DA4049DDDA9ED2CA6EED676858A0

SMS_S wbqjias.oxbyhdspi.kbjc

74BDC0EF5A457340667ED448421886EB017906DD07BDB2A166C20E13C92A8B3E

SMS_S kzlvoi.rkscwa.ugsv

74F9EEC97D4609BE479459514C4B6A2273A7E8B1D4F0D2F5360D3568DEB7393B

SMS_S wgzpc.obxcdtm.txvn

74FB110D22472578A2A1242E93AF5D1E36BE1281362FC5340E948A990145CFF3

SMS_S sfb.blykje.xizwpdg

74FDD9BA7B3B132E7E96DBA13D17CA02A7FA SMS_S xjns.kcesrbfj.xrfy

Page 198: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

CE9A3A16594BF22EA9BFDD32236B

7500949FBA2FC9AAD7D4F128BCD66173C4893F0B106B98BFD8359022DE53BD3E

SMS_S prc.pbjcvfkh.hilwgrxu

7505D3CD4A44DF4DF5536782849270194760EB8F19191A4E2276151DE7A062F3

SMS_S jzdbhx.xybqnutsw.yiouncvze

750C0AC826E4CA6A7BE08A2EDB2601C58022AC7AF71E0DD5140D6ABAC051E8EA

SMS_S ahxjz.foxjtsr.euhdtlxvz

75150AAE2B12E7F4231DE9C3009B1FA49D84E300366A30E89196B6DEF8991C13

SMS_S kdhj.pmwoyd.nhqcjx

7519505754908AF2650776A9ECAF11EB77979A8B4765A8A07BC8B064D01D78C3

SMS_S akhs.mrieqgn.eblsx

752C343E89B9178D560BF8A5E574DC29A190C66A614A167216530082806E0371

SMS_S bdtn.qejrkmn.ftmc

753B7E740F8A81044CC80F98D9E22837B6733C2FEA0E6408DD8C642FABB4F007

SMS_S dainc.tcdbhz.lxbzr

75490DCD7F6F25671678A38288F08E9F3D97B63A312ED6CD73107A86F67D928C

SMS_S dyk.hgaqdusi.symphqztkv

756AB0E560459B85C8C632864B13C0370702A1B90EAA90117CB4F915F2116068

SMS_S tvx.glpvusjb.uynpwj

757B35E80FE27B5F8CC7335A10FE6A77CE8E68DB6610DEE0CCB2594914C9C7FB

SMS_S cbqotg.kjuomz.nepdjgakr

75ABA6DAACF23B36D29D47AF0304F318751AD31A4A2B5F39CDF2274FE0B2EDC6

SMS_S zsqldw.qlgvys.wsncymzohxlg

75C52214BDEFDB67164D65E1C95FEE3346195F9DD1E5315BD787EE54525126EB

SMS_S nbilpzj.hcrmxisln.jrklzin

75E9842484C01B8EB1B57DC826F5A55CF76AE2BD10CE9E861ED033E8B8F979DC

SMS_S yau.wmtbrcoq.wlqofctnm

76071BD7C6999801A11FFB65F5477988E0BA142AC544333D26B7119FFC561378

SMS_S akwuh.xhyfois.jftqkuyszda

762A05A9A740529125EAD83B597FEFE3DB14395A6D8F2FD14712457A8898ADF4

SMS_S kch.xfjopcntgq.prts

763D4B49422E48FD1AFE89563AE524DBB6C7C04C88AA35C3F7AE78C43FB07121

SMS_S hqjy.wvbxauet.mgwabv

765A2916C207A669666C2FFFF2C4445E4BCC5E0ED290EB37764E8977F36CE387

SMS_S qop.zfkwhrejp.quyv

767C8139DCDDF573F8C862A85CF3C115DCEA6CE444A94457A6D629995375F513

SMS_S kebtzpg.gjkmtuvf.yrdzgm

76802FFC9D2867C1EE043A55D2EDF468519EA033F24D6AD296869D64741B2FB4

SMS_S hdmqe.drbufiskp.tfdruq

Page 199: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

76A0AE91EB87682DA805F00B16E8C608D1F282420AA5115758F1DE522F990FB8

SMS_S bipyxg.ltbncdeu.yrvxgcf

76A1B39833F860C6B2289AF37D27A54EB12CE95406C58B758F45A5F07175B2EB

SMS_S xbcaq.oajxfvszth.mwyekjlvsg

76B35116F3F939566185614E556923B0EB7DD479446D55BA5B157568E36DE5CE

SMS_S ymtsn.dpihyakujn.gewuimz

76C1516870719F79F4D5BF24C671E99DF8F63C5A51D2543A8766AB650683FD69

SMS_S bhwsxmg.srpwkabyz.qipkzlxu

76FAD15C108D3DC1B61A48C5C13A7AF8017CE383D54B0B79C048733A9D776E95

SMS_S dwx.qruelpfaxy.bdxzlcaomfsh

7701B748F4B87C4E1CBBAE0F25EE4EA1C3566414A40B90E04A83BB488AC2DC8F

SMS_S kgnbrqz.scjfxgp.pywjsovmdb

771529B729BA6F2499A5743F793BE6CC79CEB07C92173D95C10BAD3A2D3F9393

SMS_S vnt.nruhqcwpv.qctpdmnkvgl

7745E1E10B5E18AB4EA8F1AF862EA136001C1E3109D78BFDCB7C9322B087D703

SMS_S hymc.shwixeo.okmjsbn

7747C89FDC4C35D775FB5FFA35B7258D659D37A854C01220243454B80CFA537F

SMS_S mierwb.pyudjwqn.npecomsr

774D2C1913B52B18E97D5A15A9EC0537578CD692BB07AAD1B93893DB84BC5D44

SMS_S mrhpa.gitezwhc.tudaqoshcgj

777753AC51705AC36ACFA457942325DA034EF3387D4320C5A8C9DD444B8188D7

SMS_S alw.cdolfnkzj.ojbhzxcedqnv

77832013527D508DEA217792CE4704C1DC8FAFF2E8B6401EFFAEA18E5352F9E1

SMS_S kmx.okvaensdp.aqkb

7789FE8FAB3D09BA8D7539C6329E5EDDAD6FD33F2DB1764E1655007C71576B0F

SMS_S oxkfyc.pndquib.ptdilkcvx

77A075B7E01CA2B1A05535A4F346AB1F314AD2A575992FB9300BEDD30730AD56

SMS_S ehsvm.bsfylzdmtc.mnpbous

77AF68070DEAA82530908B6199CAF74458B269B70D4B627DE9FEE808A4C5730F

SMS_S ustqjp.yhgivjdm.vgisjlbhxqpc

77D931845320D6FB24B9B4491B245C8D7912322124EFC881238D590B94D7E8F7

SMS_S eqymngz.vtykujx.wiubjfmg

7817DB897CA52F5CC47819EFB644A12DF13370C0F6D194BCB0C4FE589B72A040

SMS_S hzewo.gpuamid.yifqhe

7821ED4B31FB1FAA1BAED68A15879655074CEA10640735FB59F4CF6CBFD0387B

SMS_S elv.slgridqxjw.tegulisjz

7826E469652DD44423744CE083BBC83E8777E7D1664B81CB0F35E03940954946

SMS_S zbn.wirnzbv.mzkwqevp

7837292A8FD83B194BA9199332C1704544D49 SMS_S hpmiyc.vpmtbr.rpkzitvg

Page 200: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8A5F3848FB785660D7A8D94D159

783733E46B624E594B78EBD1D761067ECC97F14715543E8996C4803674BD41A1

SMS_S slzt.ydsnzwf.srblxvq

7851A6384D19CCEE77473D1A59B5BB31869E22B047DBE43052280937C8BFE684

SMS_S pgkxiw.raskvcw.qfvaoihse

7860867BB55A22CC85B29BC38DC40A4622E6D285D708DA459FB3C65641D8374E

SMS_S aycmw.wveoiqkcl.ahslqiy

78954385FF59263F39E40BFCC57346C732B20DADCA0AFBC2EF3FB31CE3FAB8A2

SMS_S qbjz.ygjwtepr.jkeazhfx

78A22926D8C09684BA4DFC8B5405423E6AD80002CDF49923778F880E09C2ED31

SMS_S kemil.criujoqaky.qgkovljmxcy

78A5BA0D1CB0E91B1657BCB31D09125A83786C9B1331808B952A5AD62F182F43

SMS_S psatzu.ytqgmkoda.qfjbstzcng

78ADE251FE7EA9E8259FF0E13BDB15EF6139D478C155B429DF9ED8D1B5BC6877

SMS_S syrb.yeositmlk.ndbazltcqwux

78C50AB42DA94593A451F7FBED59949CE1DAFED4DF99C63C6CC21EE5F286E83E

SMS_S xghfk.cijmslbkf.muxgjkiewo

78C9301C607BB4A59868C26A711F7004B546B37203515D3C8B7AEB20E1CBC384

SMS_S zso.gplnti.fqcpouratb

78D782B6CA70ED23AD42FF9EC1989B8F227D5AB1210BAC8EE95C93E94A0A8050

SMS_S petyzah.gioaqhxfr.hwqekn

78E0A51D23057565F53A4449B994F1EDD11C1D8E6FD6311CE5BDC16EC792DFE7

SMS_S tmupcl.muigjlncv.qulmvehniadw

78E7557686071E2036D1CAD233FAA1A59ED8C715D646B552F2DE0E15EFF8617B

SMS_S koechjm.hfwjyr.wxfu

78EBBEB399825CE65F7C387170D5098967DBCA724E1F5ED854F59A2D128EAD22

SMS_S yofdw.buexny.rvkq

78FA019EEB49D55B860781182D2A4457F8E7B2F96F15CDD41904E9BEC70B7F59

SMS_S hxbi.ymocvi.enghdpuosv

790AFF09B020F99EC4760630ED2AA6190706E7BC4934743B3668CB5B3808FB71

SMS_S vzqadj.ysuimzrb.aqkdhjlpt

792F1B4F020C2F43EE7BB9EDE7835AD27970D318EB9DB307C27D507425DC6306

SMS_S ukfpr.azdvxto.avjnxzyscki

7937B863BD5D29822E9B2AF961B7BCCCA8B5EED39AB215CB2D57F2DCC482489B

SMS_S bkyeapj.smqjpvohtk.icodmubsfjzw

793A5817BA79F655B7AEA2B7C299F2DC2BB860D196ACCE71F6CA5A3958B8A142

SMS_S tjc.bnxmjcsi.xmledjkhz

79405F00663D1E344105281967BFA1D71127FE9453ECB2645CD99CB3ED646C66

SMS_S knlr.saomli.cisxjvm

Page 201: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

795A117EE6FC568E4849443B771F42EE4D2F796D53D0FA8CAD9AE6C88B8773DD

SMS_S yempl.qutbidnop.eqckoa

795F6D5AD2E6248890B3BC2D92396C5F98ED52EA17BBE9251AF7BBA7A47ED272

SMS_S tmbqlw.xhqfkavgb.vxguzdsloj

79679C25B50815EA241F40966602AB8FF3FCF946AFB211B2CDFF02250FBB5BA7

SMS_S jaerdq.kystoib.qvszeyfkjo

7978AA5F5764F651B97957609391C650BC8872BDA64D377C08C9F9606CBBC12E

SMS_S apvjfxr.luazsrdvon.jxbugcyrd

798616E26EBF2857E0489A3932E60102C620E93E4E5AB71C82847AE992A02A9A

SMS_S kmfy.hczajmexol.wipervzkmon

799FC9A0EFEFE4D9AE340861B7E5AD9BCF287358C4DC87E55BCB81409B41FDC0

SMS_S hbrfvn.xtievyupnr.zmrtcaqfxv

79ADDC25337A3D03FCA4692739178EF8E6AC0FAE2674326A24EB7CA5735BEF6A

SMS_S amy.lywdokxhm.yfmegzbut

79BE3F5E4E6E86E8BA2E201DCC67D2725F87E0F2D1871DD57D48E46FC6AD80FE

SMS_S owuzjm.fqszci.jyzmldne

79C0F91B26A7076E2C1AEA2D3E41A0A04BED1D52C4B730356859C81B419B18FE

SMS_S buymj.jgwnucpvhx.yswinxu

79CE7BDAFA32D625534D83A5A577B25A8336CACA10640C559BF70966D8FCF319

SMS_S vpshkc.seorutla.vtnsrylqj

79E1D6632E9ACE7725B6E2BA4A1F90CFE23A9229A9D4B20D759511E31043A957

SMS_S hparsc.dziwgcrphn.wgmxfyaeiurh

79E666942A972A5627407AA1A8C8D23245A3AD6003119D076F67D95B1D48A2BC

SMS_S iodzb.coqdue.dlhj

79EEB035554D1094D054621AB7E189D98F1ACB9137FE0CB487306C5787F0A48D

SMS_S bdnmfui.ujitbncwkd.elhgb

7A1117F4AA8558D3FC817204B0D008DCF89F106E5264C4324ED7C22A652F7A31

SMS_S zeu.bufiqx.naic

7A12E1DBE9D6B7C4E5FB737178CEF0DE0C3ABED6F9B610E2F2FD23F92C047F6F

SMS_S qpu.nsmekpa.jlhrskmownip

7A174175E2387E16ED2166EDFDE104B2263424B36DAB5257A41EF76586B23D79

SMS_S slw.rekazhjux.ntbwhri

7A37DCF9E91DD9C242665621D7ED21706C415BCD99B59AE85EA519236FD60D20

SMS_S quv.sdwjkpihxf.hlizqdpxs

7A4BE70D5C7B07E2F135DA90540BE1EC1A5A05D08CAFF13A7EA85068B5BCBC05

SMS_S gcokaw.izfwvsg.xwnjordp

7A5B3C811B2024310D667CFE0F5C1297C8893FA9F8C2FD428CAAC203DD8D35A5

SMS_S dmhyebq.arlnhp.mqrki

7A67028A21C17701A18A1A6BCB0CB10DE3A0F SMS_S wsuihf.hjfvnzsa.jxeytimap

Page 202: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E67E2A3211B59520577F251E117

7AA744BCAAE7C0C0EE76EE9FE5C14D5B74DB3BC9B7ACC748A9400463784E79FE

SMS_S reo.xfieqto.mbukosle

7AB4630D8A7A8E3F09E11A8C2C08950EACCAD287BBF9FFFB30BBE555380CFA30

SMS_S irakdxz.idkzyrmc.cinxdhgjty

7AC0A3880A6220690911BB82A0E21A437C83D6CB264F795A09E8CBF7B44D1568

SMS_S jtb.lyifnuezm.vsmruyqxo

7AC6ABD0B6355E8BD173945D4187992A947027A133349EED3A40D53ACDB6BB9A

SMS_S hes.drimoucv.zrwjfkhgc

7AD2AE578A5BC0327A2918A33264BE8E9A41372F5ED3AC12249DB2FAC73917B1

SMS_S yhzfjse.kgicnpt.bmnz

7ADE41F4E99DBAB23DD4F04CB79347C680D6C7CEA2B739670D95CF5AA24C75A6

SMS_S msip.repqkxgma.ykienvc

7AF5AA3F02546E8F3CF46B7BAE026AD044B1BBE16F186F08C44D0561EC4EBB97

SMS_S zckjq.cbxmdkywlr.jqdnf

7AF646A357A6D01074B6079DFFDE690E9AFAF45AA0FCDEB644A6404774B0B4E8

SMS_S zows.qydgjhuwac.tdhgrfvs

7AF88AA8F4A644E62501A3C91DC7983461F68D7552F36F07A5C477D8AEEE79C5

SMS_S wgf.wvrkpqlb.dveab

7AFC13593B30F2E2B1849EDFFAAFB5878E6AFC5C730DA6F286B85F8E97A6B4E8

SMS_S mbca.uyzqsxngca.tqonebljfsxd

7B046705D261F22B783682BF84D5698EA5B8CB948A61F997ECDA1C4EE7E81CD6

SMS_S kavgt.alfhiywtd.ukety

7B0E53BC2013542998B449267E194E626E73DD726E9DA8BEE40EE1B282286244

SMS_S hvmgsr.sjgbqhc.dliujtwgqy

7B0F6C35F781E4104034ED490EDFEDA81D12C78847802A5D5312C7CAAA416371

SMS_S krgiuq.egnapovj.plebqwsj

7B15757487CB4D788D4A79E4038BAB27B09FAE075034844142E4920A91EFD55C

SMS_S mbyqsip.hwomgxz.ebmtwpqlrhy

7B396EC9F379B32453F14E475EC76CCADBB8FC6046EF5C61A221DD5C97EF9505

SMS_S etxf.wtabnrs.uelotkcdy

7B691C58A89E8877B2B59BDC85244696D825892E4C4D4B84E276F4C915680748

SMS_S brveq.dbrfzx.xaoshu

7B72EFA01875AC39D32CA605EE171AE00CB197C6804E48993C9841CD7660E7A4

SMS_S elo.gfleaxtzn.hfanvmck

7B767E9BD6EFCFE9F5D3D8BCD8302A4F9483DC17A018D68523065844C33DC581

SMS_S wxoygcf.mhqlvx.vfdilkhq

7B830E0ACB20F0C8C83C5071E336DBCF53C970EEA6ADC5DB18DC4F008E3F021A

SMS_S bsdax.ozqcnuj.czsqiym

Page 203: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7B8E067DAFC6B016B86A2D4504312CC84A75A756778BE3CE1F3E4E9A4A833FA1

SMS_S kgpqn.tsrmjw.flepyjacosnk

7B95E4149E86C82289A873BA46021E45E59EEE0A4B100274BE27C5DE9FE6E1CF

SMS_S jwfr.iwctxkzeo.lgjyt

7BA66A006DE514F010F7628B509B4F0FBCD09703DB56E5F5639448D013F14DE0

SMS_S ohmf.miyrcnxph.lhagxbrfi

7BAF75089BEA258399E461D3BF377A63600229DDE36FC9134C4ABEBE41AA8F5C

SMS_S onera.hkexiaf.dmeyzcgrlwx

7BDF22B7B4487D349128D33CB234756F7960B82DB242D67F52A7DEEB301C4C87

SMS_S nswzu.tkwindac.ctzhiq

7BFDAA562919128C148299C16336B881DBE5794CD64AD561AEE87FF62036593F

SMS_S puomg.ufizma.xfbqyam

7C0F75D7CBE9C66C7775E552065BE0FC05877B3E984BB4079D7B73832D72CC9B

SMS_S vld.aciqfwgy.fbvgwkueqtl

7C1CF6B06724359E627FEF8A8746C24BAE5F1EBACCA1A8ABD35BAB0FC15F3432

SMS_S cpvemab.urhdlex.dhfujnieao

7C1FD689DFAB72D9FBF51370113CB84D7A5DF9F9356FE8CB6DA9D4CCF8CAC3B2

SMS_S kcetjgs.efgsvuxtwb.qkxzrisedub

7C48699241C011DFDC34F5F0956AC40416FB018FA80B2260B02BAF3E82F7A901

SMS_S sqy.tapyscu.zahurqpvxc

7C51B42F1B3DB83281A4A112D3B89517BF6A043368B3BDF26A44D8652BA9969B

SMS_S acnk.ivrpyscqe.ustqrbdck

7C668A6C80B60058AC42CE093A16DC10262E42E67BD7A689D1E95A5E4FB590AE

SMS_S tjrxwm.kfziecwlu.rtjvywi

7C6ECC49360DE1F6A429D8292355EC7FA8D625B9B6F3C8AC2DC7B5CE2E6BD83B

SMS_S jbcfw.palqiz.hemsbjizw

7C709F278E0368F6513ACFBF621E76770695F5B0B5DB1CACDD025FD312B257AD

SMS_S htu.jkvozytns.dqvw

7C7FD3DD327DD9015C4C5F552A2203C13DD5F7749C5E5FA3BB7A83F72FAF1920

SMS_S ywmdgi.psvtfnzui.kqsluxjepb

7CB17646E8B3F8F2E33C606FD94FFCA47248BE7D710FF5F1241FA467516E5B9E

SMS_S ceyfg.ylrtim.wvtxnkqc

7CD51F282C76817E7A5799142C0BF5DCEDEB9CE32DBFF88989FCCB5DB40FAD59

SMS_S xzwy.rlvbmpkxc.ycjoviwukrhp

7CE24D970F852D67FFF2B1A6ABDCD0D223D4EDF1C03F6BA8AE90AADABD8EE653

SMS_S ftnia.xwbhdvgqlc.avchignoybr

7CF3AF5CDB1E79C0EC18E082199538C632F7CEBAB4B7F3756A068F455C6FB447

SMS_S ifbmvw.axiutgmk.jngkeowfmhvt

7D1C2901479EF1E32E4BC09100B0254D4F3199 SMS_S tngbzqj.yjzeht.pxhmanvqjdu

Page 204: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4F9D67162A4F190C28EC5BFAA3

7D35D029F9494DF525F4E9F4238670C8DBFAAA92224CBB05B654353F2A8663F3

SMS_S gprcnas.rldzqws.bzasfqnr

7D3FB554DC142432E6308563829B6B7682F81DC116C9BD9F481C65C86A5D4591

SMS_S xscifjl.wlonqpmig.lhxe

7D4248A6A9C95C1316C2EBE46415A60F551F612A9B60EC81FE450358A18B9325

SMS_S omgtbqz.mxtrlq.qntvjsykocdh

7D4A9F1C093AD8BFA12254FFE2AA70141CC64DDDD3EE310BF39E2BAC64F5A9BF

SMS_S rsca.idwgktp.bjazf

7D693214F2CFFE90B02E559F4567BC5EFE67E0433B41CC1E035225832DDF04B1

SMS_S fritydl.ycqibz.yfvckmou

7D7591186559A0853DA868490A6A2B9BDEF3B7C585E1DC4CA451C6BB21C2E30D

SMS_S jworzbe.pthyfvqjsb.upqkaslotmbr

7D7772CA7C59C85600F2C95533D6951CED60ED289C935493E618EC77A1DB6825

SMS_S wlyidbo.letkaxb.omxwcpsbvzrq

7D9A83AA4CD3AE91F09238077754EBDD4448BFF896DAE0135EFECE89D5467E4A

SMS_S oujkxhq.fqsljpb.yxepgovl

7D9AC6C4577E7CA8C8D4677F65B66BBE1B5A22B175135B1C4D085F67B916AEAA

SMS_S ecqy.vhelrwjudc.teaohgivsjpq

7DAB7B9E4258165A7E355ADE3D79B7115619124BD68F7B45C482AAE7D54C2461

SMS_S rjt.zvcdpnulq.bmnhki

7DC90F8CB35D7A4C2CAC8FC49AE1493C18DA80770EE4C1391F3DB84DC20529EA

SMS_S jtdczvs.nfkteyg.abgjcdft

7DCFB72DF14BEBC080A7B0543B7CB897991E613E1F0F23A6452A0CB61E2BAAC2

SMS_S hfrnatp.taqgcm.ahbzmp

7DF8E4B29FB4DB599E1971045C6B205AFCBE3DEE8DF9A73714C567978F4A4425

SMS_S zxqkegn.veypizd.ahdg

7E11198C1394D6B83EEA3A24178BCA9A7242DA17BCC46957CD97DB45C62A2CAE

SMS_S crdgwhv.qxslijam.ihrkdwxfvu

7E303608A321400A5DB611C506D584C6CD869CB619F17EA56EDB1B425CEF11F7

SMS_S wbhd.qwhbtnyzau.ajvn

7E64E40F845F152BB443B12C1AFB0C28C839AF6D459AC0502989D569BB59FC5A

SMS_S crlqp.nrzkeyij.phjryzi

7E9071E480F55EB71B1A96DDA8AAB001E3BC16F8B14A9A9F1D04B6A727BDEF6D

SMS_S nti.spbhwqaxmy.ehfyonw

7EB6A220591FBD1BE0597C6F08807251FA8911CBAAFBE90C59E6C2E25610470C

SMS_S sxzl.vuqskthlia.ogvsx

7EB7C1EB2A36871E2F3D740C85CDBACB5D968BE8B65EDE4C1F65BE61758893E8

SMS_S vbn.jnpflx.qndhea

Page 205: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7EB90C01178E0B7CD29B25748AB92E892A0B5A4C2A19F268461BC3D3632DF098

SMS_S eltwqmo.ujmhycedxt.duwj

7ECB1016100B0D9A792C302BAEBEFE28D0D630F19152B326FED8D02544D46C7D

SMS_S nyiuqw.kbxcpaqevl.acyfqumgpibk

7ECB137EBC9CD2A2750E3732F592A4956CD601D6A319EB245737FD14CB35ADC6

SMS_S rcnzds.rseofutvja.uckw

7ED0B5FF25B49505D3A4B71517F39C1D9F5DDEDA06DDBA406CC7E786C0079035

SMS_S exw.qyfkzv.mfuob

7EEA09FA164300A4E513CE88D75B14CE5BDBD8DA5D20A092FCC1FF4DB8BEF631

SMS_S fzq.pcjxtkr.ctzpoh

7EF9474A7EAFA410E084D191B99D0B9839F1CCDF3C277D23E23BB1880A587287

SMS_S dwxluj.qoifyw.anoj

7F08150972224CAE010B597EF5EBBBC3CDA43807613BA34FC122552F1BB807AC

SMS_S wipax.qfarvc.jehdpkx

7F1CCA80C2CD7DCA67CC4B6C9A1F61740EA59F5BFDBD3F787E0CF48C82457D1E

SMS_S tfprxak.ercvadlwz.gsonv

7F2CEB6B6A5A207DCBF4A8ECE9137148BF9BA90E845876ABBDFC8D6A10E4E8D0

SMS_S vzob.crhpyigxj.bzouixnl

7F30C51C8A40DADFB21987621E835743493F6BDB669BAFD57E94D1E2FC58EBCB

SMS_S opfdb.bldnor.mpavlfkeq

7F6712DE636A485337D1447F1BF4F36CC7E07B79C9CBD8F8BB1281086A770CB4

SMS_S invsjpt.afjsxr.sjwgc

7F68E177FA56BAFAEC97847C1F5F92C0A630CB2D6DD9B8381B51EDF666F14228

SMS_S yzt.gciamuq.egrypaxdfsi

7F7C3336FE0AE9A7EDF8BB30F7AFF8A9577E3C1DF1903A31596A0FEFA6005B5A

SMS_S zchtum.lfdrvpcehw.ectfjxmrq

7F9A3D5D72C96EC70E9DEB8B90F462D7EBDBAF1C1C41EC9D6ED870DB00D65B61

SMS_S kzhrni.jloieyazw.uqnfsbrlph

7F9D29E91D98745EC3B56225F4F2D29F0009AAB288974E0104D72E8A1F4A2FF4

SMS_S jdapls.daekpl.hcojlzikep

7FA8CD364A6ED31242867D7F8ED602D388F2D9397AF001BA6205DB1DB2C11816

SMS_S hadl.dsubcyp.jnebqpizmxvk

7FAFADC01E529DEC108F4CAA244DF7EDD9FE61713D46DA665A52E4BF74303670

SMS_S nxp.lpzbgvsmjd.ntpdqzmcrfi

7FBCA8DA6CC3CEED4FFDDE4CB3EF11F947F7B69C8CF83BD7E3F6B37E808DD20F

SMS_S qdwfok.vwieygzfd.vgich

7FCD0C4342ACBEF9F75F8A2C3E7092AF076C9E5767A5A1A8BD9926C44346BC9C

SMS_S neodij.npqtsojc.inrokpyeswft

7FE87FD251D5DC1440530CE1CAE2D2A22E108 SMS_S paxus.eighlrjfyx.xrobscmkdw

Page 206: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BF88C32B101989E3BB51379F2CA

7FF5ED422035CC03499857C64C3F07891C91AEDE1BE90E443A45C35019367603

SMS_S ludmrb.nqpoufxe.ntgefyqo

7FFCB7871DF4136FB8F28255FB1C2A1EDC1DA075B0D79FEE853276C639132123

SMS_S pfw.hxpbiwtycv.vkdlitjphf

80174506EC24870B5C9D5FBA90687049C3A74930C98E85A7B98A251FFD2CBC5D

SMS_S uzy.mrnukci.aiwc

802F4A7397C1E465A9619AB68A11668EB6F9ED850801168B0E1DB88C8C1436AE

SMS_S vkwcxz.lcjnkv.rpthnl

803BEB89AEC56FA4DA4914018C714AFE44677B2FD0325C33C99FC33E83FCF3BA

SMS_S ezht.jlhfeoy.exntbmahgw

804B0DDD0D0A0A9CEED85FB6449F5E2AF8A706EA6CDA32E847EE023705DC6EE3

SMS_S kyhxadj.kcxqsmurha.zjapxqmoiw

8088A8E52B8C5E78EE35B732F160B5DA4CD22977B9D0F1D7932D1BB7C388A6F0

SMS_S nrwcb.dpacwxugt.amtveuoynkqh

80AC061F8BAE12FCB8E7ED4355FEE1287AB9961B94593BFBFC60E18E6CF70A90

SMS_S tbw.erigjzvk.jhsowq

80BFDDC8748E9DA361F1767FC4CBF61B957CFE6AFC56286A1ACE5328A6B3E7E1

SMS_S sja.cermoqvjf.owdblnje

80C2842A2F289CAE70BA64DE998FAFCD2A40B80EC986A3C1DA1EB6FEA4576D28

SMS_S wcu.onmsrbt.zrlyuhm

80CB155859C7A6EF408A778E77D5EE04788995EC7355E2AC059741E25F67AA99

SMS_S xmlav.csthflrb.qcbms

812D0C611ED02F5128B917C7DED11127F28FD017F6E0971970F9A60D16113615

SMS_S tfybkch.hxqedps.gruofspv

813FFA98489C731BAD6E6E2F286CCE36247FF58F66C283148F579557E8DC4068

SMS_S yvtdb.uqeioypsvr.svxjlytu

8144171F81ADDD3F3842DAB25EF4EC014B9FEEFE615652CAE49E729C59ADC0C4

SMS_S rwy.vyhasxcuon.cgwd

8145B38126CCA9DDE6408E1F80A1FE1E029F7CF43D97EAC34A44394E2ABC8F4B

SMS_S hwzg.jhqipgvn.dzligrmy

8150D0D43F953DACB481C2DB5537A17E2B328E1018DF50C8094DB571CFF7BEE8

SMS_S johx.akdfsntj.hersxb

8157CD890D60533499D51678E65A5B9D5CB172AF1000CBA8F4AD8022AD3E045C

SMS_S qeadp.eytmnjw.altkryhgvifx

8163DE73B64E49F816DAA10385EB5B4DEEE4B7AB3954E1CA7F3C5051F3AE3B36

SMS_S zugm.mcvtiyg.cjoltakx

8169EA28D1ECA9203FAF0F1CF3003859A1BFFFB852AF9AFC56428BAC010747AA

SMS_S mcg.usfhcwlob.cbvnolaupd

Page 207: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8198228B61E298C1489DCE4DCC3FB3E21083CB8B9AB57EFCC920844DFCFFC033

SMS_S epj.bhazylur.vwdumzc

81C703E8C2BB857F866FFC1B9E5178C954119F656942B44CFB3664906F55C0E1

SMS_S pexuts.czuowqfevg.xyfqhjwiuna

81C93F76E688EF0ACF7868702323D0CA1B1785DF1B9FDCD555D0B6B88A4ACB45

SMS_S pskayij.itpwfvcg.hwxykorbfv

81CD6471199016ECF51B07EB16FB5F275FBE6CECDE66972D6EFF1FCBA95E41AC

SMS_S rpq.flavjimdp.kolzsyew

81D2309E6161339D301E0C2CB4613B474F8B232469DFDDD6CAC21695C1AFC77F

SMS_S ljw.kepuhvxtb.jqvbohxcfwky

81DE2E9381C736868B6F048EEB85B1B1433F2259BE52AD313839A4C9AFB3F7EC

SMS_S fyips.pcsfkjrt.vmcuqy

81E7F057A852C1A627339537B79C6EF9A25DB97034A44C2860DF8E0AFCB4C1B1

SMS_S ugivsml.qntezwi.ywpsfb

81EE4C00D23BEC77C4603EDE2601D8B34ECF6265556A180D2487092E814D7F1B

SMS_S yinp.hsjlfrniz.zospejtg

81F6292E8E6F39A0542DEA1782D30704FF2F9D70B3C41B3EC5243F3A67D1C2F9

SMS_S coitjvr.gpizdbo.samtdo

820111551C1182050D1CDE202FF01833A8EB8D8C11DAFA65246E7BE5BD980257

SMS_S pdenc.cakpbuj.neyut

820458030EC01601DCBBB2715BCBFD114002EA865F4059AAE7A004E99C2CBCFA

SMS_S hcwuz.lhxupcmb.idpxrlmzgwhs

82045DF43AEED99D7C88FD6C8FDB59FBF2C955E625E20D080487A33184A9E4E0

SMS_S ixh.wxztrjg.wogqzdxn

82060A24354ABB5D9F5839FB30A094827F2B1C3BC23A2D6F6C931393BFC36E49

SMS_S wtsha.gwfptknzcq.rpcvqehun

820F2C627E916231743486BBE3FC35F9A5224912D4CD803134BCCCD9DF48FCE1

SMS_S rvukx.sevyxrgzmw.mkvhdlyrusxo

82265D0047D0433E5842620B49538B34387C4E128771CB7671B2B67586D12A22

SMS_S wxuasz.cuedmqklxp.stdn

824392C898CB96D77E34434F4FE0BD5A09643D9699F8D366B9ABE4C3B2553BD1

SMS_S ctgpmr.tqbwsphd.gutrvlpxsfyw

8289CE7D562F96363D394E783FCBAA016CC2AD99B51D93D9DAE5A7AD991C2F4A

SMS_S hxjylmp.tgrwyfsl.anewupf

828D6F725E47DE57FBD1FAC0391E08DB31E30CC66D8FA2144A398ACBCC12D73A

SMS_S muihyxn.uewiamr.lhbpcqi

82934B1BB7CA7E2573F060383B00E3553F58C20E69342D1B8724882A0356CF97

SMS_S vtgh.enoiuq.jxyvlfe

8296373C2C64E07F418DA91DAE5864527EC79 SMS_S ewlspyn.tihkeyac.chkzlx

Page 208: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D9A7F3A7BD92DD00EBBEEE488EF

82A12759AB3E708EE546E942EBAF6FEBB5AC316C449C06BEBE75FAB522D7063A

SMS_S crdioy.bpvmoexz.ifchtjqeysa

82AC135F72FCEE7C3109BED21D3E2C3FDF64983F1FBB7B14F6F692936048E950

SMS_S elm.fbtawzpj.ywtmd

82BC866BD6A835B30523D7679448B80DBC6453D5AD0C565CEED1FFF7858F61DC

SMS_S stjzfb.itazuy.rsglcjp

82C33CBFE057B393B21A0021EA3D3CE0106DF06E6D54850110481919ECC57EC3

SMS_S gzso.vjemrg.yzlspxokb

82C523E3C081915B9C7F7D5C4FDDE94C691A2ADA397CEF66BDD0A1CA6535C94C

SMS_S boe.qlkdrwm.hucwgmk

82C587DBCC109993615C7F2881B59448690ECB90DF66A2A4A468DA07073326D9

SMS_S fxklonq.oigxuaek.plegobhdsyjk

82CD4DDBFDD5689E20FA4DD3EADB55B96699A2F3999E18A111B9E30219F1B427

SMS_S dws.rxtkopud.dlyksjfpagx

82D6288EC6DFCC63E20B94CA63BAFD1F2AEFD557A547E9670B47AA9EB152DB01

SMS_S icebxsa.sqyxlrczd.mkjly

82D784FBF86CBA576DA62F9EC3FDE32645389ACC2FCFFB7CAF4047E132A66A3F

SMS_S ikubztm.gvsoajrpmb.hpmsvecqyokf

82DE8AFEDD3667A8D9571F6448177059FD28C51293AEC3791814ABCFA33D1958

SMS_S hyl.tsbzylim.rzguy

82E5CCFD53AC9C0574D2AD3EAEC14437BB4E876BBCBF7DF05F4E1D4F91B94E2E

SMS_S imfp.dxqacgft.ayuwtdfpko

82F0E748F8787739D91051FA826632A048812384D217C9C40F328FC879CDBB06

SMS_S ngzeayf.ibljkq.ukas

82F4C4E0260912961CD178DF89190F0743673F5A7781EB71F7A2B40F347A60F8

SMS_S hre.lrgqotcsvm.czbpmqoewg

82F920E10F2FA0062A1A7839C056C79F72C5F5AAEC021A4B8C2306605C40A5D5

SMS_S tev.lqaczojhe.tsdvgozuirp

830AED70EEBAC9A9DD4A95F9810F145D526778AA948B37B7B28B43363BD5B1BC

SMS_S tfyvxuw.kipqlhse.wubejgo

83387C472D26BA4F32F796BAAF32F716526A2094A122FC87154A51D4A6E8C1A6

SMS_S gutdqx.tuopqlyz.dkiohbnc

833B92159E3329DB1B96B04421BF253E8CF128781F6A7099CE786ED083AAF21A

SMS_S puh.bdtorivx.ymexq

8369F17DDA308E338413C58CC93BB89BAA8E412765BBAE89F44DA10327B701D1

SMS_S cap.onivbt.lsoyec

836B566F3B41542BF4391205C2AA4CF4F397C1EA0F044C252E738C8041C64A50

SMS_S jlquzhx.cmuvpt.npfhwc

Page 209: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8376EFBF91CC426AC7DB94AABBB83024F446F3CE413394726355C12F13FE8F60

SMS_S ydq.yovzagrbux.inhdb

83864FD413E49365AB347459B54CAA123536806FCFF36BE57F373503A7FAB8C2

SMS_S mck.nxrvob.hqncgsrkovj

838B701AFA9B9969EAFA2DADBECD2E78224A8018BBA853A65EE1908A01E4B53E

SMS_S abels.hocezvas.jtkqysrouh

83B2E8B7A74DAECE5287F072118DE7B6D087449559E691459A6EEF6E7ED9172B

SMS_S ourzl.cmeqgfvzai.emcxrj

83D3E8A83CE3092939070143F44EE2CDBA3FC9BF765349261337AE3D9EB09EF2

SMS_S rusem.dtvzna.fniybexr

83E7822B15ED037489AE4B6B61529A7D18747750C23EA747C4423C895CA33901

SMS_S cnfubx.aolesm.dthsgvpun

83EA53730A3521E14AB1663BC682A49D24C662A3AEBD7E6164EAE2333F253FA4

SMS_S ktfcpu.mgeirld.tklayfjcvui

83F1436063E2F06B71B1300F9310116A14EA97BE59A1CA25D88D8B5451012898

SMS_S hmvtjl.hoipyvfnx.sikzle

841B17C0AC201843A0DFD8EE0077285F3663FD0F97ADC56D0C0E21D33D9EB6B5

SMS_S wfik.vuwezj.rewxih

8433F1D27CC0DDB73DE853F3DC62F5869EFDFFFEFD3C53F262BFD812C7238A7B

SMS_S gpaewr.fhxjbkcd.cxbagl

844A887A1AD4C28CE8161F472C876F8DD17475BDA8D1ACF46AC0C0A53959C7BE

SMS_S irjybs.osdgkf.suvg

84667436CF322F777945B8CA6DC449BD642DACE8BABD5ED675C92F40102672E7

SMS_S evhtj.ghrwsdiaej.ouwflymc

8471F3DBDD96CB86DA3C8D0578A44F9E39EFF996401F0783BC7D5573875B90AB

SMS_S lks.qwntsu.tzgwjkocy

847601C9B196FA6DACB60601A5478D10324F509DCCDC51B37B901E15F4241C7F

SMS_S luwoc.qzhbtvdg.ywjknhdazv

8479D11A0718E53E1B9D6D0DDE8BADC35ED3323486758C58C83742E2D18E7482

SMS_S ozck.xhsnkpd.carvjuxk

848FDB7B0492D11B87B1BBAAC1074274D885C2C2E5D6EB0D8BBBD6FA00B71E02

SMS_S oqkwgjn.qfoxki.szvuglfrt

849A257542034E54DBFF0DBC158D36FE2D07552EF8C37CFCF091D555C0DEEADB

SMS_S luyoxw.nhpvwxsry.nhelfkyd

84A3E9866192FED91DDF42C6A612533C176A63F20C3187C6F9821D7A313600FB

SMS_S cqfa.dxepbhc.uzyem

84BDBD0671B4BD97CE797C07CA048013A09511E349A91CB6B25BBB3780158B3E

SMS_S mvzfdik.bjepqodfln.zxjplsyha

84E401DE6F7B2E9C01E821BCDAE27A82AE0C6 SMS_S vmwy.fgclxjpt.ivtyhgmakfo

Page 210: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

71BF107171D4F01B3E9E564950A

84F02F6C59E7BC75B07FB98FE0AE25267537EB2C8A0A772775FF84FE461587A2

SMS_S dnbule.tslmxp.afjqzomkprgw

850ED88409AE84A4EBD87B9201941B6061E224ED3D6EA44D13D10B527A3DA8A7

SMS_S chksiu.fgenomz.cvysfiuglrh

850F7AE37DEFD300354B5D771A244737CB26E885855F79B560C9AD0149CD7904

SMS_S nihl.dklrsceb.akjvtrxmp

8514B47429CD6A0117E8F6E2C678E8375EB9A2A6F868EF9AB6E526238EA274A0

SMS_S arvlk.uyordwpcli.vreyso

85522E2CB6311AEAC6A16019128749BD74E4CF1CA1028E45C6C1876EFE7C45FF

SMS_S cekni.bghmyifvc.eymfvhrjiqu

85712D155F5632BF22D007CFFEFBFFEF885E06F90411FBE121BB2E1F38AD0803

SMS_S yisvdz.iyhotqrcvs.zievpyng

858E9D0C4C0C4F5F35BDA01B0129666D5CFBE888C3A1F95CDCAE668F5BC1F35C

SMS_S kcjr.wjgyaslh.jxulsgfbqwha

85C2FB49F26C899D032B31CCA81A00693A274DCC6055C4D17F35132146F1E3A5

SMS_S kqvaz.wycrzsbmp.tyeqlag

85CA6688E99B08C22394F9F62BE45CD57A05E2B1C7878081C7E50A93E7D2B3E7

SMS_S qsdy.vtaowed.evqm

85D3010EDFFB92BD26E6440E6D344C11859949BBFFDC518B73AC44876821E723

SMS_S pwk.xvdhaqys.jwloczybpf

85FA8ECEA2DF3D6DEF4DCFDF36A93D7DBD22BDCB887D4C8D6AA73B16AE6EAA12

SMS_S raqf.mfgjiw.atsgbro

860110150D88B0DFF10D0D74DD002BC0154714620226B6BC1386397E6009A350

SMS_S ydrua.srtyio.kqzjvwxhslp

8601F4988AD6173AB5DEE3EBC89C44703776651BEAB2DE80F93C3FE6C7742FB8

SMS_S tqzm.bkedyq.uvfhidcybz

8609BFB4F862827A951B870347160123E596B3BC3B7CF3CEDF56F1864960AF08

SMS_S vxgydsi.rfaqwsmh.vsuqyclbin

8633FB117F0317C884AFDE2A244B9071615CB09AC361D5A60B437C5383775371

SMS_S apqkcfe.nsdfatzy.bhcmkopxlts

86359D685856E85B67A1EAA76C0E314B48D7C246253BD083A1B438F08D94847E

SMS_S etr.nvxpwfe.hegcpir

86501C367116CD1E6A5EA12CB8DAB08E41F9EE451586C7860734CA2DCD8830B7

SMS_S wfdhsk.fcblovdnr.hdemwrqtkba

865A3E6FAEFBD1177E694F21F24347EF3A0909A836DBA32AAE036DC1869FFBFE

SMS_S ulrsynk.roycugmaqv.mtyp

865E847C4A67F0B222075F3FB8C327218874F561BE4A6DF91FA8DC272781A825

SMS_S ditvbf.trsqmngow.upmhsi

Page 211: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8662918265CDC21BE34CB832DBF371417FEFC840C75909609D5BA5A92C13D381

SMS_S jgvw.tucsbamr.jhfsgxva

8668A2232CAACFE7D222B081EAC39896F1DF3E770FFE735503570DC7F1A7FBF6

SMS_S rdbfolm.gljxmue.itnrbvxw

8672F62BA3F048D93545FE6CE166C5A7A9BF94C2C4B26839F48EA690ADE2DF97

SMS_S ovyau.ghzkea.wijyrnf

868D0700FC0099CE677581D87C6CBAA9122B6952180E3C23754B99F6957414EE

SMS_S eavyop.oyabsickuz.iwlrkzpgoy

86A499BB6FBD83136BECBCE98843DD640BC8C8474CE1F89C119490BE7AAF801F

SMS_S rephw.ormbyqe.clpx

86BDF36E2FCEDFF86502601917F63E1FDA9BEB96A52F03A83B8B79F2EE5C0EC7

SMS_S nhx.dtgzwsvbyk.hwgyzxedcvjn

86C9789F2F0193F95B5E15D2B3473C532851A6233AC4513CACE3EF654684A325

SMS_S bnzysew.aorvwhmnb.wsfouyimhxnz

86CA05564C29C30B4B63EB075E60E7745A5DCB99F3F67532CB8D0B1BAE945150

SMS_S hmj.lmukgarzd.pxanciwov

86D04CB664D2AC2BBD555BAF932F5B1C48D30DD9CB28C6A464FC266C1CD03C79

SMS_S xgae.uvkjcdpx.clayekptn

86D109334F2FD8CE563D34B39273A9D54FD45E9FF5D686A471A1059A0C016D04

SMS_S fedtg.drwbtyf.prngowqxtm

870F29D1FEAAFC18AC69DE84495A854FA3D24301D649175FA18DEC9122E411B5

SMS_S lgs.stglwbqkjo.fdwxpyzg

873098E3D691D69222BB2D3102E3492BD04566E0898160EA5257A8E7BF75056A

SMS_S dzjcn.fiagcjkzw.xjlmir

8735D38AF84F5E289962A4D5F5234D04EE9EE7F90EE6E49F12F35AC109A78F7B

SMS_S xol.xtmonrhfq.riky

8746DC8AA9E8DA4FE3F4BC932D7E7E395B57D6E49D96DC45093DC18D1B3DCAA2

SMS_S rgvxhba.kdcseprnl.byhp

87802C008B21194326BB99D3F95605777988AEBFB04841EAB34F6B2722A01242

SMS_S spie.wprfdqsgvu.dtrcqye

879E9D4E19C16D4B1C23DBB6599D0F9C797CF404DC1CF8387E5BEFE694EFBBFF

SMS_S blz.qkeurpzn.yftpgocqzeb

87DC9CB737E1FEE06EB504D1B877FCF76C405BF9617607A74FDB06A5039F9F4B

SMS_S kovdmx.qldtkjg.nxyzjwq

88075164FFF1060119743495ECF9F6B71C4E0C228B0C56636A5717630A993CBE

SMS_S uski.boavcuf.pnocjgtbxvya

88116E6B73A91CD39C7EC2FE8F5CF0A58AC9BD9A8FBC7F7CCB5C61645A33F7DF

SMS_S siw.njxezvhd.busxe

8825CA6F0AAB773A23C979E48A199DD048E16 SMS_S zwjapek.ndfxvob.hmtfvkqa

Page 212: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D7CCE00B09CF921BA179AEB87FC

882C931125182C952B117ECAD4C69218E96360F479FE959EE2F985774A719B4A

SMS_S jdw.wqpmkbt.zjcy

882FAA8977A6248FC3C5FB0B6EFD57F940635F32B364D763612CE82574F90519

SMS_S qlu.htjyokpbcl.pvbltkiwo

8844A198A2DB037B15C21DA2A40C904BFB0C0A3EE0B183AAAC97CA853F7263EA

SMS_S oudy.htcyxp.pbsazqlt

8855F07592ABB09C02259B23E81BF287863397A626C911114921E8C6B8D7ABCB

SMS_S lij.xtkqfmdzl.hostwiuda

885C53AD38ED939A7DA0FE713ADD472C4B220C232088A1131B339288E91EC245

SMS_S yzbtgq.scywbvlm.knptzxv

8867CBA5DAC4863A266EEF4FDBC73D7F6DAD873165B48B0F6D096ED3D1E2FB3E

SMS_S octnvs.yvwljmkfi.dfeoti

88743BBE4246DE944238958B2A6CF2DD5791FD41D8C7304B3D8B8134AE931001

SMS_S bsncq.vudjobsxt.wgrnb

88845F0DAC6BCC3A052B10CF786A8C2C3AECAE2AB0CDE032D33D98B0139DD42F

SMS_S hovfcyb.ebjlrvn.vyomjxtregsd

889896EA68A7C6D4D50896B8F2E28CF72CAADC92A705083AF126EC3BF9A925DC

SMS_S piwx.ztrqklef.cbip

889C2373105A3BAEF857A2D3D6C0D2FFEC84B0E632EE24153B135721FECE61A6

SMS_S gaq.ibohyewua.jsez

889E9B8268326C5573E35658DDC2E68B9EF557ED100A1C2D6779C86CE466EE05

SMS_S dzshtjp.zcqmbeypr.kyrpuwieto

88B0779BD6859474086868C7D7464B948B350F76A4CE224D5C2E35B59453BA6B

SMS_S yajsmqd.ghlmtzov.tfsrnxpjvb

88B23A0A30CC3F72969B01FA612A460BE1E03DDD1504A5A5346227905C1DD52C

SMS_S nkcrj.yfedbj.chfgibkx

88D4DC0627EAEBCCA6A006297061913A918732FED40CE255C509335A59D6D43A

SMS_S gkvitdp.otdscql.zlvyckniru

88E0A74E5E0315C30FF50B9DCA06E59F1B4F303A2204BB4A4217A9260575C516

SMS_S wtugjo.bxqfvt.umcrqg

88E63B180B12329D9192681C2874BC0D0E693744B16BB6EBAEBEF474ECB4E859

SMS_S zbwdcio.htjykgeimp.lbzt

890D5E856BDB8B758E62E1A442B7C4C0F92607A9F4A284FF57E5A0C2F5CD3F17

SMS_S vfbi.iovgeajub.ueatmcg

891BFE3A6E74249F137B9334314C881A07D92686BA0983AA2E45C086B87689AE

SMS_S bxlrjtu.bdsrutf.hmcuqrb

891C00B742BC905389E56FA6253C23495911ECEFF4B90360E696ABC4A12140A5

SMS_S depofk.fmbcnjxs.vqupr

Page 213: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8946D112C70612D29467C2FF2927265551B3322549F70A297F6C558DF6BB9034

SMS_S vjey.idgxjqhb.umgrcjiktahz

894C9C5B4CC141CAB896D7B9DDF395C360DBDC5C3BAE324D7715DC33029549EB

SMS_S loa.iqdpozulx.sfldq

898DC04D5F628D6D60E67CCE596F9AB77DEB4F937321E0723E9629D9BF27406C

SMS_S cbsar.lrytdczub.uabejhqorim

8996883DCDAEF04C028FD695ECB88D2ACAB7F73E4477FD5AB0EAF2A9B4A109D6

SMS_S qanwdv.hjvsem.urbj

89A9BBC6168D5C249EF8CAA66A5FF1EC907A40E4D096DE19CB7ACC0BAFB3EF55

SMS_S hku.hfyoanet.mvsjfhocbype

89CFCD36E1F070BABD7419256B59BF170EE1BD2AE9D1DA576197FB86E3862FE6

SMS_S zqb.gbrqihpto.mnvfahcg

89D1B765446380E2FBBA06C3B7358326A218AA1230FABF845A0BA94900B04487

SMS_S rzxuca.evldoyhgk.sucldgf

89EB368D6F85F5CC6159368E713FF8FC7AF3050F33EB22C1FC62444B7F04A300

SMS_S ebvtkp.pdymgn.kgzundv

89FA154B9CBA211EEFD59F04CFC33E5C8C5C2293DBA901E946C1D43DBC7A7367

SMS_S lbydkz.airzlku.klogpfwba

89FCBCC1A4E73E45037D1A4D29A7E368E06C31732A8730E172E93F9C4160BC17

SMS_S sizl.mkwevbsafo.svkzgwdf

8A386811D1B3FBFEE3818DDB302AF6C229285374743C7133E104FF9FD17228F8

SMS_S hgnzoqr.mobrdutlz.gsthrcykli

8A3D0B875274F79C217917394EE061800A5699260D7E6FC991BB4811FEDADEC8

SMS_S zsf.cgaywh.ault

8A470EA2B9CDC40FEA4216DA7176E2EAF0214A69767F1A3DBBE1BFB748DA254B

SMS_S xau.erglhkj.wrlsogpxa

8A65D940F52F268F5167E3FF936864268625F88E18EB1AFF26260CEC46D92A84

SMS_S lepmzai.npaevkqz.qnzgm

8A67EC04F5B8988CB6A54748DC4634AE2CDC9FFDFEC65C3018AFBBC502ECA482

SMS_S icu.hidjulvs.zjlwmvquec

8A6BDEB8899C60A122E13B486CB06B202C43CFAEFF363049030AA5540F3DAC8C

SMS_S osd.sdloza.dnzum

8A8A3543EE93188FD1BD5CFAAEA8B891685329C5A40D1A711FFA0A1D3F67AE0B

SMS_S lmf.hztlnwxib.toqajurbpsgd

8AA57A009E8F2BA864F95FF1148FF72F1DBC5F2598A1382CA6103954597B3BC5

SMS_S eufrpa.bmsqirheku.ovksw

8AB2BC01512278E4274EBE9B74BFC814771B5C50B39D27F29B56409E14099024

SMS_S vurgq.mlkigtywe.yjezxdbuqvs

8AB5C3F7F370FD33CF76CE2175718C9258189E SMS_S vasfx.xqnrvcu.zhfp

Page 214: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

43D29664C256A25DB7DFEEC886

8ABD5B6C7161DA4B6E5B28B157C6ED1667B8453328063521A70B72523659ECEA

SMS_S cfrhpwj.jytvuhixzn.fjbdtzuk

8ACDEDBAC516E9EE1A51C92224F26D63B816DE6240E77878A6A01F589ADB26C7

SMS_S kjorlgt.qrwgfsa.qrgfk

8AE1FD894C783B8786CE6DDE34D52506615DD3C9A2920672AE13E431353EC360

SMS_S xrcj.xvlzkhgn.qzlymoprintv

8AF1DBCAB9D0331F6C98DA0CFA2834F0E4D4D82DF5D40B4DFC72493E73C75043

SMS_S hxs.ejzxrdhvb.ysfejkpwlroi

8AFC9ABFCE92EFAC89FE6A63481E2D8E8C11F0F519895DBD6B162BFCC58261AF

SMS_S hdiun.vdlbrguxhs.jsigu

8B215AC19DD2118F82CA0B0686D45ACB584969DCC2F57A33CF3A418B8624C70D

SMS_S phd.yhglxvdbnr.hycgwixmuk

8B24279D5BB335399AB02B4C55C7AD0FFAFC4306ACA73656AC983DC8338ADB11

SMS_S ifj.rogvbzhfs.snxtcarkhvp

8B5C14BBEF2549924A50E1081DB4E155766864704506234330B88A352AF6708E

SMS_S oepnyjw.hbmgot.iwbz

8B87D2592DB15B8DB042EC1F34E2DABCFBD743E6CA7FE7F07740D62F5A75E55B

SMS_S picqm.lhquseroy.uhca

8BAB1DED35E403334159FD0D5534D5A0D5D152A10B18B639F166CC55C74516FF

SMS_S evqa.jsalxcopz.wlnbe

8BD56691A8C837FC9E74BE84F764D63C9EB58ABB94C8CEFFEF2483FC277BF0B7

SMS_S fhd.ptrogua.jhvfe

8BFEA21DC76620BB28CD765C5A6091A4B14A3140F7985F02DA7DA069D8419FE5

SMS_S usjfc.eozajqu.woamsyxtj

8C18004A223F0EED580617C36FEFAFA181298C147F6CE5A3B84ADD8CD505CEAC

SMS_S aptsvj.uhlfowebg.kmysjzfx

8C19D93ED8BC6F741E39F82F0C956209769B0D97C4393C491B06E7B43EAFC704

SMS_S vpxnq.whigvay.ogjmla

8C3C67D8EB4DEFC8D9C9603FF44A9766403981597DB658981E2BE3521B0566DB

SMS_S yduxb.wmkitscar.zkcr

8C428DC82F3E44A05907D4D638FF6CB13D88F6474A3830D9DC29DE3EC9E7FB45

SMS_S sxrzw.pibasxy.oxbcsd

8C63C8E80487AA56FAAC9D1543C5A643588A8F04AA8B9DB5F8E6D07B4065280E

SMS_S dohfsg.efvcbyn.jkqnwcift

8C6CC0835384CCCC145A02CF3C0F6F213EC2189F5C9AFD7A3E925C2CEF45BA48

SMS_S jtcx.fnaivoct.brwumzve

8C73C4174DE5A7E15127E5F2DAF05D00DEFC9209CA9527487819235BEC5EF7F8

SMS_S ofvsj.olpyrsi.lixkgwmou

Page 215: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8C84D8AAE61CE062AA0F7C4E00C6758CA2FA56318319CE67EE1DFB3980287CEE

SMS_S qpeyaho.uqwosrynx.nxfr

8C976165D74B543C2C53067786DE6E887EB6000744143097EE9065435412A274

SMS_S ftvkohq.mgofhqxs.vhjd

8CBD6DDF5D6FC36C685F7592306D00152F4A49DC4F844719EABC46EACE6FB7E5

SMS_S nhsim.fepsbr.jsiac

8CBFFA73E52DC4D5CCA5EE7469D803F00B9AD0024F63A9B22FF57A31267EBF5C

SMS_S rbayxsh.ewxmrcbzqg.qjtuym

8CC96FB47D7BB2749558503BAA462696E6ED76A5E6A1AC5BDF94938F3AB406A2

SMS_S ghz.qgjofbcxr.ruifnaodctxk

8CCFCCC6606F34683921834352CAE63858BAB8DBFB1AD52E73CE9C2EDD8806CE

SMS_S asf.lmueohd.mobrafuzw

8CDA89639BF9543186D9344952B49F0BB0C3327B6C2D313D7A152E6A0737BB47

SMS_S myoxs.mhdwxtuzbl.pbzyrdvegofn

8CDC0663B25B48CE0614D58CA334E9C1179D825790E7A096156D36EF7A2F2C0D

SMS_S pmazs.rtpwvalc.lumeornk

8CEC234D16218F340AA394CBEBF75F2B700182780C6B4FFD7F4CCDF1388C79CA

SMS_S jrov.dhnmzbu.wptgchoers

8CF87235E72AAE41869B557C2E4432FA115084BA7CA97EC500DA6A4CC6DCC0BE

SMS_S jvqkix.dsnczbtfpq.vgeyljk

8CF8E35481D08DB5CAA58EF2E68468D945063565DF8383176339840C5ED4E0B9

SMS_S hfaj.inukqxvflr.eufji

8CFC75269E183F08BFEC9D25F9DFE30F7A88B1633834BBEDE24DC30856C82214

SMS_S dnm.xnemkzg.znlkwbrcmxia

8D03F05FF6B3B07F56D59141EB79670BE94F0E579855BCC2589054B4654483B4

SMS_S yqvaw.nfuogjh.prghndfi

8D0E92EB8F81C465D61ADFEA17C708FC91C579010B1A58AFD88C837CACA359F8

SMS_S tbheony.aomngtceb.qwyusemaj

8D1914242CC3026F3A10858A6DFB96E2F5FDBE0D1910EE503EF0F2FA1581B249

SMS_S ngizq.oakgxrhv.npuzvhetflmi

8D19ADF88766823FB940BD345CF3BF90D2A1FA24EB3F14BC5C27F9414299A78B

SMS_S yzpuegi.oyajtx.kaxmnqdg

8D1E3158E6008F4222416DC610525BFB45BEFAB10731B20F49384FA9839F2EC8

SMS_S rycv.ykvmcup.fgovmrchjz

8D244FF7F141840218EE8ECD8CD28B56B0AF60C9499D4FEEA5374614D98BECE7

SMS_S ibr.ftcsimoyr.qgipzy

8D364F4213C2B24FAB5A6415DEC9853C54FAB96385365BAC922F4B852EF76CAD

SMS_S rvzns.blipnoudvr.hkaotiecrgl

8D3F88A6307BAC2FC656B9119698B03AD8569 SMS_S enbx.ipbzgcxsao.ygjtbd

Page 216: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9C7B237AE133E58BF1EAC56A191

8D571175FBAC9E23F3A6FE98E60DBD725F7F894A998B71ECD708E67A21D24298

SMS_S nldpvhi.bwixnzmeus.tvzhmspkwcln

8D6C8F983187F8C8AB47B5FB46EC56974382221D62B5F7FAFF85DE4BF2E8F979

SMS_S qet.kbicolugr.yuikrneo

8D6CB8D09C99AEDF429A0546554F5DEAE09FDCE76EA8714565F664D9C8E1780A

SMS_S yuel.dzkewn.jcruksnhqx

8D782F2912D446F55656703B8F044DF8E79CC6A3A947A5AAEA1E3F651A05AA75

SMS_S bgqhfj.unjtgzoxp.hxpqsngrwjay

8D7CF0F5738C13E0A1E659EC33D873E9757D5F2B6B41B752513BEEC79C321CCC

SMS_S pudrjiw.hsobtnz.oqaeizvtus

8D9C9EE72B9309FAAC566B288CC81275E443CA3E327C3D52AA617564B5BA7C7B

SMS_S yvqkj.gpcltruhb.zbrfpxdetywl

8DC2382500AD21CBC388F29D50A0BD2085C03D97A091A773A842CC7BB857E356

SMS_S emjyqc.hyxvqn.cewzj

8DC831AEF255F71992CF07145126F4108B53F200E0CDF1C813B1B0FDF9650031

SMS_S rbz.ojpvdsx.hkxwdcgfby

8DCB24F3A21BEDFE46DAB7EA490665F9548DDEBE958FFD41F5408C1EB80F54DF

SMS_S jgmwu.rpyizekg.vwtyaeuomj

8DE6FDF02E8A7D2955E34D0C895CE700B5D3EE3DEE8CFD5C411E4BBE61EBA88A

SMS_S toahj.ikphgacrsx.ygku

8DF19DE5D3F55EF956F9A362D4F873CAF3E0E1C6C26799B83718A7F4EB86CE79

SMS_S naef.rntdlkaf.uctvefldms

8E512CCE84E5742F59EAB69BA2391047A2F0A11E9F5AF59CF26E3342477724D6

SMS_S urth.ldgqjao.aolv

8E66057D7B27F0F99CF9B854B33E946B89E69CF3312D9EB7A379465559CC71ED

SMS_S xazoi.yzvaewisu.dzqswing

8E795AB1326477446EBD595F77EDFDF7072C9A4EE48BCDAC333A44AC5A842EF3

SMS_S tgumhi.lucqdi.ebjkphrog

8E99D24C9B7BDFD3BB37C8F74F855333219A55DFDC69B73D77F3285D973F7AFE

SMS_S tknmh.upgzhsomqi.upavbwyjidkg

8ECE6734F168C849801D85EED2E23E0FA298CF8E2F00BEB8DF0788F733291B8A

SMS_S mywslk.nkbztj.lxjokyitve

8EE5EFC0AE8687DE8F6BA366E0CEFC4C6D9C02BB0E24C567C26F0086C5164354

SMS_S orby.qatcdswo.ckaqeby

8EEE23D329A019C91C7E4F561A3C562A041C59C36BAD90DCF2936008F952B058

SMS_S tuah.hzvcyxinsg.aunlkbgzshy

8EF9761D37618B6A0733791A1F7FF12FBEB00ABC7078C4E8DAA6C8902B8526B5

SMS_S tjc.gezbuvhpdf.mpaxifzc

Page 217: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8EFE29682ABD44EC761B5694569D55980047728F44F33E611AA80717EDE3B28A

SMS_S qbkh.winatpr.ioftcrjzuvh

8F0C8BB47EA9059684334BDD7234501D0C084334D11AA3BF98B0CE7B98E838E4

SMS_S yob.dsienclzyk.xshdbwro

8F1A09A4EA3FE0B535B3177CA858651AC3F71B9299C63A3987D117436BEDDD57

SMS_S nqurtlz.zdyqij.iaxkwlfyq

8F5B9A4B4285FA272FCC353369CF11360613D07859B8A223E73199057559354F

SMS_S qwc.lqyurpoja.vrouctbzq

8F88674C0D2247CF235CCC956F7AC5ECB171F2D8C3C3B5998307F6BDBAA539AF

SMS_S ewdrz.evphfjgi.ipykztm

8F897244E2941FD58BDB0BD49C306F280BB48D064683F74F98126EC717DB276A

SMS_S ucfnvt.rwcbey.qlxkghzbjo

8F8B949B1787440C4E0298655677D2FF56FB1AF099FA13FC4121E243C8BD550A

SMS_S ciemox.xchdvmkl.zqum

8F9DD366F2EB276165C12038DEE25D4A3331B5783D688C386B5455DFCCF0C903

SMS_S hqjxgek.seqcdxwlf.syvnd

8FA18819B2B0F9214450DB8557B65C5DAF56C5C6AFD3A1BE2529A95AE1349D10

SMS_S qmi.skgxyb.capvzyghdre

8FB0E5D3E909AFC6CE3E2DE7F2D82A174A91A387F77DCA0C7B4AAFC999A3DD6C

SMS_S kurymxw.gcbrwdieta.nshq

8FB9BEE66DD9999A624A7ACA79155C72129ABB147DF74F013B931614D638717A

SMS_S cvpf.anwkes.ngwst

8FBFA625C2613A51F606A9BBD978DD86CD0882EA957FED359CA511A5BE020470

SMS_S fze.rmlsvp.qnbvrajf

8FC9829D0D4B4F96F7639A56A48720D15B2F1E12355273D06094FA56DC3EFBB3

SMS_S lcb.ylxebm.zxgloskpt

8FCA66C55B58D564F04FF6134066388FD96EE78EDC3836BC73890CA663627FBF

SMS_S cdtb.davmukeoqw.xvbezstc

8FE99E69F1A842F487D3D04FEBDD7FC20B113A9881BEF4468F1F7B216F891508

SMS_S lgfqch.cqozybsn.gnavc

900324605EE6775D3150AB54E008406EDDB56DF54B11854C03BE900B0A3F82BB

SMS_S aqo.dbuaxercjz.tasdlvgk

900E9FA2A0E28DAACD7B39EBF2D768F1088C619DC952CF363347230AA66A383F

SMS_S qfz.btehwcl.ncbpzouax

9010BD8461B944893A020910A26FD49B76896EBD36E88F95123CA0BFDFADAD7B

SMS_S rypnsfh.mblgfrx.rxtfhn

9013994B5ED4A3779D3149FA57625AA8F876C1BAF025B8702500C68D74FE9D46

SMS_S vxbaf.biejdtcg.pygcfsnjixz

903F2E41D951234D4242F5C245332363B88E85 SMS_S epgfvrd.byjkvqdzth.kyfutzmibvec

Page 218: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

57539CA438D0707E1597FD7CCE

904D11F1AA9D798C87C754EE19E426F1AC7344A2512E458FE2825F55623F7064

SMS_S lxf.qnxwib.szlxchagum

90663BA6B0A54CA23782CD1B931FBF04A7A8747BBD1AE4228E29FFEFE5D07FDE

SMS_S molhya.ezabvm.idetpvgnr

906B376920BCC603858095E88A63923D1E09C0E226AE85671C1EF794E4F6EB6B

SMS_S dbvh.btyzjxuof.sdbjhkqpxl

9084AF7EA2517AD4A0F3AB2A25D2AAC40A1B76660C824BCD37E2F9A0E66AAD6D

SMS_S exj.mnuwxl.tczjqeyi

90AD055748451566A5FA5FA6DA549D14805C07F91CF11DB53B217664ADCEAC58

SMS_S sfx.npxugelw.ocvzsph

90B228B04D5BF76182E7A1AE806A45499466F9CE04F557BFC3C69E08D6EDB963

SMS_S ajs.zdaunfxgtv.okmcjbhrsqu

90C64C72D157EE4087EF5C67C0262CEB558A91B5B1FB0F1B4089721E708D2CAB

SMS_S uymcpsj.fupclmyngx.ktno

90C72B7E9378077C4E8CC4301C8ECA17B08940E0A1D1952A63529E1E3298DB52

SMS_S pclmr.bfcxqpyv.jumsznkrcwof

90E7A3B799A4FC96AA3A8182AA744C78D9F2D8AE3322F906C384A632850632E9

SMS_S cqs.xotkuvelcb.gzbi

90F238DE0210EEDEF8DEAD59B8296A40AFB1B60E1AC6EDCDD770212F0D779C33

SMS_S hrcb.wvjikx.zncfu

90F28237103E3A93D081670836B0E2E5D633C5F108CBCFB216CD6B4A1FB3EC76

SMS_S ewyo.fihojygkv.jwydfmerbkil

9100B83C777089CA915C8BC4ED33DF0BCA9AD2CA8315065383F6796AF3BDB2DE

SMS_S jhe.zmpaerqyj.yuhc

91048A12D0B36445939128AF77E38B7BC4510165C6A7605789E958EECCB9EE0D

SMS_S rnexb.xsdcbozum.hfaq

91095886E465AC8A2B9AFFFAE378CE450375788F741A0BD83185BE9E414892AE

SMS_S dmv.gcznkfjp.ntyxrge

913BFC5849195387465AC86DBC401410D9F0CA8C0E851644F2498B65B24F2767

SMS_S gvd.lfresad.doykt

913FCB547C3DE77CAD6B8C0578C7219004D8CAD7D651673CB86D378838D964EC

SMS_S dhbg.comyadlxsf.fdlmqhcy

9150812C33E2841643A5B5D4D4BB99DE622310D6F64C98ED2FA3F0D900830A6E

SMS_S uld.umxewpcna.yziujxhlcds

91730DA8D9D70D455ED128BBF14EDBAF960442C218768F1DFC3B2E64676B2C9B

SMS_S nzmr.kdorje.xvtyebkcjl

917908757692D59C787F713631DF339DA6864D5BB6ACD32C0C2A3FF012FD3C39

SMS_S efk.skguqdo.ecqhrnt

Page 219: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

917D4EB4AF50C35B16246377895C4A116F343CEA15B4C5D0ED5C9F96F5DAC55B

SMS_S tyqkfi.lnjsfhdaip.vzlkgjp

918D6EE1F86941BBFA3A38DBDBBFA71F49706C5CCA4D7125F6E7D7764D9B199D

SMS_S ieufa.ybkcfhvu.fbyxeztnvqkw

91972D2E877158128D878D29B73F58B7A2A80F0C98C1AA2EAB9389A00F6A5955

SMS_S mtb.vrphbwfmuc.tyogzqlu

91A217B3CE418A994640687C165EBF42639F2F3FED5812065F78F71024D10A15

SMS_S ifdpygn.vcoamin.eionya

91A9C4BADB2D1810D659486F61E60A90A6D233BF275C27235C09A493561FB267

SMS_S hzovjsw.oxvidzrtu.amgyerpfns

91AF5E4EBEDE6CF05B798BE9CEB58E1D03C1E6CC9D5CD89B065D9BD3AC4E41B4

SMS_S fhimayw.uenzqjas.xfhmpsdn

91C3DF46194DEEB1C25CBCB1D4AFE1A5EB87902AB1CDCF429348D670E4306E51

SMS_S yrbhxkf.ktgvbds.wyhgupn

91C941A558AA62597218379D79DF382D12319FEF97F879A0870E709A3BAFD2B6

SMS_S thdr.leqyjzhd.xgzqvejpa

91DF7D2B384D6B19FB39386B51691149682E8655D1F73E1BE9E4E2A7F73536AF

SMS_S tprve.kchjamxrp.xvrpn

91F01DB03C55479E326E7C3F0B5DA90B9AA436F62C4565C53E53268C4C2DEEAC

SMS_S lqah.qcpondasju.jiwclxgqzurn

923C41226A146ABF2C108A0E0CE24E596FB2FC4249ABB1345046CD2130AE725B

SMS_S vmfwaus.ibsnxdo.eaidwvbmy

9248B576E1B1A62BD19F1C83C3249C0D5BC826F794CC0C8A9D0CA8FC801199C6

SMS_S xybckdm.kzocjar.icdplqow

92572300671598B53D9B2A0DFFA5CCA4312ABBC70BD799400917A962F9767D9E

SMS_S tanpyuc.itkevachxp.jmwgiplcx

92877F01C6C5375FFFAFAA9399884DBDD33A8ACE1ACA253F630DBA89F5AE73B4

SMS_S ukstrbx.awqpxcmh.soxfwgq

928D9888A0E2B68FE9943D88A80019E30B8EF88F44706A0DD831A265F34F81A8

SMS_S pfm.jrakhc.fqvwgneoplu

92946DEBE749F3938FDA73DF773648A514BAC5EDA57EDE68C9670B4F4B3AC0D2

SMS_S tbcofhp.kxicnsuot.zgvwhf

92AB49CAC19F9D21D845879F33366B92DEF9CA80E97A6DD8055EB77C163EA410

SMS_S lgiqwj.akcrunoix.gjqkez

92B189A959874FAF0B569E6B7D045CD08BFDA505F9CF0075CAC3DEF6746CDFDC

SMS_S vnlryw.ptckjvxwes.efnrplstcbmu

92BF7D6B3136AFFF851CEA193144DFB0B6A98E6D479C50FA92F09C539C1286C9

SMS_S yakqspx.nqhgbe.pxlgw

92CE8C91717D25B07173FB452E34D2753E6A3 SMS_S dwb.umnqbp.qmtsoejhfvca

Page 220: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

59336735697E9D912CD6B07212E

92D466B6A8E22A41A3BAAB53B9D3F8E2157F87A65BD94FD41B61D8E17634D07F

SMS_S borfv.ijeglrz.mrnbuwecys

93035EB60BFEA697A9C9DF27DBDA63C2357DD930B6766F30A98D203668129431

SMS_S ehpc.shixjuz.kxrziyvowd

9315AD7F77A4518238F5DBC959F16DFCC9423D734F451C3BB4E4B8E297EDA4F4

SMS_S kljsg.khtdblsywz.jead

93495F7BDB1B4C5A966719E9C49498F6F500042373819BDFFF45BF438D2F3811

SMS_S tvrcje.knagyruj.mcbpxnsdriyf

93789EA0F32C49C09DCD16B52E28F8E59301B49FAE870AC773E756B88DBDC12C

SMS_S avbujgw.gawxneyo.glfqw

939150C00878249B8203A122FD522444D866A44A5A7FF4886DB5BA9AB61D560E

SMS_S nuravy.xtmeoqs.hqzogsip

93A9DEAED5F00901B87AE660659D9FF6F0273FDFEB69370A0A8E61FACF3B4C21

SMS_S fsyzix.mituqc.bvdfjkap

93AA40CDEF436B33E7BD52002E3E718E08734EF23E068772E4E3C2F664F1CAB5

SMS_S oultnsg.ueyglhdq.sbqxlregkz

93AA66A1B88ED6A95724450608AA4F2402F3E85A934AA0CF3BE344E2FCB2FC12

SMS_S nwqzm.vzretbqynx.ngwyhbrasoz

93C4C226982110AA5925CC43F6E3572C6A1E3B738BE9282B117E44B5DB95B24E

SMS_S veq.hoicsum.zdqohbys

93C97BBE3CFA4D2BE086DFCB456BDE283D247E1E8FD29EA63261B8E6950192F8

SMS_S pri.weiagbs.nulrjkpb

93EC39FB66DCFAC3859CCDD254E7600C5CB0A243D80BF828584CD43EF8A04727

SMS_S hms.scrpbwldg.rjmkxlfonbvy

93FDEF9F90C91F667CC41B875F98D1C4A09EAE20851C6A7BA6AA182F405183DB

SMS_S mozuyl.pluhdfaj.kfwhq

940DD96EFF9EAF46BA28DB118F08E5B928A85E01762D354D3AC6121BD49ACADF

SMS_S frl.pwfdsoj.cybnfixpdvj

9419C454703999A4C8F8263ADCC8F3309978C565C65B90A6031959BD7B63AE4A

SMS_S zgsum.gchjyiqavd.ycljizuxnro

9428D7883F96492255DC18428AC12AE97C150DFDD839D1F4D76E20CB84887F43

SMS_S banrk.dvcogpu.tiyhd

9438BF062CDF28ADE24E1583404E54EC6B009A766660759F04CE9D2FF86A0289

SMS_S hmp.hidsvlb.tkzisw

944BDA66BCF536C326B2700B158AB7C4F00D2AE1B7F92E267298F224B7FB78ED

SMS_S iumoab.chmfpuitq.fxqhvyspzm

944C1CD451EC646EF7A248A1E711FF7DD31DA9B31F941A3705B8C4D4E266F1A9

SMS_S vraki.frbmiswn.oraghwyi

Page 221: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

947087C098F72A66D264131B349D43FE72C3F5A4419A62E76352ED919F1365EB

SMS_S irwpe.pgbzjn.sqlbvdfaxutm

9471E86753CCDDEE5FB954F648F29C6E88D025480A30717AC2495DBAAD2421CF

SMS_S xjakl.rfsvnjg.noid

948D241F4E97FE4571B3CDA9C747209725C79DA774CF83C09999C97430276C31

SMS_S rqgfyn.cklwerajpu.yudm

94A4DBD3B489942A642C40F8DEFAD78D5DA0B6B8E5931CB7EB650D151F4A59F6

SMS_S liwe.wngzla.ykubt

94A8ED68DDB972BC074810A4CDEA5900A5DAEE3563B9BB892BEC9C4C11382155

SMS_S xwpjlru.opusencvf.ongpwme

9535B9354F16B4A00D29D93836F406EF226BB422A935EB3A8DFAECB20C62CB95

SMS_S lasjdyp.voyrbu.hptlsw

95392E064247F07029FEEB3CB61F68FF8B8C07219436BA2F1A997A2F258E932D

SMS_S sfwm.cexgtw.rynmtidg

953AAE995B0CCDFCDF1F86ED24EF07E1FDA97564D990B01511E7676DAA13DCC5

SMS_S itbzpf.oxgslyrw.ibjvzne

953E6697D11E13EA2313523FA0D76E5EE72904093FAB22EFEF899E9F73E9A354

SMS_S xhrg.gjnutbplke.kxfngcv

9551261B4C344559FA2AA16F4DA970DD5D28B378A42962F14E4494CA04E9D50D

SMS_S vqwmnkd.opsyxniq.uekyqwmtih

9579CC270C6B4D43A21949EEB9F7600B0D98BB95A42A80160694EB7E4173A369

SMS_S eolfani.wetfczov.jsvhuzgyfar

957F561B468D493C1FD71D1D4DCF0F968F969A998991C8EF97DB175FCE14B2BF

SMS_S qgu.eiasbv.rqdnib

95825C040697B1E98D8306E439F6A32C2C1DCA7E91592BBE4F491933A7C8E25B

SMS_S bmylzvt.whulybpeq.ajcubiwpdk

9597006155428D65CFABBC5C89C5B1AD9B332F65621D5ADDF565CF1331E062DB

SMS_S rnijga.zdgqajfewv.tsnwbycopd

959B0FFE3A0B66550582D5A4E933C72C54E6A257C34C5C72A17396E82D8EFCBA

SMS_S towyu.cwkhvnp.ceqhu

95D06DD5CCFA12BD788A7EB45F00260D4EC288586682EED72F00A2DDB76822FB

SMS_S mlcwzab.nwugfx.rcqbudkait

95E35C71AC3E7FF91D79CCC046F942BFE84F37D1D672EC6751C42B1FA7B57AE0

SMS_S hqfjc.rzhujdsop.btjyesmdcx

95EB243DFFC8101260464AA7B87404833AF1821532F6162CC8528167083D9D1E

SMS_S bvzok.jysulc.xfzlqhmcvaoy

9600E963453774DD8DF4257207E82609BE85DBE6C9A23BE9A77241BF4847C240

SMS_S ksfctr.uflcmkwo.ivcnmdblaje

96115A9AAC7FB948A7F2C560AA7C6F813DA6C SMS_S twhrs.krjpmnbz.ofctrvzkyw

Page 222: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

50124DD68EF3369B941349BFD73

9624A7EB535C1748A13CFF3E9376C1A3C814E19F75784F7133A987B0E8A301E5

SMS_S hrdoipx.rkxufclah.atuzqghjv

9631785FF1A9DE78D0CB73FD8B1FB860CD4567F7B692D96F21F78D729E6A517E

SMS_S mtphybn.pwjsmkoa.cwzxukjiamyp

963949DD4DDE2EDC903F9868446AA6C761091BDA47D7ADD11CDC511469E9E81F

SMS_S slhek.lwnszfvta.khtc

965390D75BB739E6DC91A22F9F4D32AD32828B682CF2784997F91FC2A4FB4B63

SMS_S vkgp.yondkz.ohlkug

967004154F9106E4EE305AFEF97F6BAE65B73E857F6599698BFC81D78F8874F6

SMS_S rgsfd.rguyhzlceq.cjvxde

96744C6598E99269630DCC5EEB406E370B15B36FAC9C56F91247E86AD3B40B19

SMS_S fgswkti.ithjpqgels.gcmvizrax

967A5E9C4D7D20FD4E4181043A5E45EE6755B43D2026CEF5F3F6883088127D9E

SMS_S wkq.jqrsno.ykithx

969EC1B828360B120092A440E840F483865832A3662E094A4CDB9A00ED3AC8AC

SMS_S hseit.ighsqztu.qwyxojpk

96A271021164829F78B29932E750D2E5F80BF6B5E2BA0F1CCC0DCF7EB8AE7181

SMS_S dfqah.mgtcjsx.oljfqmivrc

96A3AB7B3D10477C2BC9F8271962BBD17DD8E2E4342F215798E0C48C4E165F23

SMS_S tbvcij.rliwcs.dygnqies

96C74372BA5374A9FC60F095224F3C29CEC7AB1AB5EE7B303728AD5B478C7701

SMS_S azlpb.zwjcogbea.dtfumingjkz

96CAA6379E0209CB0D83152AB39D33D954FA90B33C61D3101A4652B6E0F3260C

SMS_S xnhtrsp.kzumstjgp.mphznisruebt

96DCA736A1EE0F7D91DBC13050F3DD695595C11A97D2336518596436BEDE1658

SMS_S emnkhx.olxtifbjs.dcqxt

96E6D5F29D17F9D57FB815F4954CFD414001AFE7A2B4007BD68EEBB9D8165C9E

SMS_S gmj.ukmxolhwnd.oxfvmzsrlg

96ECC76D24CA897E83AD2A4C8191AE1EB18565865FD4B49D3DC702BB8DA86C20

SMS_S hmpyn.qashmpkyjo.dscvgnleqf

9702EA795414FED7F7F1DECDD940DEFD05371EC1A84F78C90DA9750DECCF7A7E

SMS_S hgbrsya.xjnvswblk.shkxtvco

9705DB1D782441F601CA0FE71E61EC6E635C2199551FA9496074D45B4DC2FDDB

SMS_S rhobtge.leyovmp.emonzkjfxqwl

9709E0BB385B195D86FF024BDDBBF2F99F788EF70C8EF292DD3246B0180BB88F

SMS_S cism.dbsntk.ivrbmklf

970DD4655E7B73A29DF11511839B273517524555D19038E5029134DADC35D3C3

SMS_S tnk.knyhoeu.shrjamdzyw

Page 223: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

971C552C89DCFA9F0C89D7D0E246AAEE227AB67D5B6B78FEB7E0754A376560BB

SMS_S exyowr.vhifuacbtk.zhsjfnegvir

9726D3E068F48AA068536EAA694BF5808F4A4088C89598CBD393F8AA5C138F77

SMS_S higpx.vhqkdml.bkaiselmg

972E23078A926BE2569B2B5DE7E280FD114E9E16ADA6601F5B0E788AD3B9309A

SMS_S hrpkol.bakgqp.fghlnzrwxem

973CC93FE4B9CA51C4A4FF36547E64D02E3F285670D44B37534787676BB8E45D

SMS_S tkbifc.zpksdilb.mnftwhxlpi

973CFE30E7F8B48A92307418F3FC1BC37813530032CBE092A20A1714BF5646F5

SMS_S vdnfhqm.xichdwve.aiuc

9752622811349F4B255E2E7F45DC50381C8FA7CD85CC3673B3F1DC7242FED2B9

SMS_S ueyjzxp.dcqriwujt.egdwviyxjfok

97664D293A1C3685F6B0F5F257FDE7FDE44ADD0BB3C944087770353D2CC06647

SMS_S tjgfzne.cfkyhgl.gzjicxaks

9777D093FF4705C42D9D5B2F890EA67184A93C368108C763FAAA1E3136CA5055

SMS_S cfzjwl.somzyb.nxkqvrs

9784B0FCC35882297EB0ECA3DD37B13D8004A61CC0D628CE5FF3DBAC2F72D712

SMS_S rhpbvlk.quxjiatckd.krvxthmd

97861D958DD4A4BE4E77EEE412864295E792394A67581F2F3957CB82CBAEBBEA

SMS_S tow.bdozjtkmu.zpsmvoxrn

97A1C16CFB05C08F921AA4ED0F2A4553CCE27FF4BC41821EFA46EBA4ABA299B3

SMS_S srkeug.rlytsm.okjq

97A2B95BAC02C6457DDBD05C2EE48F8AF382B75F7A14277239B62305879BB14C

SMS_S rpqx.haxgtbrlus.tjdcgael

97A2E6A53E1FDFBFC5D9A05318DB2AADF67015E1DDD00D8E5E9005A97D949999

SMS_S gxlh.eshfgmwxbu.qkvsdh

97B8AC8B66E434944F86370BE54B5D462356DA681A19BCFC7EE1D99FD80603ED

SMS_S mdwpsi.xefkbrtnm.yzwsexnbpt

97DE257E9EF5D903E29B16A9793EB20C59504FADE3BB7E4C80649ED0890ADEA3

SMS_S ayelti.qusdnkteb.syhgmonrxaqu

97E0E2E404F06F787160BA0744063808BC6D3C3631B84107CCAF89ECD5B38F26

SMS_S velywzm.pfvlyr.vnxkpcelizds

97E9C8A228FE183355D9A627088E61F2C4DB312E2C7A6DAA0C898960CDCD3338

SMS_S pdkao.xonpzbhr.htmqol

9801000BBBB0427CC99D1D6D951F6F678B92CB8B4E5EB744071F0EBD0DBFB68C

SMS_S uflbo.kbplizd.oxigzyqvawd

98192C0FD598870C1CCBD060AFC518220DA13A65357834988C889A2AF450C7B3

SMS_S kdevyf.lzrpun.biyh

981B9F2C59E0E27DCD06B797450A09D3AA078 SMS_S tomegx.gcspyjf.lewnbjxdfuho

Page 224: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1BE8A74964C25CD9D8B9E42DA7B

98560B0C984DB987F85FF1E32BD9A61EC3996F4450792DC88F636B21B214B13B

SMS_S ogbx.bulhzrdq.rtcypi

98561A9B1F6F9CB9EF9786CAAD1DAEA952E743DA6C2AE5E817C38740A9F42EAF

SMS_S ekwxda.xeipobyk.jxvlqscwmed

988E188BE68D7F5B6215AA3D4A1A02092874E4F1608296E544B5C1FE6DC55EF6

SMS_S awz.ajwbvglhy.slonykgidq

98AA6EEC4EA39D94FDA385F7E110AB6DEE934B2DF041A31D8C7533723BCC8106

SMS_S nfu.inhvjmfe.xwoeirbcsvh

98B0DFDC81CC752D3DA0BDE143A5C3FD156560FA95CD4F1FC7F097500CAC3716

SMS_S vmg.ufypkmio.ihke

98B2ADDF132F0836F69C89A898AFBAE0FAAF86DC6F199AF4B83F29EA585C5F3D

SMS_S eaukr.cwmeupfj.tzsqhpugwjm

98B52DFFF463DDA3D9BFFF3E609F2FD37357C8951B7209DFAE9DC7F3286411DE

SMS_S xhl.kmjgtzi.ixdjbhl

98E937BA1B3079A13A4FF34E8B089433D0D9CF6776D17805DD675F1E7069F3A3

SMS_S qpvenwy.vcrlotwzs.nuzv

98EB230D0DCA96F11626D9A258A98FCA1A9389696FEC3B2F5A1ADF6A0B32783F

SMS_S uqtw.orsgcivp.viczxdako

98F20CAC69163465FA6C024612428E9A65CD5FABB5A14DE5A82B07419736C148

SMS_S ihyvbdw.qpximsjnro.bhpeofxdm

98F8B6689B71CE3D400E9DE4A7E9EF776ADE4042004BDB1BB988EC8B05E869E8

SMS_S gwbsxh.qazmepk.wjtyi

9914AF2B7F360F452E4586C3C0816BB1542557FE1BC866415D35BAAE73A6C4FC

SMS_S iceskv.lbyipqw.hjdyqsc

992600362DB3D7CC9EB54655291633B077B6AD8A45A6553956B48BBB91F1CA19

SMS_S xvbcg.vbflgquhzs.ryautfpsg

993673B922908AE3E77A5E635BD650C64219934126B9C2A5CAFFE24E7BB9F11C

SMS_S upierg.mgzvucx.mlws

993E920C42E8D08C6C59A43AA949640B512AA7ED004C72AF3B0100044FC13A57

SMS_S njiw.mqpogwtuj.hewqcdsinpu

99468A892D87AC50681866B16144E97E73F7FF5A456285040AADBD80EF541C6E

SMS_S shlbxjv.usecjiogh.wmoslyvnfk

9966A30FDD88ED6CE812DBDBA411F58372EBEFBB153E7AF76D43884B8C82D958

SMS_S ihy.lndgxrjqz.uzysqfc

9974B89DF50A202AC4F7EBD201AE38A740DC930EAF3457A3064D814B5D8A529F

SMS_S xdhq.iavbtjr.jcrbzi

998B6AFAA2B52B75784C3711B59B1BACF9EDAADB7EA92D66BB23D761AEAC7CE1

SMS_S qcbysn.eoivwbmgn.nelyufcdjsiq

Page 225: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

998D024D1E669AB3842802722EBEF991022DE2A311C4C763DD084D887F248694

SMS_S yrqebh.hrwisjceab.jweyd

99972EE92915278A4F9DF24C7E878FEF6AB9F7B25EE22030C2D6A9E1FDD8318D

SMS_S fylpi.xmyghtilpe.uptiqadj

99D1CB733B1FAF08F846A921C3E0B5BD60795BBB65AEBE191A6BD30245A38469

SMS_S jvrqdu.vtmfsgwlr.vymxre

99E8C3B3FC19D11E67D2A1DAA920E68723D78BBED0B1F29ECC876B4C3FDA134F

SMS_S hzyqx.lqwbmhgrpa.zrvxsbkegf

99F82400FE009C862E266E5C674898C80C5AC39FC2EB859CB13DA7E14ED9018E

SMS_S qne.mshcid.jkdtlwnuav

99FD069526838C0511169FE45743F01F7801C8FCC2C884CDD995BAD51CBCDAB2

SMS_S krcboe.aliewxpr.skdf

9A1C930D811187B351C171714557B988EE305D32401DD6F916248709DB57CBED

SMS_S ibhs.fvyabcs.mivcdh

9A49C4A5196CE8FAB822A44256D26DC58D8C1FA95959060A0EF46272DAB06CBD

SMS_S gnsljy.zpxokgynrs.xfobv

9A52394F9096522B85ADE240612B66796FAFC7CF826FE57969AEACD99A555431

SMS_S wtykd.cyaxohwi.nfmhujsodrtl

9A61AB8E845A52630F4F63EF8CF69F2DC67BFD543BE6D63D2BA9CFEDCBCB91F1

SMS_S mplnzuk.bnjirm.qzosf

9A67F5DD96DAAB8C3CE18A5AB7E1FD034A6E268D283CA3276BBEB8FE03150875

SMS_S jpy.rqugkm.njiulfedt

9A68326A13EB578FF1E90C3289846435E5F36876082468D0C14A732F8EC64DD8

SMS_S gayru.tpaiefnvwx.peqltudah

9A6D70D98274CD7FA5B849C4CC5A09F42D7AB9D7CEF066CBCD169219D0713750

SMS_S kwhfux.qiwjbdop.mytnbjailerk

9A6DA7E6C090CB57D5BA680285A3256CD69316CA1D804658B038B19C82937776

SMS_S xwnocj.vwleczq.chutsig

9A74E9978F639D611271302A7232062A824CA10911D4F0D3B1352168D7634A2C

SMS_S fwzage.fhimrlbvj.uilc

9A77C7DF5C871B0CF13CF31AC50906B6608C5495BEBF4F4D4FECF66299204EB6

SMS_S ahvzu.nkeivq.rlogbmxnty

9A7D50C1D58E5A62A84044FA373CB40750708FDE078E0A0CF76F1DEF119281E8

SMS_S roedyj.avwotmrfs.dchrzawyps

9A7EB478BB32E36051278B50481EF61481EDB884EEBD5B61E13C8AE01D2CC5B2

SMS_S mkrujs.gutqfvnpaz.hroju

9A83909DBF4C456AE7A5E5AF088EAC0387A861D6773EDAAB6D5E2C1B5ABE4302

SMS_S dqj.tplgasfu.kvpxcnaegir

9A85020830CC4D315E01DA59DDBD98BF7FD4 SMS_S ihkmqlw.unwsxzc.otjirm

Page 226: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6FFBA0A5B8CEC9796B31E3E49081

9A8D34D29D3ED14DD8150D79A3E48A21F342271DF3DE17039EA8063B3AD110CA

SMS_S gdxurcl.ngtyibfsmj.iobwp

9A8E86162DC212A4DC9D73D8F71ACE1B7A5758F6C087E8A629A1226BE6F94308

SMS_S xbopih.vjkpdfabei.cngupqlod

9A9E38088DC6129B4051592537E84AF0A63BCA31C03555230D8684D18093D76E

SMS_S ocrel.mckjgedzbw.bupgcnqfkth

9ACD450814E0EE40BE494C12BD3A9F58EFDA732A41EEBF8581133D7BB0185B81

SMS_S rxk.aoecskq.eibqmpwvl

9AD37CC8BFBA3DFD7AFADA936BD7E19FDC799CF227BD8BB3A3353623581EFB58

SMS_S sejtuw.vlqbmoypzh.jpqodheaxucn

9AD5B855B18E2B505F934B65A4C71F7F191C6ED0DA95747E1A2B3460059C0820

SMS_S qkoefr.omnfezdi.eswcjutzofhn

9AF42F83217D060D662E1B4EFD203E3D98D1369F5C3A0E7668FEB7B26B57FBB1

SMS_S mwhyfsr.scnpgqa.darfbeljqvog

9B1077B673658A4F42CD3F0C0305CDC4F6DF3B95659D8210093311DAF236E203

SMS_S ylixsbr.brogdi.ugvd

9B10C48438C4BCE035A6B36E49146CAB1E2949473232E9BD228A6356F0B0EAA7

SMS_S qnut.ajxzkcgeu.qsngkp

9B16406EBE8E75E31ABC085EAD2532EF2277D646E9EC3BCFF398F07E10A3E09E

SMS_S xwovkzr.gbznqkhmsa.wnifytz

9B1C13CA9EBDF8DBFC750B4D54D9C432D261D4624137CEFC2F16EB9CC162DE1C

SMS_S tbwz.fyvlxpuoq.jghvs

9B1D9D7BE34269D512EE3A09DB184FC0856E77FCC4D4C0671896CA0253FD1BD6

SMS_S qlsfd.ahxtwkglb.escvnolyu

9B212A3D386B125339EE0FF9F3EAA56E97986ACBE9FE8051A4078214B75EF4D3

SMS_S mkb.srkuhwnlv.jntzvg

9B3361F4E48FE69C0D9FAF9A2C96DC739020D4F055A0A2088502358C039CA718

SMS_S zmljtcf.rojuiq.osnq

9B33F8B915D6EC278A597FED753C9BD730B8463E61E04A11A7A54BA6B928BFAE

SMS_S fkaoijt.chydukgt.lupbkyec

9B3BDD97BED522A3C7A6C11DF5D65E30436E3C8138C72CEA17411CD9469D5228

SMS_S cwmbijf.fyhdrqxt.shgex

9B412498B61344A738F904389D452308EA21BACC110131302CB239A24C3A2483

SMS_S ipv.ldyunvrpb.tdjv

9B607733C3D036C606CA8BD7D95CF8B5637333980B8B32634099CDAB2E3E023D

SMS_S wlo.igoxtfesjv.cknwxets

9B767160BF77B66FC75BA0438F5198D545DF49657C2CC29ECAC6E6CB7E993CD1

SMS_S figj.rzsamivnbd.bpfiuyh

Page 227: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9B795A13CE06D73C3EE6EB6DA5023014CB8B7FCBD78C2C24FC966A59DCCCFBD3

SMS_S ralp.mzqejcox.juypci

9B8050D3F3780448E60B2D40383E8154951DBF72F88F1179E67F91E0DBB447C9

SMS_S twbj.dukcejpoqt.hoyki

9B91072576E83B5245D9BEDAB2B08BAE8F9D0ABC1D56A1A2EE9F98C50B968693

SMS_S hsfkur.gzfhibwxp.lmfpiaxsbo

9BBA7D9C9F91AE3794DE9E36500A60A0B068A54A9334BC18903BE3F4B9999761

SMS_S bvztadj.hlimuy.jcnvd

9BD80345AC672759E1B808D269E2F50469DB68C56DCF60B59FF27A72A7E36180

SMS_S wxfi.fucaso.njre

9C0268F50B2AF3CA45DFB17B26E31EB27E76B7C020FDF49785816E90D3271220

SMS_S shn.thnzuqcdw.ebarxuywo

9C0D99878E17DA654F8686D900F6B686AB7E2661EE05E66CEA41522608DAA299

SMS_S zuyvnc.klfrhi.delfzunshji

9C0EF6FC8FCC0B479C964FA5E7C1A09B0072C36594416D2A6AD3E76214AC2937

SMS_S thogve.pcutsfnxq.afvukdxy

9C38267D60ABD956C7AB155585129818D355511E58FF75BDE9D2ADB42CB67B97

SMS_S abvtdc.hukdrmy.oltbgysmnxv

9C3F6B82892719AC453CF36DC857A866A4DD1199F28901FA959D32DB51F0F8A7

SMS_S dqrhx.nwslgkrq.mqksetphoa

9C4CECB6C1B41445EDBBBCF6DF2274E4521F5A397B888372C1D06E17E32BC82D

SMS_S getjzrb.gptdcmzn.ptqkdxbugem

9C51BAFB97CDAB1EEE39F45C3D10D2D471B461E156BF89F49723AF116E8E6855

SMS_S jzbp.hwfmsao.iuvwbqtsa

9C602BD31CAE35CC6B5CF9639DC7C6D930B3FE874057219775A8BF4400B6796A

SMS_S fniyjh.yswpqlmhzo.flxsjdke

9C6257E6CE730B225BB8B7DE5C1FFE892999BE25E5AEF9EE02A59CAB9FF7540B

SMS_S acjegq.tgnmcow.nuhe

9C773E62A0304A87397DC3012C52EB1E37CD1EE8BBBC4FEEC6D8C65654C9148C

SMS_S cwv.tynupmkib.mynzldhpa

9C779E86ECAF569562F9816950AC910FD6C0B7E2A8B42F2D315FAF436B58EE85

SMS_S ygu.mthwszyke.vaqixf

9C8DC579F4D510D86ED17E3B86CBF90A993267827CFE644749954674D9742F4E

SMS_S pbgxno.dfvbxj.wcfxer

9CA537C6FA32D49265168AED455BB80879E4AECFEE12AEEEF2805E0218542098

SMS_S ioru.agbxlfuzvo.lojvdfxqn

9CADE334AFD2908B950E736437622F11AF8BD187BFC7B99896CE826DDDB466B6

SMS_S rklhyag.cdqtmr.gouhydtnaev

9CB4E3390EAB21F52F58BD5AE11994CB4FAA0 SMS_S rfkdtz.rxyjiohfv.yfjlwqecg

Page 228: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

6F361E4F86C28683FCDB915767F

9CD558877B895A0C0ECC0F7267D94F7CEA4A40969DF12277050D99B1E1C39666

SMS_S hie.kfgtsoar.osqi

9CE51A9FBF419223A105B53A89B5EC6ADAA9104B9E18A7C422CF5CA286549546

SMS_S hlfckpa.nithmwsgca.qzdctijgpfl

9CE972F39785659DA2A4931F837B8CFF541251D4E30F9E55FFEF8D2618C145CB

SMS_S triu.ndoryhejw.uwfzegj

9CED017765B55B43804A3DF50BDD8A942B05B0D583D9EBA3F20963C15D0C7D2A

SMS_S boesvlw.citesjq.sxarbn

9D038A055EA501E45E61CC055CA831E2A6AAC8985332C23616B6A3248C6EEBA0

SMS_S kxh.yibohxr.yiduskmngaeh

9D113DEFC556E3E4E1D73DDAC8C0F613955D1D4D9006A7CB850F4C8C29328115

SMS_S slwnz.zpvcnftehk.zgtvcea

9D42BC2EEF9FD218976DD79EB7098D0A5A78C641E57A66120266C3BAD6E9F632

SMS_S poaeg.hcdxumaizl.ltxgnieaswjm

9D5C729FC40A9AB12088E4BE0BFF0708DB752526CE93FAC817BC2288640EA597

SMS_S yot.btkjza.mvulgix

9D677EBEE4B2AE0C3C538C78E5271704AAF6FC352E52C6240F186859D8DCE2D4

SMS_S fehcjpv.ryizjvnsk.fadl

9D90F0FF6EEDA9F526BCF891CBEB569779229E4F6677068DC38C6CBEC9DCC3EF

SMS_S xvz.egpqjowdis.bwnrgmlqsv

9DAEB6EA484883E451978C5BC91CB32DDCED5320645A6FA2660DCAD66BC2D8C0

SMS_S pljqgkn.gtvjbwnk.ksmozdjtgr

9DD566C02ED479C0B7AD0D5F1798A58FE5ECD2C42562375E908BA07F5916BBFD

SMS_S xnba.evzjsmhu.zxfnprk

9DDDF81573BDD73A2B31F28B7A003AEFB9D8B044E2CF836B34404CD96CBA2D6B

SMS_S esjznmg.ywdabt.ipjcgme

9DDEA9AEE61494B1B874F1E478215F50A1BC771B8F26B2E1FEFCABC6D531493E

SMS_S xchl.dswutyo.iepyhatdmxfj

9DE400FCD3D21DB5C39D54F55CEB40151A2B5B7D16D7561EF7DA8AB585E6FF8D

SMS_S odm.ckyrmdgabv.vlfowyreakc

9DFC9D7C7A3B6CC482398770243E81EAC1DDBE92B6F12F8C4DD0B64BE0732A33

SMS_S pifmb.skhdwxtiu.dvlqhy

9DFFADC42EA15E0961F7A9D5F3B0333E7CEBAFB6C8CED11CA150B867A5B9B94D

SMS_S uing.mltypguo.pysizjcowrl

9E0AE13A07E198F0F9F6BEF36E4887E7EB394E5AF424FDF705B5604FB97E6977

SMS_S bvl.lxcsmgeid.orthibeg

9E189403F1EC6A650F66C4FF18507F95E2B1FC09B07E9FC5E0A2A35697863AA5

SMS_S drub.pvqslwmf.jfxvurmaes

Page 229: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9E34F14FA1E9DDDE8E2E8CDA7EA2A84509C8813C80923E41F86488BB7C91CB3F

SMS_S xrkhb.qutlnwcm.dspaozbyl

9E3F4B5AACC094F2BF13BFC6A972875DB41940C6FEAFF437D59228FC6912A4E4

SMS_S yjb.jvadzbwrm.cmqjzlriu

9E50B429D84AE203D366B01F587462EF3955C6CA7C47712EC6C87213E5BEE25D

SMS_S dwrsno.pmbscj.owkglfqvna

9E5CDEF5F5E942352DEF4CB703257F7AF16269C7641ED077BCCAA6C7094FD31D

SMS_S znapfvw.zlxijuptsm.bnmel

9E72003CE9E9AC190095F06522E1B9312D962A1EA00DE1139EE29F1324C49795

SMS_S eyq.rgtquozdk.mydxf

9E77109625F41CFDDE07BEB18463E47E0351BD64BE9128C6FA7917AD296658B5

SMS_S qxby.vfyiepom.vgcrwpiefa

9E776FDB40046695EEB87C13AE170E3B85FD17818E40B50ABD735BC1973F9002

SMS_S uzhv.boxrjczld.dqiapgzlwykn

9E89965932B883D8F38629547BA3B51C2F906E4C218BA72B1BB34A1FF837471B

SMS_S qezlhob.oyxnpsfvqz.btoygvrxa

9E9E8615E6D85E53D335C52E46C81DE6A5E14263C6009CC6840893E8C66F08AF

SMS_S cniq.pewuqhvita.zuvfapk

9EC02C631E2DF3150E69B64BB7C21E1766F962739EFBD87AF858E45D6F76B45C

SMS_S wahfvrm.uibsovd.zrex

9ECABD84205803E10193F7AF31DED766A431A2200840FE0AF822D2DBE8149ACD

SMS_S grm.fnismrw.wrszcalgxiut

9EE576D087D3853E66A53DF92BA14D186D1C49DC588B5FBB1FA965B4A5B3162B

SMS_S xgozd.tziejunx.mcau

9EF91C646F085C208B9D9744755903E449142F84ABE4B40ABD8CF25D652AC77E

SMS_S qpf.yxitrcehzu.tikwcfa

9EFD8C7A706BB1499E064A73D0EE59F6BC8F09997DB188629774BC26595B037D

SMS_S rxj.dnigluazc.mzfoxik

9F144E01A347D7E64D2E392D136765B03ADC70F70F0B7FA6C70893CC0527FE93

SMS_S uhq.xlnhbz.dtsa

9F1ED2BF24E3059AF5D8820A32D64C207AD136CE1FA01D19BF2207D1146B5CCF

SMS_S cfynut.tvdmueyazx.kfvygbz

9F527C893AD62A16D436988C32C3DF38769A800D2E6EDF3C9607D35401CD9E8B

SMS_S wiqeg.rezbco.ncoqptasxu

9F52973FA4D2CF4EC613EAA2D55A2ED988B74A6F53D08855CBD73BF1954D5B7E

SMS_S exbho.zewchxoin.zwtimgnpde

9F646CCDE12E42FCB56D36C594B7213E1F9C033EE536982D5E41C2FCCD9317BA

SMS_S figota.xuzpin.jlxduignypco

9F715BF86EE3CFA0A2F8DA73C4FDC0BE1517E SMS_S lpur.bmcejgv.xycviebfmr

Page 230: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

23F77D435073E4337464ED1B7F4

9F742F7A742894BD2945FF5CC8F90C04620AAFFD04956B34E82978FA269CC8AF

SMS_S hxbiy.xnupsh.mbkirjzgxp

9F774BDBE514B57F014867F54B86B41B54564BBD224928976D9BCE610BC64739

SMS_S kfxolh.dqnrimvpyk.hvnufcyprq

9F82D6E01A3CE6DFF3704E2278B386236322E69DDA483CECE64C6930A686C71F

SMS_S vayskol.xyvelcdfs.nlsyzhkf

9F8465D3EAC9EAB4C0D22EAED753E83686441EDBF64C6DD789B5135DF7A211A1

SMS_S lfhr.mckyhgqlb.akjbcv

9F85FF722AF8ADC241F6DC1CC045BADBBC314628BF6F7F4F67FB80271555DC99

SMS_S fhj.bvujhpyaf.yqiwxhdmru

9F8EFA26AD28C427DFD4E113408E38601B4C088E31E2710710221ABD64263577

SMS_S vqcju.bdkxarylg.avemrsgidoz

9FE5BC6584CD07905D5CF58075821983B1FDAC3CEDD9B0E3E2D73E9069A9BD37

SMS_S nvkiheg.uhfbqo.scxqpvnmrgj

9FF09826EE181C0E12701284A020301DD4C3E000EE3430E35C81B80F66C03336

SMS_S mnkc.kujvgrebi.xayivdoh

9FFF8EE2654C826D3E413873A382F690CE9BCF7A71E37DE30403BADDB685B6D7

SMS_S xoz.bfyhsjvlxw.rzfxvep

A00393188B6D923C4A616E11DC40A761E4681D9FC8ED688756B5DDECB5425E88

SMS_S tjacm.lrypwjndi.ayim

A00702CA00544D4EFE0D15FDEB85632B8DA4569690192F0DC933AE66CEA92996

SMS_S toeyfi.sfjntp.qlfikwovju

A00A27CF1EC1356822543F987E0F26C8BF6CAB9E4D05E8406B1553A956445216

SMS_S mch.oqiwcjdmr.phykfbsrl

A0162B1EEDE83BB183D87D59CB48AA614658A7B64B1D3619381AE577A8115563

SMS_S yjt.ajchpflus.sqflwexhzka

A0180AEAC7ED771CA3512A7BFCA627B692D2F9890F55D38D71C9CE04095588BC

SMS_S xku.pamluyzse.wscyha

A018A31A42308E0027594159B5991B30E858085CB97429589654B16571F5A21A

SMS_S osgudyf.lofdshrpy.gobisacv

A0224530B3B2030AA595E18539F262AA36994FE50883A8BA4357DE89C4A74E73

SMS_S xfvmdw.crydzmx.dfqh

A0254F5819AA38634D35E998E9996280FF17138FFB6198DC8AA5F943F5524FD2

SMS_S snerp.xnvzyqgcr.lnuadfoxjb

A02E3B7D8A59828339837A94B696589CC12AFBA0E3B43DE437B16114A8D3CB78

SMS_S hwpnagq.fqhyxa.ptlevyqscjx

A05740F0A247C390FB50A60DDB8666B5A47029573E3789761100A6AE3240E67D

SMS_S ouezxf.ezjbcs.rhbuzcmeq

Page 231: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A095C03242BF9D5B1ACA9A3BECE8FC7C9555CE8DD9DF0346FAFBA9FFBFDB13E8

SMS_S oijtv.dksipwbonq.rhanobi

A0AB0C95C18325C6F2E6F424F6B773A4A90DF814F64093F76B128C99E8D50A9C

SMS_S apzuosg.aceqynfl.xhiygb

A108166273C89B009628E8DE91FA12B6B19C05AFAD4660E70468366F8D1B19A2

SMS_S kra.fimvnoe.wpqtfl

A135B60D7912FF841C6A9EB2847AFD679703918F71141E0B77D4D1AAEACD8C3F

SMS_S mvdhni.mreisyzpuh.tnagprf

A1424A668CC0E19A4DF7E6BA4595E98A79A50B55D7592912EE85B38631490B7F

SMS_S vrk.hmluvi.nvsohwlf

A1668D5AC86F63263B79849C107055D9D0142AACAC7CE8B601C08E7432CA03CD

SMS_S hlqtide.imojpyftvd.kioz

A16FAC1859CE72C955271603ED2A3D4D34E74A6849DAAA7CFC22984A9FB1926C

SMS_S yzmdkot.tpgivwmszy.xejdh

A17BE3B1477ECC9A71C554BAB1B6B1C8C99F60977460EF6D2B8CDBB2E4BE83FB

SMS_S bnospkx.pyxcesrdqv.byvfhe

A1CA6E7784C29F79F3D78F12AB15733F0CAA1B22B0B6FF91E618F71DD475C768

SMS_S ndexz.gwdrnzs.xsljgqa

A1CAAC887DB9FC90D757466D55F13E53A18F91B3AE557A572FC4A49D7FD7DA87

SMS_S fragnvb.fqxpzagu.qvblnh

A1D27C8D0903146BEB62BFE664535326515A3318576A8DA86AFFA3CA4E7A572F

SMS_S oane.rghkseyxvw.jwuodh

A1D3DEFC3980A60BFD89EED9CB82BC6494CDCC64835C0F8055E70AFC3A193450

SMS_S oahflce.iojsufgrzx.exjnfdcpthr

A1D3EC44302E97E6DF283489CCE6F32F12E931B2E4ADE28F50E7CC250E34CE5A

SMS_S ohrevin.uxmnqrh.ykmxtulariq

A2015E4364778F8E4FC0A48EAF9FE7521AFA5E615A98ABA9146DCE3C3FA5326B

SMS_S qwm.ywhlmpift.ikvujoa

A202AE8A8E3E9ADF0BBD4415AA9E00ABE8AFF6B323AAD98922CE0A30E5E35737

SMS_S fpyws.onbvcsl.icnoqbvtulk

A213CDD6A6F0827075FFD3F4D1D97CF4ED0B5676D3D751E461DECF7C031309DC

SMS_S pbjloy.yqtwbxzch.rblzdqtpwi

A24C523D36222620E3C6B74AE3147DC82EA060D7D52A41386C13148EB746CE4F

SMS_S xgafrq.oesrhdfig.kfolqxuaitzh

A2541B543DB9D3B40AB07591DEAEFA485574B0B6F0AF6CA6ADEA862E08C5F01A

SMS_S ompsdir.tkjfxumhi.sxoyhpgfljqd

A278DD90A282FD5F988C6AA2E70AE2D0A5CBBBC7220277A5EB38982337452AFD

SMS_S wdx.gdsrxwmle.tmierohzb

A27E432DF560299BB0E50A08F1D85C7A13392 SMS_S hstrbp.dfgqsmntj.orygm

Page 232: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BB47BA1F3529A604FDAA37C0C01

A27FA3151AE5BDE04906194EFAB53AA30BE80D1247396F0971CAFD678A52CD0F

SMS_S hmy.hpbmjufsd.iclymdoqx

A2A2D8D8DC55F7889AF1CCA0D2A05C2BC3A91CC3379AA11B56A0181EF52D4612

SMS_S tsehzc.knmgqp.cxwhr

A2D114C59B8E4A3ECC4135733CAA6305B5747C4639C363990C81CEF0DFA4C222

SMS_S rzu.pjbher.fqnkpw

A2D539895CAED53548F6A14FB9AF9D3F91AE6CA3FFBDEA4F6CCD2A33DE518A89

SMS_S wpo.ylfgrcnk.kqcgpbmwe

A2D594AD332F2EF3437EA54E9A784861CA43BAAC3912E3C12A3FE7CA30CFF6F5

SMS_S xsac.uomfjerpyi.qbcvil

A2E4D22D3EC3B56106A142391F6592CEE4BEDF99AB0FF28DFDA1481F3527FFCE

SMS_S esvwz.wieltv.lzcbrwksupt

A2EA727171F266C9A551AC854003187925D23CD3CC3C5EB67135FDC1685B14E3

SMS_S japufqx.dhfsgetmo.ohfjil

A2F3EA56EC07F1C613F0A382DF6B3F69A90BD5D009120195C79866B21618355A

SMS_S soatk.ungcqm.ctlsuxpdngo

A307185B5078FE4878C0876B10EA8C85114C0487E8F8C32758E3877C441C78EF

SMS_S ieo.ogzcepdans.hvyedgq

A30EA42CA2DA513C38D9BDAABFBF9212B500E0D094FCC4BCC631AD901D72A699

SMS_S onujmxd.yjbxhks.bifauy

A32FCA1AF216E321833774A6073219AC583395BCDD0A8BD8B77C4E4EE9C3515F

SMS_S iwag.yebdta.ojpgm

A3440BB5F038C07A3BD87810F38A0510C946727FF05DD8FD0C85A2F0965F0FCF

SMS_S ovnjxlw.ynwzmt.cpkyharnfvb

A35903AE6DCABCD32C3A45D4517C81B693F462EEB342F562DA26A9F4D6BBC36A

SMS_S spk.zljkcpob.xfcgsqjroibl

A369C77A1548F987A1C6137C01A8F3D6EB9E61FB4B50FA5688D15AA614A7B38F

SMS_S nqyhcj.pnfxew.yfgcnwveamo

A36FB1F855756F668D611E180B9F398D5235C157D0967CB754019C21C7C7E01A

SMS_S ithkl.uvlqypwtzc.xrhvomsciql

A3897F2068FB021765C57084BBA593244D9CB3FB8C4CDD80C1CC7800A098BF7A

SMS_S zmnvyxp.hbnqxsgzwi.ptqzudg

A3A132182B20BEADECFB2264811A697421D991D676ED30ABD08535F0C29C358D

SMS_S qyjvh.jnoszuimy.nybeglrfkimj

A3A26266684EBA78AEF0543ED71950797CDC8941BD1A3B3357CFD20C442EE9E9

SMS_S tzkwn.dprhbgyut.kqghcjxbr

A3A2884D08F3E77BABB337CCD696785B69C0C590C87ABFE624D3962524585DC4

SMS_S lei.dvuilb.pzlaovibhqgt

Page 233: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A3A88B5DA443C1DBB19FA162D45D2A2F52E128AF3088854B8B86558D5D3BF7DA

SMS_S prkm.cfxqmptaeh.tmacp

A3BAB42C45979559A2D97D3C42BF08FFFF0A0606CA50BF6115597E5EF07DDF4D

SMS_S kbzxsq.pnuqbjieta.megfjyzhuq

A3DA9FE9A046D5071F3FC42A426DDCD128A11F7CB95D5A3196B2ED19DBF316A7

SMS_S duyr.tvbwdu.actz

A4020CCD02DC82747D7A7C72C59050E13F8066C38A57FDCF9E6670554AC67404

SMS_S ong.awvsotkqch.mkcvqxh

A40CDA8CE9FCAD48D4E612E7EE2A92B3051A913829D82CB3B2D794EF23564894

SMS_S vjzfty.gbjomqhtzd.wkdr

A426158513BFB48857C13A16D7E297776B1EA9C5337500E3A56CA66CF694CA7D

SMS_S yucbiq.bmtahfu.yphg

A42E78710E24267BC0872A20C5B674AD797516F2DD810E0C94A9407652A965A9

SMS_S lzbpyn.whduprqliv.cmkq

A4310CD051B0138048BC778A78ABCDC51C613890D38D6F710A384DC2AC24BAF6

SMS_S otmqyf.zsitkde.ukaqcgyvlo

A4366DFD70335D1438C09176D8D778D84A7986B6300AF959C9C393EA62DA77F3

SMS_S sklfc.lbatygn.lmhxqatf

A45339F3C57698500678C64AF1084241266089BE0D3F514BE34F47DC04F9385F

SMS_S hndylw.brelynakq.aktojfh

A45C1DEB926869A293785130B7FE65BC216084CBA581845772E594B1B47C191A

SMS_S huprvig.lwgvkzxbn.hrpmgno

A487A44716C2BE87CE820E3E85F6961FB4F56BC289C1FF7C727301FF8DFF707F

SMS_S fjt.qjtvgf.lomv

A49FCF8DFBFB8D83FA4CE7A841ECE43A2ECE2F6A433FEB9D819B5A2762287C9E

SMS_S wpdsev.dqzsgarmw.hdavknifgmeb

A4E783992E5560D69233A6AB5030B857A20E0B8C99CE7C931FD0A006B319E235

SMS_S miz.dmpvbtgjf.zsbenxitkoa

A4E8F50EA4369A6210FA0533650D7D7FB1FF37353DFF468883C27B9E0742C9A6

SMS_S wmb.zxthjie.plzx

A4E939F764504BC3B8D063AC4F6D83632DD538AC24E9D6CBBCD00E6B73C3855E

SMS_S vxgfqo.apcbzu.roktah

A4F7F3CFA56E55AC1D4251BA59B66D19515E7CB96679DBB825257F5A22EA6759

SMS_S tyl.eaxgiq.gvehwrytkajx

A505F6618582168AD8F9EF242FD212F511C0F20E0871B365A06CC969814D684D

SMS_S zuflk.bdsofhpv.rqifsk

A50CE8357E7A25C5EBF4ECB6386D6C771A80697EA92CA233FCFEC040E94CC76E

SMS_S tvg.xrnhca.zkruagcoj

A51B6E5B39EFC720D3471E6C4AA4FF4F01DB2 SMS_S kngb.ckletbwmyz.thxrzfamep

Page 234: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DFEB567BB110EE16FB11EE8B3D8

A52123134864A8190FAA51A1CC350FE958AB924DAAF1EEC820D7398A325C7E84

SMS_S kiyte.dzongix.vanludzmo

A53119CD84CD394525503B82FFC86A1446AFEB378FA73292DC2513A13C201F46

SMS_S clwmbk.kogpcd.orkpyntw

A53C0DA2EE7C41331A458504EE33073534F21EB0D1F1F63738D994A47A07D865

SMS_S qgvo.vneaoyxdf.mgofpvictnh

A5443C6AE1F83F08BA07EAE70DC1AD845BAEB0BDEDB86EE7BF4781EB9E17A565

SMS_S tehmk.afedmbp.uzsorletjqig

A5600E0357E2F61C8A3195D444569FB6D94617A2DA9F4BFBFAC7357DB4107973

SMS_S pej.bqxwfuhrk.qoblnyz

A5634ED25E78993A14580DE317F469BD8E87B53E53138578977C13714F8342B6

SMS_S rgwuk.cptqlsrmg.olwhkxftb

A56FFA015B73D108C8A70F5BD895EDBE6BF24AAB6179CD3FE4F9088C11B050B3

SMS_S ozxltj.ptsjbqrz.grnq

A575C277C6DC137C9FF7406CBC225A88DE79B3DD80570D475470725363CBFC85

SMS_S oxch.inxuvylfsp.mpjzncwyos

A590B009CFE032D0E4703C83A08F09349005A848A7A5C520DAA05CFEB5D09628

SMS_S ozs.xampbsgcth.asrupevcy

A5A4211D5B3F4585029B557D8A318180B21F949DA26A7993965E1876C6EB3F2F

SMS_S dqj.tplgasfu.kvpxcnaegir

A5A746F83221510E1BD20E637A211242FE54A524A065C6621FF40426C9ED021D

SMS_S darnmsc.uemvlcdw.zqhs

A5ABFE9BED0EAFC3190B21389EC516BA68B064DD16DBF0B5AFE5B392C1F15FB5

SMS_S glkhjcu.batjzpgq.bnajxh

A5C4E18AF9CDE9D8BD236160D2ED4FC565BEA27B1445BADDFB97D00D2305EC73

SMS_S pfgn.xoyqdutk.scjvotxlmpg

A5CF020C80175EBDBE8D12F4F5C411E402FFCA2D89F7A4ABE959B1770028E9D1

SMS_S ndmregf.oujfkglrty.ebxmfw

A5E125159A62D164509AFA4E212C713C56572F60EB213FCA079D2F3D08D57166

SMS_S wqje.yuvplt.yzftioj

A5E2AFCB8E10A76F1E6D1102F67D4FB592DC011A38A13AC1590BCDD4AB2BFFA7

SMS_S mau.wpokigqjx.dosle

A5F7437A81D8ACD198FE088045B2C68E48B9861821BDB592B387203B9A4199F9

SMS_S lyuo.svqhzndy.lcqndjm

A60258BF62DE3959CFD72AFCB0015B38D31896AB0205F57FFBB9BE53AB2E2642

SMS_S xodiyp.glrmcdxnqp.wvqabksxr

A602A402D285CF85B36410D92CD1D56E96FF4B42C34387A09552C670FDA1DC81

SMS_S yneph.ljyzucvok.znywt

Page 235: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A6052BFC9B2F9802B13FB057B7671BDA31C28ADBD1CDE7E3D878E412FEE49C2D

SMS_S ojeuqk.slexvahir.gyazxhroukji

A6064238831B194FD85CC85CB568038490ECC32434CDBC7A4D7A85FA3B1CCA4B

SMS_S dhgjiy.liyjkovwa.yklq

A607CA60E0AD255877FAA025293B22A16A815851F99CBC88E73C5D6D6D7F569C

SMS_S lubt.ejhaqkzvon.tumdysgzx

A60DEB4B95AC19EB00E794D385B2EF4075D9A71DD70D8B6ECF60BB8CDD3F6762

SMS_S hpsr.qsxrejo.ouhrpvedmk

A61F52ED9A137D75F85454F0C9E945B63131AFCFF70627F719A58842881A230F

SMS_S rjd.ubaqznrfg.vadhq

A6279154C28C23039BACF118726379FBC80DD59B51A5DAD1ABD0A8A976D253A4

SMS_S ayz.xbkhfadvw.dcxikuy

A62BD10664AF8BA201833C5354D3D6FE2E9839BBD0CFF3DCFA622BAB807D3887

SMS_S ktmal.cehloyg.vlbftxzwsko

A678CBC79182B9C0EE5F4BEE5D3EE6DB2D42E3853AF2C8F84F5142DF84B54676

SMS_S gijvkw.utkpyfqm.nfug

A6829D829F253C0476077E2B4FF9FFDDC886A0CBBA5F74D6542D3714AA53DAD7

SMS_S quzs.wecqvxdauj.pmdlk

A6921AE2447F5B8AA8A13A01C5F06F7898E574DE916ED6821BFF4BFBE0063F16

SMS_S iupzrxd.ypujiwhaq.rdizvaugqs

A69E2A6F267BF780611F53E70CA61A5807C066D71EE04D4EF9BE64C0945C10DE

SMS_S nud.cpekwn.dtpxvlkonfbu

A6AEB35F6D301B65589CEE8C4BEBA4BAC132173BE878A0CADB21D9FCA008E5CD

SMS_S pqc.gtdjyprlmc.jluwcbqtep

A6BC6A7E9DFA362E1D8842110135B3D78C902AC27885C200ADC194ACFBC2E426

SMS_S guzlif.lvxzetrg.anqrs

A6C9C8277F71219B4EEDA355A5405739686933FBE2F2C321FD5F81A9C95C43E5

SMS_S zsgxn.sujqgerm.leovc

A6E0D47DF4AC6F860C6ADDCA815AF5C1AB20CB99B2F0B837F5738476689F2CC7

SMS_S afwxlzp.anmcih.vedrtap

A6E590ED6D365EEA65EB8A34981DDE095F3D4C9FC5ACCB90D9A5394F273DD1A5

SMS_S zktlrju.uvgtmiaqcz.yzgpfqudck

A6E727C402A68C32B191D184130516F61166D2F8BB4762E29037A7F1A4B5EC89

SMS_S byzai.pmnxjl.qhjsgwdzpta

A6E95B3E46D934434FFF7C2F851F19A4A439640F97945F1611B5B2B04076AFD9

SMS_S gcpdjae.yqujng.mikgo

A6EAD399B0A021900827A21D30B18815223B638169AF83D62090F83C594688CB

SMS_S psry.ynazmilhv.kwvqlbnogeyr

A6FB8DF637C9B32525019815929FD45803C32 SMS_S aew.gmrdvcyx.xukytcjfw

Page 236: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D6C2A4B405F4E1E0B55BDC6C244

A7189093E8AEF14D61A66D383E492C2F3E2C333F5423A7F91A8BF8BA2B8FCADD

SMS_S fglqp.akdcrjpef.tscvarmd

A71C85C2040C653EA3407BBE64E756D68653D7723BAE8CA51E93F071B0C5418F

SMS_S fek.ogylfmkhie.lkaqc

A723FC7926FB2B91A8EE787524D4E6B481BDC4A7E11110AFEA6534DE790559CB

SMS_S abvtdc.hukdrmy.oltbgysmnxv

A75281FC7F33A3FE83FAEFD7003A8388B10D9C206550F5343A0756AE1A5015C1

SMS_S crqtn.ctgfuzlhed.ocdfm

A759A5BC4683DB01ACE5B20731B974793C779985E006738C588AB611513FD892

SMS_S ivy.mcxgykfi.ceofhps

A75C40AFD2B1DCA430E234250FFB91E053A5677F16EE798AEF246FC37F121266

SMS_S kyotj.dcpzuqab.dqvmwb

A768B203B14302D5588FE27F101F4162E2B9F3B3DD1BBEBD1352EBFE134F956D

SMS_S qpmbe.mviudn.nsywjk

A77756A62231DEA8F99EB49C90C1DD4D12CEE6E78CE6AFA8FB4EC77B15E2961A

SMS_S urqp.vnpyor.frawg

A78936732270A44A352627DD7963244392A76D2AF25E41E4F0F29ECA9E7BDB4E

SMS_S ihx.yqocdsj.qiwcyzsonur

A7A465E380D6F727878EA55D2C8F93F7E9422E2BEAF9C3406D6149A2B327AE12

SMS_S lcwm.ciuyvnse.scxnalhik

A7AA6FAB22F65D48516811CFE746E8EDC7714BEE195EFBABAC9482B459D6919B

SMS_S xtgupbn.aolwkg.ekvmj

A7AFFD31F730202E218C923B2B51D1B920425288CE31FCFF27101127F08E0B70

SMS_S fdenlry.ecgharxpn.cgxk

A7B3E19EEB186EC8A304CA9BE3DABB492AE113890129F9F1445D5416876ADCA0

SMS_S rxyo.haykuwqsc.hngwqjvtlis

A7B9F8B131AAF854BEA91BB25C01720FEB63B5C339B65716E9C1B31A11247D4B

SMS_S jwo.zfitrw.xamfihgn

A7F298621D45F991BBA945013A91F7FDC5420A2A6EC992B93A30E9FFB661F6A9

SMS_S ptwds.vdfgnuims.spaklqrne

A7FA28A6E1202E61AEFED21A0860A39C9F36607B38F5B57DD27213B4669E8698

SMS_S oascd.qiktbjhwvs.lvswakrhegco

A81374E52BBB7574B580B4112BCF1B9D449D44987912ACAE1A1BDA46FB867C07

SMS_S juad.tbjfaynm.eugtnmahrqbi

A82E2501F0296A3CA692343C844572F6F1E5D345A8B0BB3D8DD88B29702A1D6A

SMS_S zisq.nhsrimkbl.mtspwngvufc

A868D396E9F8443C232A3451DDAD4CDD29E542B52E706500EC8176608CA1E09E

SMS_S jyto.sviaocb.qkshtld

Page 237: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

A8747AF9800853E89FF194034AD76559CD48F62ACD42C59290CAC1FCE0E932C8

SMS_S ujhv.mxfrsljqc.swxmzv

A879E934393140FDB1EB0F9946531A85F34038CD91614228BD2B2CE690CD4A31

SMS_S dolyba.clzonwi.gxalkc

A88295989936D242DB0ACB675A6E0D82E949C3CD97F04D8D79B2BDAB80DCEE59

SMS_S fqyinks.rnaxzqb.jcmoe

A8A40BE67F1DBAC7EA3E59ABEA06140578063BA16FCE0CCFB70CE31CF30B7B0D

SMS_S eltbhcu.uopckxh.tsedb

A8AD6BE640753747B4D5ECDEF089BBCAD23DBC70B63A2AA68092500E6FD357A5

SMS_S rkxjnm.fmalcoqnk.xvljdemgw

A8C6E1FC949CAFF201D1B456F185F50A2D589871AECE10C174EF556D807CBEF2

SMS_S xrlctu.hmancpz.duxgqa

A8E54EE8E092123583DFE9B7C3633C6C755383B1CB0780793E9238E4B7B284A3

SMS_S krqwx.xjroih.jmfpnywah

A903A37B4D9069F8F1F484E4B227AD9668D1222E94BD5F377F697457EB6187F9

SMS_S xuhecnd.zscnml.thfvqxsb

A913D3F8A4FFF7317BEA604191B36DBCA6F6A4E2613C63A9957D70F16BBC722E

SMS_S ktr.uaeoyphs.jahtbypxm

A91711A9197F7F88965A8FEBDF6A5A89052AD66AABB50A9E40A0E1C529196E2F

SMS_S ine.ypedqukhfs.gwqtyx

A918E47EB37601EFFAF82F568E1DB16FB23C9FE5ACC5AB9154357022697A1F38

SMS_S dyieb.duvplbf.udxlbhayi

A9192DE28E63F9A81E7CD23DCC4FDD603EBB5AE5DCCE7EDFA36E39E8A58454D1

SMS_S zlb.ojicmf.xtuy

A926D88FE986C244B245107CF6C9600B2AA7114475CDB3F6FD6DDD837D5052D1

SMS_S pyrjcxh.cgvudrsf.uyqvaipnhdlm

A92C89059ABE1897BDE8051253CDC66DAB828D8A02ED61458C43653E220316A2

SMS_S bucfr.pudwzyk.levfyxt

A92F3E76EB8DD2BC233815E8A5FF5FD090BE0C7447C816B072A8C0378E625A8D

SMS_S vilqme.nyetkirz.mwnersvzuba

A94D432E16339F785E21A642E1693379C75EA7605C1170E4E669D4068B4C6D0A

SMS_S whpgbfy.lpodrkn.zbimuk

A97956E5F13A8C8E40CC7F542EBDAA8E1F2044DB846BD0B9FEE4AA0493D608DC

SMS_S wbze.pjkhdrbvut.rodvh

A9883572E22F41170E2D3FB82EBC2A8249878FD5BC035DB11817A7F5329B6423

SMS_S fsamt.tpqumx.fmbvijgz

A98AD4FDF5D41CC10C67131F5C2F4286FAEF5945E3F4F80F9B0B963285CBCBA3

SMS_S blk.ltxzvyeqru.yfhucraxlq

A9A00E7734D7E1C5F5C99FC9A4FEDEEC2094D SMS_S euakmt.oufxtq.jyieaohb

Page 238: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EE850DF4712740B7439B4020EE6

A9B074FA35A8347193C9481E7663DD2E12BCC243ABCFE46DB9AB50104BDE7C88

SMS_S ouycxz.kufdbgs.xotkimqgwen

A9B3034B289C804A66F7BFB5C54F1CF0E134D16DB77276C6EB3ECFF17F043DB3

SMS_S zej.ekujgihxm.pixlgnuya

A9C28517BCF5F551A42A72FB8A09693001C2D0AAB4B8823DA672BCA6727CEFD3

SMS_S ickg.kgqciayh.gsixeyctbzhv

A9CA4594D5F4029C52490668218C802D4C8769EEBCFBC889C7443413924A69D5

SMS_S kfimxgr.xknpzey.ehozcixqagtm

A9CD1B040BD43CE7C9ED83FAE4048348C8846D7E01E2E6570E76B7E808358559

SMS_S lrxe.ewpxcmfk.zplch

A9D0C8FAF00EA9505BC9045C5A6F81F2B5B87A6C67E330CA2C14F691F1E151B4

SMS_S imzydr.cqevsxpl.knzxs

A9D2894F86890747B7B612B36B8FDFA7015499BC010E710E6787143B9510B854

SMS_S cdn.nmfivj.nphyqtvikbla

A9EABD5D1440271A63FA46BE8C80D162F9425CAE278B948C0338E21EF7BFC8FF

SMS_S eomr.hvbypot.biytjqdgo

AA03080BB017BDFEA597826A50672F0C6A4F649FBEC5D739F57ADBC8323C47CD

SMS_S pqca.zqmvunidw.cvzfox

AA0E71D1734CC84D9C37D61C8BF1924974175074E8997685B5F7C10530178426

SMS_S fwk.afyout.pefnbgsw

AA1D6DF1DDC0A56C73C4BE9ADD17F52EF17926339B6697C1DD46B3CD63ADE1DF

SMS_S mpaj.uqkvibxw.tuisvbghw

AA2CC054784BA0FFF808D5849253EF31961FF0CCFB9297181278BFE147B2236F

SMS_S irzkl.menyqsrfjt.hrgbm

AA3403B43B7E80BB85AA3305C14E274D1161BF079F118E881164BC0BD5765D47

SMS_S rfohd.koynupj.ouhefjbnm

AA6BC85F63AF3EB0FF1933FFE85CFB7443C7245A215B2CDB366F313244FD0107

SMS_S aoq.rcmfpvibz.dvwesnca

AA857C5C4BE9CED706D41B1F393E101461B5E8C0146B006D9512803A250C55DE

SMS_S sgmkj.oakdnghjlz.zhrncgkiy

AA9BC514AA1AA1B77F04BDA309D79A40568BABA49E54AA64D0F7938649C514F0

SMS_S trfysqc.nxkizvsryp.vhuecizjk

AAA559AA782DAA025B16F922C011C0E9F4B5C51BB8B036574692955434C1952A

SMS_S pvos.pdsxikljwq.jzdkwnpsm

AAA7E7D18C5987206386516A942CC81DCCFE6BC21264FBA2EF0A2563B3791D83

SMS_S lduma.jruztpe.sldgftjbuwh

AAB5A7D6D9F8F370159DBDF1BE574F9223B3FAFB73F5CB5108744B5F27989C73

SMS_S ohng.qfbtvnup.juztmh

Page 239: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

AABFEEBBF1B461B5BD4651F1E1EBFEC4997751EDA914A4EDA59DDFF27BC74297

SMS_S rhtick.rhqaibm.zrjfagbo

AACA17AC81D8F638CC54FDA2395FF7586B2E2461D84EA73240B5C47CCD6B7BF9

SMS_S hqtz.xaygotzwk.fpzseyi

AAD8C9AD39330DE56288C601D64A120C9F1DB5A49B09B544DE3C4BAD89400432

SMS_S asmihyb.uvgrodqks.pnbeyfimh

AADA1B8085D320FBC74AEAC0B0A7F25FC5BA22F92CD3FF473477608DEF6F5E9B

SMS_S zqwjpf.ehrctqaiy.udxmtkav

AAE2A0F10515A2BA97F73E7C506A5180D128387CB5B1377AECA8CE2ABAC73200

SMS_S auogsfj.tejnfupr.mkjzrswe

AAE722AF373567DCD0B395559AD085A0CDAA5510DD40EAEFAB82DBA395912336

SMS_S hdjnmbx.hktgvfd.adwxyqp

AAF1E2B6176B981A10BEBD0D7E46C07BF820D9331CAC0D51CE6E771AE47EFA66

SMS_S ufm.kpqdcgew.rxtgecp

AB130F9B65E8D457981FED6A75992A506A7FD2372842B100CA4ADCD310561EC5

SMS_S tosw.chtfmlepg.loswydfekx

AB172C8F9AA4565085F8C833C070568A4522110E1DA47665BF97EAABABBA33B2

SMS_S lseo.kfejptgx.qwbsyhig

AB3572CDEEEDBDBE9363DE48D0AEC629C35C67B32024A46C0AD2F95C4A688D72

SMS_S vcis.iypqak.lxer

AB4BFA733EA7634CA90954BDD31605D5D0E12EC574AD5545118AEFEEEE77EB83

SMS_S qhywmc.fpdyoq.dnexoua

AB75C3CC1617FFF570007A50EEC5F54CDC42941EAFA9909BD7714989E945E012

SMS_S wtd.xsduwet.zwcrsbnoi

AB7AF262D287E9D320698BE4E0CFBCBF503BCF3781BE014D32BE6A6492DCF1F6

SMS_S oevw.cfhlmpgutr.nfygohmauc

AB84C5458D46544F3A965F784340AEECC4BEB2B1911A78A29FEF5ABA1BBF2678

SMS_S hrtn.dipgvy.ldgcw

ABCC24433829B2199C38BB32868607384807DF3F20D3A5A52D969BE5CFA3D6E6

SMS_S irjcgzx.cknxbq.rnajgku

ABCDA433868FD26EEE4510D025250FC099C8960FC65C196EAE7AC2222F4030AF

SMS_S gtwr.hjyozkxptn.mtlzenaovky

ABCE5169361BA0248B6D53575F01B2E8A5598FB587835EC773A06DBFA82B8709

SMS_S kajoi.ecukdxljf.dacvtj

ABCEC06BC34AE896E724E261A99AD74D98CFD55C4E08ADDBC9F0F45E7BE5E999

SMS_S xhegk.wxafquel.fmtbydlj

ABCF7CFAE74E14C1D7BF1CC1684EDEDB43F831A44B19F42125D1794AB0500402

SMS_S rlgwfne.gpjvotu.pksct

ABD68BF25B1109DE9D96556C06FB28CFC6455 SMS_S wfvsl.beszhuy.ehfimqzgpxt

Page 240: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9CAC2C9F3C4F1117857F2173A9C

ABD79146D8FD16EB71FB3A4EFBD4EED69D2C7F019027ADEEFB0B0595DFBFE3B2

SMS_S jri.mpauvdh.bipndygftxk

ABDC3AF42FA74FAE564383D4162B842518464407BB58B68DA913B41D16362863

SMS_S dcg.mfwzvolxa.kyousxrdthb

ABE18A5C1069F8007B8E9704EBDA0C59D4CD7FAEC22387F8DDECF36CDDBBE1A7

SMS_S tguwq.azdbviutl.zbpdka

ABF4065B014EFA036EA896CB59A54F9A842F272D374A6574E7DCE5D84D9E7BCF

SMS_S cxzjub.xfnpgi.yinbl

ABF91803AE45C86F7876D1B6773D5B1F1E9363BAE7435105D1046084FDDD4690

SMS_S ftjkdpz.joitlurqb.dhekpcwgjufx

AC043E1827269B0EE784EAAAE363402C48E0DF5EE487D70B7C38DD708EA183CE

SMS_S rxf.zwdoml.rhqle

AC16378FA6B3822F14BF38CF3A5BF1D7FACB7E63BAEC2CE574B049F9B3B5A6C4

SMS_S cuns.oduzavy.hjnzfkv

AC29C509488AE867E0366AC0C3DAF26CB1172CE07D90E71678CDBA87959A9F20

SMS_S userlcq.fgqvzxa.hgst

AC2D22279867AF90F85325D93AB32C2012DF76222F1A4F78AC63228E3BCEDC8E

SMS_S iof.pnscbr.ucyil

AC54F9AE047B01161A78DD1CAAFE8CFFB99CA0DCF1A2CAF22CD29E25E548721B

SMS_S tebks.vsezfwbyoj.urhtb

AC55AE2A2C303E7DFBF241AFE53C2DF834ACDBB17D056EAD550C9D4CBA627AB1

SMS_S nvsbt.hzwftpqe.deczqiv

AC7A0F057EFD5DB2F2DAD8D43CCD3EFDBE80CAF845026235DC61DA780FF63649

SMS_S rdi.faeocdhxvp.jcoladuhrbyw

AC7A168B3C79FA094694985B9A2AD7617008D80D4EFB93DB954A6D1DBE418045

SMS_S qiglop.okqyev.qzbomeujf

AC8C1715D1C1C9D1C2568979139823B1B8DFFE42B12CD98975FDF05CB3AD8B28

SMS_S rjbqne.hjoeqidrc.cemwpjalg

AC8E1358ED311DD3F89017E00E30764507AA030120362BAEAECA12486BCC8FFE

SMS_S zurtph.lqxphawvsc.kplmwodnz

AC94D7267001B9A23ED1798CD023527AD355CD82D3A4751C69852F779418BE77

SMS_S dpm.lofmirv.ofkemnuc

ACA2EB6C42EF78327CAB07A495AC4A05F7CD51C32715D7604D57B935DEA25CAB

SMS_S aqfbok.mqujbrli.mfavnbyoqpxs

ACB727AC0791B268892DE1277E53A9D4E6A6AAF89E5045FEB124883D93B58534

SMS_S tmb.gschko.ezxtwcuqn

ACC2A73BB2AF6E3D08D7F9EBE7F3DE859BD7A190A5691BE63FE90B26A63D849E

SMS_S gwbjvsl.nbcuyl.mfczyilebjau

Page 241: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

ACD2C6637C064B328142FCD54A5EBD41ABFCA688244B825E5BD29AF13EA12EF7

SMS_S thplb.fqgvlazjps.hxbopjdcge

ACEA61BDDA2B10B44B89DFFF5F05DDBCD1E5FE2CC564491AE49737C7552B562A

SMS_S smze.picqasfjek.aklj

ACEDA9D3C51A493CBE75378CF186E8532B8C05BB3368CC6150D3EA9FBD0216DA

SMS_S bjv.ixhlvomr.apedifkb

AD2E2897C94F159A32BCABEF14994F7731A6B79D408ACE989694BB2D1B2CDC84

SMS_S ywgzuam.maocwxn.itwrumcgs

AD3DF6E1FC910ECB3F123871FBA7C2568E4FF0DD9A002939F76F709C6B3C573F

SMS_S hyqipl.vhbkfe.tjsuzweldohy

AD477D8D43C34FE6B74B9FD5D619EB51CA000DA729485708643C54E1026B1A4C

SMS_S awb.xwpjfimg.pafdozgwxl

AD58EBDAA3C04EC8EB283BF357EA04AA26754A79B67F9F0455B1E9C5AC4AB887

SMS_S xym.lyfvrm.cjomazf

AD6901BF5A460EF284B49DC7CE838442E6447E18E2D07CC52C3545E15C59C39A

SMS_S porvgqh.adlhbemz.hbowl

AD832D0A121F8AE0C165ED68B52F6E66BB99A9DEEC1C8EFBD99ADF4F272692E1

SMS_S pylwxz.jilhzkncu.twupbivxl

AD9976F8B750EFB9967F144D505EAC509AB6A5C4D72DD729D59F2D08FEB90850

SMS_S kzyjpqn.cemvytuq.ligscj

AD9FC3A9831367E06CD50EB26D073C32839F791BE719D0459026ABAF44F977A1

SMS_S veqwl.doemuq.wkelxvuhd

ADA041ECF14AE4084F1356972828BBE08F8CD281CD6FC95E467874FFFAFC1C86

SMS_S tuqcbw.cruhtk.ifpbem

ADA7978FF573A6D32E7D0A9083E0BBA6B8D99609EB5BDA2ACCAA384615772AB3

SMS_S zytlap.pfuebwro.ejbmko

ADA8C68F8F9E54D9355673E1E2427E5BEB530EEB693771BB9299A8A824234DEC

SMS_S isayb.cfmzyt.euvgznwym

ADC2C131F3DC6ACB57FDB466F6A7B7A128B74F6A952B4CD5B3EA4FA3F490E9BC

SMS_S hwjkx.pfkuen.hulgdvwrj

ADCA1FA346A02A5FDF0BEBE46C154185DDF415CA752CBDA07BE2A6E4FD6C014F

SMS_S xgqarso.ukfrvn.birtyawc

ADDD502D9B89EDAD1A5615B2F69B8ED7C472528D2BC1F376E442074C3ADFEB7A

SMS_S kju.zogfmlx.uinadlkots

ADE406595FB9F6BC27A8099CA00946BED371DFEC741C1E2E10268B36291285E5

SMS_S bolnzy.ckahgtdjl.fewb

ADF3C26E4A1209BE09DF4CE421CF045D66C4D624A1EFC83F86235E862F0DC762

SMS_S avb.obraxejc.qshxv

ADFEFAEC732E3EFB387794F08DF5C1A27DEA7 SMS_S ydzsnjq.nsqwzr.meyphtwfkc

Page 242: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E050A3EAA478983E7F3C03BC669

AE10780AED4D052A38C509B797254A8DE680EBA66E421649FDEE70CCC8743B4C

SMS_S gfyn.xmndyqja.itaxcfhybsz

AE33A8B9F192BC7B2BA21654E8CF38BF9B8047EC84B1EED4786167AC971E6C79

SMS_S ibgvfde.kldrou.rmsinjgpvq

AE3DF5878565A600E1B58B8186D552FBE5FBA558C3644532CE21AC7C8C43DBC9

SMS_S eib.esndmg.xghendmayb

AE4C09713FDCDE4EB42154A6FE613BE3F639844C05CBD56B724EE9EF85476277

SMS_S oeinpkf.kvajcys.nlqhe

AE4C7F5222E8CC2E209D65005955F5E6EA6854780D05F6B9D0D4C9A7A7D5007F

SMS_S rxayuj.clvpar.qremo

AE4D66D7F578FC7DA5014DBE53A6D584BFE136A7BDFB61977A6B301F7DBE3A54

SMS_S woqvyie.jigzrpefxv.bsqxfpzrkdl

AE50E6149F5A424261100BCA1C636F854F9EDB318057D1C04BA5C0559E2D31EF

SMS_S dwapune.zjbhwvfm.swabi

AE557690CB470FF24B1BD8E5D22050635372183BF9D27DAE7D30D1BAFC04D1CD

SMS_S wqvdgto.kcxifz.exzdgntar

AE6D0EF00A7EBF2E1C9E6525A836CBDA74D003D5FD78849C636E5C8A505880EA

SMS_S xai.yzcgwrk.ycejizrwfvu

AE8A421F5A01E37DC855F7302AF5D7C4CC060022BC4DC3E84001225884E8A0E7

SMS_S pawdex.sribohm.panqkz

AEA78EA99EAD763F880266767792BFC2E631573F62888021ABBBBD87BB07211D

SMS_S eqlazgp.nlxvhp.szwidhbqrf

AEC99AA5CDD99EBDB52DBB2775DE02172D0E58DE7D42F6040562FD9504253D26

SMS_S neityob.ncafdg.ywodzrtsg

AEE56CED71B51863A15B45344E16B229E0ECA6571556103DA2588EAE75635C80

SMS_S pikn.obsjvhziwe.kjbahftqrpzi

AF1C164939D6D0174C3F11B24C98CDAE09C17413993D17055ABEDD5FF850C4D9

SMS_S txgrzhi.rdabxs.gkdt

AF243CAD021F07023B1BDC4A289E1D1822064F8AAA8734C7464FAB2A462D1366

SMS_S enz.gcisambv.yghtpslk

AF2590B9D34E5EF491724696EED34893F18C9FB9A13E26A04DD5B66D60F14823

SMS_S wac.tkjlhn.zihkjd

AF261B89CCFEC9030E4E22B2F0A2530FFF236EB43FB5D52E9D0DE09995DEE617

SMS_S yzs.kmosdqeu.jfneoqplh

AF2B2DB3B97EF95397C74269A0FB52E8EE7AD3C525A60CB2A7920CD6349DB8E8

SMS_S rpha.ezijlnb.yevwgq

AF8F51F74B855D256A4B8B70F58BCF20F7888421EF6D6A23DB2D53C9263A4B37

SMS_S pdseqya.vptzusfw.wlknupxcjm

Page 243: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

AF96CD18A057A19779545D1D8F750674987A4D302D99A765DAF13D64905275BF

SMS_S xfzhdmr.fjosgzer.rqdlxyzhefju

AFBDEF1783DE46DBD9FA46A130B9F89BF20F9B473437E9343478EE4BCEA2F454

SMS_S rsvcwh.duyzxwarm.jadprmw

AFE96659FC68C980F89C5E2865B50C9D785BC7D94AC15A09FAE6E1B62722CC7D

SMS_S jmwpzi.jusixdvm.eonkubs

B003CF4562697241DF1F7FA1FE75FF7AB809887593F0A2880E28F2C915FCD99A

SMS_S nsfpua.svikjp.pjiumlq

B0047CC33887FE0E0E3C0DD158190BAAE6E818FF2CCE5980255999DE668F770B

SMS_S rkofgqb.ezdhlmw.wveouc

B04044A200AA6D3A1279BA40266E8DE1986EA6453EE4E56B2B16AC4EEFB44766

SMS_S wuijpyx.yksmiro.hjepfm

B0584CE3F8D097624DF72A67202B23F574C9755ECEC79BCDFD4DF0B3979EA421

SMS_S hrcidbu.undjsy.baprjz

B062B1C8FC663B02A5A9337E3AECB8AB58EE9D852611C9999FA01BD4131EEE63

SMS_S pwnz.xylfjos.dizrtsv

B0724ABAD183E0DFA78DF4DABD822BB63C0EBE984B240EF76B907F3DA1608BEB

SMS_S kqbza.srnyoghvw.yclvu

B086779DBDB052BB5BDA547D540AEB0CEF9297D80CCF3374BB1A1FEB065DDCF9

SMS_S kjy.cwqrahdjfg.wdvyqaenhx

B09A77395EA9C546A8B8291CCFDEE88994C60A8A6CD17BE87897945FAF933523

SMS_S ckphxt.wmqzbx.vwyi

B0AE90347B07866E74656176E1E3737CDA7DE6F24538CDB64E12DE87A6AD5302

SMS_S hxdtbck.fqszceiotr.rphomwd

B0B71D21D8848E29E3A3816A0D542A99458ED97A14EED4BA2659A3FB79B3A971

SMS_S xicnkt.czbrun.frsuptdaw

B0C3BC7A786A8C12D9C8F6D5B1CDBF4E36A9D41CC07A758DBBE2C9DCEE9F6C7E

SMS_S cnpkzfy.tzexvfunp.qyhmlz

B0C7AD2BF02BCAB821DFCA801A966BB42C1F8AB738208DB57E563087A7F1220B

SMS_S eiab.xcsjgqn.laxscd

B0C99644A560A849EEE74DF55A3B41D16B04BBB7AE5156A645F5833E6F6C2BE6

SMS_S sqzihpg.gwlfvji.wcjolszhp

B0DBA7F19360D341B07DC5229123DEB0242493ADFDD14369DEBEEC1FACBAAA02

SMS_S unwktr.vcmrdyqfw.yxfs

B0E92827F139AF1EA731BB8C3AAFAF3728C300B65197C57AFDC00EF75178CD40

SMS_S dzpuhs.lxqbcmk.dvjirsehyo

B0F08D7377F5FD434DE41FF9A9326D0AD174038EE50675671D9DA29680B627FD

SMS_S daqbk.talidnxfub.zvjnutyge

B101874B9DCF9B7CB006702A8A161518170B6 SMS_S dvhtpy.qveuro.erbp

Page 244: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3D7DAD1378A7C47B9FB2D997747

B120DD89E27126132A3EF4A5CC400C98E8E459E27A93AB197AB89F779533D3FC

SMS_S nzdb.gewdaj.ifwh

B16E493D6E5412FB14463D0D132F5B86D0CB5F4395112E3878FAA9FC146CE67C

SMS_S xtmo.fijrudnys.vsaoxfzh

B19452F1A3AC2BDFB9E103FDA68DF0F356B66893D8D0CBFC0BE497D7FC791148

SMS_S iuajxev.txzhwjbm.kldziw

B19AFFFCAD99E352E557CB2A86EF74AAA0884F85A329E6CC8957C28D32CE62FD

SMS_S mtl.inshur.duoxm

B1A2D1B030E23A1FF3533993361758F260FFB4B11F244478AA58BFFECDD47CA9

SMS_S jyqa.ypqacdtr.yeuiostgp

B1A8A9A2B4B39A1613893BC3F55D84F84261D0758F86A6B516DFF4D59FCEC8FF

SMS_S ash.fmczgix.nevj

B1BEE7829E7D653A6D455CF9AA6BEB6A92139BDEC46895CD9BDA2A31D86FFB2D

SMS_S ywxmtjo.tuzrnds.fmjivbnokdl

B1C2467C962E9A90805AFAB4AFC9C611F091115BCD9FBAF654D4231D108175C3

SMS_S uixs.jfyoszmpvd.igtsbuazcf

B1D2285316EC2A7E94387F1EFD1A748BA45DD47D212787D5628C51DC0E422300

SMS_S amk.smthunaf.kylvcwid

B1E15F47C1615D0B7BBA12F9FE65BDD6B688D5E689E244A3299C5138B9B67F85

SMS_S gjqfhcr.byhkseil.ksqveldriuoh

B22A2116844CA7FF76E692232E86574DDB716421705775B01D9F64BB2FC84882

SMS_S axfqu.rjgnubxkvl.zoweih

B24B84C85920A3683F00DC07DF8104D87384EB09C3843BCCF1593C79CBB4AEAB

SMS_S rckdeqi.merszgvxq.xhspwunmo

B24BC9F5F75B02F94F2B16C7A76146221D79ED7A0B4FF752DF671CA7E065DDD4

SMS_S bhrmod.waipmbnj.vmfupszn

B261BB603EBD4B097EBC8E0D56ADEA1E559CC629AD5754451900DA2E3749008A

SMS_S nbhfmq.xcinudws.tnhowkuylsx

B2635E7262AE533E42F3576A49B68A8C848086282EA6F790DD8482E7A7C3BF70

SMS_S uyjvml.emdnka.nbspqzwjdt

B265F144D2AF66C3FA29683A7007AFDA9605B9692BFCFFA633D44F6F3A230828

SMS_S lei.lrfkoz.ioxnaejhq

B26A1F5E0D8B9E77FC62016198B0538B7FDBCF8B1024DCBACCCE8EC4B75D95B7

SMS_S kjto.znpmtrdu.jnvlsm

B26D15ECEFB3938AC0563C289A7F8DC1455E207DEDF64F8F13C3393584BA5E4F

SMS_S hytozw.neadrzjyqw.evunpdzhmxab

B29845419D83ACCD52DF3AFA16FED1DEC984C3D3C72ECC9A903BD5B97A46300C

SMS_S ajrikc.ticajvle.jftl

Page 245: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B29CB8BFD2C6F7053A248DC662C328E1098CB263AABF7DC48CC8D2641604ED5E

SMS_S jhc.vkyqtieh.hybpo

B2B2AEB4C9189F45BFAB8A5BCD134CCA91E23B3932EC5C2FE3E2AB92A5139082

SMS_S blzmfj.bstaxgw.ihnoa

B2B9D5CACF6031A3259B457E8B0BF1F3B3C0AEF368FA28501B87A3A9A48307A1

SMS_S ixa.bdfcyerh.zqkweoimfsca

B301606877CFD09C3990C18A25272BAB7C49506E4A970F309808FB9CA29AE016

SMS_S sce.tbkhng.bvjptdkf

B307255A5CDE59ED8F32E6D0BA6E0A12119DA146EF29B1B58D48505B8072DB37

SMS_S knrvu.xghvztbquy.kgdp

B31B41F32BA2135897F38C984618D81B4DB1406E6DC5E20798C96E7AFFE73FC7

SMS_S xvul.ntrmawei.eaizjowvk

B322A0C2627EC54BECCEAB4D06692965ABE2F750612F468EBA2E38C3B754CCA1

SMS_S cszn.rflvkx.oipbsvxltj

B32303B4CC6EAA98FEC0F07F14CFF6DC4B820AD2577CA7F96CE0F86B0D6A256D

SMS_S klj.zaodnmeig.jszpdxhumebg

B341B960E41A707FC2A018180FEC485FFC279D56F1DDE1EF82D17C9A3A585C81

SMS_S hemkaj.bihqxk.uszxd

B3A86817BAE7D1E2C96725C62DC657ED9C6ED262CA50B5863A0E37A8F713461C

SMS_S bqthg.vhyrzpdj.okupgrdab

B3B700D5C3537FDA807C8362F79A17514EBA7A6FF423AC6D947D8FBED5461B08

SMS_S eat.wslzoydpgi.imarkc

B3BD58122879CC5FDDAF30ED9C57A8A11DAA2B0CFCC44F5B6BB6B9D5CA63E6F6

SMS_S rogcdxs.hdwprozvj.csgkupdjlye

B3BFC29D439023425EC6788FB0E8C383E42C6762ED0C262F6BFC1686A9319CF4

SMS_S epw.eufdhymibv.catwjbyqi

B3C280C4DA0C366529A5E7600097324D00D32A6541AF862FEA749DE0F45DE9B4

SMS_S ftrq.zafoigbdsq.rgwm

B3C4A7715AC68A13FD94520D37FB6C090635A9F31DF3B3901F9039A259D01C6F

SMS_S yhgpuz.ycopvwimdt.ivxheaz

B3CAE9B52EE42680D2022933433ABE9BF6B223A3490E14BE2ED149D59013E040

SMS_S mnzh.xdjfurwmpa.cuzswyalhrk

B3D3A2C513E1B627948F4CBD2CA0BDB9A809EDC193EBA04604466DD5AB128654

SMS_S fkdlnv.wsyeukt.ughbcw

B3D9CA15F2A785E61291965ED938A1FA1A9AFDD34E6C2359AD4BD94103A730C1

SMS_S kowar.zqifalmen.mwhjtasrp

B401EEDB4896796CA6A3CAD80C002B4F180D877AA7DC22208E37D0576AA87D99

SMS_S vurpez.eyvskqjgr.nflpb

B40832E00E87289CC70AD670FA77284EEFF038 SMS_S mpwks.fqakmgptlw.xrhvmfegq

Page 246: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5BCD6B742E6EDE678E1271C923

B40FC4D85345E9AECB323B4213D638EEA0A37B3DF66CE2815949DC6A088FCF25

SMS_S vyqgx.eajrqult.dfetmygan

B41003CE517B6376DA5928C4244EBF51F0AA0ECC6A7C599A3FC332533EA9B931

SMS_S spnkd.hsmwyidrt.hlgcivzdtow

B41021FA113E9FBC12FFFA509F321AE995AF5216D830DC0C5E9E9861F6014AC5

SMS_S trok.rytlim.uoah

B41E2755F968BF29D7C62855771A2CEB4612ABD594C0B4FEDF6F0A2262764557

SMS_S iedzqt.bafsnhzgcd.fsqkymu

B41E785436CAD43DA45563659272B132AE21F1FDFE91712058C3C3EA178B135A

SMS_S ahucxt.qrwugbiyvz.jqigrzon

B43CAF6CFA73B06534605021573CAA738791679C29911323DAE51462BD4F507B

SMS_S rhfeo.khuazg.cobyiqrgnpt

B43E15FEAE18EF4040D28B332D81359E65E645FB818580797E8A1C6A4B94BCB9

SMS_S kdltpfo.nbwdghz.wxlqubdayrso

B463AD7FA2507DF968928BAC2352E965E899F1BE6333D2DF6C5DCDB25E385786

SMS_S lbgdz.lzfhuabgy.fsogwluzei

B46734DC36ABFC5A491D59EF9B20C0C312F1594D51C1B7EA7235CF25C86DD37D

SMS_S ucz.alsmdnui.oqilpubymnd

B4691C95F07A8843F74D4FF399EF084D1B77903E56FE4D59B3A39045753806E3

SMS_S hom.goabizx.idnmzu

B46C0D065D22E967402D9703A188CD369F15ECDA3E04E5145C2909A9D5457A9F

SMS_S aitmgpb.rwzvepbq.rgnpufdo

B472EFAEFDADB0211566D509A46DF595BE144ADBDEC90BDACF8749F45DA1A729

SMS_S nawlhdo.mkwsdhzpbl.jtnheiuagclw

B47D4F6AA3165728D08514ABD247E3F0CC40E26842794DA5FA40E4A23E7A8A42

SMS_S osryv.kcqbrdnt.iepsj

B48DE37F5AAF19F0AAEBA65E1E10D3FEB9B36FFEBDA2687D071570515CF3F407

SMS_S vjqyfdc.phjynbc.frlm

B4A72E439FAFDE88CB03CBFCC6C0F562B33987456A400AAD5961FD61A7CBF3A3

SMS_S qhxtjam.ogjfdah.gxjasmryeh

B4E537E6B508F9190D33990134AFB9F3E1D291295BB18893AA5AEFAB8BD40B48

SMS_S sba.vedimfur.obswuhlakyj

B4E6BEBA53B7F7F9AC79EB057137F270A4E73346B2D2B324678B2C9EBEB9E1D7

SMS_S undrw.thaxoeks.uhljatingyz

B4EDAF5D26CF22DD85FEA0F7DF0D5463D814146650C52AC573C8D7B1503DA2C2

SMS_S ldna.umrdgnjovq.vgwunery

B4FD15E8EBB570E69D27B323DDCE6C715213BC1121C640CBC4C5CB7C899CCF7F

SMS_S imxre.iumsrg.jthxwbel

Page 247: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B52BFEF55F3FAA9FF004C1487E329367B2D7DA1B2DAEE66E025CF14E44449330

SMS_S gfs.rhboapktu.rcnwgzfsaedm

B5455DF44465AC18CA89528C3E341FD814A90F17348ACF58C269D5DA0B57C50C

SMS_S sagxm.dnxzlu.gceqzlsmv

B545EA179E456E7509B671EE9615EE6ABBA1BBB95A2B791B4B5356DD47842961

SMS_S vimo.kezyln.pqckhodivjse

B563EA240EA6374986D0384DB1B16FF51DD4E4C9753E76192CD5A858C25F1D1A

SMS_S rkylth.ramtkfhe.dhjfrgyplexn

B58DD989B6AC90CB2F26C67EBCC9B50DDB05834C8CCD2D4B253B08EF3642E31D

SMS_S lyr.oxizeafpm.otvlrazimk

B5B24EE3B5AB81C9390328ACBB035CB36AD7E540818969E469759896F96CD393

SMS_S jym.akevgrqozp.mravsqcug

B5C5A9D5514EE586FE4CBF92B2328B2381F03BA126297DDC342BC5231DCBBCBE

SMS_S hemdtqw.ntiwslazp.lghjvbmw

B5D13640DE55CEB2870D8661257F26282A45723EC3CBB1A178A5374F0D4F53FD

SMS_S ypd.kyziax.jpiqkezmvdar

B5D7D964148362027C119DC9DA17B51820C4CF509567167E88E6E0DE915F5DBA

SMS_S iuby.xigopmbew.quavbiszt

B5E5ED5ACCE551196F71B267C35F399FD8DCBB00771521C3683E93B03322E1BB

SMS_S wgyzon.glerptib.mcuqe

B5EA3A397221E8D422BC024193300D6016FDAC59C05DC45454587528987BA8CD

SMS_S gdrvsnb.rckvznwd.apnbordcx

B614928413F14B747A7903799210BA87357FE4AA3C34AD685B7556B049412D85

SMS_S jrf.qglxdzy.fjsgraqn

B61CCF6B0C320C1273EFF1BD96CEC2125F4C4EA56321CB45DB1E92A916C887D8

SMS_S zru.qgjwyxf.xjiygrphc

B61FC3A8B0FE562BC9B6C403C284C43604D71317FAE75B207FCE8264CE212A4E

SMS_S siwzxkh.khjewyoas.pwtvyluegma

B641C8438E363CD75AAA93E4671D12DCC902A7477588A098D98995CFC4689770

SMS_S wlyjtug.damxbfk.wgkixtuhbj

B654F050801D9CCAAE958BEB38DFAA5279209C95A3DF6599661D6CAB6F0912E1

SMS_S huf.wuzysfvl.dyliuvgsxk

B65EFAB6A4303AF47CB1DA9C1F572197A7C75D5F0A5A0805051783AA34E05C56

SMS_S lnbroc.uhlrgiv.objkytfhzqrl

B6724702B5EF7649BDD1C9980F76C55A8C87575B56F09A755B108D24FF598116

SMS_S lnk.pvjgetosly.tksjoeumbiqr

B6732D2495E31017467D8FC73FDF8D7FEC657312FE5D5B804C9DBF1D946E30BE

SMS_S egqzl.ftshlbrj.zwpalgohsm

B68E2F8906835FE3930F048479A40B21630FBA SMS_S oawymr.tfoesqn.mqxntda

Page 248: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DC59528898B726CB0EFAAD91C3

B6B3C45C29430B3EA380EAB461A2040A46A0913DBDBA9BD20F2FED203ACD371B

SMS_S uyc.kplgushzwb.asfl

B70190D0D14D810BFBB003829125607D530F8E30BE32B832EA064C506527BBD5

SMS_S gwzyea.hxdsmpvl.wdzb

B7082274CF433BD5958B60124FB7EC4203C30D25779C3A22932A9DFFBCBFC760

SMS_S ekhosu.etyfgq.wpjmz

B71279075AC86AFCE3598DDE59A446CE863E55694B0B8986C70BC8609CE84524

SMS_S usc.vjikwutq.irpxalevczfy

B712ECB7C4BB77D28B28C5623C6D124707C22B11133444512339134C4512694F

SMS_S rklni.qhapsguw.vwfmz

B72379CB361E3860FEF41303151B41CA99B2FFDE749DBB670CD6493A270D33D3

SMS_S gaux.wlcduki.wucjlrmzgi

B73284B1120231D1D02F450EFEACC23301921982B8CE9092B2F0292CA8FE34DA

SMS_S gmqxud.yrmoaxf.pfhebnukcmzt

B74CB60C94A40F841BCC9B05285B9AB863EE256660E18B4E4C066B35941DBC08

SMS_S nfo.vclimqzh.ixevbgopyl

B74E1D36DEFB5354DDD159BDBC81562052EF8C0428A289C6A03920EF14546A72

SMS_S hcpe.ijtxnph.omftlijhespn

B75AD0652A9EA9CFFDDC47A3FC8F4DFC901684E6AB62097F4BE9A9CE65C8ECED

SMS_S jmt.tkrlqwynx.cbjolhweq

B75E97E7F78DD13372961F71605461C529816188E28FC2F6C14B3191FA0A0ABD

SMS_S jhcyvo.jqdlzwsk.puojanzxfrk

B76C41841AD33EB1D7DFC7DA159CEFAB6A8B77D045B589BE6F5FD9329FD4377A

SMS_S cuwfbv.uyfmrwnpb.ierc

B79139A71DFDA048D85B34D38D113CEE0D45F0DD936F8B5BE306EC3BD98B5FC3

SMS_S fsto.imlodfehn.ieoljdkuct

B7BAA3FB926CC950CE7A3C43E5F007A887BC8B2EDCB9381360076AAC1A1BAF00

SMS_S xvgu.xwdeuhg.hykxswdzrqn

B7CC8795A0DA959999C5B14E46286B0116AD56CF3D31A328B307A7DE56D0CDF9

SMS_S tsbmey.ceuwqj.nmvhdx

B7D3549E084D895C391878CB741FDADE7F3385F3A06445EA349AA55199792026

SMS_S evml.bshrzyo.xvpisejyd

B7DB5D49B6193D0A5363E6AA8D0FC4AC9C43D65C1B5BBE7CA6B249596B24311F

SMS_S oianu.wltigyj.dysocx

B7DC388847F563292B16F6823E7A04332EE006F0D53125F9C57397D08D075FD7

SMS_S tfoqpa.qvslwgxy.xbdznpieohy

B7E64EBF57A027857793B132737185EA3226F57A7FE347B65A7D4DF19CAB0B64

SMS_S axpthcd.ryzfhng.swkd

Page 249: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B7EA91312967DB2B90C656B4A079C322D5F22B2F488E48EC7EF7F36952D60848

SMS_S jxkbmfc.kgyspiceh.qlshwnmi

B8109596F527C2748EB56AD5E81E59F287FB021874E2E277F6C0EBB9ECDC6CED

SMS_S exqcj.bezlutfph.tuaqbxg

B812CB173EB6006518A9AB73C91D31160EC18154350D787224EF01DCB025EAC8

SMS_S hlck.njxzpdwulq.cfwzvqm

B87A759EE43A602858CC51CE4D56A2BA9729F92A8FBEA02C9452D9E20FBB33EA

SMS_S rilkzd.gkjvuylpz.tvzqch

B880C2A1C09E2E4E5A779F6B477A049F113DB486B3937467DC52DBF08106DBB2

SMS_S zinpgrd.vltuzdgy.wefglxh

B88BE0FC7993555B07F824A80F38426903AC99FBC82A78991CDF901CE01BFE10

SMS_S qkug.lzpvou.hawgr

B8AA5DA165F2C3CCB2F2694E909717E9D919FE72AD53CA979FF4BF815476984D

SMS_S dpk.gqjlnbuta.nxjswg

B8AF05327E50A9FFE1ABD334631522531151708ED46E0579BFE3155228C2759B

SMS_S ntqbzi.ztswel.jwyflghveq

B8CB658A50A65C841EC557D3EB2F9B33AD75E7B6FCE4B34CEAE2476C71F695BA

SMS_S cso.lfuyrm.zafvewnt

B8ED5D6365B6A5C03F8E4A250AE1C24D7442AA6E968BD5E683C0373F44E9AF0D

SMS_S hpurd.bkmpfcdux.zcwitgelm

B8EF11861CFFB92BF5732B0E06A619144D24B0F9C708E4ED388CA86451850B62

SMS_S hlxnsov.olmvfz.njsdy

B8F088B8FC054047D844A05EC6DB28386770E45DB53CADE387BAD801FBCD7271

SMS_S jvimfe.obkwyhf.guipqrhjlxwm

B8F2182B653A060CF198E6F8DD752F7EA17A479817E24755FDFDD1127D39DD92

SMS_S bpfeit.wpxfkbu.gxtmbqnieufv

B8F2520D07E6095CB96D8AF166AB2F3E471D080D1F9782C267471E18566BC295

SMS_S nkgqto.zpvwuhgye.gfxzewncl

B8F5DA15FE74EA2B32F0A7EBD52AA23505062D833886C8338CB66CD1308DD972

SMS_S idgne.pzixrt.drjvoilnq

B920973A9A97E3B039443DE5EDEEAEE9AD825BC37E538B4529BCFAC33AE53339

SMS_S cwplft.eawbhimko.tvdmchbfrnpo

B92CF139E33B7A6D232332687816774968B040533AFB341E47253D4F18505FA9

SMS_S bpvs.fpaqwcrhnx.yzpd

B92D53F52F023A78DC1A28323BDCF7A74606F0F620BA76AC57855AD43B2128D7

SMS_S cvgiwls.uwqdaxg.xmabyln

B93254A5C60E65699A199225BF888FC9515E451607CB1A45F4694146C499C90B

SMS_S jpdh.adrnmvhq.cnqzoixh

B97A4DC9803FB8B476FA8EC343FC6C2A1BB97 SMS_S pwdfra.qvehbzdawm.amtzubxerhn

Page 250: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

ED90B71039CA380BE5EDF8CC072

B989E9B5770270782BC555B466B0E0029B708E22865DF0E57337612C6083E922

SMS_S hpj.ypxscrab.uwdgyn

B98B2C754D6935E018B87929EDAE4F897C0864EB78FF046891DD961128B03FBA

SMS_S fqckvzl.qybucmrint.agxqbhcupwe

B9B28CE5703EA2B9CC4F418E570F1FA4602FAA0421CEA274BD09ED6B80992E70

SMS_S hntgkj.zhibwsgmf.ovqdlct

B9C1610E49C899D6E768DBFA63CF2383E18F4AE5CD5CC19417B961A68F7FCAE9

SMS_S hog.lpaqgbm.cnuhf

B9D90A393C3FE21FB226C9CC4E655E15A149788060C1386FB036B025CC587AB5

SMS_S gszjq.mgtfrukeos.inzpb

B9EAF3937AEDF39A21AFF4D4CB4C9656AAAD8E631F968A14719D169B24DC6012

SMS_S clonxvz.zqxytnirjg.qoyhaijrgc

BA03AEF618A0899BA1048F7DD38F51BCE740B60F77ED34F638AC93890C392B13

SMS_S hysl.pxdumfen.lskq

BA11628A067C040F07F9902AAACD97952000F6930AD612058C62154BCCE88811

SMS_S yulfgzs.qrmhjap.baizoyduw

BA2E17C68D1D5A17FA6F460FAE0A286E7010F57D63CE97F18223809570E18250

SMS_S mgbsqdy.uhkglrbvto.iupayk

BA318CF1257A959846C702A524CEC27812D68C6BE1AFAC626A30D022E4751C10

SMS_S aedrspm.qogfvjl.yzql

BA507C7B39008E2F8B9EA3F86EAB35543AD37FCBBB4E1FE61CEBF993025B2413

SMS_S cwguno.mfcoxantb.gxhljdqmfwv

BA5CBB809107F68237A174A2451E35A55E6BE440F842DFA805608EB6C8F47DD0

SMS_S swjixo.xlgmswibef.ovhbgpdew

BA73DBA0887E06BF04FACC7CACC3C7A64AE4AB4752C8FBE1835FF7BF184EE9D4

SMS_S kfg.qabrtycoz.apeyi

BA7B237F71ABFF78A6A77BD7DCA87CFD2ADDC10090BFBF574B423D0EB28B1430

SMS_S jbnm.qhkocs.anhl

BAA0E266CF35A76A2E908CAA0D1A42227959298894AD355EC456D6178FA82DCB

SMS_S onpdrg.xpmwefb.nxcftj

BAA8673D02C62C1C1CBE5BD376FA143B3D81C43A7E2A9517C0E2C8FD69B87453

SMS_S yczeg.ofaribm.pnuorwi

BAAFD3C1F0B104984BBC91B25C43107DDAA9210ADFF167E1DC95832ECC5E9FA3

SMS_S pintjoq.stryjiln.pditwvelf

BAC6731424D4F8AE9E9B168E836DE7A083E6B6A37E549EE8BD1D953FB9DB55F4

SMS_S hxw.lpjebu.foujtqzckmh

BAFEED9830B59C6076EA7B6054AF11A386B738AA1641FB46BB74C05445A4125F

SMS_S sjnv.pzkfwieb.xtes

Page 251: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BB09D47AB6E4E1200198BA5F48EF06988AFB5B3EF2F37E20A8422015614B0936

SMS_S hnwb.zlcpqmetx.bhiwovgmnj

BB1369BCF3F6BC74C8848C36539D7707D0D5B7968CA4432E200E55E6C2801208

SMS_S pitbhyw.iksepzv.hlftrgdjvq

BB3D04E04803BA5FDF62A7BC7F2C7DA93782422CCEB5F6C6A5045A2D0D13C5BC

SMS_S smgd.ywenlgd.gdyb

BB446A275785919C8E5C8A48B14511128E6B4E7F2F525D8F3A3D67A524E35571

SMS_S lqikgxv.bxdrikehl.jeyul

BB5258EA99CBC06D483048F499CA8ACCAE8D60E45B4304685896967F6CD2242F

SMS_S laqfj.bwfeghjz.aynoi

BB64590D07F57AEFED1A2BF507C916C73181AAC6B288D0331321E1398B479F24

SMS_S pdyvh.yotwglp.qtwlhn

BB84D6632B6AF2E264F17D128E8EBFBA5A43BF1F233DB8C0274A31C019D32F28

SMS_S ngf.cbvwtkqa.iulsrzvp

BB88A6CDB7183867E21F6B076F9883E49AD448EA9653DA5407A36BF1E669589F

SMS_S rciqm.nrzqwltopy.hbzopwtv

BB8B24CA5DB7FC8648DBAAC30A32285229A93A25317B44D933AD9486BCFEED5D

SMS_S rgp.nrtlkb.brtdvexqwa

BB93363822D3A59B30857A98DC1768F191EA2C8BD81E2E7AB346B7B5EF0B04A1

SMS_S okys.xqktsdrl.wbviuxdesgmf

BB93CC93651A9F1A28E5D7FCEC4558FADB32CD66124B5B863EDD59F9E3235FEC

SMS_S utfc.cpzurwvjd.qurz

BB968E1FF4954FEF62B08BBB5221D6A7213693F1E94DDEDFD48D8353503AF564

SMS_S dwj.mknrehxw.mgdaq

BBAE3277094BDE5B7969B0FAD7C2FF4EEEBCB5C76608F6C540B6A72BEEF26BAD

SMS_S nrqkx.zgmvrf.tsjx

BBCAAF6BE017A841B8D87551E92EA493E0F6EDBFC04E1985C44439EE63B9CEE0

SMS_S wdman.ecvsrmlujk.scipnzeyadkx

BBCFC0CABCEC06F47219763C15CA7A97653D48A14376BBE67A0A28FC54D8945D

SMS_S mapnqzb.zwqisvr.tdhwxbzmr

BBD5778437C29372E6A8EBF1051229349E84D32138B63BBA8205DA8312BA78D4

SMS_S iodr.btixjr.satzlhmvwd

BC0F95E68921B66A8332274FF10D9FBF13950FD00A562B8BF02E7CF851673CDF

SMS_S sat.spqaovkel.xmdyuhikarl

BC47908E3C36CC4098367857C460DFB2C82B0B3E6C6D955CD74CD2277E8BFC95

SMS_S rdcbgya.pdxjwhnui.mapsl

BC4D1A6F6178AD9E5F79A90C93422BFDB1C2D7E347656BEC737DCAD6EE855F69

SMS_S msb.rnzqoieasx.sqyjpiu

BC559DFED5749D739C4F9C84EE08A0C75C141 SMS_S urvwif.ltrpshan.esoukignvt

Page 252: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

2D24C0FC8BFDA4862D627B5877C

BC79FCD765B285D61889EBE90E5CAC007965CCF7E75446B2BE55DF5F34FCD9CB

SMS_S bgihl.agsodjeu.nqomhwe

BC82ECAF3CC9BAB6292047765FBCE0CE544C29922C6A9ECE2F8DFB31A57C7AD2

SMS_S mrhljqi.hlpmcbn.metckrhzl

BC928F10B5367941FDB03EE5276107CB80E66643BFA28762DC3D4ABDF7CEA9BF

SMS_S jrxdz.xfyeaicwlo.upyazxq

BCA2A07BD25E5F33934AED19F6A16501DBA25B080582E0268F261B18F9A359EA

SMS_S odxs.fmlqvb.tzgcxabje

BCC0E0DB45644AD1BF4E1D3C13B7E473ED7511E31603B507A1415DF0C917BE8D

SMS_S bnd.dayvjloskq.gyafziolwcd

BCD13A32403B8C335FDB236F4FF96ACC9138F258377937561A766A3E1BD56FA1

SMS_S fzhoxlk.bgsfcmz.qwbxnhovkfgu

BCDC52F9B25BAF7DEEB43F98372CEC7A7CA186906A2B547050FF342CC1FED726

SMS_S bsumyq.anwhgpuefv.blvycmszjh

BCF17E45A3EB9036D5EF06BA446DF4B06D2B2C4928FE11B676A85998C0CED477

SMS_S gqp.pjkizrxfs.fnbv

BCF6187BE42FC5A036ABE40EBB89F47DFF1DDCD22F24118194618F3964BA911A

SMS_S crkye.izbjaxou.xhtzskwabcy

BCFDAC1CCF6D253B709F72CCFD909FABEC2F911978B8045A9009F918536B47CC

SMS_S mqltgdb.fcmrdy.jbwxz

BD251EAD8FDE2AE88F050F190E3DE7B152A3FFFA359D6A4E2855BC531AA505C9

SMS_S iwsgp.upbosmjg.hwvxnasckz

BD418969C5EF8002BB949DC90FAC368A889226BBEB03BEDDA72E53C3A6E04388

SMS_S btaqkc.xqayumijk.ufqljrswyno

BD5903D8CB1CE0B2D73030B9DF6B896BA99EDF8FF417DB801913D6F9A910674F

SMS_S ysg.rzwati.yqtjv

BD7DDCCF3D593BCA62C04F746B2DC9792488C604FE6A3762403F716311AB7C43

SMS_S cdxbjhs.htxygb.efpnbv

BD8781B6939D22D9155F2AF86564E0E2C2FA05F2923FD388BE2F8B57F845A22F

SMS_S ordg.uzhfjvpkqt.yrfvzbmuo

BD96D44EF4122BF727DBCCB52234FD3393F6F683676834B3AC76354DB01DBAEF

SMS_S eukwx.xnsqdteuf.syxkqf

BD99732F199CAE275FF83591B43D7006F5C04B69290720F940DABD8C03755127

SMS_S kpduz.cafrqe.xnbcsv

BD9F8DA1E2D3957B3F420849FCE3DFCA4DD22C68D7273E22C077B7C6B2E24664

SMS_S qlg.zaxsqy.wncjzh

BDA3B650B01C8AE3A10035A2C2C8DEA9632657929A29D75E67949E7154CBD764

SMS_S mwtrdyo.rahgziv.jpgxoazlqs

Page 253: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BDE2E45E9285E780646CFBA0618208F8A7F00E7D287406458B74D3DEE7F0DABF

SMS_S kzm.pxqvlbnwsz.fxiwvhp

BDEC0976E46E970E727B68E9265ABD3DA2049DF18D0A8F35F3B33B2808C52A22

SMS_S ryfl.esdlqog.pqbyecdmaluw

BDF2CA12974E48CD74AC833D7AA6DB6A186470DF9D99E713347C3D98030B276A

SMS_S zedbxla.zmtjvfhbrk.ciwhqs

BDF3033355349034CAE0E5C991FD357E3F058ACAB70EB08AC82E73A123751BCB

SMS_S wjhmq.sywkrla.rhaxju

BDFC68FB8DC3EADE9FEB07B2E4F6D8631A8CD3BF2A8CDCFF6B61E16050147AE2

SMS_S ltsj.yqzfrjdnmg.znuxoadieq

BE1EE81DE035AAEADB8A77BB8C75CAF1AE3A981BB43A443AF6F18A9FE7061074

SMS_S arpwdj.cjarkvewix.swqljbhg

BE2025A32FFE432ACEC6716B69CA8C2CC670BF9F5509ACB91E9304E4E67A3A5C

SMS_S gnhmwdc.oriuwe.pabgtkdlf

BE49411DABBC706276DFC11E2348F41F906C0EF66F9E3177CC50C03674027301

SMS_S fkuaq.bhdwri.gspmh

BE75E2634C028CFEB9E7DF84401A1ABED0B2ED8931A30862F4E5875B106A6A1D

SMS_S pgq.uwcgar.fdnmz

BE7BB2489C09603AA73B66D050852DEBD5B7DA9CE13498D1AC3BB60776FA2729

SMS_S jnhs.pidtlmrbcg.dtbhnv

BE8561A29A377D871AA470F219F37959779683F931A59D10014BA8CEA6FABA4F

SMS_S bzx.kdyjhxins.hebmkjyzwr

BEA05AD7A51D5E9C66CB04D2DF4F603EAF61FDD58BEED8AC7501642B8C699DB9

SMS_S ribga.bihwytpz.nzpqi

BEA5B41FAFB7EE53AF30BE8C10D0B087E4EA30BC2D75BF08FADEB19A9300647F

SMS_S xgalti.zcwipgvr.bjavcmsuifd

BEAA51EB525F3C50606A409669F57DCD99F511280B540EC19C27CCAF2B57E627

SMS_S nhdwft.dlbrkgj.ryxulhp

BEAD1183A12161D5BB77BEF153F6EDD2983BED06FBE15CDEAD46236815835FC4

SMS_S wrv.qrucmhlk.lyxcfuka

BED0AD851BFB18BB97F383CAA4378778184B847D8F5376F2294BE5A17BDBD91A

SMS_S oye.jczeyhtoq.lwzevpc

BED65F9B25E0CEA28D1C40958FE447F9D9FAF43C9F1180BD5F3D99EEED74A2CA

SMS_S gmab.xrjfezcbw.vehlfiqsnp

BEEAB20077EE8C6A5B630F8B0A9702EBFE2F8114B5810F065886C9DB1B33C6A0

SMS_S cpoeq.xdrqshg.bzhwpavtid

BF2901C6D973E5877142E07C3AAA29454CE8B0638C3A3D352FBD46837407CA45

SMS_S sgwue.zikadxhm.efglht

BF2AD05071240F82B0D28B739774D153F4E3B SMS_S tsdajmf.opxygfzb.xoljevhurw

Page 254: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0CFC19698B8EBF2F47A4FE57B0C

BF2EC137677D8986AA247FEF5856A7A34C51900A5B221CA9AD125359B6C45FC2

SMS_S qcvfa.tjzqgboaxf.frubylizds

BF34D5507B46EAAECA2D73383601B302E81ADAD1E7CEB109E8E0C7B74241DA58

SMS_S okqd.evztxypwr.zxnjb

BF35CB04A381A27221A567EF266305D3148B166B4495448CF9AFA3FA0B8FE2AC

SMS_S uvc.ekvaifnjr.qeljz

BF3BB58153991D3EA3AE191E45ED24AA3443117A6923D311FFCFD9CF56314032

SMS_S prnzsea.zgakwdqfnb.hznlkt

BF43B5057C3F1B463549C123984DBAD1FF697E592BC5833FF10D1FD6F3CBBE15

SMS_S sdmwt.zvkulfem.ntzqpjivk

BF4E6970B4C03B20337205A703B053D17365B949BD5CC9DA6A3454E743DBF6C4

SMS_S ytrskwz.rgaxqlkfi.wcarsnihokx

BF4ED9A195278C3F8F7B97DDEA24DFB8F2B4D085B53CB0B806857A9FADC3B022

SMS_S jbtrfvc.diepmcx.ewiq

BF559FED9A15E433A8E651A8B0CEB623E5C67A065C776B5A5077216D323C4AC9

SMS_S uqwtn.pteufamcnh.kamobtvhsjg

BF5B38EEDE44F73912DEC80F9D14345271FE3AC5B7E322AA899B45B9BB99D47F

SMS_S nqtuv.cswlhept.pfgs

BF692376F6170E6BABA692F90D0B04A8BDA31A7A01FCB510A99238B7A2755A42

SMS_S leghxd.heapwzkr.qudg

BF8D3FCD1166E5B149DE22DAADAE04CD0445922D2437CD914F89BABD2B184090

SMS_S euigh.izacnvedmy.xfgtrvwuaod

BF8E0190B5C9D1BB5226BEE277679CA6A2E246D91E43A06D3D6EEDA7EFEBBC67

SMS_S vqgxf.ehaikv.fhgjdr

BFB6032053459748E28BA5DF8EE93A0CF98D4117FB6A5090ACCD221235F5107E

SMS_S inwhdt.qpcrkz.gqasrblynd

BFBAB83CB90CA4B9004C2FD96D879CC67C0AE931DA9054BAB6D182D91800DC2E

SMS_S sdjfck.mdbfhoqxjl.gter

BFFA3554AFD70C7288BE469166CBB7BF1DA17AFA3E98802D0D8D7889AD93D5BE

SMS_S kly.hqwopyez.pqge

C0027F0CE3254F5E0E68863975F0E64644724100AF9C53008EC3DC352DECF029

SMS_S gqsrlm.enhlqbspiu.ltvaxq

C007AE5F7729CB1C4F9FCDB4BA676040569EA1D099FB73FBD65576446D5CECB0

SMS_S wkzdal.udosrp.ablhp

C03A1213930F4D536073E96921C52DBB0D67A22A577E1A006AAC0D2FDC0B0E5D

SMS_S gbdlmz.pyugrfejsn.svpaiqnkm

C03CD49F16D8515971B217A55A764011B15EDAAEDEBD488C2F1680224F04BB6B

SMS_S pwshgf.jpxnsm.vombdiqrpu

Page 255: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C041F9C8324D2CA614AB2FA11777A5D46B25F3D3A4C3D47312218FC24A49B4B7

SMS_S uvow.mdqwbp.uqkzhd

C04E8529532E0C6A7CDF8B2DC8D4CA829195218A0989ABE1B5D6FDF6C732302A

SMS_S tiymzl.zgbqcw.oxgvkhrqbed

C0559A3D930DEF3DA61270877EC6E0EFF7CF531D59945B2ECA2C6CCADFFE2D75

SMS_S bts.zednuwy.zblkemuid

C066A40F242E90DF0234388F58BE35334E2054ED80FA7E2C1B5B5CA3ABF25BFD

SMS_S rufcbxp.ltkjbznpif.naphksz

C06C49261A87515756893FB8F7D457FAB0FC9C133317E3FBFC0BCA6468A80734

SMS_S rosuyie.nqxvmldos.slkdzmy

C06D9F02D9DB2E5B0C50D976286D5D8660ECB620B5EDD47FB55FDBE5C073D204

SMS_S atrno.ribcopd.leirny

C0730213823F810F7DE1C821EAD7B769A583C323136DDF1CC9D21E468C231A71

SMS_S qsjnetl.qxszpngya.pmuijxwdbfc

C0732F97AAA68F0C2EACCA756E4359D34EF8F29BA19121251D4781B54D1C4592

SMS_S muekh.vuktzydsj.pcigr

C0885ABC183A7E5F8B2C68FB8F6E7163A8FCC7CBB213211DD5B82958B8EC2E76

SMS_S tcwkl.bljiwmou.fkosznj

C0986A7EB5D293EA02163E173915D1EC15AD2AB984BE85513E8AE3111832574A

SMS_S mpqsh.urpfvgyli.uknxyihcdfz

C09AB2202C593CC15F47ADD45A736E3FCFDD21BECE65E282A22D894490C8FEF7

SMS_S hezbig.izvqthyasc.agxzoibyd

C0ACA70DD5FC00E818536427BC61BB6ACEEE8D7BD18633BD59826206D30F04AB

SMS_S qtmwfl.mafterc.gyqjxemhcta

C0C18F19AFC643C1BF407DE8FFA086020076A2214644CCE64E8618999E46D4F5

SMS_S cnlrsd.gtdiayqzo.bynqgj

C0C9B66B44A886AEAE44F146EEFD63F116A14FA0A79BA3225F0B133324D475B7

SMS_S luajn.irhdfcbu.rqgyndpfj

C0EA1BB1D19943743C40A1BDD680B98BD451C39D3DA545F9E3A92A6415323D97

SMS_S oqbuxm.eoyqkaivrp.uatsxk

C0EABBFE40A0BB02495B35CE1C3AFEAEB65D187E3EADD1CCEF18534AF209832D

SMS_S fektuwa.djvgloxcf.mslwuiqt

C0F9B7108CDFFC37AE4D62CCC7850A86FAE7349EA03F1D2A91A1A71201103323

SMS_S afhcr.wtarhx.gqxfbrpakzd

C10CF614718ABE8F5628C15E40CD05E4084D804A757424D80F67CDCDC0BEE534

SMS_S mgynct.znvahrl.vceagr

C111950F9DCEFF46CCE8CC5AE5323348026AC56585DA055A96D95C763B5CDA5B

SMS_S wciv.sdziqkyap.pforl

C136B06889A32FDD006255875F47A99293642 SMS_S slja.irynhvs.qvmz

Page 256: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

014324F20C7AF2405585C39128D

C13CDDBE617DF77DC71A64DFBE469E9E11E55E8FE2D8DB5D268611E78AD88414

SMS_S omw.grkwuymop.rvmxi

C143C227A49C4AF1D7AA46D4F1E19733B7A3D504836BBCBB5E684F10D6F9B132

SMS_S osrjpkt.srdxhfop.fbyxvrtc

C15CA28E56110922A2A315DD20D5375DE5C4851A4DE8743790D48EA86B3C3922

SMS_S izu.spdnbkzg.izvsgqptou

C163DCF8BE38205ADB36DFCEC8733981422FB8E553259B4D339A2B9F865C1E0B

SMS_S tmi.mueisz.xhraovyj

C1AB96CCF1AC98BF25C7201674661EF5BD3A4FF057D53037D302BD69D5A1B1D9

SMS_S qnlift.oljxzm.vizghoclmdby

C1D615155E56734BD8C1E8920BAEEC39F5E17B25F5913198AC78444CDDD8968A

SMS_S lyzj.efabhc.wuzbm

C1E400FDFA29405F339A215EDD1B6AFB518B7F2D912AD17B84761A1CE363F286

SMS_S wetvn.dioqht.jvqasiyhrkdo

C1E62220698F1926BC78C4DCFE656CE0A2C0FA903E09C91C0795F8F533B3B53F

SMS_S hfea.aqrpsbevul.rewkvigb

C2108AEFCAF1975F1B902A9571C454CB1469F8B2736BA15805436AEC6EFD00A3

SMS_S utrjdgh.sdhcae.hzcbukgaj

C2191C9B9185A09A1D899E016E0FEA11458FCF01DF06968465D46D751F953D9F

SMS_S fwjy.thblreojn.qczjpuxdy

C2216F48D4A2ABEAD81271A5F02A733427D25F4B31F08D42EF855F51E5482974

SMS_S rslnegy.pdthkal.zbtj

C2245590F4BFAC593A0EC4C38057342317B8EDAEBBE1479087A1F5590B09CE61

SMS_S bqsy.ichqutgwyp.onafs

C229C09DCA224C582D6D1EA67C97BD3BA2EC1AEE02A99CB15B6543EA7E520BE5

SMS_S jhgtqe.jbtvnw.nampvtgh

C22B25D3F823F7CEFE9D5C1B59F8DA311AA90797911901DBEFDABF7497EE3783

SMS_S ybcs.hpkfdoyn.sdlqj

C2347416F1C6D69B7E349E4262BB69E238809D1AA3706AB217B916AE23089C6A

SMS_S csxflz.hmricwqzls.wlbi

C26DD1E6AD9DF5A06D3DB7582CA1DD5600672B43C53A1A88AF42EA96D02547A4

SMS_S oczjiw.vztrnc.jhlgax

C2991ED5E20D182657504CC917FBD5998A3E462D8E191452068AF62FCA13EDA7

SMS_S byucvnp.rgoynz.ylbcgtmosxu

C2A49AC9A23887B7F593BCAFEF3F161CD17DF6495F3DC47B2E747F19B75E5A70

SMS_S pdboif.gzsexly.fyrulnviogj

C2CDAEEC16BB88626696F845F27FD1867EF8A234441B50BD1F1B3E1C14881338

SMS_S bemxkw.foidghwn.lfyubnokaivd

Page 257: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C2D674FF1A05C1A8D8D2A826495F6DFF395020124CE449EC05C2DBF3540148BD

SMS_S qtar.jwctzam.tcsbgap

C2DCCE1319B502BAF18A38C8B260945173B019F19C733B6859DDA8577360D617

SMS_S stmyeic.naswbxcgmd.crizka

C2EA5385E11CD86725D99D48F2002C7B3857B0AF3550321C35C082B4FB64CD48

SMS_S hwyv.jmexzl.avepqfo

C309F61F6EA26A1E0ACEEF0CB7D9029A6DC0577F3AB30A481C8D36F0DB8D3EFD

SMS_S wzgenu.rotqlhavuy.alkpfnt

C32F8284AB8D1D383740155CEC464713B711C29A39D0FBF19448BC5B0D43982B

SMS_S irqpex.tpjkyzs.oqxkfsyvacbg

C3360D86D717C7A910DC8A1D25EE5BC024E371008EA742A85A110C4E6B8B4AE1

SMS_S jcwam.aqliwokest.vwmnxujaebif

C33F09ED6037E5FD4A4ECB7006E8680323BE31B2035556BC53023CCE5DD88DB5

SMS_S dsnky.mavgpclizd.clbhf

C34259796F4F62D91474B63B19A0B485AAECB58C6650B0EF726978C55A40B5EA

SMS_S vmxjz.mfalpyzs.fkxzydir

C36C3AABAE07664F4722F04252F3718371F7F12C98D23AF9477E946325CBE6EC

SMS_S lmcsth.zovwrmd.cfvbtnly

C380CD0DAE28095A65904EC2C0D8E89C255256FFE8A32068DB496D5AE2D76CFA

SMS_S jls.uvncezmko.gboshki

C38F22041FB1B9D77C46268B4C0060E65EF3498E3476CA0719B66C4A4F28A295

SMS_S tovy.ximfsuvw.jhzxkpeqfsc

C39249A97702020AB4FA37D657C3A443C7FA81C02212CF803ADDE3C809BADD3D

SMS_S sldb.ywvgft.yxepstbzfn

C393E041D0B6C59F98411FEE492319FA4533B2D01403B5BA7BA390D53F78C43E

SMS_S eqzjp.azdqbehkn.jwvlntmz

C39441002E28BE333F11D1031CEFC88FD240780E443BBA454D4514A7EA83B281

SMS_S cyst.qmfjxwky.yqofdzjtv

C394EE2E18A6AF3356A7A4D038E43593E59E18CF0085E4FB186289522444AA21

SMS_S bscu.oyhxcdgeqs.caumokrlpf

C39D0BD0B1840AA86CBDB9F412330B38EAA5456AA9460B120F8665CF903AF40F

SMS_S larbp.awfljnbuq.mfryhbkcxp

C3A5ABE7E56C562685D2D1B2F8B95784D9E0E2D3F0E70652396AF24F32DF2A34

SMS_S fybkx.hlcngi.whmznjybxqfr

C3B85BB5EB8B99F89EC1F31A4E8BC592D4B1D3F00FABC40F37E9D8AA35E48052

SMS_S owl.vufzex.yaexqcsh

C3BCEF6C32E2CA741A8474F264B1CBDF1F376960E3BC6653B4FB659E9AFD193F

SMS_S igc.piycvjmhna.mghaqe

C3DA05C6228714B4AFA04EE5C55E708730A85 SMS_S qxdforg.ychxdfmrv.ifaqzkuveso

Page 258: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D6EF8777C418C6CCF1016D2BBD1

C3DBE85925F061F5C13616BE5FFAABCBE304C3E7D1828C5F7FA1F67D174EBAB2

SMS_S sel.atjvdx.fhweln

C407B27A354A28678AB32A5C33B6D7B36F180760CE497697CDF510CAE8743B80

SMS_S myrnczb.ublicjr.afesphmvxwo

C40D4FC735C69B6964AE91531BFD9C619CB92FA03664B780F8287BD3796E1C6C

SMS_S tzjn.mdrsuf.coeu

C411DA977FEE734EF75149699C2C8428E114346887E126E183630B8F2AD29DF4

SMS_S mhqci.wzcvqilb.ntpwlshcabk

C414A18FCF3A8084C9CCC557E07F7D75645C50B349EDD4C1D12BE71140CD649B

SMS_S nhilca.xadrspn.lwko

C41EFF4AEE5271D09A0B0585F50CF98C7E001B6C3EA3589AAA4918200DC7606A

SMS_S prmano.cfzoqlk.zdejuimf

C4243720EE4DC51A559DCA9771336E3867DA7DF3A950D69D18E477BEAB25DE89

SMS_S crsotk.uetxzgovnq.jreps

C4243C486652E06782448AE847969636526DB5347E8F5DAC556AB72220A48481

SMS_S bjcs.lcvipwksrg.lcenj

C42AF2D24BA0BFACAA6712FAB0F46E069C13CDD9C6321F87E4C363036217881C

SMS_S ijbta.tqlgfvj.pnwty

C42B394899BE27AAB62D104F49AE2608BA02CA4C92094DC4B1D2E8966D10F2CE

SMS_S ymfzjc.tcehjuow.wiqfd

C43E162BE127FF1E72540AF84361955C9AB2ECCEC8A07C10EC08319237C68A8E

SMS_S lawbd.adqfrewyx.auiknrzvw

C44B2A956D8DB6EE181E0F088F7813F681BCFE95019EB3173A42DE0E7D471E83

SMS_S rxgcoa.afjvkhoqdr.anhi

C45C92D9B96F93517FD1197E7553B749E546B8EDE6BD4381430EFE45AA86A250

SMS_S uybjx.twlmegibxa.dbnqkjhmxyg

C45F04DDD87739456658D840171CDDD7C45936DF804FA417A45B66993248C7EF

SMS_S isdxlby.ejuarsmz.vcohpgb

C473B2DB779D60897DDAB0A7A85F7AA7BE8DA79D050A2A22F4293A4291922C59

SMS_S fytrap.taxbck.jidcxopzbem

C4743D69834B63358E192579CBB0C3B7FBC3A2097154015CF7C96C2157A9E449

SMS_S hsqjc.imteazng.ikey

C47709C57D020F3FCCC0705E11B306610D6E215E1C8C6181CC172CA68F4E3475

SMS_S jxkqe.wanhyjuob.ganu

C483B1B8E4E255C212AB48C5A0EBB795A488843F6024AE1A601B6701A07EA9C2

SMS_S jmdrhs.bzmoyhvwpt.lqkvbia

C4938C2104B261F8772E554028F9A545707195064F7EB9DB72203DD81F449B03

SMS_S irazp.obiuqk.nijrhkeoqm

Page 259: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C4A48429A05FC3698B25D4C4B56A8257B3046ADBF9DE04DD3EB58DD27066A62D

SMS_S ujfola.uhganpdsei.gsucleikdpj

C4B28FC9CA106EC5C474F46F86979D065EE6E7684DAAB4591528F46236ED0CDF

SMS_S aqhksz.nmphvr.dqfcgpaut

C4C6332134D32F8296E09875C3C37823B326B6F14BFCF8C6E2392BAFB1E9FB7C

SMS_S uvz.ypfwih.qmlhpgiufx

C4D6F465D9D2ABCBFDB17789888C7F3DC494D79F14180A4699451A1EE33C7A77

SMS_S bhc.wivtdqfsur.qodciaxjws

C4D850D0854A35A372B7E17BAD07634CBDD837969560F1663592FAB3E9BEC0C6

SMS_S ozrt.xuvagpj.xuoqivfea

C50E0EED1FF07BAB170EA1C8639503452A90427A9C403096A0B9B92E67317671

SMS_S zcigre.eoxcpj.rvnctzxgdbkf

C53226941D248FF16AE05396C3A8968A90778E5D05DB6A4D77EB5370E5E01E74

SMS_S bocjmsv.ibajofrsq.elmfkz

C54270129F40A9448895B558A02C4B52BF47F14F3DFD44A83C65A77766B53C0E

SMS_S mebqf.bazxukcm.qvaicyrseuxl

C56012F6B219A6091D05C40F3CC242BD123631AFDCAD15CD295ED126EA6A4AA6

SMS_S rauywmj.evjgflikxa.wcvepm

C57E39D30EE48A79FE04FE9E8508E012220808A1D38C89EA5BFEEA2518A34080

SMS_S xukr.yhtqdkw.fnukgvsixjbr

C5962ED582DAD0CE2B4C924C21A5D25BF9ADD9345EEA87CEA0ACA676800761AB

SMS_S ithgw.fetqghwm.vojrufeab

C59B8327240B0D9465D113E0150BE70F8EFCF3354F072A1835BC3B24DBEF652C

SMS_S buisraz.hfimze.yhrqubwdlat

C5C4AC890E64087F0075D74C1EE1D95C07128032B238EC39B2385AF9A07D5026

SMS_S nixdewy.jkuzviermt.rupdjo

C5C793D35D3FA58D6A98BD673234FE513421AC23FBA506B090E787046A21168C

SMS_S omrlbwq.jivfrx.grtxlv

C5FFE0E26A508D32D824B8CE3A2138E0CE7ED6757CEF18DCC8E5E59FF41C1806

SMS_S ldpes.yrfxwjzom.tklsuyn

C6279D010F3DD5559F6A59F66E819C961FCF4C4A7B5EF184E8241CBE523A2406

SMS_S mzpf.aviblz.cvsxrqw

C6492652DE90448E4A3DD76EC98D4CF64668527930EB80E85C91431B88FAFE65

SMS_S ytr.sjutcdp.dqzf

C651B4A965A9E152C49845DEB10EEF3A535FE42100F8148131A9CDEEDE2E6738

SMS_S hxoyk.exhnlbzuvc.qwfsbzcgy

C6544DA74386982EBBB58C6B072AABE17E980A86F3717FCFC1575CF036598002

SMS_S ucdqhny.ntjgbmrh.ecdm

C670A5378F43B9C2A13487431A9204E7B082B SMS_S gurcl.jdwuxh.ybvsitdcma

Page 260: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8CFCBCD05CB1CFC7B8FEB881A1A

C671A1FE5DF378656DAB6285BE433B1FC7E9E36918B46D904A7AA1B96067B137

SMS_S poylhbi.kaqdeucmtp.bokjrmypti

C68123FB64A91372D3C370F02A1651DDC6D170FF613D01E88FE52EFD949DC619

SMS_S zytwx.ahbkfslw.ozav

C686008331B234D1F65A85531DBF9C0770CF49DF0DA143C8EEB4641561810D4D

SMS_S fql.ithneypbkf.ulxydjnvfhbk

C68A7D60F4FB4774E0C1C79CEDCA9E9442886C05ABBAC8D6602008A6DD88F314

SMS_S arp.wbyaxeio.jwladfb

C699DAECC38BF6C477C6647D4EA56B3093F8B7E82F18EA0C5DD8FC76D3F9A3CD

SMS_S gityqf.zdlcbsu.mhwnibd

C6B24D764F72A11AF83D9BA0680363D4174F62897B2507B7DA3C552CE684547F

SMS_S hqauo.ypwzvl.kgeyfjhmsxoz

C6C5C3FB5C3DA381F98B493B73461FD9F3D03C99AE4FEBF98EB98B5C078A62DC

SMS_S jcnr.scmnviez.ynvk

C6DBBFACB15BE649251B5DFCEF6FD948E5FE8F34ECA96EE45CEFBF6E9C3AABEB

SMS_S xumr.kycpaufzqt.xtozwleyf

C6E2195A983A02DD34FD5171D999E5409A24EAE4C50C85D499FD54D5147182AD

SMS_S jfb.mkjwlivubf.cgbheuodkj

C7045E56293F2C3E6F4A27FDE1976557249139AD624C6954158B97AF33BD4385

SMS_S ogb.djgalusive.krcuzbwehnt

C70AC033239C4DFA10F97EF370AB2344A5D036E81AC3D694331F3FAC0F0339CF

SMS_S cskdie.aqysgd.hizotx

C725F80EBB6A281087D35D3ACCA2BE9A4564DBA72A03687268511D8A20487408

SMS_S nmre.hszdbri.hnrgvzcsxwp

C72BF0F7D11B53522D9256BEE9A6FA7B02E52DEC18721745CB9AAFC5339C5D8E

SMS_S yfsq.efwndzk.vgysulmfod

C7390CA6FD4E5EAF0F86574C9CC1C922FAE40C76B4DFAF735ED9BE268B56101B

SMS_S dekgtvw.rszbxwnmg.zmwrdcit

C74131F0BB78997272679D29C37382BD20B9B1256D132B7B2D65B8A2E5FAB64A

SMS_S ice.mklerusv.zvhnedort

C74D106E6F02E06F8A33E8334B9484445896A4F12335BB3D746952EBA4F4D1A1

SMS_S wmgejkn.dsmatpl.lnaqk

C7593F2C0C768B12ECB8DCC54D6B77D8D787D9E1A37055FE21B753773E00BC74

SMS_S azd.sfvrud.uhoxy

C7678C61A559ADAFD4E5A782BB7C47BD853F08F9418D490752AD3C822D63784B

SMS_S ryvwlt.hyxjpgobci.foam

C7747BDA3F9CF73A008301A4867FE93C866B71885A5142EDC0485ADDB614F80E

SMS_S uyq.luixsmhpg.horlwgq

Page 261: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C7A982BD5078CE8718B5162C913920FE58E3DF6C58904E9D7981381AE37588DE

SMS_S jdfk.kbdiwcpo.rdystvoipx

C7C5F070D5E3F262E1C5B8B07FE0D5035874E12847995E0D753C856284A139B7

SMS_S xdbvas.pjgkdf.hudyezvmxgis

C7D5E0D0FD31ED937EFB73971715DC7888A8B0D03A2467C41E81CD9567817B85

SMS_S bmox.ldwcaunze.junfcmwgv

C7D84E543E16F2D5150640C2D5EE061AEB453518B58EC577A2612E1E4848A05E

SMS_S pymhkw.oqfylwj.odpvjsbrazt

C7DDC6CB642C1F5964190EC3268AA0619961ECBD208FACF02B4AEC092F005ED6

SMS_S ghu.mfrcus.grciyfutakpd

C7EB26B7C2534DBE43758C7D437459B7084B6F74000F17FA9DBCB94E600B57E6

SMS_S znc.fyelrbmq.yunsrbaclp

C7F81F03398551DB28ADCDFC95A9B92B5D3BD28899CA6D887BAFC71CE63DF453

SMS_S tayl.vbifcgxql.txzvdralcm

C7FFF0F06768C13082A922DA2303F24D965847B45D567D818944ADDA9C07BCCD

SMS_S tfs.vdzwei.pfkyltbi

C80AC49903B187D0BD18DA97A8E96A00D188887ACA80DA0893179A524C4FB815

SMS_S dvrfym.drzowkpj.tnukfqblhce

C832064DF2FF0CB09DE5EEF3F8C2DABFDDC3C0B7BDB4063CEABAC316FD85B7ED

SMS_S zwfkr.binluzxgp.iwlfo

C848AAB4F4A1AA3D9E1637D7FF2EF7457A34C2679408D55DE9EF07EED1C3E558

SMS_S avci.sahnvblxri.mdtfrcwnbjs

C852E75A7929A6FCC2A868DB3CABDC6FF2A889A282F50D6F0821B02D0BDF35DF

SMS_S oghj.zfljsec.gufnxwh

C861A9A96B7BB855995104B5B46DEB25E470B7EE1F298B491D8D48E68FCB5BE2

SMS_S ugzsivf.rdpfqwvjk.dblrfzjvieu

C8905FC0FD2B2B8B5C4BBB3862E36DE0FBA886AFB9BC8E5D9A61D1731BE1070B

SMS_S ncjmvw.oxdvlkyn.cdkfwqtypn

C8906C32AD0E2155A703C4A5A3739B4F4B598E32CC71FA8D2D90B7D611496811

SMS_S lnbt.dfevixqblh.rcihpelvdgbs

C8A37411979301A624FDBF878D833A35060823359953381EC44B76A53D66B98E

SMS_S ighy.ucvzkjshy.vdux

C8A69AD181C529C57FEDA64393FB6732D849E785F09B3DF9DFDAAF545AD08415

SMS_S dpeboh.ghouypjsr.tndsqluh

C8A871CE34652116762ED898E6514A5606D71146478BB330A55FCCBE23587CBC

SMS_S qyg.wrhtalqn.yfjivxlgbzep

C8ADB8C62E3DAD733BA56D50D9788416DDF3BD3B43D47A239280E1E1783356DD

SMS_S xmc.wkrmzovhs.edoxsh

C8CA3976A52CDFEF253FE9B4E037088D4D39B SMS_S vsiu.zegcbfkhto.ymdtakex

Page 262: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FA8AC38F49D71115BF32E0DEB05

C8E7208552D4391C48E678BEE42A675DCDB2D33BF06E8A7AEEA57743DFE6AC9D

SMS_S rie.zjemskt.lapwnom

C90349782C0C8208C2ED65E6AA8E5EF722D770AA4BF1997E447AA925D9D49B46

SMS_S xnsuzf.xmbzdt.pmwxokasuqgv

C92100F69B39A6CFBB59A0F2AAC36C8F9443E3F5FCB074A1297205894436818A

SMS_S hxyre.mtkwxhu.dkeb

C9250AC9E6345039C91BC8031DD03DC4277267E1DFB41ED4E447723327CFC15B

SMS_S jprz.mqsipcl.rceh

C92D6850E2CAF15A7A44A319946145F7792EDABFF3973588CA123F722B113411

SMS_S pvx.vipgadlf.okutjvgdpn

C9318DB053DD68FA164D7C0D847723FBDDD7B19343A6E17A61DBD07463DDD9DD

SMS_S tsnybg.xrqkipoyvn.nqgvz

C95D84E3C66B6B2FA3263EC705A10CC209F1EB85F73F34CC69F570A45AEACEF5

SMS_S iypsb.avhqocnj.poeqkrbsunj

C95DF571CB28F1DDD6EAE98099B9C59644593C5C0A7B60172B6AEE4B7A5891C0

SMS_S mhnxqt.mdyaok.utcvbmqd

C979103F62010C37D4977CBEE546F7A793A3F0B4F67E096B1B4389AFE90C6AEB

SMS_S awty.uimvjp.dapxogz

C986BDB8BAA3EE9E32130C7E300B864782D4106C49EA6361733435C80B1C7497

SMS_S djomi.ceyromsv.avjeg

C98E473A3228CD7807C24BB67C12348640733C64575315444589649F4C2E781C

SMS_S cgbtmj.emtaylhj.rzxfium

C98F4473E58BE15C58310523FB14839C038EF886FA3BA323D32D6E52331C748E

SMS_S tzpvbsn.ltemfypirg.oysu

C9A487386FD0CA70140F050947F117669F7AC883FEA1D86E6355532407141984

SMS_S dav.gqbulafzc.bukjqs

C9A4D15E5E1DF71F03C749BF46AD273648B6F30D88C16BEAF226CB9EABC00BE0

SMS_S latokc.bsierdw.cdfewa

C9BEF02678188DA0FFA07FAFDF4F871B661918D1D137F357C3B3E343D85FDA18

SMS_S jfi.ifvqytx.ydcux

C9EC72A207093BED5F6C8A89A0DABC6DB7E3D8A5C6C6E21880BC44EBA5EF8E7D

SMS_S wjcb.zqypmtrewd.qgckzx

C9EF8EDC868007683345A8F68F52A460980C4400A09071568D5D0D17F2E4F718

SMS_S cuva.fxovryq.eqfctokln

CA095149D6E0ECBA552C760EEC2770C60A67C5920BED1F7ECDB0F13C5FF53832

SMS_S pcqmsky.ugybqxshzm.edqwg

CA09FAF0C7C5897112564FA335E5BF852728058693B7C866F3AEBF043C00F27B

SMS_S rnfyacg.bjrwsek.ribyvolq

Page 263: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

CA0C9C402D4D41CF2FA6C146DE3167DAFD940BFC7E0CE945393A2309C7C4D289

SMS_S rhv.iazcvrj.vtdlmhbnz

CA24023E8B46837D74D6303A15B6B0E7E7F6CE207714DEE3A20A3FABBE098AEC

SMS_S yjqcs.mczhexi.nflrctqy

CA27D2BEC04452042809302853E0C816CF9CB34F412503009C1FD40A6FF85789

SMS_S vum.rwsbyziuga.jkqdozuxgh

CA3AF7F8876C8AF3302F12C4DA7A878F736B91F04C1F42194DB66B671ED0EF01

SMS_S bcyn.afpcqsm.mzdslnekypwq

CA3FB7C10634CE3995980BB496E0A9CB90E7A592F432FD92862A3AE2B57BCF44

SMS_S iwr.gtimvuzko.wsnfijxqvmz

CA439CD1E872695C2A70A4BE72E0CF225747FA259620956D8A1D9FBF56C49ACE

SMS_S wpl.pczjwtnqf.eguk

CA4DFAE2D36E6D0DBC262E3A99B91100B20BD3A5085E82BAF00CA9ADDED7C74E

SMS_S egmvoj.rfsdiazptq.ocrdtmz

CA5B7B2F75CDFC7A934DABD7D12771082FE768B2E40876188151250E61A7FF66

SMS_S jhmkn.vgzcqhda.bhnyerim

CA84894559D460942CEA0B99C7C4100248CA6C3691D33F79EFF6DFCD0DBA2B01

SMS_S snytoa.bwqhnljgm.jfgcmpe

CA8C91DD973D894CBBA8179F37A9251CC54DC5447FB96916A31E00871F87C734

SMS_S rkaq.gpwxsqolb.tmcv

CA9882970158AD49ADB8A4633AC4F87767ED50E0B18346594BBB141C95B16698

SMS_S fkylz.hdgmxqk.zqsy

CAA9E472EDB986AAF2322AB038726D99B326D19DF75603369446D22FBF017EB0

SMS_S kqfjl.ngmpkzaoj.jomxkbtzcl

CAB300A1F7B65DC79CD345BE0CFE2DD56A74813A7FA1D0A4F7479A50CF46FAEA

SMS_S ykzcan.mbdnlyauhk.kcgrquslnde

CAEB85570D10211F90193D1EAAEE7B36FA4FC9004AB8FAB806EE7E29939D8C08

SMS_S lhtu.jgqezpmw.prqkchz

CB18F692E38193C66478F380C98112DE985DE533CCEAB77C81AB27E6D3CC066B

SMS_S axoqi.fhbrcivzj.hrpbztx

CB29C53E520E9FD503CA23C67E2256A445EA25008D250D4A50B73D622CC55E66

SMS_S cruywp.hwcnqbtay.alhgi

CB34F684650088980E4005A9DE35F0D763863E8A4CE0515A07BFD2B48A65F748

SMS_S iftxu.harjbq.mserpizb

CB47EA40D625AECBFC14B207AC285818714F43E90F84E630647CD3B94061D594

SMS_S wlkxn.aqtepuzyr.wdmiqk

CB67DBAF38A278A01E0C3B9486110F01FF2CD9EB469A54C7D017B7CEE325D00E

SMS_S ysbucjh.lkhfzga.dckt

CB6ADC41F1E49B0FFAFB8FBA73477E507AFD9 SMS_S acyw.kzjyoqau.phumzgcifa

Page 264: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EF58011AC5C15CE72A2B2580EDE

CB71C5EEFAD8E7390511A9677182FB4196A216B65A8CBAA16E14B14A96FB5712

SMS_S hovpjr.lbxqnzuyr.aujcork

CB79E95329738D82F9D660AC9B1E24CBDAEA622CF37413935E9AA9BE4656408E

SMS_S rjakn.vcpkfbr.gzaxb

CB7A1D0AE162E3F67D5E2D32F928153A7D546ED6F6DBA8D5A547B3320FB8AA75

SMS_S lkd.fkoetmsnbr.ewogyqzaf

CB7BDB3BBF91CC7924AC6D80A4C16EFE33AE1F9C884271DAF593D520AED50E8C

SMS_S buzge.wolzuygkh.qyevabsgl

CB854B45B50AB3BB1F0D422A9C450684C4A5F2D3FFD3A4DD3BB6292B78405633

SMS_S ncqr.wqklot.kzqi

CB8FA88D20D77AE9EF2011F793CE64DC49F62CAD21F787E0D5D4E69AF4353FF1

SMS_S opnmscy.fdorvumcjb.hgblnqpofvi

CB9F7CADC0CE5BF197076BD3D6E5E8524FE0203FD4F805399ADACCDC39292667

SMS_S fkebd.xrifesa.wxzu

CBB0EBAE4D0F722CC03D66F56D9E41621E1AA6A961C2EBA885F74C74C4FA85AE

SMS_S zxrmek.nmgdapk.gdupywexon

CBC48D486044BA2298785348450307521C7DF317228DFFC8CBDFF205958797D6

SMS_S crpj.zhixuj.witydaqvpche

CBD7328D4B23EAC7021EBDD7CA230463D47C088D80132E25C3E423FCB280C9B4

SMS_S xnlcjzh.iamqhv.ytoxrhb

CBD7ADB7F0347B3401BF35072AFC2F9A2E4FF40DDBD5F064646808B66BCB0A61

SMS_S evbxoay.gxctkailf.cugtjbfaw

CBEC236FD0F088CB9DFCC99E69E2A9C881946FE3D3266B005B03690BCA03EEA7

SMS_S mgzxv.wpqoxifhga.ihyr

CBEE59ACA303A40E1537460F5A0056C5531881AD1E417A03D1E49F634E7B1C9F

SMS_S fil.qfryij.indtb

CBF98A55CE3F1D7ACC7E324ABCFC7A509AC8F53B2E9F6BB73451BBA01052A6C0

SMS_S lhzxjd.shaztl.waok

CBFC89A61493486449F90CB066B6CC6963B1525C5783D1C353FB8485C6098B31

SMS_S zujl.auctwxe.vprgnkdflxo

CC20087BB14704EB2F392E015EACCABBD41DE4B6B6EC0C403A12769491064400

SMS_S pzc.yqjxhbd.pwenvglo

CC463BEFFBDD23CABCA7C7D039D70740387F2A194DA89A017F37FB4368FD3760

SMS_S lbnmi.vykafnqlr.unlk

CC4686488439972B779A1680A4C4D8C99CA8A1658253A5D454D756B43861A3F9

SMS_S uazhx.fewxvai.enytswmogkv

CC4B30C3BD82E25EBA08D660847B94E2CF793B4E63668F9244233001DF4A2527

SMS_S xuqmvcf.muyhjdia.yrtwsmx

Page 265: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

CC9DC0370F0BD43068B709DF19645651250CE63CC06CB7F2B76020B820A03C7A

SMS_S caop.bhaimegq.olmsanfwejt

CCB957F9DECEC64124F5C69FC26CBB17861DC4A97EE46986A4A128AA553660A8

SMS_S nzptvf.ygpmtdnblk.rlhstewkx

CCCADEBB107A626AA0B934528D83A575FBFB9AE58050131D12CBD634AFD6A2FF

SMS_S vpg.xudoephs.fhymq

CCCDC126960326E032D007F555240329284801F859213279AB455C252503ECDB

SMS_S wtg.auxdpyirl.ukjhqdfvs

CCCE765E0CCF838FBB063E0609A9C38C60129EB0730D0BCDFB90B8160719843B

SMS_S cotx.yjrzec.amwfdglsjovb

CCE00328AE2325D80388E7ACA7B028E7702EAB526BB069440015E517EDF0ABCB

SMS_S cex.ktbnsdfx.qlfpyak

CCE60227450A06BF11E28748F4BAEF9CFF55BB2ADDD6B23D624F13A3DE471516

SMS_S rowgh.raywnbs.odsbrtlpjx

CCFB0D5200DADB28BAC80D5C8AD3FAF663EE4786884520BF245BED344986A5BD

SMS_S cmtb.eshtbkria.dtrazqefukxw

CCFC2CA519F730F94B7B56BEABB074CC677BB949DD416A3507D5C6480A8AFFED

SMS_S fvylgzw.ufemwxl.qdcutyxvsmag

CD025315881868C5DDCAFC79D65B429C994EDDFC1131C79B0090EE2C89AF013C

SMS_S vuwpsd.vkrsthefl.qbugxh

CD1C65BF55C2E7408D535A4A722BFC59D59A5CA7D83EDC35B9AE67DD91F1EF7F

SMS_S vef.pudgthxnew.inbw

CD28BBC157DCE39CB799C34D5422D923311CA3EC8DB94627BEBB115FAF6E743D

SMS_S kxgviuo.lfgvjd.opwz

CD2D6B71C206CFC5208E8ED6DCE83B9904F37FF829C5BF73B0B25204CD02C006

SMS_S imrgep.pzaowdivh.pnmzdjbs

CD309181155C265052BB3E002B95EC2729AB262A0E9F7C94EBFEFA567CEB7E7C

SMS_S kzqoje.hzvaqkd.hrantdsvgi

CD37D3C08C681CFB387F61085FD51B1B2BEAA525102F7F06B0C7376AE1956D3D

SMS_S zelpf.ecptaqi.krimzvntfeys

CD41566149E24CA84C515C786A37E661BC97AA0C1DC666F5BB081215D042A4AE

SMS_S kiytfd.fotzjn.usxcrbfkitw

CD42BDD0397B3959D21EB15C3917F0BC7BA5956A98FD4F796CE52440A098D0D8

SMS_S svc.xgtocidq.mvgdrueycb

CD449A091C2EB39096B569BCE6EE136283DC69E1558B13CA45523E72F1A0747D

SMS_S kcbaynl.xhnwrqtf.tzxw

CD66AB33FC7D9C29D7C55F4D8C92B9596C2CE16C687EE939957201A5636FBA08

SMS_S jytqxrd.wcspemhyzl.sibkcuamty

CD6A7E720D034B4D8A01947ED9E296D97F94A SMS_S yqph.mzdpjlrf.cetqjbydm

Page 266: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

566AD709299FE2946804963E86A

CD70F81A183CB69F2D1F70C0E4A5CFCCAD824B00A48E1AB3F9F26424D29CDF4E

SMS_S pcolm.cvnsdf.xfazreqcjil

CD75A63DD522072D0E0B319A5193DE86765BF06716D7E952C70161EDA5CDDCDC

SMS_S sdny.wisagon.awupcsqdgfi

CD7A7EC00D16640D33B98A4B740F97C2DFCD4A3F48A2858EE7F0947120581BE7

SMS_S gbyczdr.ckniavd.nmxy

CD8264C68210DD7A8A064959921A9BE08ADC29B5CE6437E80C9F4DD2D0371EC1

SMS_S uahr.qxjdcze.rdkvfcuj

CD8B2D976CB2151B52BEF84F96B3EDE4AE633BFE576B6E51BCCAA94D0830B426

SMS_S gjyfvs.mqasbfrh.tgsjie

CD92BDDBFF0D2EE7F30F44C6F6CC81697580F0FFF0D0D46E300C5AEC2E464712

SMS_S xgtszro.qkfhvbctsz.ogultqcyks

CD98DA6A515BEE633F4D412BD436AD30EA12BB19BD12C5E9AA58F886414D4329

SMS_S nmbhw.pqusdabizn.jnwhp

CDC24D97FD9E63C86B726CAAB27B80CAF8E6B1916CBBCD90B8791C25F50B9094

SMS_S oqud.xlfhozrk.uvpabrwsm

CDC6C677EC30662095A565891CCD0341C10608D432BCFAB10ABF5BE274203D01

SMS_S iuxshg.aqnwsh.jfbdgz

CDCDCF4D18815C0ADF88616472D1A80637D87DADCF462BA59480010A1106C265

SMS_S etbjf.fbznjwer.vfruoidtwj

CDD73A4A701E6F1A31649D875775F07879773D39E6553849E33FAD14A584F78C

SMS_S kvlujz.rowfpleusx.oeztjvnuq

CDDBF9C057665701FBB6AA7F124F6A4A4C02318B6B8885B3974065CA7A0F6B67

SMS_S eut.pzstkdmjeu.psugq

CDE45E13BB2465CF855EEA2033E8CCD368B646929068E3B36D420BCA35F6E650

SMS_S vwxnkfr.fmqepz.axrls

CDFE2E32C4EE014E679937BA8C76C2DC6921DF114B360F853796C1F22BCF34F1

SMS_S rzb.ejkubrh.leqdkvyg

CE04D56A2F6F1B9D633904A075CBD62C62E38A6E0487572AA88E9A14EEA99DEF

SMS_S prvatd.gvohjnsky.mthkb

CE074F10387E435CE6B519E0F6D9D835664CD7DFCAC04313E005984C3A57927F

SMS_S okbtaxq.azwrvblhme.indavxjk

CE0926C844F36248774A0833B73A0D6532080034997A466640A664CE5387A3A3

SMS_S fjzqdo.gqxbon.slewmjx

CE1B51161347AE05EE28ED8F5CF319CE1CFA2B25C3CDDD6757D85229E62BCE41

SMS_S juoyzh.qxlhge.rudfjoqs

CE3961574D257C35BF239CACAD41F1CA89030098E1BAC5ECDAC7C83495C6ACD4

SMS_S nixh.hevubdswo.mdhsrja

Page 267: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

CE4930A1174071B13875AA17BC2315CF09D5BC71674829AAF4B2BEE475336602

SMS_S iwahg.hpgqcikvd.npbldzivmwu

CE4C6EB350CE49295BEB5ED27BF154DE544E46F8A5D808B0D87F71CF550E07FB

SMS_S oyxl.ojqnphswx.thupsgadl

CE51FBF121E17C3481432F94A7E8EDBF4D51F1508733708ABBE91016824611D9

SMS_S vwhdrl.cvbsyq.dxpcwnqhkmea

CE77CDC616D5DBB0F1B64319568CC78A26AD4D6955B94F274B8755F5766DA4F1

SMS_S vdp.waeipc.xwptbnugfhi

CE8410B09D7CFCCA27DEABD31E378DE7C7DF97C0FF97052D8AA6E25463568BCA

SMS_S ywun.stxulgbjp.fcurjpnwhsi

CE94FFE3E7C8EA3F12FD6A8C8CF290533549E009E9AB00D21E5D0D3163679346

SMS_S ctzswf.aknumv.qmzftkldn

CE9744C5B213EF88F4D767A4E085EB7F9688DC8B045925126D70B9CD3A94A4EC

SMS_S ldkvjz.oxrmhlbk.jqyl

CE99925A0020C99A340D7AFB7194386475D713664D0828D39A77451C6CD65AAE

SMS_S nubswqx.fzqkxmvyug.njebgts

CE9AC19AEA3F499C4211BAE11D7AB911C889455FCD03AF25EEF509F7997E04A2

SMS_S xnuklm.tpnuxszlmw.xmdwlzahju

CEA5399B24B8FC6A8DE6688E670EBD6A17E778AC532382E8698411FC94AB59D8

SMS_S uercgq.boxlfgpdck.tepcwi

CEA9DBCAED19AF2BA3BF53FF036798846E1A52D51F8716686806199418D08C66

SMS_S vtmuec.utigfq.ndhbwl

CEBB42E8E26A9FD60D6E418B1AF2BB1A58F73C958E9CB94B60D9ECA3ABF81D55

SMS_S ewa.lfceua.ajftsiz

CF2DEAF018347F5C9392F5E5250627C7576E8BEDD6F7912A38B2B745025F1F44

SMS_S clegy.favnricshd.vdzpfgywhcju

CF30790A9E2EDBFD81ABB20D4D9382A5DF14D2618E534F19434EFB783831AC31

SMS_S zukdg.sfdojikw.oxqwbsmcy

CF36687ACB8E14F7E41135E0D5D614D9870AF6B3E5227A635BD0787723B35DB7

SMS_S uvkfh.qunhemkbsj.bfijwgcqvpsn

CF3A31B8E11AF22137ACB0573BA77D1E3C41F16A8BB12008569ABB181C70AD85

SMS_S tmgkxpo.gzkohnreq.cwrjbqgxidas

CF3AA434C82A92FE3702F15C582143417A4FB04637FE72399A24BA038C5DF3DF

SMS_S jub.dwefutckb.xgpdhsvli

CF66433973170DD25D62C200D6C95D840841C55623158E6273669C4A636FDE1C

SMS_S fogluzj.bkcoxvred.dkurwm

CF66452F202153FD8C6BF342805A61A718E4B1C2EC9F5BDC86B5DF00F7BF2E4B

SMS_S asbi.vdiqtong.egqjvnuwpxb

CF7C309EB1B82EE4A052BDF93DE74EF202733 SMS_S mgzuo.madsugtzhq.kmhqd

Page 268: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

125CBB41FD458CC9CADE83C835D

CF7DFA0E9FD522841EF0CA077E972F9766DEE16FB201D361EEBC0149ACE14971

SMS_S tzp.buazfev.driacnq

CF985E098BDAE91A54BEA6EB7A68A7675EEC6A921D69709FB36F23603D9B1AC8

SMS_S ewfuz.mfwtlyciv.jfpicaemhry

CF9AC27ADB3170E2AF4D83CA7FB17C18DD25B2206B377EC762968EDF17ED708E

SMS_S akfvs.czsdjvitbk.dmugtj

CFA489B4E313806BE6B5DF22A918F950DE68A6F5F7263CB85C407242646666F1

SMS_S qwfyshv.jsqcwdrle.lmkzpohst

CFB963AAD6D9B38CC44A85C1A0EA7BDDC05163C6C478F5B22CF5FFD199406534

SMS_S hury.pwtocvj.ghpnocx

CFC68B32ED0B13523729BEF9652770B0D2E402E497A4FBBD9ED61F191B7B0E84

SMS_S cpftmho.tqymbxrn.pndyoecums

CFDB86BA10E2FBC1D048FAE8CD44426E4B4B817D417B06059DC24E1CA8BF18D5

SMS_S kfyj.mhszyfa.prehwucj

CFEA760BB8690E8A493715D1ADE738134FC9A705C18B7406450BD33B6B69778A

SMS_S drbim.cznrdqbw.bsut

CFFAA26C32475D91ABDC69B32A66DE8924252CAFA84BAFBA65C6C525B266E98D

SMS_S lja.vyaouthnrm.qpkazs

CFFD0BB1270408055A211449350DF3AA683D7A07C17332DBFE0B55EEDC01296D

SMS_S dia.vfxgkrequl.gutkvhfbnywp

CFFD68F3C4F24A86418EBC632569ECB2287A8ABB06407C8BAC3E3D63E8C7D280

SMS_S ihxwq.fakqyo.grcof

D02AA05D154E8DAE4BA1701D9C7A3369D746439B4C6EF281B8254208C90BBCF4

SMS_S rlzqmdg.zfpwtexm.iwkxam

D034D1FBB305E8B3D95A203D9E08B7FEF10B5E29348BB8A61B344BAC3D8DC7C3

SMS_S yev.vushjlcz.morch

D03F5764D9F9DE19685FA9467D8D4060BC2B2CB2B3154D71882299AAD537B46F

SMS_S uwpc.jqomhlbn.mysficzh

D053F53EEB6CB806EA4204B192B3782B84C56A08BC46661E48D27429E3122D2E

SMS_S bcxj.ksynvezhp.itowvkjslp

D09DEA4FDAF25DE7940304562B77F21FE268C69AD38C3A48FF73B337E74E6360

SMS_S uvxdzi.ztygshxa.ztih

D0B162F808DF8469F85672851817BC9D461DFCDB27AA6E27A215AE48B921E05C

SMS_S jicleq.tgzemp.dizcepkjxh

D0B8D996C855BDD36B5A05AD1608B603EB136A2FCF18B77CF2A65F09B951D24C

SMS_S pso.gaoenp.deqbhycjkn

D0BB497116A884B965CE2E5882EC15E619C9041F8178847049B0C93E58FC6CDF

SMS_S jziet.anecyg.cutfg

Page 269: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D0C68B61018018C8A891FB5BDD0B272780261FC60DC02C19E7A0DBE80C5707B2

SMS_S tuldw.ymvoqzegw.ztyameuxrviq

D0E3330ECF010F79BAB3D64D9846F357B4F13D538F14A2958D34FD7505C8F6FC

SMS_S hgxfk.jdsytho.sxejh

D1088F7D6D5EE943CD89619062C590F175506B1DF91A1C4D88710F2F8A135B07

SMS_S bnfy.evoxzj.jrkvnwgl

D10968261F8B3E0A3DEEE01C2F9F6FD0624AACE6AAC23A151D5E241BCFD482BF

SMS_S wzrjtq.lqwocspdy.jtpou

D10C00266C60F03E58F635B4C597EC76092F212529921503EAB471806EB81909

SMS_S hzayqlr.qfiymkgp.pbcagzhmtikf

D11BEF1E80E3EFF636C17C6BC217D0A086C46539FCE47D57F53C4440E3B65CD1

SMS_S qfrla.bdqnuxt.jbreosmqnl

D11F18DB09F7E41A60F4BDA4173E7A7587322430002E7CC585B55111CBA7835B

SMS_S ugthiy.jdxungf.xehvnzfil

D11F4FE0C82468D9CAC0B24B36727184AFDE5A0F3F270FD31B617D55ADF84263

SMS_S rmnwacp.vfcnbu.vldksac

D14854EA9D6E79909DF165FF66C9D23DE45C6CADE8CA12B06CB5A6CC4C7FD02D

SMS_S nmwkx.skzgpt.lxgdurpwyi

D14F2950CD1AE46D3225B4A512D5287655085ABFAA0186241EB9EAB32944188F

SMS_S qnc.ujhgcvpkmx.osvm

D14FE02DC5DAE73C75722AA37B7504C24079191EDB372E739BB573EC3B1D2F5E

SMS_S jkvmwl.qtdawhgmsv.mwxfjhtrs

D163FEC8E4CEC99DC712C8AC67BE33BCC62D33346D60D1F0E597D14CE2384E54

SMS_S jbql.fwiadksvby.prnacxdtj

D17323C23CB874E0B7B0A411566EE143AB9A569B3F0796CA4BF7AD229C933E36

SMS_S tjup.hcxtoygk.qytnfrcadwm

D17DB721586D2E4561CAD5EE1F514F962F7684D795BDADCFD52521C050FC0DE7

SMS_S ydm.augjrhew.luwetimhrcn

D1871043918590E1FFBE0DD2BBA580106E2766565C6534CA42E0DC1EBCDDEBD3

SMS_S wpnyaqd.ugemshxkcj.urdoegzmpqkw

D1A0CBACAED7791842026522924E256C6D8F9B3D5A050C8AA23AB6AC86159297

SMS_S jtsq.ikfsmxqpg.rempcxi

D1A51CAE4A181158ADF1F41F7529B1645B059B60686842C375DE7D3DD70DCDD6

SMS_S ymcrzin.ovaugkzsf.batjsigoqhe

D1AAF4CABB748D827729A2B2203158BCD2086C5947C4B6F411B9A491E7AE644D

SMS_S qyporm.ybdlhcgz.xrutjonld

D1DD4A736EA5A35627D81C1F1602C8749AA97305A751C665D9B628A328455C02

SMS_S lqb.najkphl.tkdnozl

D1F16413A6995C9525CC3DC009103358BEA78 SMS_S mfzca.qhbzocyr.oiwydakzp

Page 270: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

9CBAE8DD82EE5C0B9ABD0CFE3F7

D21674D84B669ACFD6734297FDCE01933791DC0C59FB27638B79A1DA8E02089F

SMS_S yfpoqr.yhmnfogjc.qgvclia

D218AF978B852FE119FAF6B8AA8E4D735B904C48A0AA24E73570F4090AC8D274

SMS_S kfowgjp.gwlbkju.jyum

D229C2D55F93DFA1EFDFB8BF146363FC7606BAB9D6F7DEDCA3E4ED011DF605B8

SMS_S hscguki.tcyhazkrxp.tkjqeu

D22B2EA48128CC652339AEB3FF4C7F6258F4479BE96903955378B82209C88CCA

SMS_S zwfdaup.iptrzgavqu.aufyig

D234B907276F1EBD743CE79B01DA1774EE6CD6D1058559298866C4D84AC35C94

SMS_S seq.fqkuzw.zwedipc

D253506760A1016B086AA4788196D567E4327C8D7E4939C4460EDEB43EAF7577

SMS_S azk.lkmubxrng.iszvbgmo

D274D222B2D7BA8DD0E3971DA6E0CC015FB79E7CA00D52DA19C6D1527C0361B0

SMS_S hxmyn.notzbdj.xuglpz

D294C1FC67B546346E865A6232E679D63F97BD1F9798F3A010A60739933C3716

SMS_S lxdyf.lobgnycfph.rqflsigty

D29DC4202AB0CCF45110E29D37A56DAA67BFEAB3F817CD65562F8C495B41F333

SMS_S iun.qupdiso.divysatwxchf

D2AEAB59F3E14455E4B47066832F2C0259AE2D10D39379BFDCC32E65C334C91F

SMS_S cqg.zywuan.mndsbgruhcqi

D2DCD7EF13F0A243935FA61607577F6A675984F5DEEDCB78DF1FF68774AD5B93

SMS_S wdnf.kbjfcs.ydlqfpaj

D2E647C4EE90319B5F13701B3995BBB9DBC2A93F6EBEE731A3BD15D0AB8F648F

SMS_S hdw.ojdistfw.psjgioyzahex

D2E8EE54801A358B0F5B876C292BC233227A851BAFE9587E791ACC1096841401

SMS_S mjolfsz.bidfvx.kpedtzrhxvb

D2F6DF9DE5A4FF7B67FC2AFE35252E67D9EEDF50B242A78878CF6C2D5F19AFD5

SMS_S exp.dmoxvaiz.saqukitp

D309BD165B126F3D4C67E9327187F917E0D5000883A9E81FC6BF6ADB6FD99C11

SMS_S fmpqiw.ctlguhr.kyrbvzoe

D316A3E3A98B27BEF1ADC2F40A9DEF7F5D59E64E2FB103561493D5EE5D8DF445

SMS_S alyk.crlmobtfi.mwyu

D32129BE619A6A67FB904205845F782A0C5CD659688E07EEC45EB51C701967E4

SMS_S pfoarl.bptevy.ogdjsufn

D3305B7EF71A6B746ACFEF409B617265C3C3124F4903985D1C3D0FE0BE9BCC1A

SMS_S vrby.zifahn.uxolbprjvcid

D341310BB62EF6E206A730D901DADE3AA762DF986CD44AF1F1004B09467530F3

SMS_S bxpjw.tibeudjf.xletcjgk

Page 271: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D358867BA78F5F16921A6DAE4F84B7EA8F0766E7399604065E0CF5C12C18C78A

SMS_S wylspo.bzicud.khaiursbwj

D368DBBE8FAC3D9368040E9586A7C95697EF476F5FFB82A45A148F88CBFE5AF7

SMS_S pwc.aeqniloj.clnriudgpyq

D3795A91D26DA366809EDE17FA10A498E379F6A83ACB9F5D5928B37D3062BA66

SMS_S fnpwr.mlikyt.euvrbq

D380A4D2A410B61194FD15029A22E137ACC7C66B704F38B542383EC947A08180

SMS_S toukg.nyhiqx.fckogl

D3A2EA823C43C1F014D464284AB13575A12694ED8105656C50FE9E0F97645D64

SMS_S bshefql.nocimk.lovmd

D3A99FDAE34EA46388181B1374AE14E6E00B0A3A2744DA8086B654EEC449198D

SMS_S qbozaps.amerzocuni.ndetjgu

D3C173656CAAC72BC8F92003D7429FA830775D9C69A626F850C8D32953541D37

SMS_S otf.katevd.hdiaf

D3C7151F477E861EF59546CB2983616AEE644C347340A9E41C28541DB7F50777

SMS_S wkaqfsr.fxwyout.rwga

D3C9C22C706FEB0967ED5229215FFD406203E200866D8E374708B56205D86AF6

SMS_S qyocngj.vdaftroe.asodrtehb

D3CC948A13E53D3F9C4E40B309939C5EC5C1E2F31B458645D566C86584DF193F

SMS_S jim.qohnvkbwz.duoqvpce

D3CCF4125B352BF0943C9E9A212822AD8DAB1CD09D538B3743093CF4EDB2DFE6

SMS_S uvzqcg.aisjuzpf.pblyejxazgso

D3D96C21C921F9E2B322917156601C652CA093D6DC87F619784887F5E19AB847

SMS_S ajmexu.rklqjez.jlnrwqpvfit

D3F062A671C42975BCA4F51CC28F98D7BE3F06B558AF17DB304CD9961A6B8120

SMS_S flvr.hpmdjwbvy.geto

D400C2AD5BA1D0507AD3883087C8B4329999F60B7AFCB522320CC363EF8BA49C

SMS_S hazesf.ywtnesb.nobeg

D433914C1C392E7C81303CA39A699E68D4ED2AD229936A087627DE3374F8F8A7

SMS_S hrgvmz.chdmxn.pmykobzhifs

D43AAFB3D60C94D3C30656043BA0792BD275A4A6C3DC82CE2DE981643878EBF3

SMS_S auwck.moqaklp.jquclzwse

D45807CA6B07213323BDC2B110CF8DB9F5911426DB163B0BA26B5339F8757F21

SMS_S rfeo.gpovdz.mnfq

D45DA85A3B5F50EBE5AC5A39E68C612174FF1A2C42EE01C75D63E8806FF36BC1

SMS_S tyxn.qguwykao.deobsqm

D46A5BFCA409E52AB1B6F0E1FC2E2F612CC66CF3AC383CAD41D402383400317D

SMS_S gyqmkix.vukqpzdhsw.vxaogejzb

D470C6890E61E8ADB7F9282D8C9D38296BBCC SMS_S toflksm.keigxqc.dqzas

Page 272: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7DDD1DCCD7A58176A6DB01341D1

D495F413721311C8DDF0019A69C0ABFF329D8D2722D0B8FAAA2DACA269E54E30

SMS_S duy.svqikjomwt.ramolgcpzfv

D4A8E109F076F453395864A799C72CACADDEC2BD3949A1ABCD90A06DFEB7594A

SMS_S kmguth.bwuaztrhg.abmdky

D4B0B0FB4FDEC642454996A6442381C7D199985261A07A7528BEDB7975FB63E2

SMS_S pdlx.wekrspjtl.bsulwyatiqn

D4C5F2AAE101648D6BD1A15FEE0E78074978BC90FED96CA3291B9F9710C334F0

SMS_S henv.amisluw.lmfp

D4CA7BF4477D7B39E2469714F06FE7857C834F8D8ADFB58FE138738551C28D37

SMS_S qxusk.ijkbxs.nxjql

D4D34653424EE669150059A37C32840D7AEB6454CD4BBDEF1516A04D64EC1D63

SMS_S imc.emcdga.kwvemcnpxz

D4EFC4E74DF6C42812756F066F4B9518D25B75429C9F07FD85F92277C62B0E85

SMS_S aizxk.hrfbuyvq.uedymfni

D4FA5706B423A5B0E30DA907E15E6BA2574A512B1AF2DD00A0A55779E01D6DEB

SMS_S swbp.onwdiqub.dblkxignetcr

D51599B0F9E62CDCD94DD4F019AEC0E2CA707C36062E4AD9330CC8002BAE77C3

SMS_S wvknbzh.mwrpxg.qpha

D52361691D26E9A35125417682F596E52EA5B610C6F131FAD19DE5DC5F580E57

SMS_S ufansd.puxdsa.ntgqbh

D534EB174D48999A3C92A5D7BED7C1C7D8C468088EFE83A452C94D39B8965770

SMS_S nuido.fbrayz.faoz

D54197ADB60DD13C64EEF502F0E6E47E52DE8D055D5CF976026E0D3A02D708DF

SMS_S jdnu.rjeikmayt.carqnl

D544E5C4D4C2592820628F0BFE1A18AE88A87BCCCD4DC8C7ADD10E7E24DB3BDF

SMS_S wplqx.ohtlbvgwai.xbodgjm

D55ECE93FFB663E0F1DC38AF6B38B2481772CE2E611A893ADEF5198FCC1117CC

SMS_S qzo.ustdecxj.ozckipbrfv

D5AB4160174BC5C243A0BF51E4426FA2B929F0557FA21676616A0C384B6AFE23

SMS_S zqaodxr.gntyazubp.jsovagmxkq

D5C6C25F2272D034F56994E1B454B8867FA55B94C0D2D27A15CEF94DAFBDF174

SMS_S yrkuzes.zlgbjpero.sdncmwlvrp

D5C7CBD1DE41F418CDEFC5F60C728184D4F5ACD7BA7C22332946B125FCDACEA8

SMS_S djbxo.vwaynkie.rxopwsfhy

D5DD9B5C55558CA3D8D1CF0B1EC3E1A3DA23EBD63B3144C588131A5C00055588

SMS_S eugotfx.bjwfqs.fjdbyv

D5EB615D34DCFB2AF46EC18F7DD416DB9D2BE20ECE99740F06FD4DE2A3722F0F

SMS_S tahe.vuebmfjlgy.uagyznwhjs

Page 273: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D5F36B5DA0D7F4BDA2F3CC6229C8C68EBD5F342E9BCC5A0C9F384CC00612D495

SMS_S bsxrvhc.ehwdzpky.rlaphb

D6169E477390146E66B2B4484212B46D33E731FF5A00BA713B0B2DDC204436B0

SMS_S cuhio.gruebznli.nubye

D62799B3D2F882694854B6C91F3471F1F168B99723538F58C4EFCF3BBE9C087D

SMS_S gya.svfigla.mufh

D6363E119156CAD68BEBDECA2EE6EC0E8F784BA30AE63FA6073CE2E0C7EE195F

SMS_S bugrfxm.lhaztnpmk.nsozkm

D65CE842EA5B118B937DF26EAF61C82B3CC77620601A77CCEBA2A9131D9CC241

SMS_S hmtxiro.lhpkseuoa.gksah

D665ACCA770002236C145E185C908D26A897D049DA27468C745B167D4134F143

SMS_S rdsl.zpcwanjq.epzhxkflocbu

D666B6D0CAC820583CA8FE3C2449AB4EF28F442D632364A03CE3487037C374DE

SMS_S cwpxqfm.ideowpjz.vwakmcrudx

D66D767E525F8820A842B2A23F574859AEBB711CA63D39C3E80CA34BC8329050

SMS_S eutra.dcluovinf.urbex

D67FD5BD5A824B951FAD581977EA45BA220AA0A78BA877E3853D71FCD20328CD

SMS_S awsutcg.cvgqbp.fszwd

D68528EFC8438316D7F6BC71F19614A3A099AB689435727CD083EE1EFB39A861

SMS_S zvnrhs.tznijydgm.qpoez

D693828A37330DAB9740661C579DD37B189B905BBE0D1B607B69CADFCF647BBF

SMS_S qiaf.dqsocrm.zoramuwqnpjh

D694B2DD0832E121AAE7A5A03E61FD24C67CEA8C9EA8DB145F5F488E13EB0703

SMS_S hqpcwfy.zlhnfuvakp.jhfwrydtceno

D6B0C28A2BB3FA55B49773003492AA963DA15E665EB78A3A3615598EDB4F9988

SMS_S hbizklm.qeziljayp.xwdig

D6BDAC233DA327DA5C5863F318F498144E50A36AB472935D1D0CB96BE54F2380

SMS_S jekwmgp.ipjguadfmn.brin

D6D58EFA04060CFC43B5C45669FA6C92FF725614F510497F1092562A1CDE27E4

SMS_S afslg.ylkiauosbw.xejdfoz

D6D92238B76F27B7E307F778480FA1AC0C47DCAC001CC1B89594D26D681E85B9

SMS_S sdchf.ghecintls.pfozqeghjvu

D6E1EA412532E4C4446FDACACE354980B1727298B870E2C723E474BBE873AB3C

SMS_S qvnsyg.nejkhtx.gvltxwqb

D6E6D5B1E1A3B2B47145B56656E5E739985078EEF859D36898EF6291B80B3FAC

SMS_S oqn.dmqtxsel.afjweybh

D6FDABD3EF12794E859B1DDB0D6711C1FAB38C2DC3169A7C3DD39EA86C27604F

SMS_S ejc.apbrhstzdv.zxjci

D6FDDBC53287759464AD74E276CD6289B9382 SMS_S cdw.rqmyzjpu.mytxczu

Page 274: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BF384498A74048B0C47A748C972

D70DCFD7F2B704D4C04E290BAF52F3EF248B83AB844F1FADDA0AE6162FA6ABB4

SMS_S gscofzv.tcyisjob.wjsdxf

D72FD0BFA19E89DFA6D5CBD18938F15D0B758F86A8AA429C58626FD727BE8A05

SMS_S lst.csrjfznga.axzdmlg

D73335F6392C167EF0C9DBF94C761A646B6AE81DE0FCB0FF6A44FA22B749F39B

SMS_S ubwgah.okbnzqa.widhc

D73A936FB55240672E74C330B9D585298C2B66E48F56EFEF14B50C14A273E323

SMS_S zlbsfj.mwxihdkpcn.fdaukntrei

D7483F4AF2771919ABDB88E6578A2FB61D103ED89428D711F20CC59AF365C80E

SMS_S qkrawgv.brxqisgmne.dslzur

D74B29F77D540979791F34A905837A073D3789B3CEAE235DE32E51448718046A

SMS_S ordgsl.bohzlrnsyq.orfwgqeimbn

D7595670A2872F616D189F5DDA5A2FA203AB3200BD663EDA82BA695EE9E4D8B4

SMS_S jwpns.fjzhrqax.fgqriypndou

D768987FC8A5CC1597E0AA10310253BEA9931029B9DC436FF16C3BD3E6DD6407

SMS_S ptv.txrhdmnqpg.zqfrmncs

D77DFB2A9D126F6C8B69AF4BB9B550BDA48CBCAB07D763CAC496EE90419AE179

SMS_S ahxeydn.nkctzqd.emjhdy

D782AF8734B2875725677BEF253CAC7ED6DAD7C374E787A9AF984503882FC4B6

SMS_S emkxui.nfwpilrsgm.bixzjpmaguke

D7876E105E52D8DD0028DF3BA8CFC1D3FF3ACC179EA7F2DEFAC6F5F801F9F735

SMS_S rfdbnv.ifxlezwj.lshzbkneqc

D79E8DA66A629C35B7D7A680DBC21433262B2C24389DBF0C048D23DE87D89792

SMS_S lprozqt.pjbewacvlf.hpngrdtqjy

D7A66C6E8C6B874D876BE537853CB10A324E5C7E7EEB3524DD751A77AD15039D

SMS_S mjsz.hjtmafqrcn.vapmczgshof

D7BD3A02BD624EE44167792EAD313967FF888B343E38799779FFCD959484588B

SMS_S yxipdc.ovidkhnmgr.wjiephtbuk

D7C7D4D2C3F6BFDBC13A73375E32FB151A8E3DB9D97AF09A10DEB4452B0CF0C6

SMS_S rpowsvy.tracywvkj.fqlyows

D7CFAA3C3600743AC8ECCF9429D2E41487D4546D55B0F5BF96FD1434CEAE0EA8

SMS_S ivgnkc.nbghafkyt.embkdaqz

D7D888FE3AAB12D753DE397246242F1663E7166083952E639FF5645E0E167E5F

SMS_S yqlzjkb.zrtjwp.umaqhisklxgd

D7D9924BD4B705D9524593A8079C207AD530C1F89CB905EBB10FBAAB14F3CD7A

SMS_S ykst.pkhsjomzd.wdzbhytagufp

D7E1685709B721B8969ACD4857A5646ABCD29848CEA1265CD71C314F84A1390A

SMS_S tfb.aifbmpucr.fcgvyuxdzjl

Page 275: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D7E6896C5D4B35E03167BE7300620BDB8C500AF3614D7480B9DFB440E94A3AF7

SMS_S ckzh.pufxegd.ckvixhlbf

D7F81166A3391E146BD6F454B72E7A199B3B16E6B29A29168B933CC6DE443D3E

SMS_S ydumav.eygmtfh.stcdeilar

D7FA496882FF2D3A09AFE792614EB39B73CF7595D85A84A41D63026DD39415F6

SMS_S bzihu.cxqarpedk.fqcjst

D831F1D7C40F5B61BA6D5195D168472B2EF45C7C885ECBB444CEFDDCCC30C65F

SMS_S nimepsr.vwftrjk.cxyr

D85CE02DB12320A8AAA026AD0AEB2414A75230ACBF7E802427B2617F196CCB20

SMS_S yklzai.onjrawpdx.wdvjlzc

D86756D37EA490FC1FD5CE09AE169AC54FA7C239565F038FB0FEF28EB5D0A78A

SMS_S xnj.znbfjxqirs.futkgzxsn

D8713581B7F14DDA3EF6BE251B7D8624616AFAFF9F4B04594FF90F8B8D0152B1

SMS_S sgxl.wodscgvy.edbxc

D880BE75541F5324ED04B3525FE4C80677CFF2EBDC347A5EF59A9CCE1494BB3B

SMS_S uckiqsx.fvqxwecros.wvzgpcma

D8A8D3E52CDEB3C723D12864FA172244BEB51A52B971A52EED9B9258A24C26FC

SMS_S zlfna.ymhpeo.ocihyxqs

D8C6196AC3FB1ED6022162D0EE746F049661B8E65DC963794196F3E5E3C782EC

SMS_S iqkz.kicrjefwhs.qzaurvkendp

D8C8B733DA916C44485854B07399CF5D79A0FBA6229F354161CCE56E14BC05C8

SMS_S uie.jhwsmd.wtvgqrmcuby

D8E1802FB9B45BBBEB690BACC604C31116705C5E0C47AB550DF2DD96E7D4D54F

SMS_S urypqg.jaqmcs.icrqejpszmfa

D8EEFC926DEC31A871EBCC376DCC7B07416055328DC2364BD604A54A04B2944D

SMS_S ojrpb.nigtqlu.wompzula

D905C2E6949246C4D0E9FBB156EF70CD48F3AE3B4165CA18F3A022CA559EB610

SMS_S omanubw.bmjfrvywhg.qzybs

D90CE6873B79FC924F107F345AFE514F19A0561612763D5473737EB963E950BA

SMS_S smlc.hvetdq.ukgdsjcqriam

D90F366EA37CE273ED321250D383CCF4EB8280716141B7876CD0B6AD6F6FA007

SMS_S jleb.xwmhaekt.xgkha

D91830499C9078370CB6643E7861FA74917A2A46996D58F15F035ADB684A7AF3

SMS_S yewcjd.yfsrjizw.pahxnbdur

D91AD0E4233754E02F6D7A638655745EB564080C277623441667A13565DD2835

SMS_S tgk.ahqbcv.zdobvsg

D920A04113D771B6EF410AE9269B7B337449F119468475E78FA869C029C2CCD8

SMS_S xbs.crysieqm.lrvoqxket

D925FFC1EB25095F168FB9EC156299E15B3F78 SMS_S qxo.bfvdrjcl.xzknoutm

Page 276: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

16B3A3473CCF71EC1CD35C49FB

D92CD95560486206D281D80B5D3A594EF1B5C31F5DD34359140DDAF48AC98E1C

SMS_S pmqfne.qkmuizrbyv.dvjt

D9344938CD98109D73A43CEE10D751233EA4366E0E424F2D66244D57118AE4B5

SMS_S capwoky.dacrgwpit.vfsdquehlw

D939DD947C93E50B5375E6E9ACF054FD43A1666983F9206FCEBC488D7AB3A97B

SMS_S znd.mgejyxh.idxthln

D93C1AE883D09ECC5907CB01919901F3E3C897A6AB75B84C2D65C08F1A1F091B

SMS_S rcztw.zqvytu.phvlyaguf

D955BAC01049915904429D61DB03AAB88AD71AB067BF7DCA1DEF16B98F83BE76

SMS_S jkgi.mzwiqthdj.hxap

D96653EB6F202892FE851C12B48BF897D2220B42171EFE7225A377775055392F

SMS_S emy.fszbqxyio.eyswhcbqogu

D983542572D84CA1081A020EA71264F09E26040E1AE90E9867760A161E8F2613

SMS_S hfs.iwfxqlgpmk.vjsnb

D98911D08736D6BE21DD0C50BEF0929D44F58D810ED87ECE172DA91EC3B1E614

SMS_S gzo.chqmgotub.ngfcpvzme

D98F31A5EB53733D079BC4105A4D920C94B4E98DAF3344B99C55CD831F53E845

SMS_S yqxj.yahkmtond.zdvtkuneghyr

D99E47B8CE9014C1FD1A6A54D63EF8FF925285B5CDC147E1D162A01E196B23E3

SMS_S upa.dczjsrq.fysatme

D9AAF497484EAE6C720E3A5407D5A178472F47DAA9B5F5114954E550445DF8A3

SMS_S fskji.qmdvwys.grbyk

D9D1C5F6CA774A38BA91AB90CB439029448D4A3339A168D6070E58B294FF5558

SMS_S fzy.sdcuxto.mcvud

D9E11DE3E03C4BEBCD8DA8C144F554EB7EDA0B0F6DA662C6A15A8E48E8192FEA

SMS_S gqoz.bpiavmljth.timzksn

D9E141D53F9CA6F8586A02BAAE6168108FFBF4FE95F46CA30A48BC433424C97D

SMS_S ezfy.tcrdjpweys.uywj

D9E25F96CB3FE57210A6764535E2BE247E2AEBB6D3404A090EBD408A0645EE31

SMS_S qtjd.yebpxv.qzcjbtmov

DA35BDF76CB68E21C476065434B0A00A4867AC5F8E5517F80BCE4DA94C3EA332

SMS_S nwep.kulqvx.mcxaverjgsto

DA3EFF79015C53147CA27CD407F00C251411FE2EBF494D8FBF717E059D6E7602

SMS_S jga.zvldgke.gkvmljoz

DA5AD2C7D6DCC956A56D531D3D5E7AA6C392B14E435BC38A55408A62F7304796

SMS_S was.lcgedqjy.tworfpxk

DA7657E374B9A3F917C378554FAEDD94495CC0D80196EB072B665DF86E5C7D0D

SMS_S qefwurd.myhwja.yseuhinojlmq

Page 277: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DA7C5E0D7BB689DCC78D9020A27D3515969A85E24F8C5132EBB6A1298C4110EF

SMS_S ypvr.ruephmq.mvbfexoqu

DAC0DFE1F8169AC33F877A828BB3389441C4D3A0747DD22154C4A84E7292EBCD

SMS_S uov.xehnckvpo.qzmsc

DAC425B3F83528793B38F89885F97B1B29AE6B5AD6F186E33ECD7A9EE3C2D876

SMS_S dzuaij.qbkarvmyc.mowezxphndbq

DAF1FC9810A56A6C55268059E574222A9B1C018AA10A3A78CDE63D230306BE5B

SMS_S ikxn.uyolcz.uzie

DB01483E74B4692192BB0A68350FA7B31AA6BD00B00AD28D101AB0BD4F0C329E

SMS_S kwtcoea.ijykhrwqms.henksi

DB3742E31A4A66D01ADCB46F69F4F4136EB801C8E50EAEE5B6460B4BC685D1CA

SMS_S aft.bzqdlmvcsx.vwzna

DB38FA8B78FEC9C383BD31DC53F95DBC1BA8AB08938C1855502C2387E0270130

SMS_S gfmhjvd.nacdviotfb.ovatz

DB5D01AEFD22F5C6478DDD45744261A263EE684DB85F3E0A26955A4FED368CB3

SMS_S jgbwhc.bznpalktq.jlse

DB63FF474484BD96D30270A9633B3028A0172D8C33FFE1F5464BAB8168E8483B

SMS_S uvh.oxmfdw.gywexjhtv

DB731EFBC8950F2486CF2701BBEA8E910EA5E5B086B238DE834938573B24E1B7

SMS_S gjt.cahtluwq.twxeygibrafq

DB8C071302FE8D2F4A16202D16149EF534E1388D070B6AA54271D8BC8CB4C84A

SMS_S wpbvhj.byjsrh.fipvhnab

DB9EA3AAE87A3C00A5F975D0DA0077A9F9EE28EC5710EBB0A49FB9C8D65FA2D2

SMS_S ybr.khwtrvdub.kfmirgzqy

DBAD65D4857B54B30EAF1F8635DDAC95A2AA41765BA88CE4D09D1BA77CB47365

SMS_S hoawjti.pincldj.pwugocvdekbi

DBAE22EDB810B204594FE65DCCB926CD5B853CBB2D3A8CA59596DDBE54CC1769

SMS_S fpj.inrdfzjogb.aknqcdp

DBBB2678C2E68CA6AB0FF7D79A7CE990A4E12CC2648D275168C3FDD57DD0B0FA

SMS_S pwr.dmixpay.rzlngjfewy

DBDDA5F3C3AC59A7B64429F57DBC5A56B719B299B8AD6BC1640467D4DDF05151

SMS_S vhbqrm.nvazdrmt.dyipfhlt

DBFC5A5E563C52FA6554FE2ECC20926758AE2161F3F276CEA0C2627C08C2CE63

SMS_S efs.tuhjzab.oflvknrijwu

DC0AB71C7FB5782A1B382036F6FB0B69004B7254ADCF31363E8A5AD1C4E5DDCC

SMS_S luqowgy.lyfztx.uqjblxa

DC0BD9FC21D77ABB8AF7206823C6DC6E159F86F44ECCF016DE93645CBFBCEBFB

SMS_S bxkvft.ohvezuxric.gljkoutsbcv

DC225F7CF2B2EB4B5E90F7189008443ED9CC0 SMS_S vbxncrj.yeoqpfvkm.faxwebinlqmd

Page 278: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3A28F1B498972DB692DCA9FDB17

DC4FA00A560D46AC3AE5A1146DA8920EF42939FBA065DFDD3B6FCB3BB13D088B

SMS_S vmytxcn.hljgdmtw.rciq

DC55EA6F096E795558E63F29F39EBC0588DD5B78B13A55ADBBBD3D29DE84C464

SMS_S sce.vgmoincy.coms

DC71502472DF867B73604F3F30DA6254A7C77C8D51EEA6AE76696AA15EDD32CB

SMS_S yus.dalerjzqc.xhrfsediln

DC7384BC67080AFE66FF11C9553DCFBC7700F79C5155B93239275E162C54F524

SMS_S jyzhkna.bnrhmouaf.zcsawjmprey

DC999480301944C0AF8CC03A54B1B68D4AB34431756873081319758CD624E392

SMS_S qlcye.knwaxvqf.ndijhprtfoga

DCA1DFDA4D139E3F39B6F24863F91FB757B29984655BEB87F7B823ABB75C7018

SMS_S xvbefw.pqmzxglubk.smwycfz

DCBC78C017D8C4371C7FAE61E86869B45AB4B23878FF8EF820C9D93AAD3B526A

SMS_S vpyqa.tdkxghm.tqmbuaeos

DCDA6B1713F246FE8A7B9F20A924360A9BFA857F68311AF4E358EA8F832B5C7D

SMS_S jzdplm.gowiamlde.tpyafk

DCED026CC88D57895786C1357AF871B615B9F6DEFF62A1A012922FDC95F7A579

SMS_S wpmqc.njrbpoyaq.qsfdxjap

DD3BACCFED3AF1E52B794DC7FE27B5A01D18323AA789B0D720283741C38C221B

SMS_S rjwqfg.cipsxel.lgjfwx

DD3C62C1C6DBF95F3F59736FABE3E1FB65BBDA458D9D3DA4D3A6557C1F8E1295

SMS_S csekr.oumsvikxbe.kgdercqhnmov

DD3F20624BCA7B506D77A3EF15BFA4BD091DE163EA21DE27C3F257E1CD2EC675

SMS_S zbvy.pbmncsier.aqehf

DD40E13B8F5EAC258FBB7D38C23F833C77BD8EC3F5DD82EAD2DE3F84E6647E7E

SMS_S pun.eiaumsyox.oktgnjem

DD4353B777E44E31A657E3AE49EA2D27757C168E6B66DE4648AE6E0C0A077AD4

SMS_S jxyw.nwsqxry.oerjhcktg

DD5A084D2020AFC8C529EB2546122BAB0470C4677F6FAE297F7B4E6ACD0ECF76

SMS_S vpwlb.oiqetgy.yipbdhoslcae

DD5D99A71EB23989962B83DC9E0B9CF735B5DB1AB3539A1043BDC6E4354DBFEF

SMS_S dnqmfag.jhmriynu.qkacme

DD6B2D8F04C1512BE068A3D9385E0FF3789227EE9870C6CC39BEAB1C906441BE

SMS_S gtchpj.fhrgcmu.afxyvtnus

DD80C4C6077CB32A60E1CDD0D62E593389F953ED2AD2E16A6B19A8CE01DBE193

SMS_S pehmoy.iawhbjl.gtqpdhsciv

DD87DEC42AE2CAC1C0673BB9BC3D278CC88AB275DDC05FC75DD0BEE7978F11A7

SMS_S otkb.boypcaq.skwhzvl

Page 279: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DD9DB250AA603DC1858E79BBB289C409232420C18CB1DC8149BE00D699BE0011

SMS_S tuivd.jitnrhomde.skulajvoi

DDA163FD1D2DDEEABAE8A5585B75C7084AD02577AFA6D0BFA4425B49734A2091

SMS_S vemdt.rafdkpojts.qjkacfuxhvyr

DDB8BCE7A60836CF865037078DAC2398C9E541E3C7A587288DFD5801C76FAEA2

SMS_S xoidn.bkdnmo.jcrwambux

DDC8B3D5FE4D7469008427F82D97315F2399DCD6C37B715BEFDD8C01AEE127F2

SMS_S eavnqdr.xiybhm.ndli

DDD4C99E43A5D5ABB58067FC9E84D187F5A4565D8DC68744077C347F5942A289

SMS_S uxfcr.yvcdkgsxw.kbsxoiz

DDE37D91ACAE962889389A24FC1B0BE34A981B7250D332A7D05A90DBBD409557

SMS_S mybsn.wfgcrbqp.voytcguad

DDF891EB82C5C2B70A886D5F585256E371AA4CA1545FE097FB96E738795D050F

SMS_S adfsq.gtpnsfmoh.yzwb

DE3DFFFC9DF498586C261D1E4D3ABC7589850881AEEF0A4FF700A80B34089C18

SMS_S dbgywpu.lfbqpw.hsanz

DE5B775FC6C01369CF90C2FBBEA244B4E5A236CE8F9CE6552D96403410B395B9

SMS_S ahls.qtruycnlo.ruxes

DE6471FD1695BD45D8FFBA23E8CDF4E840C951E5178A59581A1DB302E167ABDE

SMS_S floe.svwujex.cazfbvjet

DE78F7203441415F8D40357F01D7BF45F2DD98AA09B00DB5A049A2E63B3F4CA7

SMS_S meytavp.xlgkaou.awgk

DE81A5F7E7A4B006DFBB1892FE29CF78FD4276DBF25E36BE954E4B4F99C4D2D2

SMS_S btd.ifzchtbry.zwvlstb

DE86FD8CA87A8856279D60544CACE3CDF4A1BFA878C9D35CA660F9AD4B5C2FD0

SMS_S qsjuwhm.bjpyindq.kypxzomasi

DE88F0BBBAE86063767DA9CF634EA031B22183084212F90F75E7911829078EB2

SMS_S lruys.ogtcva.vyfotaj

DEACF4470CF9E8B7E1EC6205EE194496AF57E57716571231077393A8413F0A92

SMS_S dhsevqm.vfrjtxy.oruxdph

DEAE5E45D93A57BB078EBB7380813245C7FE8B82EC0ACD65D9A4B749F1C5D355

SMS_S yertzfm.dfkluht.yijndgpc

DEC14CE09617F74C643DCBB9D86EB89F7AAE7453831D5A497FDCC9E217A0FC47

SMS_S pxte.gwsrvkupq.gafjpqkbc

DEC276185F73EFB296A3C3D19A9F912AE1C38945361FCB601EC4EDDD89584252

SMS_S isgxuje.fqmhgvb.cmapoxuk

DF0148F1222FCA12DCA788C347FEE29BE62DBD2BE9723E30D97E844C26CDD579

SMS_S lro.tfcgawqz.qfivjnw

DF06BB557D190C47D817BD237C493D3D3E2EE SMS_S ktw.jgwxmrenp.uqcoxysi

Page 280: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

26707BCF0D5517F4B1E3151CA00

DF0CF343146EA1EDCD7D100CDEE7EE71F1E772B3AA86AEACE743B3ED7B0A9C5C

SMS_S cat.bqczgi.egfs

DF0F4F7A07F5990692F89F4A681CB0BADBBF48CB241829EDB3CF326310067363

SMS_S lwnz.eicsvh.bufozyskn

DF23F6020556781D775A281BC129E5B4FEF74CBD25C0920F0152B3D07FAF69B8

SMS_S dlvjuz.obgsapkc.wsryf

DF2F1F8D35B9771414F6458921F720BD261722D2F53C1CAED8A9B4A666E496CC

SMS_S byv.ekmfizac.zslo

DF35968711F3A09878E14AE5F7742868DBAA40B02717D452E5892C124DF258D8

SMS_S tmjbl.ghsqclb.adrfczxlewk

DF35F20F9AECD12C35B4A107841C8A49609C2CDB3418D4D9B06C636EFA34ECAE

SMS_S jtzeq.ncomxigbza.hcngley

DF441569819BEC108359D4AB33601B1202507552E77D3177083B5B102DA8894C

SMS_S ngzhbm.jfoamp.txodwn

DF5A2EDDD046A034D3AEA45F480AE8887AE54B708C2DE74094E99FA706B64565

SMS_S hqyxfik.fyatjg.vipnukerzaw

DF5EB719FB7FAC075B5379D129BD407709BC3DC42F978455AE91E6A2795F6429

SMS_S fbjp.abmdjrklpw.tlkhuznoijfq

DF7361EA744F50CD6D6062AED09CAE781CD3CAFC8EFB1479CD8EE96C9E4BCD3C

SMS_S phf.ntodfbiyv.cxml

DF773045196814985E32218DC27571D8F3E8908387EEFE250837E8684AC0312D

SMS_S ovdlnjh.zvdrqhywlt.wtancib

DF852A28417F3B3282B67DA0D1C8B4AABCC9D666042EE2759D5BC34E451789F6

SMS_S gps.isghqfyelt.yiadfnwprcjz

DF8C506E002B6608F63A9D51D57AF8B26DFF778A4EF74E1C345A9113FA5107C4

SMS_S tpnu.dkwomb.aoiw

DFCC8395CB62EB4B5F2A35F12F31F49BE23BBE0FFE1E9B046844AD4880EE165D

SMS_S fsyk.tihzflnr.qjhdoygcsvz

DFD0516E0868201CE01B8E051ED635A57D48FA580281C7589BA8A54B6621A7C8

SMS_S tpw.kbaiex.xhujw

E01C215D2FEEC7CBAC642F59C04E39B5B18A54F6FB871B23876657FF8430864A

SMS_S redvj.pwgvsd.kgztyqobincx

E023DD9D09AAC43623EF84AA82F050D8568B9312141DB594A52550BEF9D90AFF

SMS_S hcy.mhrkyjtlac.utvpg

E024DFB402CD353D61ECAC767642338CD13F947445538162C1499573660149EA

SMS_S pnrqby.qjhixz.wpqdjtxsnkz

E02D34A51A89C5228E3A2B5666C42B99DC83E8F87619DAB97D467B0288A02C66

SMS_S skrvjaf.ybndaor.pcnkltia

Page 281: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E0320A728A4CF67DAF79D3939E19C62D0C8A8B53516B56CBACEBFA37EDF15367

SMS_S yeqkpdc.ftcuihmjx.iykpvehzlgu

E04C66C1E769F4E81EDAB775F68856E77DD6D02F81A7981821B3A3AD855F4931

SMS_S humewv.tqfxydep.vncmix

E052F0AA1F3237CEC6AEF1DCF19971DB1450248ECA44C2A3AF2D8AA57BE887F0

SMS_S atjb.vmxrdka.jbune

E05448427C2983516B9008E69F0A355F43833807B020D14F8C1AC41B2CC6B7A9

SMS_S bjn.yjvrpmhlu.exsy

E088533E276B0DFA36AF4E3AFD48ADEFB14891025EC4C998ABF73A88D190B89E

SMS_S ntgzp.cbgvfe.zorevfi

E097D10C214B627D52BE4134B9D9C32E60DC64D12E432B4E099AEAFA1C5EB684

SMS_S tdlui.amgdvicz.azdcb

E0AB6D7C428400535F08021A7B849E4FF083FCB5AD9A5989FB6B14A534E59E83

SMS_S ritd.zxekpqvat.hwciyg

E0C65B198FC34A5C0C8865A8A35221A4FBCC6A48A321BC2FBC956D425F4BB443

SMS_S rpyisk.deqfcg.owdas

E0CA5638CACA1C1E329632DAC033AAFCE7B8A726E89B5FEB5F81B2609BE53F09

SMS_S byc.vqerkmzfn.vbrlikqaw

E0E3B5420ABC0A8F45F7BDE284044A4639331BE29F8B00B4DDB12429BB826DE0

SMS_S dyzpce.hscbakj.mgwxunfbtkq

E11EDF1BE0FC4C62D7F44E0C8CC9EA114C6ECAB8943741DDBBB190439602915B

SMS_S azjq.rhbpgz.jkrq

E126238F315848A1804B8053512C2E446F4E351745F363AA4D5CB5B7959203E7

SMS_S rlapo.srfjku.yqcitbk

E134A9B3E83E76B5D860BCE40BDD3934925C8E5C23AFE5B546D7CAC3DF8D96BE

SMS_S obraq.kynezmj.cslmdp

E140B229BAF5AC138F7EE3A231390CA144F0441F425EC2BD6E95710E8DA08808

SMS_S egktr.cfuivy.tkcwis

E147F925ABAC23AB265EB548E5CE179A63E7415F118F0C7203C540C9ACDF2C89

SMS_S gfzp.ewrvskbp.lykj

E16FD22DBADDDB837D4491FD441C64B38D4B3508A30713131D4A0085E4F62431

SMS_S kamcjgy.xokaejid.hwgiufbnaz

E1785BBEA322DECB444E35C8914DEFA36144498660C440F7007C2E2AE488D6AE

SMS_S xmiak.fpgsxv.yaiqhkz

E17D8DE703679E4B80501494190DD3DA69FC34427FDF26C3CB5F3C355E07B245

SMS_S hyi.hivtoprn.cmui

E17EA756696FB2FC9566F2F90E97D56256012A0ABEFB8015E94D82EEFDB9817C

SMS_S hiy.thbplxrjey.qpfgmlbzui

E19A0AD7AA280B4E0FC8BA69752256CBAAF99 SMS_S gbwzmh.gweychv.fspcaxqie

Page 282: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

C8B9DF04C8563347C821BEC5BD0

E1A0A119EFDC04FFD334AAF10C287D0A0CF32E6B0EE19FEBFEC85E3F8C9AD0EB

SMS_S loqpjn.bcofzgpsqh.frban

E1A7A49AE0292C8B4B391DE96AC9EA49845D04C5DF68EC46E307BFC4AF3628F7

SMS_S axbwizk.saedwgfqnc.hyczabwnvof

E1CD483F201397EDA0952CDD5F7892DA1C5B7893BC53F0468809A817AF1B6520

SMS_S thpnx.ocwupjqrvk.idzrwgljcb

E1D25C1D9ECB9FC2F8BB296EC5D732D48EEE0240332436C6C46E5DA86F975A18

SMS_S tipf.qbnoepcr.xpfudt

E1D5FBB392E9CAC0AE18A4E4F3943B1942592653771A2CC9081D996052122546

SMS_S wzkalem.odgzsep.oysvmdu

E1ED27C432F8F2EC41F39704E73B9AD0DD6D2157561047DAFE509ACC7A086FA8

SMS_S mrcdj.kyerzbv.eoufnglcxrq

E200A251E016603660E9F22FA1641DBD9A37BADA1F224F814178E612AF0F798E

SMS_S ghozdev.btqznhdwl.omawihvf

E20B7476804816EE8713EA810795585958CF610976D25DD7EE3B5ED1C2AB03AD

SMS_S cvh.ywixclfheg.tydginph

E214CDF5987DF5731FF171F0CC44C70E8EB46DA4C064A7FA3C6A116E0FF0EB5A

SMS_S vjon.yxdobips.thqpwlvyg

E226037233C4A2020DC52682041E773ED5836A680EBD6F3382138391EA7C892E

SMS_S ubgfqys.jrymgthowz.gswymakcvjub

E22A3DFD165CDAAC01E9A9014DD14C7FC60B2C7E94F1B487330E2C95E649562A

SMS_S lywqntg.awkhpyeoiv.fudmrocqnlb

E24562E94A688B9286EACFAA1A0236D4B717489CE8B7EA486CC280B491DE0F36

SMS_S heciol.tzeghmi.lftcvxms

E257076FF9C01DE49340D1FC2B48C77EAAD9A180234AF06C711D5B6EC2835151

SMS_S eul.abcmgdfrwq.pjdkqwgszle

E264F1B77A08111B06F729416538FA43B4E108280D64919C3A7A847663297059

SMS_S wteldxf.rfnaqcet.idfwmbzrqljt

E27F0C9FD00E580408DD8B99C418164989D5B156F4CC156A6CAF8AAED06A6F85

SMS_S xjeid.tnhjoyis.xaeckiomj

E280FDDFCE498766FA8ACE6FAD4ED2102E454CA15A70C0A53009312D7793CB9D

SMS_S ybhm.teofpnw.qckxnwe

E292D99B5784B83600E9042D20F797E7E80A8ACC97CB647427203A0DD6F0B739

SMS_S ious.fnszhbkd.hfatbqiexl

E29A9DBBEB6915718BC9874B748B0679CD3260845D4722755B217D8A12066E93

SMS_S sgvduz.ckytnp.mdlispfjrz

E2B33CD4E19B08150BC435551B82301493F67DC66E10CDF58058761339971AEA

SMS_S ubrvnq.ivlsjbfpxz.ludhv

Page 283: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E2C3A8FD5CEABE4A5B7805561937FF42CE5FE2C8A14AFD6DC07848A5A7B829A8

SMS_S ojrya.reacnuov.ftwxp

E2C888F1672B454F9E4DB2C88B92B14434BB3CBB5C02F60BC7AD356327417416

SMS_S ytrv.yijdrm.bcgwmzkxnjh

E2D0844A2EF269319A514590B3C42558DF629BBE4C69F4EBAE531AB7F9217CDF

SMS_S ihgp.xuawhni.boczmxewd

E2DEC31287EEE16C544BC44AE812EDC2B9749F856D5899A9846818FFECE8C0DB

SMS_S ocn.siroywunp.hxjzanvyb

E2FBD7FA5D35C40F28C76722C78FA3E606CA510D60A8A6D6B152AE68AF9CEA25

SMS_S vdyqc.wkszita.haymqku

E2FC057EF3CFC14D0F2BB3DD1F15B1D735FFAA7E5FC308BCDC2BE56FA16F6582

SMS_S cmy.mxcdtnlow.myxqztu

E32B457B9996D84318213B3485C97924DDDCB95DBFA44052640DFAF8B9DC7FE5

SMS_S dyf.zehqgauow.kfzuipxl

E330668ADD1F1F1B4495E130AFF6E4698BF5A3798267582F4C949CC6C7BBA99E

SMS_S viwurb.mvyctxiez.uqxgodtl

E34D6C59C79E802C6BE831FEC4ABA6F2FE4C0061567D1EC87D4218490E34E28A

SMS_S urd.gybodj.gjmbiua

E3577C507F6710AE6E1770AF9E5B3F339F47A2129BB3F0F23611FFB765FA5ABF

SMS_S mzadhj.pnbhuocs.hrpcufglst

E367207DBB243057B7E7D91A36469E96B89BD31E9A2DE20C3E1CAC79409B93AF

SMS_S lcq.tupjzbnx.uzdrajb

E38A781208AD4D3F428C50C4BDD7058E227568BC4190F41C4D494A430B1C22C1

SMS_S kge.rebqykgo.wietkjdrm

E3939000F35B5D603A26F76C0FD7812D47DF9CDB1D141976A47CE739A15D04E7

SMS_S gwnbu.rqpfsx.ckfbjvlzsq

E39798C7F0C575B23B6B0C348F8132F10B9BBAE7907A9C599C3A06F006FEA48C

SMS_S avcm.arfxslpmw.iapfednlqmts

E39BFC31D46B43546E2BD3971CEE35F178E3E9D113961D8949AE9F057F4C5A8D

SMS_S iscp.gkieounrj.vguwlmrtodxs

E3C6524A77F719FB934EB7703CBF26896222FAE1A5AF83EEC793E2D93DE00B2D

SMS_S vake.xatnshqezd.utyphkaz

E3D2EF2A9A4A017C643B7D2745E33DCF439C1F69594D97F951C3C213C360687B

SMS_S bqkhxaf.ervbhw.mosdheqb

E3D84729FBA9A4958C2AE6A86B1188E374BDD142B532040CC04B1053C654F9EB

SMS_S bfitqv.sceirtdm.lzywq

E3E1BDF1E9B6AB41FF26F5E352080F21CC9DC0CC26BF434F4473758DE9B72590

SMS_S bztvjue.yjearkmnf.plukz

E3E307EE8CD67EF6B8B664667460C660E8FF37 SMS_S blexyut.rzftpjbu.hxgvqbymzek

Page 284: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1D7781AE9FF60C9D64CE9665C1

E3E8C88198AC5AE75339D04E5DCDC20BEFEF996738FE051D1A12282C88192138

SMS_S motd.bfsvczku.uoxgbpkmqy

E3F2BEDB3EEF3A59E23BF4FB43CE7A21B73DEFF780E6E3E98C51060E767BC5BB

SMS_S bzp.oylgnx.acmj

E3F2C07EF8B809B27136C679F0359AF6298D7782A8A9DF749AD502B2C6EA52FE

SMS_S tkzfhce.moxlakcu.paiwk

E3F33D9BC5FC6A46327B8AF5690F232207D23531998E168CA877543EDA6BCDF0

SMS_S qigvjpa.uspxgv.rndcezjk

E40AF5845C2A72B96098B1C6CB8748A2A3FC3D0AE399ACDF274CD9CDF5CB6F6B

SMS_S whrjfnx.lotavr.zhmbosjraqy

E40D19A0A71361C456E5E72A5E1233FE0B69C07828485D09BF4E23477C7A88AE

SMS_S uxj.crhevwuaf.mweolcshfj

E41144FA5D9A4F505CBD434C6FD4AA5A1AD6E973F93A4CF37A1701E7BADED6BB

SMS_S vciep.rweylu.jabhyxc

E4119E00E850072DDE747419E837C10958CFA877D727C9D8634A3D9AAB08C1B9

SMS_S tudwfpk.gmoukl.nlzojm

E42866E7DE8CB55B93038617E407AEE45268DD97EDB2B59FB6665F687434F3FF

SMS_S igsldhr.eirmwfl.qicfkvxosju

E438A7F6292FD88D7F6351527B7994CAE161226738DF415EACF4B6481B6BA012

SMS_S rdmn.qevwxf.dcwyak

E4594DE9620C1B5B19A22265EC06A496C52484944B7D7132752F9080A5E7C0FF

SMS_S rclshe.pcbjzvyo.eotzyavnhd

E48EE53CC56078E24BA8A87B3A23CBA4D08856B9503B0B6C7CF157FB4363C53D

SMS_S binev.wonspz.ulinxet

E4B62321AEAF09BAC4F2F81036634F772877E800A16FCF384B31C50163CBDFC3

SMS_S htpwuox.ubagqm.vihjkgob

E4D6228857995D68A1DB7242D5A256C2270C1F15AA3D6EC2941BE87FE4565BE6

SMS_S rihxacs.stqbhdan.drjownvly

E4DB59D81690A5909CE91648F42D32259FBAB03C1EBD66EFA9E0D94E8F8E4711

SMS_S uoa.promck.qgvosfhklt

E4E657CC1D226E3305D4ACDA1A41680761E221038AD73363DA17C3BFA53707F7

SMS_S qyeca.zixugsaq.galimwz

E50A98FE7AFC3DB82BE5A109D1DC7A237AFC9FE6873BA8D0D10ABEE33CA92B2D

SMS_S apudwti.myebquzaot.rcgais

E51189D8D28808FB81AAE8DAA2B950AE29EC453E7806F04BA2B8B9B478967CD1

SMS_S azoxjg.qkprsndmh.kmaurqsgxci

E5171B18A174550BCCABA21E9476F9BA7A776C0842AAAF90BB09DC82E91FD9A5

SMS_S kdihqst.dmogsxkfqw.swtajxrvlniy

Page 285: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E51C2490D04542870148E6DAAA638E33D937042B8A6B7B628301307B2AB63C16

SMS_S hlow.zmxfjl.xignqjbyhw

E5376FF762775CBDDAB246DBF5D496A01B243F9C8EAB2358E561F78332B88414

SMS_S wslamd.jfacytdblo.ndmjolzgcurv

E539D2E0EEDCC9F7E894AF39F64B8BD1DB61C08126CDE9974C65EDB816B56F8A

SMS_S rvisfq.rfzhvex.gneov

E546CBBBE78F65F1D443555C08D4D3D8F88FDEB1E6CE700E21F726AD5FC6E029

SMS_S uexda.ijetqlmx.hwsgf

E55D51BF8A9D93DFA66B52C98ECAF1667A93A8E934FCD0DCFA4D27258370ED06

SMS_S xfcabzr.fymketold.pwolcsmutq

E5731415779B98759252AD8BB898A0EEF86DE202147AED927B49A88D04DC631C

SMS_S hbnkmuv.znpqgoh.jabtnehm

E59379DBAA6778F8B34BC7587412A87F8497D78F14A851A912616A64B2468C69

SMS_S cjgfxr.ztvslm.qecm

E5A1A8C902851038FA91B0A094D220597C8621F7C57CAA6A9BC192B71C2190B2

SMS_S vapmen.xspqmeriy.ctjbpzxdve

E5A9B3773FCBD2FCB0753C979E6CEA2C7742FAF47B75EC96697E36500FEF87E0

SMS_S dofwch.xidjfuc.fnbqypr

E5AD10E292898032E9A95D64345B721269CEC9440CF38431A9E1D7083D4C829C

SMS_S okmh.qbxdkr.sfmevtkwlxcd

E5C013D5BAE8F862734DA7D7AAD83AFA5E15123549F052FFF52184D399AA0C13

SMS_S qda.huqsmplvf.ksoepibcr

E5F6EA18C8A1C1E6E9CDE08BADE93E5410CCC2FE116D7F771180A9C33E20A6C2

SMS_S rditjex.irzebm.tomdxiabu

E606223789DAD6B421F665658E4809550E17EAC34A37ADC53C25DC976D7F4575

SMS_S odz.gbqlmjt.tyvjknxca

E61079D897FD1C35E027A03B38EC4EA0E007BE861C48647FDF7A571A6EDAA1B0

SMS_S xik.tcwgoe.roadcq

E619F4C0E371935006CD81CC5940BF88C1480E93096D139FC2CE9CF8D3E2EF63

SMS_S kzgrqhe.oxuphm.lxuzniamevhw

E6351C06283D0DCB8B8884E673AE8B1F81ED4000B66B03D2CADA3FF0C5EF2C68

SMS_S dlmospi.qgmvzf.gdmwixtrcayj

E63B8BB4C523B3DF1345CD61A19D7A120A3626EA623981B30D8910733F3F296C

SMS_S svumlr.zrlsgykf.uniscy

E64571A376412528C28B4C82A057FDAE4BBDC5D42206E5CB2A88E6DA57C1A932

SMS_S ltwoi.fuwcylpaj.wsteygmz

E65DF6B32A14BE3BF1B0A3DD7695193922B49B9126B9250F98DCFFECC3866288

SMS_S oxgk.imfndujhb.mkvg

E6611338823B6D2A79AB3FECCFC9A5A2C8575 SMS_S hycgus.wvuyikcqp.eowkqtbnvz

Page 286: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

66AB63FE4BF7E719F1A3010A76A

E6A7D33964DCA5AE19D800EE86C62557AAA282A23F40F30B721A2637C88EEA5C

SMS_S zvypbr.vrgnwajk.tycriz

E6A9C0579FA5A5DD50C7C9527DD0EEF6573BA88E21D8399034CA62CC4F47D62B

SMS_S rjonqax.xhofmcvu.drmhxnwasuz

E6B026A29CFDE6EC951D28FE063D76F1584B8DA50EB76010A5B292C7A233BF9F

SMS_S nhc.sulipbdmgt.zemq

E6D587193E3434927CC94CE0872ADC1D15E48EA64810A0A9CFC26E06A812691A

SMS_S wvgoysh.kyxchsitl.yrnocgultd

E6E5879AFEBC1502D82A2A123D7FEAF7D6A278EDE2B54F04DDC371E2E05C0F0A

SMS_S kcgpnal.xaftehji.hkaetioywmxn

E6F0A49C108988C5C0E62D59285732B3E571EB7FBACD0EEFAB2B7F51123E6B57

SMS_S mrxuepa.ofpgyxzvtl.ratidzylgjvf

E6F616C1ABE1213D914667812C9571A024AFA7D118A2CD46F1D069F06A4DA4AE

SMS_S vlxrz.rgcszx.wqyrgmn

E718F8724E3BE867D7282EF0A5BDF78B45DFE75511F9240CF93BF47DCE6F1930

SMS_S xlh.cwiexzr.kogaqpfde

E724A0A31192D8E35BBA3350AC7500487BE36D56507C586980C9F9EB228B8F85

SMS_S pblmx.rlchvkzo.fiyknsmgezb

E72B465A6EE6193DCC1687BA8A312D5D1A95723380143A7B79994498EE4624B7

SMS_S knxpmu.qgabsmd.arij

E73D3C23CD71B863D0B8192E26DF28995302DEA2F5FEA7678816D19842C62595

SMS_S wsmxhia.pvshmf.efdg

E747BFC72E72D8BA2169415AAFE54E6DFF656C78FF314706A3C7F3093A4E8283

SMS_S aids.xkwidtfulq.wjgiqhfy

E74D942913A5FD7B2731C5C845AC175D0D2C97A7BAE122BB01CFCDE76B3B39A5

SMS_S lpkaic.rxgyqfuz.hczrdivfmj

E74EC0D2B7903F94A6E32A00098E3E092F2F023F4C507803C29F25D72E833707

SMS_S bhq.ahnjzeciv.idwt

E757DE8ED3669B9B15B30A7F9C99146BCCEFEF4E2EE6F5391D2DCC8E3D8BB412

SMS_S hutag.awhoqcpzgf.ryfdwhnc

E75BB99F990C6E0E7224DBB437974C260DA33210C8B2B40EF5778054C9BDC3FF

SMS_S rsq.hrsuzljp.bgdwxq

E7655B3FFBBEA1840CB68F3EEE5CC691A6909B62517E600C2A8BD304419A4F65

SMS_S zckji.bxgftsrwi.qzxujgc

E7790B69AFDA8B7389CADF33B9A9D8EABD95FCCD3F6F8FCB7ED36581C396347F

SMS_S snfwjde.difwspea.yhipdo

E7844F73265E9825FC329AD036133D272C65E20093758387D86E0DB5E71B2C74

SMS_S iegm.vuyqicjwz.sxohgmkybj

Page 287: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E79702D1B844311F82471955B355E96679EF33AF5E992FC2965094CA5FC9E399

SMS_S psvda.vsgraukwh.kavscbt

E7A6F4844C95974EDCC8A2B568DEFFCCD2367AD756D152E03A0809417B0AAD3C

SMS_S oev.oczsjmqvxe.znervhuiswbd

E7C2250E6C653B8078E9707603B1EF360609DDE2C6EED39C8FBEEC0117D83656

SMS_S qtid.xeyrwmqoc.gnhcfswztpxi

E7C4D857578D64FECE780EDF7756406E02FB98A6C3474DB1A655EA064F90487B

SMS_S czv.umlfgcsiqy.biwtfelmpgho

E7F21F81BD580620EB38DBBC9AABD7CCE4CA8165F4576058B68EAE339FFCDEBE

SMS_S rlvfw.daryuzpj.togucz

E7FD9E44048017D7AC882B2632291EE98B4A3F924346F2ED8D378B33596F9EF8

SMS_S xiaj.wmkljrt.twnajliv

E810524FD35D8557EC004CFA26B610251321E75D4704D4FD6FF9651EF2AB4B3E

SMS_S dqc.ojrqwpsb.goaui

E8129416FBC478E725E087C5855885D3E367B4DC51C1BE250F1956DE389E34BC

SMS_S hkoa.cslihz.dwvfrmy

E821116732C79A9527447BF11A959E03322D57194B2EF6FB255EEA9D9230A4F6

SMS_S tnh.dtplze.dwybqc

E828466D85A8DA291D1975FCA9DCDA56DF31F327887AEDDB3AEB5BF1A0B56C73

SMS_S dvgipb.witopvlhs.dcspngeot

E82EBE1FBDD2856390760F3C9159911B3CFF8A3C643421FDE26F3A27FCB13D27

SMS_S tfz.sowrjb.lxtyhspa

E84190101A3A5D9B297E4E60CB650A5F9B87CD7C3B0FB712A9CFD8D273464EC9

SMS_S jsm.ugwmilev.tmbfuxj

E86B1618D563AD520574ACC5D624B766C029DCA181BB8985B68788A2722B9C1C

SMS_S qaxi.bedzviy.mzaviqrtlpsw

E89EA186B98CADF89D8E39719DFECA4ACC9BA5C63D70B485C43148E6AFEB55A1

SMS_S cbupe.dbozpmanl.jexfsitapw

E8A41539254BCB0DA76242B5F0914C4BC05E8988BDF34DE0F205CFF8569C41C1

SMS_S ofmjsq.tsjukyeqo.nudekm

E8B96DFEF5863AAFEE51E4D84EED2F808352FA11C4CF0568B9FA7C2C89401B45

SMS_S ecafghs.qrsmelwt.iuxb

E8C84C28763A98F1E625DF45771E36704DAB6386927AFC46D958B1109C764A33

SMS_S mwlj.lvucfxawib.hjfezo

E8CCBF8B9A865D24EE253AAA25F787B04C74B87FA02AE17BE685EA1012EFCD98

SMS_S tfcbnk.cmzwftu.jqavxn

E8DD62281EB0EC0B8FF777CA3DAEB0E1414F93B6AA200D47EBB691DF719AC615

SMS_S vpz.eymngizrc.dcuazgkip

E8DD897CB00A94F2731889641BC978FF3CB72 SMS_S nrdiltf.hfrjkenm.kaypiu

Page 288: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

88782FE1CDDB9F918AFD1DCC74B

E8DFC66E5C049F0308859CB0712E69B23AF5E48915D19EF00709703568049139

SMS_S flu.gvftaemswo.glsrf

E8E2494106E0F1E76257E3990DDC72004F0E4C2CF762E1B8A31F55D8DC7AE427

SMS_S boxz.dngsuhcj.hmry

E8EA10757026D60229C18C2AB603A9B043E3A9358B3FB1149730C8E0AF452A79

SMS_S iau.pvyilgatze.uedbntifvzp

E8ED9FB40387FD032FA21B52291CDE5A74FBCB71504A199826774E0B605E89C0

SMS_S ltdum.binklp.iyxe

E910E716F37633D90F62CDBFDE76C4F7E34C3BAA3C232783F30DFC3DC4B50A7C

SMS_S urcqax.nywouslbf.ruqwzlnxyhi

E912CEABDDEDDEB04087629AC3D1E4FDD0B123A43FFEB2CEC5E0D3AD949CC0B7

SMS_S hiytm.nhikeqd.faothwbjymv

E9138CF20F91BA69145F5420412CA8743972627CE57AF2BAF33EA7E23A1EB5AA

SMS_S xrn.ohiznfau.ozqausej

E924295942D2F31B9FFB0D689774327B2F46DE05999BE683D52C0B523A535398

SMS_S yhr.bxyqjsk.wvax

E93DEF1F1007ED76084596972CD42FDECE64A89C939315FAC87363A1815EC4D3

SMS_S efrldi.mdanywei.nodagvtfj

E940461E6658079B387E587737383DD215A1276BB84491292E8FE2D258C3FCE8

SMS_S jkp.kmcifhwex.pidebxsukja

E945362A7ECB62BE54B2649F23D938265EDC5A04590A94224B4DF849C5CFFD1D

SMS_S shblky.chpyzg.gxbyksfrtui

E9453639AB7BEAD1833707285A285430C6A97D0CD124CEDD66DB90D9082A18DA

SMS_S grkqouh.ondmskzr.yqlxspz

E950D54C1AD8DB5BF892A224259A62EAA6A3C988FBC932A3AA85269C408D1F38

SMS_S bjrol.hmsnaliqwz.wieuhgltqo

E97DA1E1E98FD8F47C065D36B8893D12656844808B4DC3818FBF826986638C8A

SMS_S rvkpxb.kmwfbn.tcpevduglr

E97F911CAE3270D042398463B67CC3028C8200C733D57B4F2DC924D296BA52AF

SMS_S zvhbma.grifjbqdlz.mgncs

E983613E36F9AF9A916199141B8BD329E7D5D5ADA315F2C7B2C3117AC9609784

SMS_S jiy.bitfxdleuy.crdilzws

E98CAAF2CDF4B6938578CFB1404CD1BC942828D626E3CF1C92212B7321C59667

SMS_S cjvmlh.xinkvrm.idjynr

E9B5E5C2F08C56A6EB871B7F44E1CD1CA2A07598A29E999E5338F1EF4B8B2309

SMS_S jhyvk.lthscgyxu.ckdgjsv

E9B65E6D8D3070AB1FFC7CBC2267EB9A627D1BB2D8CAC11791B50FC43B479F69

SMS_S ahsq.ugdzmsbcjv.epsqba

Page 289: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

E9C0AE80A7BE16ADF2A27D893DD0622F3E726FD1DB75DF8D98A2697A2BBE08A0

SMS_S zjempa.rvqiztpy.ijgew

E9C2AA1FAEB2FF38398AD61850B0CDD6B830AFB03F844D597A603C3AAF751C98

SMS_S slqbw.vlbait.onir

E9DF3C7C5B2767DE1AB93B878BDD65292EF79CF109D63610E4F1E1B2DF9E1F20

SMS_S flu.gqpcemkt.bdatz

E9E47DD764050581375E898C6B5C924A81F5736D40A082D854D00BF8069E34C3

SMS_S xufwa.qkzjifae.vcukaiwlby

EA08404BF4B92BD1EB67D2FF03978CC2DD412CFA8894279E04A9C5E1404DB612

SMS_S jowkum.kbclxyqi.bsojth

EA0FF290C5C3560BA9EA77B043770E5E57B46EE67158071C81C55D5A985A712E

SMS_S sjm.rcknjdvo.awxg

EA2DB1CFAEF5D407E7B66FE68925F3195E65EEBD845CD4F5D2D674A3BE287722

SMS_S zoesmg.wufadgbr.htanqwx

EA2E8D5438CAE977DEAF4D79011818E38EF449DC84C34D396C63612D7465C0F5

SMS_S zbyromq.dqigfvsxwz.icjgkfert

EA34A32007F2F456473AF408DE14ED330E4192EE468EA4174285121D68D1888E

SMS_S pzfx.nxscjtagd.zlmtywhnepxb

EA36A7ADE524D239236A859736B99A9422D3AC58B32B702D0E8E0F8BD1FECC68

SMS_S qerz.ojawqdsru.lgsar

EA59E380917C1F12655656FF30125C951DCFF44B7BE5565D8BC77D4BEC79979F

SMS_S gvutw.xijslp.swlzpjo

EAA7D18A3ADDC98A87C831CAA08687CFEB8F43E7034A6BFA46A070B597613205

SMS_S otpj.wpmuvxfdnj.wymjduhalbv

EAAC697DFA3286D5F6FDB55B5D9DA5B6CAF3EDD4BA03C2D361EC9B5962C371B1

SMS_S xsjvh.afmuvtojcr.klznmvat

EAC2E6473B086A598E6417DC9D21953E9220A7F838AB14BC9428E82250CAC449

SMS_S owv.irzwgemt.miyfjkbd

EAD8835B2D8B93E192EADD7FD6D705C23A9C4824B4CD049D9281FF2F3AE10F4B

SMS_S outs.vbjxotk.nwvy

EAF241E5DB7F5B7B3F6E60FA16019DE6110F5B80DB4CDB2E387C8EDE9214F18A

SMS_S zyu.bsfadvg.voefs

EAF4A57ADA02F45450A881E44BB83B1F41630963C837E5732931FA0EAD0133C9

SMS_S azhrkfb.hrqatfocns.iadej

EAFBCFA7E19E518862E0D1EAFCF0873B9B3408B3114BA0CEBFB998388659B14F

SMS_S zxglw.dgwhfu.qzntlu

EB0B38B0FF99011CFBC5F9FB2056C01B728F41F48574ED6A913E6ECC0DA9529D

SMS_S syi.uropda.oinfxc

EB0B843D12990FC43ECBD89830DD7E16D0046 SMS_S ncfr.lorfxd.aiblhmopwnrx

Page 290: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B6D0F28B172DDF8CC28B3E003AB

EB22B26AD52BD89085557A5307B20E01A89AD4B359E5F851EBB97962FE0AD9C6

SMS_S rjhsgbz.emfdrw.qhpesizj

EB28F4809061A2F148E9649961A51457048F04D152542333953F4390566AE54F

SMS_S tqlpkxj.vxzoygipt.fugqmcb

EB336631C2F132EEF7548DA433301C3C44BB75FFF1B57186C8F5B9E178D089F1

SMS_S fok.ojmnfgsy.tdvl

EB3BF2FED0207BCF64D11B1933C749A4300D6C30BFF5E0FC15348F8E88A5FC35

SMS_S gpkqsij.rditmn.wojdgiu

EB427106B9EDB647E1C5323A7D78D8475DDAFBA30B36FA1C09285F799105F104

SMS_S fyqovrc.xnhubsw.heir

EB68E259913C887E0D2BF01666A1E8AE7E4D94E53F73CF5607059B80C6D6AF1D

SMS_S aumd.xzkmtvi.maeqg

EB7194F0E2476760867F0FADD48B0C7E52B390961FF589D9605883221F4E68DF

SMS_S odk.qmpwkln.riafomtxzwys

EB7A05654886C21D702B724547BD9D210B34389404691E74B224E5096F1F23BE

SMS_S kzlqeb.squfwvahgn.wauesfj

EB84D74E4BEF96A5F134C6286E5DBF45E850AB6B209BBA1DF1E60AA8661D47C3

SMS_S temjckv.zbmgvht.gisar

EB8A2236ED6192BF34AD6E63CA6A1616FE1EAEACED80146BE9980E54901D867A

SMS_S tugna.wdhzolv.cmstgvb

EBA424C5FA3FBB6C3459E8684F8FD0CBA3550CCED81634B9E3D6923D5D146667

SMS_S rfiam.yevrau.hqksrejitm

EBB2F4293BBAB35FE4F2CC5801C4D9A8FFB4784E63E35F0B21C4CA4E8825B8AF

SMS_S qdgr.vokgxce.vlcpaxfyud

EBBFE31E8FB068D426B30FE16AC8EA1B205CE195401A681A972C59E4339E9AD1

SMS_S eolw.onklhbetd.avyb

EBC7F0AEF69573C807B20C888BA491AE290386649E24EBEC94B0AC47AB6580C8

SMS_S wropl.ixhafjqmdv.snaxlv

EBCFEE7F065678363D5F9C5CFFC22E27C0A70037911289B6D227591B4FEC5EBF

SMS_S jlxi.fqnesmcz.zfgx

EBEBCA05F074D8C42A63D8B706829C5FDD2F823EC70A798E312D0DD7F95A37A4

SMS_S gai.jeibuclpn.cuybh

EBFCF213041E902F3A2FC0390AB3C24D84EA8557AF7E5ACEE2C5603A3041192B

SMS_S fbjq.qxrpzvgof.tadgqoxiz

EC01F45F9649F318101870C893137A5C9FD185023537B2EAF129211096D434AD

SMS_S uobd.fqrzdic.itgpejybro

EC02484CA51055B3534B3379F45C17F5009278BECA3DED83B1D82832C563AA0F

SMS_S znxifp.zanyvif.qwuim

Page 291: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EC45106667CB108C7205098884D4E273D0DBBE6070410357DFE3E473FAC6CDBE

SMS_S mfnhk.jrlfgt.xmsvfzyrjipe

EC4811C5AB13B36B7924C886C04DB4FF4B42DBA54B5956D79D3601F1DCA7C6EF

SMS_S skun.dhcqnsomli.uodcjgwxah

EC732F6A4043E30FCF42F127A7EC717808139635018DD3A56CDE68AF0810B7DD

SMS_S njme.ghuynb.scinkpb

EC9323A88C7D9EEE999044AF942DF46A221115797E09ED235404DCDF9BD35E12

SMS_S hol.fmbzwail.piae

ED00A18CA78BA2BA35116F8177FED055A2C806DD048AFE520B93174420E156B9

SMS_S xzoupbm.xfmbrytidv.fsluowh

ED32D472A4033AEEAC09CAB5A1091C90E14DAC5EFFA8CD0C27205632FF9D7D03

SMS_S ylne.unvmqksba.yvnfroauqwbj

ED3B5AFE0DA13928B481E5C35817033E1ECF3B6AC4A8C2801DCB054564496330

SMS_S fyvezmn.efktudjis.cblv

ED482E4B04299A1126CE472555941137CA4C752BD12869849CD58A089DCBF5FD

SMS_S fhw.vldiswag.glrm

ED4E3A8C17F3E6FED540F35BDB60A8F0B1CCC76A980B0E12D433055CA4A381C7

SMS_S vhcqoj.giupvtjlz.bkxcwome

ED675AE3869B6F41802153B21A89C86E94D8D4E1647679EC6D4A3BF4E0EAF8D0

SMS_S uvdt.wfnhlupoa.lfdpzmhgcqrw

ED6AAFC325AF7D244C98750CC9A35EDAA2688411365EEB61A5E6BF9A959FD021

SMS_S iuwrmn.vxkohs.tyen

ED6EAD0C24FAC18125608578BCB1E86326B2D9D68040EA0691917C7A7C394561

SMS_S kernt.dmopgsw.cxfsb

ED7427109EAD684C69E4771BE86CDAB2EA588DC6F6E9F838EA77C8C421E7BE41

SMS_S domsng.talhfcu.naexkyhv

ED85323DAC2743DC55554F355311DDA2A911B2A6996EB5D077AF447869B530E6

SMS_S tzlfrp.zbfger.gnjfwz

ED8F0764ABD8A6CA0E14B00F92D875AAC31869845BC6D58BE61722BE3B772BF2

SMS_S lvkdit.wvnyua.gkrazetfd

ED9E9B90BCEA9918960B29D120E1F7254D99D8333C4098E122BD186D9C273FB7

SMS_S ziok.lmkewry.znsk

EDBAAB18388EF7273234A9EC34103B808C8405E5109737F2A47337EA95D5DD58

SMS_S ehd.qhgvcrla.jfzmrgad

EDD0DBEE74702CC36E4BB410561C625360BAC85F1627A318902AAD5E2C6CEF61

SMS_S uzr.jekslupa.jdhknmxsvf

EE06F0FA870A4DBC1D8E5729CA325D63C231A6A0B9C344CA589EE3E63AEC2FAC

SMS_S gsa.wcszmlub.ocubmlfpnsw

EE20BD6AB2EEDD3BF8991D02106BFED0CD127 SMS_S eyupfni.gdfmbqn.aynkcwt

Page 292: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

52476289C30F1BCB93AC3CCAB1B

EE3DEEDA4AB2AFA93CFF68741A272FF263C986E6D3D43EB6B026EEB19E50916B

SMS_S wagb.hfljezb.dnymojvqr

EE5468E75B076C0A4D969DCECDFC3F97C565F72164A65C9B53F685ABB901ADEC

SMS_S wrflec.zkrpqgv.idnovq

EE5A78BBE9EAA6D20271FD70F854793BBA227A00FE05E1185A74B2794F78247E

SMS_S xqp.utpvhyalfs.iygzsr

EE7894A485CCAC50A45B080472ECFF3CCB4734C24FAB6DD7350FBF16B09A0BDD

SMS_S kjavql.lqvcfgwrb.rshdaoltcqvn

EE7E243B1F503632F95ABD1FC31A06B26E399E90E3268469B967CA54205DDBFB

SMS_S jsdurp.yixjvdqpga.hqmdwb

EEE73308B8BD8E6134C1183F1A3B1F1577EFB3D2E6C128601DD2F1BAF77F0C53

SMS_S wvf.thpfney.ryza

EEEA0669A0CC439C1ADC6FFC887111428A9C848BABEDB719D613086D61061A5A

SMS_S wjzvqgt.hzxylvk.fkucrox

EEEFBC31521F1B4D71C0234DA06837CC3A7C58505EC6D777B7624F606753F0C2

SMS_S owtmgsr.qyeprb.lbrkqxcedon

EEF46AD1475DF3D8D1CD2533F51A0CC5FD4A19A27F0B722D1499D4C2E14DF196

SMS_S vyofisd.yjbcedvpz.prtwuash

EF1560DACE079CA0FE752598C76201C918EB8316278E89ABCF898DDB1BFF79E2

SMS_S flqabw.tyojgfvd.pjnqrcy

EF2AF16E6573D7468944CC0C21011FA0F7B13A13ECF938E6F573CC6131AAE265

SMS_S aisj.wtcxvpq.zdxg

EF3C9B4F1194258EB36182E7BA9ADDD4C7D184A7C508A0616BC5CFD2FD20871C

SMS_S yvtajb.enixyrblz.axbcosm

EF428675BEE32E8737BE93ECD4F078C83EA1E1E30F5B5F02664C98B584943B85

SMS_S rmhqn.iejtonpd.qsonzhcrew

EF4BB5D86990660DDEE5FBAA5FAAEB921300F2368D3024A0ED6AE28AE978117A

SMS_S olag.mzbcnsowj.nwoaty

EFCB562D1EB4A9066C5DC687A47F6E1C2B8CDE2B4D84600E6404D1BBB6C75A10

SMS_S nwzedgj.tjfwqcehkv.zrjashy

EFD7C142436BE8A42228BE6FF75D1B917B5D61BE42570B8D275AA4E3FEF2065D

SMS_S grscyf.cmjgre.ovnp

EFDDC5659DB8B73F79A24241B1D133F74AF1DEC6506BF06E834E1F76F89353FD

SMS_S ygdb.zlhoay.agyveh

EFFA1BEAD8A4B33A67A6BFC19DAA620AEBCCFA0B5260F8E0AAA58A19D1095B0B

SMS_S elzo.plumrbe.msjvzfwrax

EFFDC23311790F0FFBA7E1E3B5ECDDFB67621848D1BA2AA1E17A431DBFAC07E6

SMS_S wmjc.oiljcrtqub.pujwsmcn

Page 293: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F00654F5519D2B14945C67459800DFF938157080DE55609A74EEC7330A981484

SMS_S nxpmt.lmswtcpbz.qjxty

F0223A4218F8706B029018FE8B743519BB28CEB66637A59CF43382DCB557AF15

SMS_S sah.jdfhboyzve.rxjq

F024F3D575384D5EF029A1383025BEE2A2F96CC2E7FE8018E79046CF63A1E83E

SMS_S mld.nemxogy.chimedlnjgwa

F046D925F190DD34343614D3A611617F79690FFA378A9D65ABD1229AD076ED6C

SMS_S skicxde.bswcuvhr.aziuh

F088ADEB69BA5BE0AF2A7F77B039604012EFADCAA9061CDDD2E5C24099BEE85D

SMS_S czmkx.cgpriqma.wvfmxrhu

F089431597D26B9284BBE06BB6BE2FF829987219176D22F9E2E92D17AF3F9BB4

SMS_S upgcz.anhudqift.xbse

F0931B7563ED132C911D2B5F84D2E1C7B57A0A068DE793925CC255F5B04E6645

SMS_S xstevdl.nbczufawet.rpdgonh

F0C150C1DC57DDC5EABAAF70CA9FAC8680A1CBA2B68CB0D703EE7E5A805B779D

SMS_S pulj.fypwmlh.dktjmscbr

F0E54E8FCF4C2EA6602FDAEE4E6ED5402FA2962C21838353D45D7A0BED4E3E5D

SMS_S rwn.elvdfh.rwtyhugoif

F0E9B7EE2F70BDF221AE2156BF3CD2F0FF564889DCBE3F905EAC544EB09B6339

SMS_S oqarumn.zigtavfc.vhdpljfuc

F0EC9F9C7AA51F3C9F5A6CCBD8798163E9B6DFF9E0E6AEE415B7803B857ED8B6

SMS_S fepjm.ryixbeoucp.tmnbgfhzurd

F0FB0F7EA670A6CC42D2EA3BA9D01F7E242FC337875E4189EF2CC618FB6B03A5

SMS_S xvi.jctzvlgy.qywnrm

F102D8DF5B581034BE0F9F55A5868EA7A57AFFE8C6B3F10419D4D8A4A7830EA1

SMS_S efspniz.xqeojwzhay.bpywkorefhv

F119880DED7FECFB21F44C4FDD9EE7A60CA4FA46A8FFF25566F22022975D54F4

SMS_S ycbpuge.wcvkgzjoiy.qpnjofzldwyt

F11EC19E9B5FE230DDE5E45242742909A4495C8252A32D398B2F93FC2095BCCA

SMS_S xcntg.kantbmhqur.qtlmoypivsz

F15247679A7CCF967DC74B7F336F165C9C75F8E5C208ABDD0799F555F352DC5B

SMS_S uqixfg.motqervky.zwmoy

F15C33F000A06371FA44F1ACD183CDCAC644D8DBE91EAEC2398B9ED6512279EF

SMS_S uytcfe.afejtp.qzdafuwmj

F163103A72064E7AE2A1B1ED95D9CE9BE0C4FC61AE79EC7D7A9A67825C9AC176

SMS_S dljuhn.dexwbgy.olifjpxercva

F1726B8A0B0611003DCCAD4A50E8665FB67CE3626C480821534D76942DBC072B

SMS_S ctfmlx.evshpdtuw.rczybv

F1769E9B55359FD32F8439C675D71F1E85F023 SMS_S wiktf.bvinptd.qsgpbltcv

Page 294: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

11B43D77FB15F32B6DA8B1EFEF

F19EF495AE3B5CF85776A1F0509FB6302E239A211B7E98A1CDCCF3FEBBEEEEEB

SMS_S umc.twprvelb.rtwnoqpleab

F1A6D3345F48846D7433F3F5042F308C3CB5C542DDEFF4592769FB3702A8B0A5

SMS_S awz.odmzlng.yxnvhidjqus

F1B24B6A284E2165B36E2D3B3470F32880C4D55A6E4B127463CB23ECE31A366C

SMS_S oymkfz.jgowayf.wjlpostbnzeu

F1B5130DA06A62EB4A5CCD1E31A0D5CABE1C0CE5D5F817C26C5A1BF42EF52DFC

SMS_S anmlfyz.hegntqzlu.ikayvsjuh

F1C549CA08AD8BCA441006EDD007422FF4B5262BBFF2BE91D599A6093641538E

SMS_S udlbfhn.xrizkvgfu.kgqwfv

F1CB84F054A5795DAFBDD5400F7E8A28073AA22F741C387BF7CD0315F1D3A6B9

SMS_S twoufa.oavfhj.sawty

F1CFEB92B0B2E2E307D5904E1B748E38CBCA712EAF87D3BE2F0EF5DBF513F31C

SMS_S nch.lbohugn.lvepqbx

F1E0B190FA2D3959733226FD1279D510E91D5AA719D85B4D522DACC8E8A09640

SMS_S zylgn.mbwoinh.wcgx

F1F79D1D5186D99524886E8F2D997D16E1DEED5EE4068A6CC165B6390FFF6D6B

SMS_S iqycgzf.kztvam.xkdzhlaqp

F213BF87E23BEE3ADAFB5562C0220CF498FDE34F1AF72157D7DB31B33719C3F1

SMS_S yhgxfj.xsablhocw.hsayumdwjkge

F2290524EB4517D4BC3EC6FBE6A5441928B8C2B1A8455F368EEE429AFFBEC329

SMS_S mhzgs.btjwzmn.pmsvfbnkrjc

F25C7CBCB828E73AB8D2F8A6646DE01768318519637A66C7E01676DEC8B04E2A

SMS_S viefbnw.hdpqtyva.mfknw

F2A2B9E7A08065375CF0AA97B49087309AEBEAA11CDA124EC67EEF56ED6E230D

SMS_S hoglji.tesfgdry.jtqsbpziok

F2BAE2000D95D0F97A35D223ECD3840A1CD4AD81E07FFFAD90FEE9F1C7D0DAF6

SMS_S uizhblg.swkeyzjxni.wcirskun

F2D6D6FA6B721354B12C466D8167FF2FEF4E991AF86AAF6782BA8B0C56965373

SMS_S wvchi.pfgmysw.oecvu

F2E52BAEAA9E701EA4327B1D17369AF725A4C426C70FA1381B92F8244FD91024

SMS_S tdlwas.atrzkqwls.eihmlvactusj

F2EED9F8A8BB69367074ACB4A98F86FAE7410CF487CF8C80491DB211A6D7CDE2

SMS_S iwzvjmt.ofzbknq.vykopwfanbt

F2F16EA4E83F832C9EF3F2B58E2CF4E2137F3AAFB78C488ADC376C8F59A3AFCE

SMS_S qyi.nhrdwz.islad

F3166AB833B4B5F9BCD5795849B0A392B662D248340F62D10175D4F9840F55EE

SMS_S qxk.okslrximj.lxpunbfqwis

Page 295: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F31DA8FC050FCE7D1D2769584E851D13D17A4B964B5B9285DB0269BAC7B46B46

SMS_S ukesal.rmwyvgkuc.xrpuayotfjl

F33025CCE8269B555A96204E97146D9D379AA6A1799B38A112C8C409A08BADF2

SMS_S osumbng.twivoaxyn.liheysz

F3315377E62C20AF24ADA370B2B26808150B55AF2571E9851F63EDF3DE858523

SMS_S utgjmz.jpgtoqyd.khclwbx

F3333DC8D9AD7139C0510E527AEEC457BCA9B932C6CFA8F5B31DACA9B51F6B3F

SMS_S mcgbfrv.uxjfaklv.lmyfz

F34E3CCE04DFA62FE0703881C80811C2FC37BCBFE229EB026F95A78692259C83

SMS_S lfy.suohzfkl.ylfumnqrd

F359F23A0C94F3F14AC3AF7C5B4B79349BFBD6D146BB2B7AD8653AD779936E3E

SMS_S cklj.snglmpjovw.xbnvwkpzeoli

F364B6B882E51D2F69A1157180B518F0ED8307A5B4F747BD5D173C913375A510

SMS_S ulcv.finexs.phnxuglzcjd

F373FD9BBAB2011A5A4AE9D5B72BD844545C8C1CB051D5EF0CB5F39BD1300699

SMS_S ufjyx.fuxqgpj.cpfzbe

F3B52D5FE8D45B952477C04CA33DE8785259B6ACE24386A8004A790F0653E5ED

SMS_S nkrexa.mbsalx.hstgo

F3DFBEECB0FB41DEDD65FFB1D234B01F67B01EF45FBD11B04B44008C658F4486

SMS_S slhmykc.rgpestkwbh.sbveq

F3EC5D031BD047E28C6B9A90956DFE253C317444A449C63BF2750EB4D9C13658

SMS_S ukivo.dpasjzo.ragi

F3FB0869243EDF6122F3961408E341D21C294E8FB563864CE0DB7406829DD7B4

SMS_S iudrkj.cobdwhxq.cljqhxyrgzd

F400490E898F173460098D33DC846439994BDC50F447AE96D5371A0989567A8E

SMS_S phwtfv.hiwqutcr.bndulvy

F40312FA2689B09791559121925AEA52D49CE1238B2C2CAAEA00F8EB04DAB04A

SMS_S eiftc.akrnedvmu.zlmv

F40E3D4DF49292A668B57DD14073B792172725DC74925EE5AF7475F4B881F244

SMS_S rstefcb.yupcjek.agoty

F40EB84DF5B86079CE8630B29ACBBBFEACFF0974A359C74C2E51971A0F9EE2DD

SMS_S nqva.imayueo.epfqyx

F417B4AB592185B080B16DB13608417F9C71EBB94BCD132EAEFDD643A5AA01B4

SMS_S dcb.xpibhlf.qbkfmah

F42C769BBDB9B7DFF6F960139C2D1215424938F3ED3E8DD511F79D7D8A0168E4

SMS_S mbngyak.qljdnh.qzcpdihwylg

F43C7B278C0C401C06D9C3EA10AA6AE48F2BB9A32A46F318ACEB95EFB7E9EB09

SMS_S hjksmn.hfwsuq.xvkcgaodl

F45310BDDD8C90CCE38C31F67744C4854B225 SMS_S ush.yvbkjcq.rciyvzh

Page 296: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3738EB0BD8FAB18B9DCAFC724F5

F45CF81836636CA9BEA635A96DCECB0278E2F7AF8F2978EC710729FFA5FF21FB

SMS_S bgtqd.wdfmry.brutiqcfamdk

F4623C767803F1B8862065EB4096DA2D52A9A9878C35D5567056118234372844

SMS_S qnlx.vcizwx.odbakxjc

F4699C6492F3904832F7CFC8D0A11289DDF56D4B42261DB2F687AFDFA8DF2EA6

SMS_S ekrdai.ndbcrowqyk.euck

F4847FD4B9F6A0028B0901627A4DA9276F270ED5576D0EE3933C5B3430CF3481

SMS_S hjzwsrt.muwclfqb.izwrvo

F485B70D567E90B8A6AD22BE89D264428C794A5C6307BAA7B82435CDF8312DF5

SMS_S zcw.cyaxsuleiz.mgzbqrfwacyo

F4973CF6D7F23237CE09FDEF9FF7CE46441050174D8823F491FCF9722FA4D27A

SMS_S rxkzn.cnlufqwd.ztewdp

F4A95C5ED9E5A8F7049CF5B4E3419C9FC8E0E6A0DEEA17EA965DD360F01B8828

SMS_S ucgpv.fbkwrsyaqp.kftd

F4AEAC9A733F4D44933CDF63E0C23AA0C6CF02E6B69CA8E28BBC22835897757F

SMS_S rjmuxtf.msuedh.rexahzgyqvfn

F4AF4CAAFCE20413D3836F4F3769C9C01C0DDB9EA288D6767CF9D002C962C372

SMS_S zpmslq.acrily.aghcb

F4B573167A4E3DF37B2245FEBE6A062E6F0B514B00C0060A0ADF811520C600B3

SMS_S buign.uhbyktoe.tvjkpuorxqh

F4B6E7E486C95CF0B5218FC88F024727F40D86E2B0F77F052657999AED9AF126

SMS_S neyxq.axhglobeks.zhfkrnlxev

F4B99D50412EF5D7CFC34AD39FE6071A5F509DA10EE016036F0E52D099B4AFC6

SMS_S edvtpil.sugnrf.qbewc

F4CD30FD523A4BCDD7D74B55876BF327174233B53E20A23B68E0979686F96D0D

SMS_S cdvznga.tpvzgmljya.ybzvrjkule

F4D74140AE7F6453794834485654E2984D29EFE22587ACB2F14516930C9FE412

SMS_S ekm.tibpywrdle.ltmzwndacxsu

F4DE5B9A088CD5E6E07AB52F4700D3DBF70E97EFDAA62D24A26E37FDDCDB4E3B

SMS_S olnziyu.fhoxedl.fmkewzhypbrt

F4EBA7E28F568E0AD14B0397A4DE6A6F1E79F3E41C391E357A1A17729FC29794

SMS_S nomqh.mfyzxvtenu.oytflks

F4ED6EB4A35E7D22A875635411696B25939FC863BB77C877959F11BEEEBBD42A

SMS_S yloeb.tviblh.jctn

F4F3ADD924E9310AF0D67690836973408AC3720F9CB0449F958173BB070A75DF

SMS_S ivo.ezawov.lyjdagfuwp

F50C1D1A3AC259B27C94B5986D1810CC46578EAFF51CCD30DA04CFE5DB5B9863

SMS_S fzrmung.brntemwol.mrnqshb

Page 297: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F51A1A1B79F03EE3D3C6F2821A518578AB8FE0D512DBD090E0CFBFA861D0E17D

SMS_S jbcu.mbehdqtwn.menvgbijho

F51F4C0CF54CE17BB7D9E4FF67D1AE3CE83E6EAEE4F558001016D29294C4CCEE

SMS_S hktp.qeutgmlnf.lbteqdxi

F533024FE993551E6C8F8C754F7161FCF4F80765400FE6C92C4C50D21E3481FB

SMS_S vrisjua.ivehxum.ztvlypoe

F53691E71174D3A2ABA039625423BF9519658EB59F7F3F06A42AEBE5E44335E7

SMS_S davfpt.afipxec.lfrgeviqd

F54BE68A97827BA06C4FC603A21E0B35CE2CF5E9C3D3C58E1D04288438E3F81F

SMS_S boywcps.prdnhaxl.lamniypwfrzh

F555F8349F1864854D261B2630406B79F62D70AB86977C329FE9B378411FDEDE

SMS_S fukjhlz.tqdxbn.cmhfueirtqby

F5777B001EFF36AED1FA501BF4BC1A36484B8794E057652EA3CBF698DC98EEC3

SMS_S ftwuvn.wqfboegu.kgmt

F586FA30D655C1D3F3D74AFC3F57875D9CE7C91E3470B69C8579E87C99A8C411

SMS_S sideft.dscpiw.jestiwd

F5A8C041D9C5F44DEF463568BBEA6C11AC29BC46705B4D4ADF3C2C338D7FB9E9

SMS_S kfzi.tgfwqkix.dwryhkqeuos

F5A9C65EEF0C207B99A7E46C382222C97EA0EA93B78A1BDD3B2061E5607A088B

SMS_S xyijb.nyrtxgbu.avlhoygkzdri

F5E0AEB4571F1585B9330C5BAA4F6AEA3F2AD6D51EC57DD02E3C17842E4D60FF

SMS_S nzw.exqwlnzdv.zkjtnyof

F603ED6B689E924D5697B78B5CC5B244708E00ADF94D666B6C1603D99E992490

SMS_S edkgaml.vlpjoca.lfxakvtmz

F60CC796D0BFBA0F84086D1054CAE2C7DA6BC0171359795774DC734A951A64D9

SMS_S acnksl.uzylvijb.ukofeh

F6127ED2538FD7B6EA07579AE0B99AC805C0C7D6CB661BB90D6D86F145CFF647

SMS_S hzcmdul.jkyaovb.njwu

F61637DBE7C84A0168C8F5D70C0E458BA3651D0EF1CAABB1554508E2A76F0D33

SMS_S kdyjxqo.sntroeh.gyratopbcjwi

F620EA0EC654CADEED622CB37305BB9502A06AC01656917FE103273427AB8246

SMS_S mudeagr.noisfdjea.mdkz

F62204BB294FA6723DA81DDBB2E54A531F046E50A5B9350047395DCBB6674048

SMS_S gxprd.rwzbia.jdofwqh

F6277EEE2ACB532A6D394B20EED6A382515B4FF3F07CB29C02E572C8F59F21B9

SMS_S zdfantu.rvfdmaozsk.nofpblt

F6495B74BC5C72FA4BA2ABB1BC65B365EB33A7E94A226849578E50A5D2E8E596

SMS_S anvxo.vyxrdat.kvhbte

F64C2E4D65B1D575F954C3C04CD808B5B7356 SMS_S dtqyfeo.iyswlf.eprtfswukzoj

Page 298: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5301A67A5B5B389CEAFE9404F99

F6634771895F5C2BA114308DEFB9045030E6EC185DBB962DE57CE58A1E10C049

SMS_S jbm.lhqdmas.plqgj

F6701B859D22862B041F719A5F78A835E0A9D7ABB7253AA95AA140571F807515

SMS_S gvo.sewvmp.wxcqmfzk

F67C9A6FF094C045AFAF7007048F231D855C6CCE0B7C220C48A95027353EBD63

SMS_S pbgrj.oxchyl.uqct

F67CD0C462F2245A517E6BA39A88728BEF598590DFC803505B9F8477C3BECB88

SMS_S aktfcpz.ijvqba.fhaw

F684B351907C96453B95E439F5EC3E64D97597C88CF2BE8FA44B0FAAC24D5C57

SMS_S whjcr.nkhaxzmqwt.jfra

F68533E2D9AEF4958EA5D24DAC9C0E75C4367668EB7559310D82C7EC2759B7BA

SMS_S uhfnyxz.uwpjcf.hpfwtldirx

F687AB2F2E3FDCBEA36B3617A140BD959C7D3819D6190CCB00F05E54EB1F8FD5

SMS_S mzrxo.xuacrz.plbct

F6920293BAB53C31CF2F4ED8580949DA8AB64115AB5AFD28FA84271DE640080E

SMS_S ypu.svoubchyde.zjqfsyc

F6951386974FA39E5FEEADCCE57B633B402A4C3C640FEBA457BC54F5B76FD7BE

SMS_S bdauxoj.amryctepgu.bzytwr

F69A37747D39922106A49A2FE53C5840C0B13253B168F4274E54793F7110061C

SMS_S vrwxy.nrsxljpkma.epaxfldo

F6A4F473BF2019FFF0AE809D3F107CB58A11AAF0B0226A81510E8E6006D37C95

SMS_S smjokb.pdnlsjoc.ychmul

F6A914058C75ACE369654CBEE0CEF6832C022CBD58AFAB8BF0DD5F35A6AA1541

SMS_S rhcjb.hfxezm.yxdshlefvp

F6B1F418ED67F167EC765121B6E723A5838005079074FDB1FF4B3C66AF689C78

SMS_S wdqtyg.klaiwp.hqbcrjat

F6B2421B5D3536F0C00422D030628CE7D06B842DEDA2D671F9096172B0CB1FD1

SMS_S wjiqc.urqwkocems.yrdg

F6CBE97E1A6B68F9F849E360682F66F7E8328E1D050226D7F78CB161823D2A43

SMS_S msu.dwxety.ryuxc

F6D30A56997825E788FDDD7BD88A8F160DF19F806952D38339BE9DABBDA88972

SMS_S myrfsd.duhejqb.hfjnvt

F6E2A7F5FA4BC60FF5A6A748D40A2A9B1DE7DD1046BF79E5C5C76CFC46240937

SMS_S kqyt.badgcex.jbdqtgauyz

F6E375B594777047F713832BB90287CF7EC4B95857A56D775A324BA255F69EF8

SMS_S ucl.rctmifgqj.gynvtlus

F6F45A62A73F9F66C4D22806E88ABFBD1D59E6688477A87CE7EFE3A28A3BBAF1

SMS_S bgq.haboxrne.czgmpbqiys

Page 299: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F70463E721142946A010A5AC52BD7F0CC44401CA8EF8BC64B245F45949377F67

SMS_S pgunzq.rkfypmq.oltvjuaek

F721F5E7E5F9E88605F7150D34CCA067362E450D51760ECCC0CA683934E376CF

SMS_S cyuvop.trjdkwih.zhtnoyvpa

F7249EA4F9748AC3602A3AB7518A50351B8CAE9792928FF4375923B2C056FB3D

SMS_S guzjo.fozheygs.ptqvyhkma

F7319BCB8472979FD5F67CE446BFB1234DD5B86442094969C4D72A52D1D17367

SMS_S cos.misuhb.aklrmzjbgctx

F78B25D6A5ECA6240D27F733B05ACD8DF1F7A922F434CC2FA0C0A5C73E56845E

SMS_S ahzkr.swvmkghu.muljbtr

F791DD420E816DAABB25B2858BE1E8AF2D55E098994A9510502919E53FDB4797

SMS_S ljs.wktqviod.obsep

F7A282ADA3B610FF1F6DBEBB5769BAECFED7DA77312EB02EFFF363E2A3E0B453

SMS_S wpeat.rnclmts.daibneryktv

F7A8BAE4B5213EE949684585871494C051C634F0C112D6055651FC6974939035

SMS_S jipa.dleaziuyt.ozdebaikpnmh

F7AC300EA5584E5F9CF1666DC96463BB27CB97F837C39842E57BED537F3D2EC2

SMS_S bdfq.phzmtsvyn.jebadinlwr

F7B4DC596CD97506DA8BA20D1DAEFE3E7D92A67F17CD49467754FACE44CBC99D

SMS_S asvij.pmvqxfji.sroxudvhke

F7C3C59E8973D040D480C6FEF456F960A129147C15E856D57231DDB2ADEB6AE6

SMS_S zdctyp.ozqslpxd.idpnaemlhx

F7C843FAC298E980AD23BC366098DC08AA73D3FF123E5E483C15595C4E0A5E91

SMS_S lpdkn.floytxzvi.kqnwtxahvydm

F7D03DB5C99833BEDE4F1000210680F5C6775A88AE0002E11E3379BE3C48A8BA

SMS_S uhedij.mhgpldxnrq.kmepcl

F7EF41ADF5A58863B5E3899A759416E8BD0E71661FB5799685A3F6B6D3CE94DC

SMS_S gcuxy.cwgslzofrk.ebqfkarlpwjt

F7F0570135CA145A0F3484F8E2DCD7B06EC3DDE511924177DBCCC534A7495842

SMS_S lmaskr.sfjlphm.belcjw

F80F8FBAF32AD8DBD4C9D69DA23EB6180FD70F663815D78150242734BFA56BA4

SMS_S uspgzbd.hzbovfqt.fiqojw

F864E1CBA0E6D6C45915D298FD15072D710A032B437425BF093000148ED402B2

SMS_S bqgmij.vsiohadzr.icqwfeabt

F865E107EADE21306C07208727A4312E1A81D6B2F4622D506C8894FFC7D8CAA6

SMS_S jcfxphl.xbtnpkjguz.svigqjok

F871CC6BFCE10D1F8225605F7FA296660940C30D16A7454E0DAEBA1948B4D93D

SMS_S zbqths.mqaczjifhn.usgmhjnvawd

F888AD8765ED7FF83780062BB9150CBCDC36D SMS_S htn.gdewluyfs.arnkjc

Page 300: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

BD0B45336312B1F37AA7013BF4D

F88BE0797A3979A18E54F7B424251FECC763E7E2516F9D74F5AADF20BC8376B5

SMS_S ekgz.cjlbmfu.splvkhiwxozb

F895F9DFF482B5A1C2D6589A6B7AFC4333E4B8F1A43B81E4EB5291512AE7D944

SMS_S gwz.honvey.brpachsg

F89896CCBDEB74C698C827FDE3740EE9E493F6F25C2713FF955D8FE961CC0CE6

SMS_S iums.pxnbezds.ecjlkgwfxpd

F899BFC8A4481840673839A5E19A8332E3806854C7885383D8550848E0464DA0

SMS_S iflxa.moxkyb.ojpqmzkwtrfh

F8A32AAEA140F6847A1C1D9A7EC6A877C3CA85001032D07503490D453D5175B1

SMS_S xbehiv.mgqpkjwyec.xwkuyp

F8B90B69FD87E583ECF308C3E3C524751ACD9CAC1468518F199637A84AC52656

SMS_S cnftyz.fpbkgvmws.tbaufjk

F8FBFC22641E25DD0A695A8DD8A45A308CBF41A0C9FE07AF24A564A2EF73AB1D

SMS_S lmqfr.ehkqnbjr.tfjcszhv

F93303626964D21E2FA37B2CA8ACD1CEAFDE457FDEFC4B0059577F6C5ED6501A

SMS_S doftyu.wbvxqjzkc.faodjnr

F93CEEAE4524371E0E40CF02D7EE523E5133973FEC76F6218E860E01BE4862FA

SMS_S raloz.wxyeqvjsl.wnbirsxhyk

F958BEF57AFADA7F6CC9012E10702F5177AEAE2C5DD4D669C3E6FBCDA74D9CA7

SMS_S iujcotz.iudbnpac.ojczm

F959B4124D53212EAFA94E34875762196B37445977E4FCE3704CD6535C604E1A

SMS_S rks.jroqec.zeywmbuv

F999420C490A330DDD50E0B7653CD7E50987F631CA848D4864B5EA0182A69794

SMS_S qtbj.nkxgpbf.ozeyvxkwdq

F9A3D948B64CABBB78C83743AE9AC8A487A3E3DB6A0A8965FFD56618E3961FAF

SMS_S phn.uochxife.etsuhovc

F9B35DB11167B62084B5D76AB3CF19C42561AB7BF743387DEB491F15FE6D3215

SMS_S qvgp.lnmrcpkb.uaolehxtdv

F9C141C2E8EFBB485662CBC036481472969F819BDD9DA56D4089A5426AE73141

SMS_S qpjhkxb.mzltje.migonalewurz

F9C3BDB85D88419947D90A35675465EC315A6E8AFB4FD4230BFA6008A3D4B1E8

SMS_S kqjoy.efbthcyox.vjsfqzdru

F9DA9681361020602FC5574169ACF4821C74D6DB0A4D0D8C1C5B1AAEC6304F14

SMS_S vrgtajo.wzlfujayc.lurmxbfocn

F9E97CA2002C3D3369B8E542CCD45DD1CC9EFE95F99948C87C7CBECB59919614

SMS_S fzcrpye.mxkecgb.tjcfvz

FA0032EBCC189A98657711854DEC0A87D36EF46F776EE6B493E3D18CBC4856FA

SMS_S cohuwys.emrpohljnf.olxsvyfzag

Page 301: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FA025D0DFB09520DA1A8DFF18DC914028698EFE781C15C5C8AEFEFE2C06E4692

SMS_S denp.zsexnmjp.jlpuazhsotnr

FA21E9711CDEB395EF33B725B24B2C09332D8FECC671B55308BEEB3D23B8B2C0

SMS_S mgfteol.mlwunf.wbcrmzfitu

FA44336809810E3246A04091B75010781647F2B75F296E0A7F2962AC3B51D7BD

SMS_S fltqmx.lvpcidb.bzqsgce

FA4D572E7CE8968E8864D014A551DFB927C220A4751B0075CD67938EF8D982F2

SMS_S hgsrmzc.bepwas.zavrkbd

FA4FD873E2395EDB885FAC7344D5680A5FCEDF38484BBCC42422F73C2A17EA6C

SMS_S zqhic.satcvb.jkpvxlof

FA5040B36E5A0D31B9010BB423EDCEF2118A12EA23E5B31A06E205BCB8179B9E

SMS_S tzu.ginblxecyz.adrqobp

FA6FDF5537EB4670CB5B381B57A55EC4F5EFDEDC2F44A46E31C4D8E5C913EB6B

SMS_S utjn.thjumvzgd.xmlekuaoi

FA7DF280B1B1F382C08798917CF3ABD265E6F1F3CDB293390390D866720DE291

SMS_S bgj.pzfurw.uebyfhzlwk

FA8D751CB6ADE18CD3DECC37F3A49934474D4330336B6702E68E23F9702A0801

SMS_S gfn.hyfnqpls.getwbhqir

FA9338720F93BD47D73D3B86FDB373C17CA5C5C2E9B1A91CB3D5C85A4099B891

SMS_S xzs.luifpyhqxa.bxrlfiuczg

FA9FC1BEFE152AF771EAA1653C0DE91CA0A5BDDDBA6136540A55C14F7649E889

SMS_S wmlha.vskrlwnaf.lfcwp

FAA0E19D3C4E3D399EC04F307F5A224FC066AAB4F58936DAD735D101E1C95D9B

SMS_S ist.xujrlhatv.vrnwcuhpbfsq

FAAFDC8458E70BBF60EAB8CD802A3637F566EE798B8BD0AA417F857E9B3FBE7F

SMS_S ewysrt.hfdajginm.dncfx

FABCC4678DE5E6D124820B7D4692C859185BA48FEE7D76EFB44F398C643DADE7

SMS_S vixpz.txqvuas.ofthku

FAC8692B0FD545D65354D600679F253084CB732E67B2FCFDE4445AF0102E200B

SMS_S oqa.fclovadxbm.ypztrdqxjfu

FADC3E2931AC13D117926AA432B6F2A3D5B369A5A03D0C76B8028128F6D8AE67

SMS_S glyxh.letpamrvwu.guktvw

FAE383942DD5FDBA4CD0AF924BFB7584F942A675DDA32F83126A45E8DA3287FA

SMS_S hqc.bjomzwepgk.znkqhlutyjx

FAE3F237CD8D9999C3C0CCEC13A01FE40B33ED24A44FE2BA0B2A5726D391AAAE

SMS_S gfzvi.cfuaswkyl.qliet

FAEC456E1A26A3ABD5B2FCE2AA4B7A2B66FDA495D8EEE2D9D1986CD37710F589

SMS_S vkzlu.ihmgeuy.nxlzoibrdje

FAEF71300821423DBD91C1C7AF19A2F7DA3D3 SMS_S oqnxtip.riwbxda.cogfwnxmiz

Page 302: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

66F76A99EEF39FDDCAED051A389

FAF92669274215DA15DDA7CE4F390289FCD2FE902412058BA006C6A549CD12BD

SMS_S tiywf.jbosvdaez.zqfvecwshgyj

FAF9904EEE8328DDD1196D54DB091F53386AC1A57C316EA60B41685639732859

SMS_S ntrbj.wxfnvtiuy.epzysihrv

FB04BAE91DAE01CEF21D6D69BEEA7F3F6C1BBF589A08EEB223870F3753AA9D16

SMS_S ilxdy.soyguf.kleb

FB08947A4866C7F1BFA5D3443C8ED36F4AE5DBD94A4AD150F963EA459513474D

SMS_S zitsk.gratshzi.lmrhpxnfq

FB15371D20EA9A59526F56A0A827DA1A953A612243261083DE3A7CF4B09DC5E4

SMS_S ruow.shqfzeikuc.bchpnvw

FB1C158D63ABDBEB63289DFB2DCA410B3D6B53C7898D5D88540B332E740443F2

SMS_S zyfsd.zpkmcn.vpbigmtwfaez

FB1EBCA509A45403BA8BF4E1E4039D0B820E144C62467627FE18EB9AB64719E8

SMS_S hrnqe.rxpdsngtk.fmqa

FB3A97680C87BFF827635F080B406FB33F4E05AB6B7B90C898CC8EEE5649AD32

SMS_S kdt.amcsgtdvfn.yiarfmuwvlp

FB525B0404813E2D1CA8152BDAE171729168CE01B3FD879DE50B653F37AA2AE3

SMS_S qrfps.pixnhozbc.lvfmqwujg

FB80B754780B4BD40E74E0B20661665343C6E3FE97FFB2F7E4BD7941136D0C61

SMS_S ilexko.ywtfsq.ylhg

FB8CEE5233ED238AC8FD8920F294ED1FE0546D3AE28F3F09B1B6530CECC086C7

SMS_S btnlqew.jvmhqklrfy.okjebfuhri

FB90946DB08D6BAD4E97CBB098FF53A3B42835341F92804EE3FF6C995C916710

SMS_S efk.sduhzrm.tihelo

FB9C013554EC7B30C2FC6828FFCFC35FA0DDB4043C1BA064FAA1DB7EB2C1C8EC

SMS_S lazw.hnberjciw.uenitfvmq

FBCE298DEB9C7D82345C4E4F6EF5A111E2060A9EEA20E0E4359FF9EAC9AD7E37

SMS_S ivx.ewivad.mocvwjiuezgq

FBD5EF10CD97F83B2F1538AA808F306FC6AE3F0492F2DDB1F5A4BC928A1D247C

SMS_S txg.eujrpvia.komerc

FBD769B35BEE1FF7813FDA23D543BFB7B37346B1F0B440B99AC7B61B3B29C202

SMS_S xygr.rfktmbpi.sydwufzbq

FBEA23C20E44695254DEF8015EEBE2E3C9D3624D62F2C9D4CEE8C073FA4CC317

SMS_S lysn.yhusqp.nlgwekqmoraz

FC08E865E50CDB492E86462D93A5EB5B08D89B144FB47CE86531D444FB64A461

SMS_S iog.nyhtwfejmd.hicd

FC171BC327744F56EE975C975AB71D101A39471F3BA56A1E9053D5B096E68B9D

SMS_S tcwxbs.znvfgthu.btlavsmh

Page 303: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FC5375A3A2C07DD348B7447144CEEE2AB1D311204F990D6A4444AF5B3012B220

SMS_S ayjq.fquchy.gmnxo

FC66707C9841AF46947061E76B71F45FF8FC88218E8A9E527332064DCC520100

SMS_S ncujblz.mfwsciptq.nypsrqgbv

FC6EBFB4CF1D30D26BAB955C2EBF3048C4221504B25563629C7D13A1D749D2BA

SMS_S ediuq.tkxvmwrhz.sxqmbw

FC7B0B98E8ABCB7FA645166777C6B40091FD2DE393C599E346EE27C35E1165E0

SMS_S oxcyfp.ntgqmyhpo.tdncx

FCC3E97C6937B71F8E3454B790AE3878671A8E301C4F6A73D711254B7967D15B

SMS_S xwdnc.uiyzxkc.tjoshvmxrep

FCD9340E52D227D96645865658C31EEF145FB0F71A6E6860123028463F24C92E

SMS_S amoj.uzqxsimo.vlmodru

FCDFC0DE14C6BCFADE4DA95DC4C585E93BEA437B2ECE9EB0CF28BCE3E6D2FF54

SMS_S qepokgh.csqfnx.iepqknugdyvm

FCEBF0BAB38AD307DCB0C3F366E8BFE16365AF6298C2968C7806636952F69061

SMS_S wlg.cvpxdrhokn.dyplng

FD0BAE53C6DF31951D539F073BB53DCF0A1DF6C517981C8D2E08B5BC4D259DD9

SMS_S chf.rndhzamust.dpycsqre

FD18732DEEF38282A84313703682E02D771014C7DA6EF0C0BB491D006C1DFE07

SMS_S vbu.grmvcep.ifez

FD2E871B4C591EC452F161F2CFC9EF5BFBBB62D3B5755FA42C8D7CEBDCEA15FC

SMS_S kjeo.yjfoqripdb.dpayvwujce

FD472783D6508D73B501374AAA035B1406EFCA422E0B5FB36DAE6F9245833AF1

SMS_S iwxtaq.dhgisrflu.lbdiq

FD57F799666C21A68DA9E5CB7236BA36CCB5E3C80EC15CAABE4F2A2520B0C03C

SMS_S ucyokvf.lwahcbknmp.hwcibtsjdv

FD610C56CA32F1F67FF4FB0E44D4B322E7C0FCAB894885CA06579483A19F7497

SMS_S scexplw.jifvgpoum.nckaz

FD622C2184F5F1710E0184DD57CEACE76696E0EA5A0E3779FD2007AC3AF63334

SMS_S cpzw.pgbmwqehiy.cvouqsdjzarx

FD7A7EF11B50A0B5478E15987AFD298A1EE6E7F062365F95DBC0296D245591CF

SMS_S ghswnt.ypegarjf.jcatvknzmxp

FD7B3805A3C62304A9D7060BCA0DA06084948931F2C3744472B98F93748E72BB

SMS_S qxjdfp.iducts.xplvh

FDA0BAC7753C059AE58875E18391990537DB09A6870AC09CB7ECB21F8D17FCDD

SMS_S qnzshd.fgnmzqc.gikh

FDCDDFB59E1B40950D9D444B1CD4315A40395EDD6A62F10F4C23BA1F189F4216

SMS_S jskzat.dckqisv.ldfiehrgvycm

FDEA14FB90BC6753D1FE9C3A6EFE8F41260697 SMS_S pcnh.zaqrimfpj.igejdlcahno

Page 304: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

30D2C0F746D743B6FCA728E781

FDEAE13E7CF99DA2A7662471266FF1C6C4140A8CDDA3EB88849D738CD7C5BEF5

SMS_S hywevs.cgxevr.hqcpafzkd

FDF30CAA20D13E402D52E585B5562DDAC2935B4DA6951A909635EAF49AB19F4B

SMS_S vlw.wsgiycuhk.bnyxw

FDF877F29DE5E4A7E4E4F2E6E3B7B9FE9F6E6461429D55FAB7F42EE31DA9029D

SMS_S vcblxo.uneozmhiyj.joyzfkt

FDFD5FE29CD1A7FEFC141EA19EC612D0A237C792B658E2B89E03E24597DC6A8A

SMS_S vmqbj.wksuaqnxj.ldfwtreg

FE0A091FA835C5B1E56D5CCA5E2B5B8D148EA6C8E52743B5F6F1FC2CB6B0A259

SMS_S epxbkgs.eumtcxbg.lqvs

FE12383B3CF641457D4D3E0E7594CB70762D6042B7B0644613822C5559519A47

SMS_S jyit.dehuponvk.xdermkuvai

FE194C008481432C1A73055F25298769C244AF03D03DBFAF3782E6F4A29C51E0

SMS_S oicym.znwsftm.mhgzdfoyx

FE33ECD06A472DAD43AC7C04E332268FEEE3DEBEC329937A31C545340C7C7950

SMS_S nzvd.jwxlrzk.ikpofnq

FE3BBADA5F75B3055A7D991644C096698561B0D779C3362E1B2EBF5F201AD361

SMS_S rlpkgw.pxrfiowasq.qmtwkzhscdyi

FE40A64C9E0C03F169F960EB7F1F9ED15B0AC1231E6C2B19BC9EA55E0DC2A731

SMS_S wjzvo.djsuwgoqcz.mpgh

FE63B7578AE3B5E93E521B08BFF897E838A283C660BEBF43F3D36B499774892B

SMS_S nqgruk.kiprnbtohy.crsjg

FE757990CD703934C52D92129CD592AFB888447BAE18BAF240DA0FCF84C3A4FF

SMS_S yalocd.vktjizd.qfkyseuwxhd

FE7FCFD60C471DD224EAF40FC059022064D6B47259B62F4CB7DF614E9DF30865

SMS_S gdenk.jewnaqvmyf.mtjh

FE83D828BC3A3C243EDCC1D7D22C8912494A6E4DB07AEA01955F03756936CEE4

SMS_S hkgzt.wmebdguol.jupamzkxfrbv

FEB0EEFB1EDF957A4716EF3C280FA16E1FD4F6E3E0F9DDCE16B937E462225BAF

SMS_S lmsg.xrcidzh.zqyp

FEB45CFF1EB95866BC9ECE7603D36144C2EEAF968B6C064B1170043D5AA2526C

SMS_S gypci.ioqlfjauvd.yzfg

FEBCCFCE86ECCEE7D5779F094A68D5EBAB83C2E2BDF2505C02787CDE02126A4E

SMS_S rbcpds.gndlmhzpr.wmyprvfzsh

FED84ACA882751BF6C73E3B4E7AAF0D386A025BCC03E8BEFF2D59005AF59F8DA

SMS_S wbkivp.cpflohbxr.wobrdkxq

FEE30095436E4631901416A7EE146850B8A49AA854AC6DD89FB28A6AE6D58E58

SMS_S bxfwy.jluqogry.xfgospvru

Page 305: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FEE64BC965462D516019FA89FA6C3A29BF14BB3BDA8478C559C5F1FA0FDBD39A

SMS_S xtupz.uljdcmxnh.gmovfrdw

FEFCAF2E44A6D5ECB2B953FF8A7F694976940332EFBFECE599C04EBC1F42613E

SMS_S mvj.vkynghe.ibmsueah

FEFF99510D6DBF9CDDA19D977EDA6ABAFBA749AE7D0CE66010FAFE132324BBFE

SMS_S buqm.cvafmyb.zxlqum

FF1022CD49F8768FC7C4428658A8106BEB2C289A359D4CA84FE2660DB576124F

SMS_S uplq.lrqmtfia.qrofghiz

FF1496D0314BC83733D24729A7AAB1AB586F34CF969A2018B5034246CD2833D7

SMS_S nwedcmx.kpbeihtrma.lhqejmf

FF1F6BA2112FD5A5CB26ED03B9F6454C6E1DF060ED79935F621280AB93C75706

SMS_S rvuxa.lgwpjmih.yeturqvobg

FF2B2627A98D984B587F65932EDD7C2C5B9DD9FD0BEBD22C0DE456773BB859F9

SMS_S homt.hmpbecjstx.tmxkeyvlo

FF4DC794C1997BAB6AC6F0F9B3BF9902EAC5496F2FAA38429380995A77EDB849

SMS_S nakvh.dgnsyt.poayzvc

FF508602EB2FB16D8EFCB24D1B6F7F2F4FFCFD4BD4BD26735CED0F36A1657CC6

SMS_S rdk.dzrmby.ktliod

FF57E04436DD5E87532FC9CD5376ED0B2795B93D471046BDC1F722E535A05B39

SMS_S eriw.fstpbawqy.djbicgzkvuh

FF7249A4A63A2041EC6167B1C65FAC62792FC9A020B9359FF303A87799D83F92

SMS_S hfjpmge.dmokcprnjf.tadweio

FF8047C45AE74C86717723DAD24A45EF71E05CC53E12165F1EFBA924414BE328

SMS_S xfwyuvm.ibpflsgtv.tojwzpyebq

FF9DA2DC79A4AF9312D8994662FACC052D1FC3D2CCA6676FE7E367E9FFEE0072

SMS_S pwvsxh.poctmjzqvr.gkxepjmlh

FFB2B30C67D3E085983509DC8570AD81F9978FDFA76BBAE2AF135AA9BA4A7CD4

SMS_S dmbof.zrvksqop.lcfwusdyk

FFB35805F0DB2014039B76DED81ABF0256AC7A7362433959A2A2D344998A8DE3

SMS_S jelu.qcsuon.xnpat

FFB9058E26D05A4F2B07E598A86F9FCDA6947F3BFD70BB69B175651210A68083

SMS_S sjten.rghmeydn.ivnlgtawshuf

FFBAA373A48E8202E627AD4C078612B9AE02732A872C9678FCA9CE3A7A439785

SMS_S mixbzh.xsflab.acrkqgsjwmp

FFE7EA27779A63B4468998AC15EDBC68C46FC5E68537E8DC0B38D031452A9CA7

SMS_S ghjlows.aqtyhoev.uyhb

FFE9C37848055271187C8E8903C87F122E7A4734FF25B7A9ECA2DF906F138264

SMS_S pvjd.oectxl.jpbgeydhqoxr

FFE9E5B1345837569BE5FB3A5D9DD9C417318 SMS_S rbu.cbtrhu.xcsyp

Page 306: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0C0CEE24A44F0634E619AB98B04

FFF3CF7CE0DE6C3EE6A1CEA0D543B5A05163564B1130F4BEDBA7DA4147571BFE

SMS_S wlq.jfhzxcw.jeyopgdfhnvc

0C51FA4124CEBE1C26DBFE1C974D36FB914838089E2E6F9E5FEAE33E1BE99626

ММС - Пoсланиe

rhcjolz.phbczg.vgeazxh

18806ADE563ABDF1A8A171CA67B6D08D58133CAC245C96C7D8C544EA6A0BC59B

ММС - Пoсланиe

pdtu.jswflqk.axeotrzckuqi

26B6B41B9AD74E0B0A8E47727E905E9C5BB2380BE21CF4254F28E13FE66F2339

ММС - Пoсланиe

neqo.khjobg.qhnv

3CDF9CFB3F86CF6DCAC532D71B78F458DDD304CA44B985853FBF4F6F3313F6B9

ММС - Пoсланиe

vkmpia.qevbhlydp.vmba

492C292A67A63CDEC1C2F025EB50DE0469363F6B90C0524641C33D01D1EECA1C

ММС - Пoсланиe

bwjyaux.pmfzvyjkua.tvuilywhb

BEA2CC8C8B38D2FFC0463D47D989FE1032C5719682931305B2758921F382BFC9

ММС - Пoсланиe

acvesd.husxjpmrkn.fibmcdjnw

FF6CE6EEBBC02E1CEE2504566DF3810D85D184AD5CFD903B8A38BC2B22D6D873

ММС - Пoсланиe

jpuw.vlctfu.azlvfphu

02E8D6644143E2762CEC6E83C8B611D1C4A64E63E1EEF4B66B27F9AF842847C5

ММС - Сообщениe

agq.bleswp.hngx

0E7106027342EC8975EC3CAC148283A58B33A6A353DD1DE0E2D2CC37790C78E7

ММС - Сообщениe

tmc.hezaonqrli.pandx

20D302975A5400B03F6EE6B1EAD65397C22428E9F4746DBAE940CC28D8A11416

ММС - Сообщениe

kafl.uysgopv.xjgy

30AA0909F93142560471447ED9F27130AB15BF19905B1695189E2B7BC97A3D8E

ММС - Сообщениe

qdut.abhvdty.vuqyms

412AC47CA06508D015C3CF0E714E6470A4D1C6B64099558AF8BA6A62494DF79D

ММС - Сообщениe

wmbpk.voelntgzw.mlafeckohgir

690337A7C6A9FD9023A4271A6128A9992C8FE6E51565C6D66745D2CF81DED936

ММС - Сообщениe

wizkudn.prxmnl.dobhvrngfl

6CA6B9143A769C3736ECBB3A275E5FACAA131BB93946977E8E393AB969632FBB

ММС - Сообщениe

gpky.ewfcgiru.dpzxclhuefo

BBA61E69A1AE1CF476369FD46677CF97A2B7C7012C968129352CF708994D688A

ММС - Сообщениe

sgzfpo.qcpvmfrnye.smuvpcq

DE1B120CD33C99C7D2C1155C81FE19BECCD1D4211CA3FC18D940F0D312A32AB3

ММС - Сообщениe

quvfia.dhubcs.lwmfauezxj

E01CE5E24FD74DB38C98DB43DC79E2A6DC7D179F7CDDD3383669FC6BAEAA3C01

ММС - Сообщениe

vdewiq.kswxfeujzp.fvxgkdtwrnp

E1BB0F8120BCE90F296487049A193D7A26C5B6DE33F877517227687B4243E561

ММС - Сообщениe

gksphd.goiyjuh.qlyeuvr

Page 307: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FBC9190514DC492492778493ED7B4E62C9E2C9CF0B569AED52B01C411B77B30C

ММС - Сообщениe

ufrv.idjwytcvfp.nrumj

01098D72120C9D29B409B05E6169479354C35A69123A9B1D9714B9575F95C2D9

Посланиe ykwxld.itrhdyjwcu.cjahvwykebr

02048D5F4AE63480247269A3437D45FF7E87405BD3DC08DF1A515A30A0324F57

Посланиe gcbsplk.nyrvifh.masd

06547E8E04F0944BCC10E1CE978E3E0A2CFDB4B7D44FDA1649112F629EBB9658

Посланиe nfpjqgb.rdzhlne.hqlbmpfcyk

0693BC4EA5863AD7934DF522C0AA09B55A4CE84A1498E86B86254D8D5C17DE56

Посланиe lfdmec.smtqdgxj.swblq

06D492E78EE644E95DD8BD81232EACD99BDF2CA9A4F46CE273E3743D4FC321C6

Посланиe qpoegr.iforusdavm.yfbzwejvgnx

0705279E8139B29AA36DC8956CD647FA69D893E6A2965F1C142CE335B4BFED1F

Посланиe btgjxy.gtjuydf.hflntx

0B0D323FDBF16B5BABAC362508A4BECECB68FFB347ACEB322A662E1954095DD3

Посланиe wzkf.suetjdqo.wngysmd

0DB4E6F7E1F58DD79801AB2F0F6AD8E49D117E5C35BFFF62745544D99FD74815

Посланиe ntarm.wvquelogib.ljyzecipdh

0DC09EF5CC7CAA5ED9E736A6C77781FB7B1AC51C76A04BA8823569840453FCA5

Посланиe ljwgx.semhgft.jxucsvbgy

0DDE6F5D1D962E32A322C4F436B7E56D59F4E3B4783A60B797B4085B5C90C044

Посланиe kdebmh.lbasxpqc.bvhforgkum

0DE7310C51D8892D10CCFFDF8AA85F68B903DDC786B0D52F36D09F3760E8172B

Посланиe rdxigb.xvyrpilb.ahdfryijz

133F64943A38086A17C02DAFEA7009D5D6B0189BAEEB8C261359514871D4F566

Посланиe cqvi.dbakozm.gvzqkhpesb

152D6FF5A302D94480AB875ED2E3B8799C3951F732F9186B0C688155817D3B1C

Посланиe hsgw.puywlieo.vqskd

163AFF6A3DECF6383A30E072B75D3D985D4DBA27842F5951A8FAA14661B1684B

Посланиe lcoi.xvfibjom.zjanlwkig

1AD9A042FDFD32ABAA2745D8D37606B2DB3191C752AB311EC3FBCE22D5697DE3

Посланиe dhclnt.uezjkwyc.sgaej

1C759AE02B93FEE58E68C0EE892A0B001966864E218E914F0CE1D11C62443FCA

Посланиe ingfbhl.htekyvdclj.eaymx

1D7DB562AEB3004CFC7E035717B596759157BFB6A6978447F87457F14C2E3184

Посланиe hjyou.jcmqde.umgsvjqyk

1E8410FF28E88C32F99997AA92312621154D6724F5DCE97B002D1CB5D329773D

Посланиe zyl.yzkpsh.tfmjbhykn

1F1434F5978BB76EF6F572A2C5B30A8B9F911C Посланиe uslvxjz.fldzbphmot.idfyvue

Page 308: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

4948E9512D91ED1D4440FF1149

23C88091C71CFBBCE244B185188D26C25C5EC73CFE3EF7D4B2017E509008CE05

Посланиe edxtqna.oewldyfgc.lurjvfcegnsh

23ED5CD090C047F4E085209CC29A1975DB1912136AB4838AC6CC89F720B2F3BB

Посланиe kxuvgzm.ufrngtaps.yxtfwsdop

25F57017D34804287180B494F8D3D90BBB70A30B579996173A36EB418925A1A0

Посланиe yxcakfr.axrzeqgdow.lkdmqhntvp

2D04EDB9F07CB16E8E1B7C53F8ED1DCA7CECB90812DC768DC5C35A6990645C38

Посланиe aignxu.wzxlusajcf.kdvryquhmcg

32B7FE3894500F10935DDC7932917BC9B256BD77AB61A4CFB838B1F352260D3C

Посланиe xfgka.tmyahlcrn.vpmbujre

38A6C3BFE59C36E9BCF26BDCE1502DE05AFA240218A58B1257B476226C4EE85E

Посланиe aolvbng.qpbeirxmow.kxhaomnjvp

394EC16939D89AD84C1A6922AE053062A3F0E711A7DF638A94005E38D41A0A2F

Посланиe dwbuthz.spctiybgdr.yvqlrhf

3976603987391B09E7C1B7599DB0172A86DF46D1A235713278B6E1A6FE1704CF

Посланиe izwnqmt.pvtjdmolag.qbndwvychf

3B8C2E4AA4BA438A923A182F13CAC94E2C898FFDC8D27D5B0EBCF3EE88D33E6F

Посланиe jdrcfqs.covjzumale.hfgdanu

40A207B14F8A4BF89BEB4F35B4FD28AEB436C9F80C78B25B7256280309553CC3

Посланиe vkbn.kdgpyw.mxipeky

41B79A97BC898A262661189EDA415B2D312BF294E13202234D5EF633DFC4B1F6

Посланиe telvphf.gcznwv.dzaufqrvhoep

42BE30B374F183C28DD249169998C4511EA46ABA07427EFAF3C56FD88AF7B7ED

Посланиe zldfo.peoghbjvt.jlvxdweyksu

43A92917270204C49D75A426395CC48D93A337B708ADA953584B3C8B709E22F2

Посланиe jheb.nscruhey.secqgubi

455081283F3EC7C798BCC5C0E3D13F4D52DE7F7CE34185B150024532FF8B652E

Посланиe rijsyoz.lacsbnokm.enyfjaqtzgx

47EFEEE178E07459DEDFFA4F24243347931348E318AB6626439FA8331C511D98

Посланиe rghxdnp.wamigroe.thspamvcr

4ACC36B4B6780851194B941A0468A415A539C34B3D17FC1157A69AEB5C14CB21

Посланиe pxdrve.bmwfeio.bmqsgzf

4B369191116F1A25F0A1A3C50D763156C6F285EA7D2EBCA95FDC659E667B495F

Посланиe wqnbtlm.nwtjpv.zbqhdufacvtj

4B7109F1003A0DAFB07F915ED0491EBBCB50500649FAC14EBA06EB85EC6D3E35

Посланиe fso.cdhsxepft.rzbywdqflu

4FC446FBA0FA524EFE8630F812B36ACAB9D05110F7DE581B4D2922E9A218B0C6

Посланиe gdlc.yhocnuzew.wkhjgvatb

Page 309: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

523DB7CF1A366415BA15A471579D6E6A1F552CEA3EEC263051BE40786DF53748

Посланиe zpuasg.gqneur.cinrm

52EB234AA7C4127A8A03E8B314E56A672AF95B47481B7D5CAC6144031E9E999C

Посланиe pnk.clewaxpg.lzxyr

539C6E7707EB3485838FD56FC6AF7C67854D520A6B2B4CECEFEA82C494DFBEEB

Посланиe slnqx.pyjahifbs.fgqcumr

53CCEABA01C3902E38503441A78B845265EFC7E55BC19511C907B1BA2D3E05B7

Посланиe unzofri.pltabqng.ibxsqpov

5461AF081A099A47D10016B45D7F8A4F480CBA21615B9DC99F512944A8B22FA2

Посланиe udaov.xnaiwour.fczdxsrajpq

56BDAE1A2B39C23B95C40326393545CBF883D8934340A1CE50B3BD93EF3C385A

Посланиe kao.yrdbqtium.ngxkflrvoc

57C5A83E9696F5E1CD667A44C1072215BF61531DC71B2575E39FFBBF3553FBD8

Посланиe jletmo.uaepir.creixv

5B9BDDBF48ADB37C90FC697423FB138BAB3297F994A5B741B9A738F48973FEC6

Посланиe kvr.ticwqdn.fmojegzbax

5BD497E25B43917B8C14D3C74A0A7859129FFC8ACD7D91EEA0080B0F432AB603

Посланиe dulwbip.iyatdlqvp.lpnze

5C4932F9397F77F3538ABB4414234E074D0628F75B3DBBFDE3274DD2AA13BEF3

Посланиe towy.lbzixync.rkwloecnx

5E429838B96024D9ED61722A6888E0C916410053B86B6B5223A5B28D5EAE3FEE

Посланиe snrvxqj.uhceomyx.lshubd

604ED3F12DFBBF8E00B9B5A7937A96E18C1F0CF601F57BAD4B281B6F6C6A9906

Посланиe fjsum.szpklajt.xqwonskpzuvj

64914FC520D0EA0303B42343C7F454F0A536733964CD845B63A3CA09C458E501

Посланиe ybvk.wuhxlioc.lywj

64ACFCFC17148180DB15BFBDFF586C7DEF4634D381C2A5EFDA771F9339D101A7

Посланиe jlgk.pskowjte.mhrb

6674008C1B3493AB38AB150688AC99A008D595A8F4F758471359EFF91E7B558C

Посланиe vbszk.djwzxatcoq.gwbrnzkvo

673CE23AA93A084B5EA527D3F501407C3370CE8A01FEC700E20A05E812A82E4C

Посланиe cuzalg.mnsehyl.xolyeuhsj

691A43181DBE4EB375905D7B340D6A069FE47D6461B610288F1B89E91841093C

Посланиe kwbip.fwmjgvea.ofaltevmxzwq

6945BC5B5DA34E01E84F1B11A25353EE05DF5987750580B54DDA9C453A511067

Посланиe mvob.ythcfn.mbuivxhsad

6A35196764DF05BD707BCD0664B1A04A2364EAD46C74478D9B7AEBAF2C1BAF9C

Посланиe czlkme.cwkupjg.qmolw

6AB3B1B1D908399D4FC7A460B489652D8B2D Посланиe hsn.bsmjyhtlka.jdvcqfsh

Page 310: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

002651AAE3152E13BE6A95B76409

6DA9F967946AA0B3644311CDC97B886E194CA30E80A1AE4BB8B8B3F5C22ADEB5

Посланиe mfvshq.vuoyhdqbc.mcif

6F6F174E599FC6EB8565100A215A3084A316020A3E67B0661F7D6EAE6BD4F80F

Посланиe obnlxyk.kvwisx.jqydmoaingl

7184D9FFE473999CFEE60336ECC76705227177AF47F871954344E3E707369C95

Посланиe jxid.jmhkgz.scihgy

7488C41F70414872CFE59F11D9C7DF56415DBB7B0C0CE4D5ADEDD499041C75D8

Посланиe tnrjm.zmpacxhun.suyrxgw

7715C6B1D50EE59B4F22B5EC146B6F79293E887C660CF3D948FF06EBA0778DD4

Посланиe dshn.dukcpxqfla.zdlk

78F0D4E7B0F52572F01846ACBF84C325E4A0628133FF8D9101E9FF86F92E0A37

Посланиe gdt.lricqnkvmj.rfmtdhjlywco

7A5376252570A8AF7AE683129B31241DB9527589B8FFBFFD6F37CD0848F5D1EF

Посланиe ety.mizpkjubfc.hafqszcdregw

7A78FB849B6482DC824552FDFD8252C3E2AA68AE3A83D901535C0D262C9BC2C0

Посланиe xauqmt.rwaqmfig.xlof

7B30B8D9154F74D443A19C1B17911369490ACAA1D1ADC3CB660B6904C02C2F27

Посланиe qkl.ruhamlbc.sfmhacvzbiku

7D9B1C1D473BFEB6C9E70BA6CB8AF2EBC4CA1216B50AD87098E49BA49A2D6216

Посланиe dagov.gecthjswlr.ejufhwivsg

7E46C55DFFC2F01124032649F1F40CBE2E64ACE592302CD63335FFEBF8897FDA

Посланиe bsawz.ftyubkcrq.tuzwaevr

81D8ADA089D7B6473AD51F7991D3611A483CB67DD4D23431876A21316C2E4060

Посланиe lcswxvf.ehnyulbvf.dhiufeknj

8382CA96FEBB1C8A9AACEC6BA64CEFD9F47563237821EA53EF23027874A5CDA0

Посланиe gca.hvwifx.mgdwl

895CC023517C539E88F3C848A02A14A8AAB018281190C9093D6651A84FFAEC8B

Посланиe okjdgy.jwzvhas.kmnd

8AA515260E39B6D7B0E7D29CF96A1F9822C5933F0ED99AF3AAEB2A9FC76A953A

Посланиe pwrc.ecpnhb.lqsnxwzdji

8DAA1544EDDFF7A2E130DDF8DD059BA1215ACB7B03284A4644D99156BF5C3BCE

Посланиe gqecys.blardkstjp.hwrvntloybz

8E06CA806B69A73DB851C2C77E233481BEFB3D0FCF8783C1295CDAB15971723A

Посланиe dkxba.rqbgwkjx.ojmay

91FD9FFF771D622CAF235C12B06B4911B62AFE945185FE9DDD1989D39BF8C73B

Посланиe crmuqz.manstlbhyd.rwmjvxh

93A3D165FD6532C0C11A08C51AF8A8D576827DA14D6B363603D7E7A1F7353A2A

Посланиe hznb.livudj.ypxgvbrdwz

Page 311: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

95217648B4A5853CC98D52AABC9363AE679E9D60A6FE9AFCF2964A85FF943E79

Посланиe bstaq.xikhrmnc.fbelduqzsgox

95D6C266868B0F10008649972B6F09CBD6A1819DD14A093B931B83A5F4546E21

Посланиe uzsp.outgjfkciw.dupyw

96054DCAC00179006A1CF62ADC3F3291E3026AC38FC88F7CE0755377F120F951

Посланиe irmfyds.ntrjskpic.bvql

970834EB9051BCA1B065B38D59E7822D5B78D8FEBA814340B4C76E14F58DAC34

Посланиe ynzq.ysqenxi.qjndef

9722BE6A59F874B7CA94601D3043C69A28A7415A92724D5C41D3A3B63D7A546F

Посланиe gtle.aglqwo.ycubwhax

9793761104F2E79E764BA3011AB151A7ECC6DAEDB763240402252172E2052292

Посланиe euwinds.rnudshxc.dnqicjyvp

9A582E0F120ECA476D6CE6B18DC885D846248C706FC66E0A9772FA48B0E5777B

Посланиe evto.ujzrynx.pyjmkafs

9A5EB55EF05546A242E6EE512031B2063A9964319D30D7D78954D90F6E69C539

Посланиe zedwkfb.yvsozmh.kyoptvqr

9F815EC18120F44D84C717FA3467E39175FCD7A5A219B53550D55DA8F7B12EC6

Посланиe lvjde.mefbhxanot.ohfvjd

9FFAA80F9B05B5CB368886CC2A576E52B9FAC9DCA5669377A62E41B6C86C19CF

Посланиe jtbadme.lbdfnrxz.ewxyoin

A637F36F5C1C1791F4A43960007EFFD1D5D935D2277A17C6BA2EFB2DD487C650

Посланиe rweh.jkhtgoyvc.yumke

A7757A439AB5519C4B197A0A4BD5ABD6A8F5A569EB930FA5BA4B1E66FC5FE87E

Посланиe uvxwdt.auykbqszix.woxfms

AAD80C779A7D535CC6AAF6592B57DCA4A55E30391AA1317578FFE9E2BF10FF6C

Посланиe otf.tsmvdaxywj.cqzpluerkaif

AC4B6366EA9618E7A54990DA2DB3225999DA70F8AF0BA4F1EC6CE2CE0884898F

Посланиe dywco.bqljpwyagn.mjpa

AE50D2682228090880163E1B3AFDA2B9EEAA6222FD66EEE9986D08D34FA36435

Посланиe hcmgbqv.eatrhoqipd.mdscqyzfip

AE6C77980C7C05219EFB5AE2BA0749615E5F33659D3DC9B7AB09D28B93A51981

Посланиe idvf.erzigkhu.mfhbsxojlv

AFB78077AA5192E33979F3956F9210D0B696BADCB7DCAF08E680C34A72EEFCB8

Посланиe tjoplw.nyazmukc.qzvjpxndbl

B08311E32DB1D0AB1E6727273D940B0E844EEB6D50F18CC5AA5347141EF0CFBC

Посланиe zpn.fbhdxjaw.oemkfsdzyv

B479D344CA6FCE448E5A0BB24655691FFFF4122EF5A78981895AFDD4A7B9BC2E

Посланиe oimr.bnwgzfksro.kyjfszbu

B63CD65C8583462573D2F257C27357547ED9A Посланиe jema.reixapgny.kwvsbfe

Page 312: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

FB47297D5DA7BC4D724A81F99C5

BE08B794AA58AD329702FC429D9EE6306C4C19ECB1343EBEF3C354162B9B5054

Посланиe otkxlp.qurjlekot.catnjeip

BE3384A1FC49F34E2EE84D227C5846788822FA8C26A3A6F6499564C2AEBA74CD

Посланиe rcjpflu.ftdpxazm.zwebg

C1419BC0F4401DC6FE4B0BFFC7B9E14BB790EB82527FC9D038D32F83671BEE9B

Посланиe gtzr.cmgifhovx.cfntobkjuza

C54060F3B21FC2516E187130819F8DA0B7270873E44AFFA1AC96A85CBF269F8F

Посланиe wirv.apogxtw.abepqurkcz

C74F8791A1B927AF64FAE0BD3B49AF0D299B3AF119B2D9128A8F1015A54D88A9

Посланиe idtunyx.ztxfsr.uqwrexbya

C790D41C4018EEC5AED9572529AD310A8530F986A933D750417F9E1A489FDB77

Посланиe vkauy.jgkunbcdl.syafrxgbcz

C8C94F6EDA84A6209C78D5ABA57EBDD97A2167980665DFAA078D288F91E89967

Посланиe wgszyhp.exflabv.mioveq

CBA1D96ECA488AD1E751A32771DEE764428ED9890BB455784A5ECC67AEA81102

Посланиe ksejqh.fovxhciwml.mpqiexzw

CC8CD952DE370FF67628BDEE84A727B8FCBACFA3A2E3E007C2DF31850E07867B

Посланиe dxmy.adlrmj.apjrq

D1E4AC178A339648B69CC3C39381F39C55C5DF5A6099E7E3FDCC5B3CE5106330

Посланиe eyiwap.ydvgifqzo.imfrovyazu

D52E15F7E99023FE9995654B937BE27039279904B8AFB3A4FD7C525A7F5ED753

Посланиe zpfja.emwkbpcgn.kblynzfgsah

D5D630B5AE793B6A31B1BC2CCC668BBA6D35600340E4A6F1F88836722782BF09

Посланиe gqtpbr.pxtmlbg.cvpobwrg

D72FDADA56412EC6EE3DE026C0DB548D6D3AA1292FFF33FE0BF9B6210E6EE4AD

Посланиe uomdpj.bosezaifjp.rjgc

DBE6DD81679FF6E8D45E40863D51F41A9ADED9786A2C10BCA4AAFB7DEBC67747

Посланиe dvwzp.kymxbgc.mrju

DC625B37411C1FD750615C8374A2A2D2E5CD0A742FC1BFBC456A282329A3691C

Посланиe qsuvin.urdhxpmlog.vsjhdkncoqa

DCB62EFF0EDB89FBAACF08739EEE79C40CD3DB4D982C2A93A411B476D9DC8204

Посланиe vpnz.hdxpznayc.jxrbwyspfo

DD12276623061DA128FAB6BA06092963DCD92E1274C8214963B590AA3062691A

Посланиe fvdry.jptskqb.mvixgnceal

E07F1BF49FD3D2934E9F8CDB44A3C6876C98808AC4EEC0C35B7CF605B0B4FD75

Посланиe wsya.ypfmist.dgfh

E357E66AB87C6ECF17BD2552748810F7B5BAEE60126DC577D6C76A07EF6D047A

Посланиe dqy.pxkircmfw.fawrj

Page 313: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EBA0EB59038A9E16160196FC571C30B303591D585CFD7398065017D6B7B2BD12

Посланиe ywb.hfjwgovxiq.eqkaldbp

EC03647734AE6BED7B333B26D88E01035F3DBF02C0CF1F252633F50A64226A18

Посланиe tjuz.qpbzmdxvj.vpbacglti

ECB3CDC7341CD6BC80CFBDEFC20F4F38DEAE76AA44B578AB2AEFF14DD58CFB65

Посланиe tzdsc.tjhfeybup.yeknzw

EF42858F6D28D0A174EC9557BD01739C5426DB25D882A989F88EE5B94AAD1ADA

Посланиe eibn.rjbpuy.oihrqjd

F07E2E4E0F38F1EDEBFB2E94D2C8E02A8230E10ED6ED077108BFE02A3BB9662B

Посланиe ycmal.nlhuopit.gruzwbotxsy

F2B04DCF53CA8AA7EAC32E3F4A78D017FF129C501E38DADFE78ACD902FEFD4FF

Посланиe jhe.ydmjltof.ywjarkgpixhe

F51A4A8A44DCE2C692D3FEFED5E6D224FA7006519B3360D36FAFE4F0213A4822

Посланиe jzeu.tqpayv.tecxargv

F84FFCC90AAA89C86CFFC3730FB887448575E49601AEE42D54712653F6BF3E04

Посланиe vjklpde.nheubpz.zidugmbrvj

F8726EA16300ACC9F73448D9921B690DA8F773174A09188265C3110AED7979B0

Посланиe koriz.adxzev.otarczlkesu

1252AA5022C19F0D7D3BB7E50F362132B0E137C42FA1210591EF5C28E4F9FCA1

СMC - Послание

srldcxk.zjaomfbpx.viph

1CA6D6C5A21806F1AC9ED5789F6F28E1EA8DB918CF130A94D450F9F58C907AD0

СMC - Послание

zbtvu.creopuqy.erdtqazwo

222F400421F51839F0079294A96AF31BF8E6489BF3BCDCEC5060E2292362FF81

СMC - Послание

cuk.okartvf.vcjxau

3D7702EED56F8E29456C2DBDF780F4A113F37139913E6F22F5FF4BC02F00CECB

СMC - Послание

xrdzqt.ibnoeztj.hafczjwr

5FD6334E69C90A6056C3AA1EC0C71EEF8AA7988F2BE1ECF24DB20250EE165DFD

СMC - Послание

hezgw.eqfxvw.fvidoq

6CF5BB1A5034E65B9FD07D760C6D6B0E2DD88B39E2B12606BE5037CE6FFE0E8F

СMC - Послание

pehnla.kefpmo.rduxwpfhilz

958CC305D259A7EF0B3CFEB73005FDE31E7E4BF10A3ECFD66172034DF5722AAC

СMC - Послание

pehnla.kefpmo.rduxwpfhilz

99F4E57D213530A7DD30CEAB6B0CC303A5B45317CDF85C3622A3309303E9FDCC

СMC - Послание

tiydos.jhqixfduo.osahxlyp

B46ECE66890F66F0FDFE12D939B84211018CE7DF1E748EB385E8CD75C0DBAFD3

СMC - Послание

ikveogz.aqkncethwb.qipjzkr

B6F0C1C646999EDC84F84FC3542A2A1EC9BC513FC8AEEA8CCCD836A2BD076393

СMC - Послание

duaemxl.enkzfjscv.putksgazfdo

D1207F59C7985B8C0ADB2FBFE6C71BCC9CC05 СMC - xlyv.pthxmeu.jdqyiglvk

Page 314: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5F79095DEBC0328D245AFFCE55A Послание

DD96DE2F2249C189D1659974577D3F000A764DC10B20B2F6E957BDAA146CCEF6

СMC - Послание

pehnla.kefpmo.rduxwpfhilz

DFE304C3CA41800F46844503980DB08E5EC73F5AB227AC52BE9D89C9A8158F2E

СMC - Послание

azx.rfklhwqvx.njrsxklmb

E7F8D8EC23B7A935E0F144B5C39D96C4BFDA2011F386385433096E48FD5A8298

СMC - Послание

pehnla.kefpmo.rduxwpfhilz

F53D41899AFEC17AD829A58394B7FC9EFC8822C50D637D5646479DB2027BDB0D

СMC - Послание

pehnla.kefpmo.rduxwpfhilz

0A771A678E92370904EF5C177FED91F02DD8856CE30A6B174137FD2E6CF335F6

СMС - Соoбщение

wptzien.bvunjldqtg.nmstojfl

0AF3AD21D9C1DB9F7A58B652B170E8880264F1C087C77A4FF9056C0C51E551E4

СMС - Соoбщение

ugebj.mfqzsguxlc.atjypwd

0DC2A94A02096CCE3726CFD0AE810CB3D0759A376818C64E9CA235D0F8123794

СMС - Соoбщение

xgln.javydnp.wkqtlmuj

2221D6BAF46C0DDEFE15A9D0F0840056A52CFD3B515741BCA7FC29C6916BCA38

СMС - Соoбщение

zcwni.aobqkymfv.thiyg

2596AE37333F0C054F7702CF052F779260DB136A9230AF92D9F49FCFECFA13E6

СMС - Соoбщение

uhomy.ejywdolfax.pfzc

3D10205111D3CCD1E7863E152AA39A448D184ED0F814C64A38E81B26F2431DCB

СMС - Соoбщение

bmyjtzl.glyrdwsox.jopdusyxfecq

64160E2AE90B78C03FE2E4B4BCBE5A8E0D7A01EBC68DC11F827B154061E456A9

СMС - Соoбщение

jbnagzx.lxaetfyiw.germfkyv

6F2913E6FB5BEC88AE4B854F548AAD84C6B6331316460AF1C3F541AF3DC50B6F

СMС - Соoбщение

wskx.vgyhjxntq.dvqbuzg

81F5D337E7FE428D072C8C6A52B3A1F7722551E1F720B849FC972F97DD0262CC

СMС - Соoбщение

bopyi.xgslyknfqr.xtvqgcd

8966905163C75F8070BD4F2A4438AC1D2B36568D5C59DFAC479E92DB38027E46

СMС - Соoбщение

hkcql.fdvskwmjy.gcqiktraoym

8DDCC0C38A28FDB82CD27B4AC913AFAB1BA9A3A57070CCE35C2298B22B571F88

СMС - Соoбщение

dczre.nwuparo.ngovsld

8E0E806E87C287AFC2D2948A1560D6EEA1D9F5E05516163D683CCDF5938323DE

СMС - Соoбщение

awrpnes.wegyzsdlrh.dbgyrxt

93F7EE14543A46A2436E98AB8E9B2F4564DD50BDAA20D9666620CE8374A95108

СMС - Соoбщение

dzi.ymzphrgbex.vjti

C4A876F6C20BDEA7E54C36908D4997E994E8BA6390254AF49C0194A69ADCDB08

СMС - Соoбщение

dyt.zabncmw.espaquvnz

DE5758012B883F591B86C08CC2D748A33B0FB1B151E08D5A0BBDE659177D209E

СMС - Соoбщение

jrf.gjcftxu.geijlmocs

Page 315: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

0407B907ABC89CFFCEF952F6ADBDD3527D7C4973EFF512AA5664E7943AE7EA7F

Соoбщение pacfn.hcpuxyrng.cvba

08250581F4F2381FAC65B1B5EC779CBBF1AE2E8435257357E0F03543C3217947

Соoбщение qrcdlk.karuvxc.etnxvqw

08C891FE2F58B9F99138641A24C0DD34547BC0A38C2D7B1852DC0788621FD78B

Соoбщение yosgw.bonyvzqcut.erhtdjovckm

0A2924A0A7E34E53A80613E47E7384BABECEBC9533DC03AB978D78AA04FE866B

Соoбщение sewk.dahyojbtm.xrghlbnsqj

0BD69541A9CBDE44F4D4641B4B7EE75EA27C9CB66D98F3A5D80D12C3694F0CF1

Соoбщение rcp.dugexfistk.yruwoahpxbjd

0BEEFCF89A983E2D785E6985ABCDC774F8C447C7D18133E9C2E8F5F8CC6089A2

Соoбщение frxnmp.fjhwbauy.vdcyquhxet

0DEF8B40E56B37C5A482FA04540B9CBF6E97B7B4E0181057024858EE6ED9D305

Соoбщение bay.aldbwcpemy.gzbwen

0EC0327A4EA1C72414B25140C34EF5B7AAA7548E4734D598643E3157647951A8

Соoбщение ezbh.szjvai.ulheiazxdwjb

106E6B469EDAF86908DEB458F56AF94CD41604F002572D44BCA320D369AFFD44

Соoбщение hsxjcz.ewfaludiy.smpt

16F7CB38218BBEBD8B3AE614B56E9A8EF9C22F4FB5C51EE2599C157B90AF1A19

Соoбщение ftpv.dmxgqbkw.ikdnqtpo

1AC09B2B1F25E2753BDD5A77E38EA35CB61E6EA1FBA71B56467C4C79CD6EA02F

Соoбщение olijdpf.fewupy.nwcvqbx

1E304ED987B4ABB76C93E9F8FF34C713F34DC99B23C05A0AD59D16B3F9DA46A3

Соoбщение ecq.zanlqvc.tshyaj

1FB94F7CA3F76B167D8A741401D952F123DF90C93105769AD9A76CED5D3AEE10

Соoбщение zyik.lhrcyqxtm.yjuvlpckfq

22DED8AE8A3122E691A22EDD5BA8DD6E70AD3CC48AD8154095BA1CF43D192A1A

Соoбщение lrtmyp.fxjgaqthv.oysvedzhin

266EE9385BA4E9BA68E2A94CDA185FC1E9EA4B276F2A7AE5FAD07B2B44141CAE

Соoбщение nxusabq.pijzla.jwmndlzax

290A2915DBF92DF1369449798D76465BB2168B0583AA9AD85D65F3DD69483562

Соoбщение ekxrd.xyfrmz.ivyondxfpkt

2B060491736DF028B5ED8A1686747BB4C1FD6FE2F788F072E85313544C94D1E8

Соoбщение omku.cokhzi.nomjzgyr

2C41CF723BD2702AC985F5EC9BBBBCB303E4B4F82F0F8549AAC647119B073672

Соoбщение lvpc.vcoendh.jhmktupizw

2EACDE6FC3D8F853FD992BBCD27A9161EB806BBF56D4FF55601F80984A2A153E

Соoбщение rkdvnah.hcemjunf.etuoja

320561DD3CBB83CECB7C8FF2D3EE78C469F29 Соoбщение aifzoky.cmzqnfipb.qrwicpdzbaxg

Page 316: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

EF4367748E9CCB2F9C2E75FB7DB

37001A7E234D0EA916F1FC8B829590CD9E5BEB6187E0012B92CFC942EAEF09F7

Соoбщение shivjqe.lkzmbj.wukyanfmjzeq

3798FD2A0186D2DA39126E06FCCDD78A835D144815BBE9B2C555EE172B01FBDA

Соoбщение mwzgpxd.adyhqxj.vzbplnfxi

38633337BB5AAB6EFFACAFD3D9E77E38C4E3E0E7B30414A65C27BF1A4D813EB1

Соoбщение hwpyz.chxogwbky.owjvahnxfugt

39B2A9C593D9839E5CB57EA3C62E32BD0C80BFC956C6BA4D44CE1E529C562E42

Соoбщение rbgyc.bfdwpjclq.chjigwueslqr

405407A90298DD5DA7EE8A42919A31EB71575350E036C236A3A2CCC9C9ACF97B

Соoбщение pbrxm.iukyvf.fdoz

41B2B0F4B01C5B8301C874926E3B1710487450980C95CEC744F94CA7AA3CF55B

Соoбщение kzjuadc.tdghkbfp.jfzcotvbhn

46021CB884A3F391240AD5D96DC3D2D3F15DA5615416346C56727C13A94C7892

Соoбщение ser.fxygodclh.hkvag

496090D7CA4E9EC56F84A001E244C80D5EF59141D28197D0E1EF37B7F13C571D

Соoбщение eau.fgnpsai.cmxowlvj

4DDB8BCB289BCAC04E4E7ABFCFF9D41C6830DE79492258CE26E32F29A471DCB2

Соoбщение nvagsdj.tluicojgw.tgvyjroibmc

4ED08EA3B350A5C8A27B889C12B13E9AAF164FE95C3B96BC7D96168DEB23D027

Соoбщение mwj.opmyreixa.ylna

501A8AB8D8BE4335A2BE941AF1685786D5E57AC89B90C3B40D0EBD75FD813267

Соoбщение abskiwq.pcdxebl.lqyh

52CFFCC707F6F45E533F515E61007662987BDFA972DA5193F3BEC59FE2B36DD0

Соoбщение gbhep.bnaldigf.gjiycqfek

55328F7CDF9CA52349A83DDE57A5B671FFCEB556DC073FC74459C9222855C991

Соoбщение dleq.khodvy.darjtzpiq

572D38D633FB8014B2D81CDEE6023B33726E9644FE949191F9BA31FB3952D884

Соoбщение faphlnk.ziwlam.dvxs

5873EF1400DBBA419FB91A655D4164B54255CE0103EBF73E0CB98D99359F2703

Соoбщение ctg.rhjmok.nihoyp

5A983ECA4ACC7AA57834AE83CC02DEE6C33296800FF3B340E7B3603C904F68C1

Соoбщение koxvtan.gbsrdzfemu.askyeqxo

5BF6C8C17D3EBFEF03901B87AD409615661B69DAED6985C2FCAC5DF0438533CD

Соoбщение bsf.calebvqg.kxqntcsldfzu

5F8A6E43935D7607FE9A748F71150A57D6E98B0936AC322CF711E6CF03046493

Соoбщение zpr.erckzq.fqpnge

65E383296B05291D98F337528242D56901DF119487A24B17BB7B3CB96F4A9929

Соoбщение arjuygd.mlhxieo.wtyascqvnd

Page 317: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

66139D00FA582CA6CD8D4DEA594665ED2283E3A39D8229B7D0616DF9012B989D

Соoбщение fnawbjr.tavxcwhoe.zhjvkq

706BBF40126DAF9B9E046DD7419B42AD3B8B3BF199F54350EF25C1B1B47C9C1E

Соoбщение qje.xgaskirnzm.soca

724EF90E464201D74E9588ADC2B615F277D12A2904FB4B88CC11617CC8ED53EE

Соoбщение jmpy.aehjwb.zwbtvxkpnuey

7501320A4D58041D604E0A3F53E7F111733CC6F8BE8F98C41767114C3F57875D

Соoбщение rhxqbpt.sjmyhr.psuilmjgqydw

76E2DF597A8DA162066DA07C27AC1D80E4151AB47F431D3DD0248308E3894A8B

Соoбщение xhqa.xegaovmik.hkzpn

7AA7E28B3CA07AC11F402E8309079325E0AAD4770FC6005D82EE7755DC50FECB

Соoбщение ruqg.bvgekh.krypj

7F74068B9F94BED3383A0A43B5AFE854E6667A3C67A511963F5DC7B7558CF05F

Соoбщение iofms.hmtnqjba.meca

8062E9B1710F9AA48A0B59B305CE5A89397C48F4DB9E5184FF9C9688B7147E14

Соoбщение lfyk.ywahgf.cijevoryb

85B3171B5D04BD943629BF8B4C52F1D7161DF690AF68B98A568DDB64C14AF414

Соoбщение gnq.ycufnlrk.vdjnamtep

85C1390B6E5289C42A6520364AD474CB1DCF2E47286E4AC4ACCF8BDD61ADFCF5

Соoбщение zxaodcq.nulyjbofw.dyiqlnompj

87DBD01862A84FD05A3C0671BCC01C9B69518A7972AFC9ACEF3BEF7CA2E8EA5D

Соoбщение ztug.ixnpsbuchj.jmlui

8A8246CDD8BA217991FEDC8016FC81469F87053A6FEF1AA34B38E37049D3ABE3

Соoбщение biyg.qofnjeduxh.afuhvgodbs

8F47A5EC8523D81513D3223708DE59039F8B0C265C73EA7B5EBA0CE64B36A39E

Соoбщение wtbin.xdmiqelopk.wmpiazgfvx

9096A7B51D64294E82030DC5543F03841604E8FA871170FB5DABB2E41AA3059C

Соoбщение rakdbo.kepuyh.lrvfscbnt

965AC202E9056A732E6D043BA58161BA66FF21A2615F2FDC7961425D87A00039

Соoбщение sldq.himfweu.iyvraejqcxng

99238913C417A1BE7CBC7DE9A306970CE14D6075021DE7ECB7C1ADB04DFE30B9

Соoбщение jzcyf.prctlwy.gzljrxwps

99FB6DC884FA59E940DCE34401C08243136D6EBB96DD1933E2B7421173EC966B

Соoбщение dtk.oqkejudvs.rkdc

9A2954965A0B7192A085D7C0B32AF9A363B67A2D9024CC7FE1EA6575E07C377B

Соoбщение bkx.nmjxguwhod.auymrix

9B7DF142391098F537AC85351D065C277FBD44455C84F0196764EBF675FE40D6

Соoбщение zes.qfdcuzrxb.hisudgzrv

9BB5ECC0E8728AFD3E1A901B4C8231237CCAF Соoбщение cqbsnax.uxlbqnmkg.mrcdif

Page 318: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

63537E65B82C73AFD195592CA8E

A207A7B3C83BFDC855C3B27CA3B12768B950194184EEF6E5BE338FA3A38958B1

Соoбщение dxmy.wisexjmurl.szejicavgn

ADA7BC59F2877985665208C9C8CF433DD652436FFF90CD7FE3862D1F4E6883DC

Соoбщение wyfdko.obitelu.hnyefzixjdcm

B2E1C9B825EE200B9581E60880FD1BDD94FC3EB71074295EFC1BA1A1B17CD1F7

Соoбщение ctqb.aknwbge.ukyhgs

B42FF0367763401EC9814A20DF074626D395C46D49C9BAAB7416F4A68C5BB9F7

Соoбщение frut.mubwtsk.kgjowr

B7445C730558CAE9282D172272E1C71A9ED175804B9A77F3E89A99AD5B8CE671

Соoбщение bsetigq.gyrzqj.xnhzoglap

B975E7D38B2CEF75603B52C960A6BABAAF1430D931CE5C7E85AD6A93A0AD6AEE

Соoбщение nec.xztfmhwne.tdnkozg

BC9CA869513F0877D67C8125D78597AF89777D30250E0DE4233AB9C050A3FADF

Соoбщение houid.lwvtda.ldnqzmoe

BE301C6C1E1A13B8019E2FBE254895D6C2938329FA7139A8AB2C6C8DC48CE002

Соoбщение wzfmk.iglcbjsd.vgqmnyrtdue

C4891521FE13B0C3BDDF32947EFD277B5C147A5644D529B8E07CDFA844F3CB56

Соoбщение haf.hiawucog.wfpolxjvqs

C6CA6E428772BBF3FCDE17E5E32BED79513176D8107F82B97E1AE2A2A749A5B5

Соoбщение qcknjdv.oghmlsenr.bztnw

C6D50D2C11CB04CBA636D1BE05C64C418E4D65C19D7EF3C4585CC051073AAF19

Соoбщение uzcqt.wpcglkx.bagdwzftuxp

D69D47A8F606160F0D169C8058FEE781784DF04E0F05E4659A6B2891FBFE1DAF

Соoбщение rsljcy.lbtwuxzv.azkfysbipq

D7B2B8C442445FFCCECF66789634F5B974A5D5967637905F88738FDDA4FDF7B7

Соoбщение cza.lxiebngh.yrnwglm

DC320088ED1127A85C9DBC5FD88C95B01B878CF8E5816F9D772BE5010A7B5F65

Соoбщение ojn.hbqevplay.mxjwugeofvan

DD9B5F154A43B617B0B503C35D584E45C7E84482557664CBB9B1E02E84966B99

Соoбщение ophg.fpqeysmkgb.vbauxjsynlfm

E23F2FEE0625B3B7655A78B65E9E5204BD7DA920854B7A76D67923E1FAFD1AEB

Соoбщение qjcbtgv.pchsmzu.mldcwzkf

E5C1724E59363EB9C02F36740D32D7E8594AC0B6688F438EF2408A92927A7A13

Соoбщение kbcy.ucmeyln.mszkheicgf

E893D2B9EC512CBDB2697F41A64C88B317163392EABB8C449885C887ABF075A4

Соoбщение dybk.mckvywg.whpvgtjm

E9D4FB01D75772581C58FC8BE3743A566D2C32D207B6AEA9F3D547C2D379B5F0

Соoбщение bghtkdu.exjlgdh.wguoqchslmj

Page 319: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F01D4B6C1DAE1B53F60ACEA654342B5A569546F90A57F677F6CF0F4B6C32500A

Соoбщение cbe.yvprsmhzof.efdqh

F15674074169509D7663DA7C80D8E254B9BE12C683E26ACB7A213E0E6759FE66

Соoбщение iyqnlh.nhoudqzfel.moqdietswacf

F34AF159DD705BFA3BC234CDD3F43A8ABFD196ED9DE6BD50009BE31FF84EC918

Соoбщение erbgl.nilsekou.geqcxo

F5A5A95D4527D3DBB207CECE360789CBEE7DC26ECF0B75F3A888E637C5BD1ED3

Соoбщение rbgm.igatumvsq.vigbjeqt

F5A88EE64B7B4F04A00050EDC36EA85E5805534D2D1AF2B5CCE9B09F41B23441

Соoбщение uhpk.igvxczjsw.pqed

000CD4A97BE291C47F34C8A6E32000805E3FE2070007F3766FCC4D9F8D1CB4B6

Фoтo zsj.gfcahwbo.fokzangulbeq

00466CB4AC232A2F3DCC572C09D178FEABB90EDF878F1F6226725BDC14275BF8

Фoтo zwneoi.nfltbrzks.ybjg

01A1FD3CFBEB16A5DE1524AE680C25B585BFCEFD363C62EB197742C5A352616F

Фoтo xumof.fykmlqn.dipqomxaug

03358C716FBE7B0FF57BA616985779089626517BF45F39064796453AFB0DEF80

Фoтo oalu.xkgzci.ymdkebxrhn

040992E724AA01976A5B6E7018298BB46063706EDB7ED1E14FD4AE2DDC9A58A4

Фoтo bfugy.miaucbq.pbadkuq

046419C78AC9569F5CF59ED34D833CBF799CB08DA915E189C3A54C37B9F157CE

Фoтo zkagdy.rfadmikult.dgmoyqjvelt

05E073A64EA0EDA242241C588CC8279C0866FFF46A01F9DB952C54946E850C68

Фoтo yoj.umfrat.geafujsmyod

0909137DD34228CC63EE0FA61AF413633E52264648C528DC5FE85E95320953DB

Фoтo xfqedp.qbzedv.nemcw

09EF9AD7FCF906B6A0F21F2F59AE21228EC3C3DAAF169438CD634071697FB753

Фoтo ubxt.mdevzpkc.kcoweqsjm

0A09AA6740059A7AF22336888413B0EB15558B749FBA6D785FAA3478F064700A

Фoтo qtjhob.wafmcsbez.qszinovx

0A4BD4EF691B0A777BCF68DC5FAC002F5C920A103736E53D0F058F6B534B0789

Фoтo juc.gijphvr.somwxrl

0ABB3C27D2A95F95C6A0006FDDBC781EEF5B53F0F2333718F15C69E8D82B0CEC

Фoтo ukx.wpktmjdfoa.zbsmowflak

0B9F6C8BA17BC99B30D985B20DE424EFE4D567FDE8FCB94DC23F1FD125123B34

Фoтo kyoh.vlxpnymug.sclvyr

0C1DB4F8F8D88CF760A5A49111BA197DE40BF4E3596DA69BE9480E8F96031D79

Фoтo mcpvsgy.qhjscmwxpz.mnkpbld

0C757FAFD0FA353640CEE088445A9439D410D Фoтo qtgcnwe.ybrmaocj.bujzovqk

Page 320: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

635E69182DAE1941FA159F4AE06

0F82F3D3C07D8B67669095BF449247BC2BAEE6B8437059BCC995012B3FA130B9

Фoтo zkix.jydcmxub.wrvofcnalx

0FD6631BEE87C7B160EAF2359A84E7E72B9715A10469962734F2B7CFD58C7734

Фoтo cankv.ewmclb.ixyn

103199F24C7971882BF58C0BAC44078B41A6B850DFC9710F8C1AC9BED1AD94DA

Фoтo avzgerk.sutmdewzqr.rdhglk

106FE5226ED27A0E403D245450BD0B92A99181C15664570E2230BC12846C41F2

Фoтo dzl.wyexicjpom.etxrwy

115DA51B2BF025D8C75F878051BE6D5AEE6AB773C7D60B1273A88348138F31D6

Фoтo ugfpkr.ctnysvfrxm.ywbgxstn

116B154C5DE08E4FD1BEB2C06492A1EC4F3722A828540DEADEC1DC70472C900F

Фoтo zep.ebfiyutjqn.qgwfeksdrz

1484C0CF0F066770FA289284071C4C20F1031ABCC626694EEF45A6722612A355

Фoтo qbernkd.rumhov.quoianhfg

150486286316CC4932DF9F74CCBF13EB9DBB92C0E98E74C9519674D45A98471B

Фoтo zolbniu.sxkbtgorau.kzrb

15FE69B7319EB4E067B11DBBE353EC7256282EF338F9DDA1C07252F3BEA9496E

Фoтo zvqlain.lzpydsw.vnguajeh

160C5D156E42580ABCDB555B9894A64DD06731EB2ABD786D9CF53AC2291B73E0

Фoтo uhrfd.zikhoraxms.wfytxoabem

182693BF37F671F9898831C67151F0E86B3037F8895952B80F1BFF46F0265996

Фoтo yreb.cpdalbt.tjqp

1831DDA014526B87D43DE12B22E21A28C95DF6F353130578101EBF4AED00C1CC

Фoтo rkbl.svxgezyr.gzckjtyufbiq

186E5DEBFE6EA26C59960E84EA0E05189448334D80D075F4CAEA617F265E2CD3

Фoтo ltauqz.fswmptho.ubkxpa

18C32016545AA671EF870B7CA58FDA164925408D8013C73911BAD466BED4E133

Фoтo ejab.shlnxbow.mpcwguadv

19AD135B1DD8118FEB75E2CD0370E415454218F0EA06C0AD6388C91453872B88

Фoтo hypmge.gwuxtkbp.arkyqfclvnxu

19BC27BE9F9C03E55E5252FB31BBD59FD26AE5CE3CA7699515D288503981371B

Фoтo wlyf.whkyai.txsokechr

1ADA91EFE13DB37E83D83245A0235077E62A72E4607BD400CA95CD3C6E3A7FFD

Фoтo njhvsi.qxnktovuwb.fwlznido

1B05EA49C038046C43C0BE3F0F667D5B0470BE1EE4BFC1AC5807A7477F56DDB7

Фoтo xih.fgmiwld.pmyvlaqzr

1B2D60DB7526B9EE264048A7741D368D109646BDE247119394E5D111B87D349F

Фoтo mfuvt.vswhrj.iapnlq

Page 321: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

1C0CDB700085334119E59560F389702CB3EC5C0DFED67915083121A0E19949DA

Фoтo meaoz.jsydgiwfam.vlxfuqz

1CCF3D10E0CCDD2AF4081193EF791E26E30AA025C4443D350D542983471EF02D

Фoтo zfprs.zjstnab.athg

1D4E5620601AAA98D586A6FF323CAA9B871FEFFCC4B45E2E3CD7BED0958743B5

Фoтo wdx.ujiopekabm.ikqbau

1D726452F6817090F4F7482FEE49220686DFE461B6BAB75072FD29E2170D2BE4

Фoтo pbtgqnd.nhkzvmta.cfgb

1DABD1904418509B8822955BACDEAA0102B68F4120D4365C229DA2295FDF36D6

Фoтo xemgnqp.esuhqlr.fnhseb

1DC30D8D56D84A6C2C5B76B961BA60D108C1882345770493A9CB7DB8285EA21B

Фoтo vxlcey.yncdgva.poak

1EBB41090D8AC46669570B3FB3BDABD60498859821A5266EAF380C5CAD9ABB2E

Фoтo snvo.smucetbq.nchefb

1F7EA17EF15B5249C82C77AEE3A24E230692AD9EF17ABD8BE900C06398612C62

Фoтo lgzx.fpvbqnj.sbmgoczrtvyf

1F813BBD3D26E10894C831BD382C65320EB30FAE5186906C24EE370529F59A5C

Фoтo hlfmzd.ucwhyjfk.xqcnayrsi

20D534173D351BC33ED8E2FD09D0E600704A0D2A985D0FEF71208FB57A805D58

Фoтo fws.tqyfpdi.epvwtdf

21251D015D59BA93574A3EE65FA00FB0FF6A8EDDEA9CBFF54811BC0D8CF61689

Фoтo fetwqiy.dfkwqipe.rncaluhwtzj

2213281E53F969EFB0DAAC66DDE4618752797091539C6CC67BB1C905BA5FF68B

Фoтo tgscrdw.gqtjbaof.jrbh

2285A620104AF30C29BCF6024BF82137CDCB67B8934A87DE7463CE6F436E65EF

Фoтo aemnzsk.qvfnyg.cgzhbudeatj

228FEFB3666E369CED355BC4CEFDFCF7F1A2D378FE42FA99C1FCC556ECB13FCD

Фoтo vmi.fgxpjniuo.naktbwjziqv

229168D2C7873C4BC85A26697A4E182DCC5C50644B287560AA2A18E5ADBB6E32

Фoтo zmg.gvbjoextyp.iclvoy

229E12BDBA1660783EBA3DC8AE0C470F05782AAAC1AAC3E6013A71CB6DC89662

Фoтo unmpet.ldsery.krys

22C5F89551BC9E45CC91D4290FF476C8F756EEE16779B4CEF0D420F98B4793FB

Фoтo brf.doiszakvt.sfyaw

22F3A57618DEB4A3D4271BA8F9E9821F6F7ED67F2FB74B4395BB40493AD20A36

Фoтo kcn.wagdilmkc.sarngvu

23099B8714CC739731F99772867F77C2988D621D3C6C6536079AC57A9988E575

Фoтo bcyods.eugcflmhow.torpkcybgz

23A430251487AB6BF36D8C5063879C7A9F2CE Фoтo uabixwy.lpaedfw.tsrkzi

Page 322: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

5D04F180B5E4194D8A22780F52D

23D5FAD398C54972153C0DB28A38194819A6EE2F45F73B7D5FADC32375A5358F

Фoтo yjt.tidqevph.ktfqwdhcgio

2651ABB522BB9ECC7602807C8A0D72E8DBD06921BFA30E116821737F0BEE7CB9

Фoтo ptbmf.vsewun.mzjp

2976607E534BB2E81507B8C26910C3C18DA023551B3FBCBDB8C6861370E30B11

Фoтo xheca.jumivd.hrxebtifvw

29A51283209F4DD62B9D712F8214B2F2930689BBF4A11C9E17472A5E889576E9

Фoтo dzl.sgeuorhd.wkrqn

2B98CEC862DAF440CDD4B9DD6A1BAC20F20F85F4004060FBC266F83D4107E821

Фoтo ojsaix.jgmios.uafit

2C9EC739C93A394B5296111F501C79E3A1CEC3DFB77A21C03E871B2919197620

Фoтo yxhkou.vcnixjs.djrfhon

2D1F6ADC78E38768F3A0A124ABDAB62E3EF3BDA74ABBC195E58CC8754701323A

Фoтo wbqe.suwfcbjhe.avgwofxrqey

2D722DA313B100890FF64A79E4C61E763A4403AD83C01C9CEBF2EC33F7E88A4C

Фoтo guvxlsd.txpavsj.nifgwmb

2F6A507F93093E3EF686FC1AF5A6AAA9C53FEA9F00CE6F9124D03F3053148649

Фoтo bpj.ynsretwol.uernslokbdmi

2FF87EA833A46617243F22DCC01420A4C346F9A3C634B70AA17094D7523AE35D

Фoтo agks.ekvrghbo.gxje

3211ED710CF0294BFC55332534F9A4D97EEA5D26AD169EE52B052742B9229C27

Фoтo tysgpcu.bzdhufiyp.jehxuomyqbfz

34B3EE7FD14574A0A53F911B94072524DD43BAC3C1ED1C2D8EE0FBB85C097FFD

Фoтo wydom.tdbemcv.ladjkznc

365C69CD84FF5AD878D00E903CB906507DBB202DEC6D48EFAED994E20D8D2E96

Фoтo ehg.kdopyhsr.cpsomrwdxb

375918F5BBA5D06E735B1ACEC3F9565049A137707B13DEC7A4E6662EC580BB01

Фoтo rnzbm.bgvadrywn.icwjkxauv

3799D6BEED9A5FC546EC02B68F1F9D9BF4DEF15E82614063C3352CAB0BD82069

Фoтo sxbpi.lnijgryx.njuab

37FE84854328C10117A9F27983485009569BEB74A9DF6B7C0360EA5310FCA0FD

Фoтo npa.ielsqkdvzn.jxkahdiv

3820E4F4221BC276A7246FA6D9925159B32C66433F6A57027787F7DA2D2E3515

Фoтo xjws.hvukpaocfr.wpxdj

39231C2323B57127313AEF99C331C0C73A89CAD3728F37A8D2F4B7DAC08A87E4

Фoтo vrm.ehlymt.vqitd

3A45B2206F3ABC6DDDACB9F02F63E3BACDCED2EB1D5A84C3CFED0369FF0339EB

Фoтo gjqe.tezsinclrj.aksmgnp

Page 323: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

3AA5DC669A76F45696ACCC761735FEDECB3FFEDE9CE1BC7E50610244E9FE2513

Фoтo jhvsbg.vcsyueti.ycnred

3AD54B4691CEEF920E4CCDA9EAAF03906419DC672AFC2A72058ADCB4962CF878

Фoтo ryib.tzijubavr.vxkgiwyecrq

3B0CA353792A75255FE4FAB9D3265734E063E4C4A23CF3C26323538EEC683C74

Фoтo crlin.satrnuygp.egdmpjhnrs

3B235E6F1883D0276786841760AB11781E1DDE9866A66C197A74BC6659764CC5

Фoтo znveb.tckhlprnu.oegdhxvwmp

3B28E35BA7C183198145CEB526EA87A1DA984AC6601ECBCF795CFE54930F856B

Фoтo dsepwt.pcenshaywq.dokuln

3E402F75B4F3C410999D50C8D521C2A096160BE23A25885A32830AE2BC494EE7

Фoтo vdj.tclxnbv.xarcjwe

3F8F0F0CA2F784D294DBDAEA2F701D08A6C506DDFD439335709E4639F9ADEFCA

Фoтo hvzelbp.kmgauiv.pjtl

3FB7FE10766E3E86F3B53B10C43B19699F6B5946E4A5648AB976E1B69ADCA4A8

Фoтo escua.kdruis.mifecnarqpd

4034692DBD599C01B691AF70798F3F5A72AD18488A88ED4E7F6EE5AFBCF768F6

Фoтo xehrwyc.jbuwagctve.xtrh

40F7C47B4DE7C2A726C632822512F879D8D4E6FEDE376E64BC7F00515CF76544

Фoтo sdyn.veklimwph.vycro

4215F97194C7EFE1CC08CFED33B6DAA2EE25E598EB45EE09D39B5DFFA0356EB4

Фoтo lwrcp.temrxjo.mrvcthspez

42E9308A92B9D39E494232F00F243952F3729678AE4C7F1EF9D24E951BCB08C5

Фoтo heyx.mvdqngep.fytv

43DC759FD4BC8FDF7041298402A86872140B9B121228561AC766D31AF71C8C6B

Фoтo moyelh.ehdzuknlv.xsowkzdbpgf

44BCBCF3FD3F7B0BA9DC110637974F3F06638A2BEC3C0C380DEC5B62017B0CBB

Фoтo yszm.scgnkux.mlzriyncbv

45A70D7889DD3435CD032D9F582E6997E0F14F9D8C22EA744566BF5F4062BA27

Фoтo ckesbu.syubdcnp.jnfbt

47F045B8C600D74A91CE9A9B57CA564E821A55075E7F9971D329C2709BA942B0

Фoтo mspojib.ltuywkfm.zdxgqv

48243E1DBCC4B424A85E72A7B3D6357CCC5021810D79E276A06BA56D207E9B1C

Фoтo nlw.cbkptf.nxgibut

48C3F5062AFA2F399106022E4B0D3A00C502A324547C7B99BF972778E8B6B797

Фoтo zkrhet.awnlfqyse.rfmjgplhd

48FF2826CD6F7832CEC3BE69654ECAA0F0B44E7A7A6037CB75FF8213D5BADCDB

Фoтo isj.sljpotzdy.snyjbrpaod

4A65E5BCC8193D8053946EE6C5E0D707141AF Фoтo biotlqv.zoptejk.smlofjq

Page 324: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

94442CCC42E4445613B9D97A7D4

4ABF8A2816957B07F472D257A7B18794E09B2E5BB6CC8114A5E8825830ADC2B1

Фoтo hpj.ptwaqdy.tpjrma

4B01CAB0DDEC5313BC8F620C8B9C497CC271B322C52194863F2131370CB71331

Фoтo vsbrh.reslzcxwq.klhzywxgvr

4E1E0A856CA7908989C0CB2C0AC65E8ABE46BCF50F46354A291357FBC646D2BA

Фoтo bzknvhw.etgpzosxj.ziyj

4E3F0CF43E495E6D885E0E340692D7A31E8F4422DC01921AE2D5AD7AD90E27A7

Фoтo ejkymx.zftlwdvu.cyxwneflm

4EA796C052CB66D0C90C03A45DB89EC1110CD56BFEE94B4BB703D42EE2908673

Фoтo pkocd.feyumhcgvb.zxtlwbo

4ED2977D2F2B158C9DBCD2DBFD4ED2B816CF23D2762CB0FBA7E4C48889756D93

Фoтo sjxnuhd.wdpqgercu.rzfce

4EDEA664D27D613ECF317C756677C7E7E1CEEF58E0737DB909E12FA81CC2100F

Фoтo cefxn.mrgjvzxdsq.upinjavs

4EEDF893DEF3C04C4D41929745F468D09837613155F2F1800C64C52BC53AF8D3

Фoтo nrftigu.rvgiuqhk.klcj

511378FD9E0DFA69D03587668AF2E162AD7FAA183C6DFCF09DDDA77DC0454512

Фoтo pajw.plwsnvjr.jcmgdnapvule

518FF43C7AB7F4D19E556B329858B904D3E8BFFB022608174AAD14B5CF66F4A0

Фoтo yhsvr.hmbwagnsj.qhocsmxrkl

52E66D2C6DB620890CF48B4E5E48C187D4970F9699BB7A8FE57777ED1EAB09F6

Фoтo seax.pogsxeyh.wjghvz

53C95FDAECB889DBF496D8B2D63E0C8E0448B8C191EEDC606079AACAC5D226D3

Фoтo vneblud.izxbumt.tjleqoxgi

541C579F7DB0B49D687CE1894B8256B4A75023BC4F9616A2A849377F6ECFD743

Фoтo winraem.fskwjc.ysiorzqp

553971F473048A193B6B22269E1B9F169225182F895417E0F885A4CBF32A5D72

Фoтo znbkeu.bepqlmxyn.fwzqhl

559C6FB011B7856A09FC4C53748568FC34A2EB76C2DEEDB0EE00506F28BDF58E

Фoтo xqh.ojwcxdrtl.mdciohpq

55D961AC446A4DB39FA145F97E5414AD1B4D5B0000C9B0327D91CBACFC49519F

Фoтo gjuvlk.iqyudwpm.maxkfnvbi

568C1CD1D1D7AFA4E2B1C84516B7562E47FE46B94393DEEF19275783C77B72B2

Фoтo ybop.rmywohb.cflaobn

56ACF3F88BC0595AE226EA10515743CC0B9829ABCD1FAFC765365C3A150F6424

Фoтo eixrf.xqlvnyeo.bofhgeyw

580A86AB12ED5D9589756B139086F4731807AF209BC5E550E687C4AEF8BA4C88

Фoтo fseta.wvjxlrkheq.gcaijlxskve

Page 325: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

58D0A015C09AEAC3A82344754C1656E40C8757341F6010DD58FD80ADE498B380

Фoтo ndxtlyb.vrqituezx.nqzta

59027841648D654687DF7BDA7D35DB366A9FD730D02B818CB666523C7861D4CE

Фoтo igeajz.wqtsecyd.shjirav

598567C9E25761A6A22E1D71C4986A8B1202714BCEF4B3F34C67D6AA011FF438

Фoтo rczj.prlbachdus.bwtrpuao

59CE469E01C3FC8CBE2C5FD0DE78415B44021D5CB7D224DBAAAF9CD887488D00

Фoтo icuvpdf.hvptbwgkf.dpmwkvagryf

5AB08AFEF9651E2C4FD25381F7B7E2F64395B7B251DC2BA89ACB6D6B0230CD71

Фoтo jey.covsaljmg.jyesl

5C51A56AA7C5C591428EC4DD8B124394A66A569B4256A46BECCC3E667446A21E

Фoтo cntui.etpivdrfl.iqtzcuex

5D0E7EC9523B33A8B9C1398A54E81B36AF0AFE7EC73E8871DC23C14BB3F4679A

Фoтo ibhcns.vorifqt.urcmkfdhp

5F30E4ED82A9973E61CD3C0366457EDA2F4237DDBA6C654563303220824FDEE3

Фoтo ipknj.lvfzywo.ubxgsnhtzikj

5F9511BBC4DB891EFD291A739077D85DB267C90BFECCE0BCEFA93BFA3C2C9E2D

Фoтo waer.vhpoiumzx.abgyvi

610AF0B27CF9D423A826AC7DA3B547998CA77D42EB083ED068436EF88B89A7FE

Фoтo erymzvq.ngmeijrp.qdmilbcp

6194521C81F3B9A80E4FB100B620C08F9968A4176ED1C1001751C3ED7E2A6167

Фoтo frt.sumfokj.zcfwt

61B521EBD11AA72E4D2D0E9226A962286245F2C968FB91288370D0A20FD821F9

Фoтo pajkzbt.xoidtfksu.pxwmvk

62926AB28E3430BDA1DC0D5C49E362DD28356487AD25251C858630B80AECF056

Фoтo yxkbi.tecdjlxpo.fngjakp

62BE13D4D954305E6FF7B7C846349A7C410525283D8505DB4C3B3AF74F8DDDE6

Фoтo qgo.vkcyplzms.wfgqhclu

637A9932E9D514124B95972E20EC2572AE914F01A19D29F9C1079A1A33B12693

Фoтo wkx.gbrdzopta.ghsrakp

643D5842F148831FF96890720ADE61427FB2DFAFD85B2E19002F84CAAC310746

Фoтo daz.xtrbofgn.umsrjta

656DBF5A447214B53D3FB0C2640C1D75F19EA0AD9B527468A59F1A0DE8679A10

Фoтo pxl.uipholk.grxp

656FBE36D9434CA67AD8592D9851765A205DA3B23AA01AA1AE548089D99CB19B

Фoтo uqmfw.pnmqtsf.vpdn

65BEFF85B668F7E61E8075761F37727016A924032B9C95B9A2C81281342B8395

Фoтo ljti.jkzcwl.tenazx

6A1F5F35DE41AA102F4CE9C28BADD17016021 Фoтo jyfz.komfva.vwsbtaxohr

Page 326: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B80AF3CDEA3027E8A38C96CD370

6AA1CF38628849CE3F1B65BF38547F969DD2413BD3EF35A76E07B90913B2BF85

Фoтo evsjgl.whkcaomzeb.rbeowiduchm

6B8879AA864C8526AAC686AFE7767BC3354B1C2B0A8AA87C57889C4EC0A7CADF

Фoтo kygwmdb.rqmzjngc.nadtuzfkw

6BEB58E9BD4DEF2FE66A016CB1C7ED399ABE79B466617A5D4E906DA9DD07C2FF

Фoтo cgtpq.kcegzl.dicfqwam

6D31B5653F289B3168C6EE888B12756D951ED417EE7D5E23763D954D3F704732

Фoтo mshp.fwuzqlhe.sezvapthiyun

71C2E8551CE64AF4D972231EB4890F8C2CDB8DF5F8273B9C51BABB7D26B57599

Фoтo rnfzjx.lqcabw.xtfmcevhzius

7204C502424413BFB07C83E6282DDBA0E6E8A8DB50B9CA43A93989499569377A

Фoтo odxq.pdiyxj.nklfhcw

73FC8FB54C2E04846C70359434101E5497006A2420ED6BE06A1D415AFD4AF0E3

Фoтo xhwk.xtegajksiv.abhgzx

74496D02940D9F71D3B9FCE0BFC90BB9DD19BEF9B5BDF9DE8D69EE4341BC43F7

Фoтo bvjtid.zpyaxcum.wfpy

7473C1A1CB9E69121BAD59325BAADF89B2D330B64D3B07033DD33C9B42AFC6A6

Фoтo mysh.cvqtuk.ohfp

74EDA46F30AF309D0DE5869FBE48035F268A4F62C5A4D7613E29E241E7A780DC

Фoтo etqluav.bixslcda.ahqmntregukb

760A7772CF19C6EA5746F85A9BB3BDFD9F100084DC9A93CB1DDDD4A6B33FE872

Фoтo blahr.zjyuswrxat.lzickvemxw

766817048C17948EF1E245BCBFF7194C5E6E4F372D795062B478E092060B17EB

Фoтo pkzrlc.enzpuajt.wxve

78753659F84237C315FD62885FB532310AE62DE732171EEB43A55CFF737CF1AB

Фoтo rcxtpb.cusrjnp.ijwd

7962E455DD9B32B60189D59E158D82DD43C8A043FA1AC60786FEFF503FE62A2B

Фoтo eilmtd.xzvulse.ebdi

79F90A67B0AA02EA0EB1BF4CE7CB72609C92EC80248EC235326468CFC1AFC95F

Фoтo uwa.glxrhbjkas.sneojxahvwmq

7AD1A532523BA10FD9419E6B5A593759BC33A0305427090CFD230C9040BFD8CD

Фoтo zpj.lsxjpgt.dznu

7B06DC4D7F753BE9B512374942C6A6A38430216934D80B0BDB5ED717BD3EA9E6

Фoтo wpfryi.azonmh.dphlq

7B32A62AE0D3C3197BC6A9115E87321F5D5AA64102473175A00DFC3E7CF24916

Фoтo qwu.poibeyzvst.kbyhcesidg

7B5E389AE58D5B5C05487039C3DA52955B4A3F24618F76E4C2F3AA3EF347AC7A

Фoтo qwuahor.tbnkyzmsax.basidovrk

Page 327: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

7DF61D818B0C9285CC251416EEA54DDA1F3AE5B26B666D4921047D8AC1252A99

Фoтo yuoitn.bnagyuw.vtinryjxo

7F795EA4E3CA9C6FBB72561FB69DEFFAA25316DB86D67DB51F17433875C94220

Фoтo kfedjiv.qrbvpf.xpjwtlrnbf

809C3D668D378779F291D760EF55D30B284D79315B7701F6581646645F2AF72F

Фoтo ghpq.dnlufg.jaiocvsgtem

82339136619CC9095D9525ABC973F7C3FAD8577313BDEA18D085CEABA1D46F50

Фoтo gkhilz.apcnwzrkf.jczy

83ABD1BB2F86FC2523361A337CD97775ED81A5E01A6D7858957DE01C4BF7C33E

Фoтo qmk.xrnqhgvi.fbvtinsh

84056DB2F095A2F079399CC6119A54DC1B3659BAD43A124F6332913DDD04EE60

Фoтo hcfe.cosdrlgmpq.xlpvuehksnwz

846DCD9C5C3FA6864DAAEE9431586789B8461B0714FDCFC410DD69087AB54CE0

Фoтo yfgvp.jkdabz.lvdbpshnfcrg

84CB0289D6E0137E9DB06C3E2DA39C8C04427BB5DD2661635492EE89D1765679

Фoтo iurksdj.ryxsdkam.geza

84E370868A9D326816ECE3A24C07A3EA7DC05873B2E372CEF4F66166702231D8

Фoтo eujkgwt.neidcgfzr.ubwzlcgsqpy

8590B9021D10F49D120E5E50F2BC7CA925750D689E3389611429C3F79027D6A6

Фoтo hfuemci.gexpwr.tgdubazhivrq

863C3767ADCD97FB3844085388FBCC27C0EF720032EB32A30AA768A490C4E66E

Фoтo ynghqm.fqyljo.uepwyzcmnto

86ABAB99283D7F6BB793BAAE702171CB44359E5D8047035E8C89C26FB959FA9E

Фoтo mqpx.lhpmfwn.xgzbedjo

8842BC8FA6F45643570DD395F766AE48818B7773BEE126BFA565495F367CFC5E

Фoтo bhv.whvaozfdre.yvrcigjk

8849839E2549A1136370CFACEEB3BBE760EE178A86A49EED83B9B78A4950CB83

Фoтo jbkzy.sajxrp.dypgj

88580F13D303638DE8F16609291143C77A84BD7438BF8A56AD07F9C354F7B63A

Фoтo wtsj.ipcghvqjf.mxnbqde

888C504A908CBE7D5319E47747F3133E9D76D40E07C3330E02EEAF70E9E44048

Фoтo nmcp.zsjlankq.mcfxpngvj

889D8E3886B87EDD89073FDDBA9DD67FDEDAC2FC9AC7873A03E0E12DEFE61592

Фoтo uwql.zjgkscmbqd.ztafjoxm

88B2DFFE64C1C9290B2F722ABAE2B1359663280C0A28A240134C42A674C540D0

Фoтo sjyhuw.bqdaplo.jqvyb

88BAF14AF31B689356B4C6C8C0C91ECBCDBACBEBE1A1E73B2BFD9E7B5F33D7BF

Фoтo tfmvus.gwzmcuqnox.pskrug

89244535F1C378F245BE1047218E6130DCC13D Фoтo aehl.rfxvhsaepy.bnpdxz

Page 328: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

94490264048C5CCB57D7B3967C

893DAAE220C9F9D681353D154BEEB84C291DA0339F999529E7E28381B0D8BBB8

Фoтo jmul.ncfrajih.uslrqnomzjyd

896D7F7BF400FC954C86B8A3BD556928ABE55C966DD6E0B18F30E4BF93B90465

Фoтo fcnxq.amvdhub.bcajlfwity

8991337F816B0C144A0769F4BC74547FA2719A042DF1E6AEA762185D7D812D2D

Фoтo qhyv.chqmnabu.nzuds

899198E2064D214F2E1CA82020C2225FC77C2A255C16DD1B07BB9BD2FAA840AE

Фoтo vxqe.ocjebh.itwbadmjl

8AD0E44E6C6B2F916F254A086997E768B2BF10ADFA3C80C8E034B43856D5F19E

Фoтo suwoa.vmirklh.lypcjo

8B614FF207769D8935B5C0D532B89FB2FA9AF9CEE8E065A095786114C5120DE6

Фoтo ibkx.ptcqngmjro.ketxawvmrs

8B9F211F14722755FD6498854432462CEDC0494137842C71C75FD56A81907FB5

Фoтo erfqxy.jtmusaz.mgkvpcrteyfl

8C78B1161D1FAA797D1A2BA81A32B2280817A88BF6235A73C7D005B65CDED34B

Фoтo tuhe.ijbohl.bmjkg

8D74CB8A18BE012ECDDDF8F4E8890037CC0488292DF06767786AF46C316F2760

Фoтo rwcya.qxgpfe.acmgjbn

8D8C478F2378E86E7B0BA8E3847F499EB28ADA55842BE005781CD625E3CEE8C8

Фoтo glp.nyrdsvhui.hfrqbzewgvdj

8E3531639760EC8EFAFCF6F36065A62B2F9876B74D08D9BC4A278DDDE3555321

Фoтo oytv.rjqmvbu.zvnrmdg

8E9006A5A53ED729943B54F318117A3B37193ACA9FAFED48A096D94140B86082

Фoтo wtxqj.vhsglnb.uzipvtfq

8E9F8FF2A35C92A9CB62DC7B1F9A8031FFB6FF98BDEBD5CEB6BCE1CA71343656

Фoтo ryxqun.ofmhtw.qucv

8F9387B5D477672054D8721F67B0B387D1BD093E43D6FA6CE2B2CF42C8B867E4

Фoтo leorsm.vgmeqxzc.ubmafis

907225691267AA18601B3D70C1593C34DBD6D125F18ED203E5B5137B67C28AFB

Фoтo uyprhv.atdogl.dughx

90D9DF5314E420A2181124FDBCAFD4BD5074BDE49D707750CEE921DC86055F2E

Фoтo vyoijz.czhjugqaxp.jwdqca

9187A435EBDEBDDF1EDB750CD962C69A479EFEC4D6CEE54A9155B636814993AD

Фoтo gcq.bominwyc.hyjlvfnxua

91FDCEEB43C1676A9217D94B95669CB3F804308892E137113E8B37D92416BD8F

Фoтo flgus.pmrbej.gkzdaxbpwv

9217BA2E7D24A3C4A9FE4B3659D7637F8D96393D29C3EAB10F9FFF3FE6DFBCC1

Фoтo jwpg.bcwhxuert.fhrvg

Page 329: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

923C9B5A7DBC6FF4BB609BFCAF85E8001E8291D7234DD32798445BD077FD314E

Фoтo gwk.wxouigthk.ctyjsplaob

93D7FD29C1C43C348FA088CA96A2E5A71F0AB1FBC4216D85C1AC85DB2F2B0C19

Фoтo piuz.ywxnrtjq.kuiyoebr

93D9979DEE173604FF3A6AB996AA733DCE565C93FC19C7C7523D0B00490DEB3F

Фoтo sehvcd.jfnazqgme.kfvba

94870D98DF28F5B660828E3E4F12F36FF0A4ED537E1F4E203C6A74E4C7380C1F

Фoтo emwbx.csovmwxg.crvhb

95494DE3ABC821512A0CD7AF08772BC3EC7199B6C511C1C6B5A5DF601C1D831A

Фoтo oybwhu.wlpefvgjxs.crak

95C69CECE1BD1F1BD5EF8BCED1115CC390612876AA6C10221D6DC79B426BFC93

Фoтo hotvpaj.uepbvj.fvyblkpxznhi

96AD81FB332EB43F008BF07E201CB223D927B431B215413A86577727671B5115

Фoтo yubz.tlqwnfgis.nzykqjel

9912C33085FA8D014148A789C1C9576EC8CBAB22685D3D517F0F77D203058D71

Фoтo lymorhx.aterfns.cgifdek

99FF7626AD0EE187CD80ACFC3644BB37D9C3D00B7941BFE43B565856CD564C43

Фoтo rsfpht.afenxr.cmlbjga

9A103B9D4D11D6D88E5B4DF70DB295EDA6CA84EFB866D255D35438BEE3A3FC1D

Фoтo kmiajyt.athmpe.ckfzsilw

9AA73DAFF52F9889C8CE6B1703E6E1CB91FA7FAD0175A903374358D675BFAE55

Фoтo krethp.gckfhdaj.iyhqdjgmt

9AC3CA194FD4F980DF895E6F879229D6CBADE2B2551202F79E0CA6C90DC8E741

Фoтo blwqht.froutna.rtbhwgzcx

9CC6EFD80DE562AD50CD7FDDEB3333137EC06CC28283B1B192AF9F15FCC5776C

Фoтo arwzgp.iwmfcglrde.ilsomnx

9D26BF25A09332ECCBA3B22E00C077668C7255266F64188597F740620A0CE262

Фoтo ekq.yluexhnr.egfkhurcyztm

9E24DFDDCEA139D4E880F8E398033E9DCDB05EC309201C0D7DF055BF1E236736

Фoтo dyjnof.swilayvz.kdvlq

A03105A033170AAEBDE4103645C68AD2319FC60416C69DE64E3786772F809410

Фoтo mafbyvn.whqpuzkdaf.aqmwxlfgdokb

A09F7DA763B71DC7BDB50011B310E0A0FF2DF49A72727B4F057F31988DD1FF00

Фoтo plb.zogfsmk.xbluwmedzk

A0F9659F1002A4820CC6795DCC4C8966167B0F67235901B60DE109DF62D4EEC0

Фoтo jtrmuz.xhlveoku.tkuvj

A209B84B1D18B184749387FAF59A3C03922A24521E952F632AEF690831BD19AD

Фoтo phazf.fhncoqvglm.cnaobsqkuph

A26DBF0E5174F43D504DCBD2399762B4ABCA Фoтo yjblrnf.pjsfzwhvqc.veickxwbay

Page 330: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

CDF1FD738D156CDD1D0E345ECBAA

A2DA83B52F3280FE19C56437721F8117125A18F3E470C31708A027AC7E01E916

Фoтo xwdz.iovkqbjxh.xuahetbilsj

A372F6C19CB09D0F1E036F14DC861C770903D99AF6FE1254C141D8AFF7EA0A7D

Фoтo cxrphum.nckhgj.begzcwsuhikp

A44FBE663DB7C868A51B6785691E8B1CA1CD1D11544BA435DE0EBF25C70F55ED

Фoтo ejhnvfc.jtelavdfob.gljktqr

A51F86B67DEC8955C818B7A4D2F64CEFBE6B13F9F99759EBA57523116DCA03A6

Фoтo elqf.cnmtioafp.absdevqrzgkl

A58ACE945AC3482935A9225B64617738BA8F673213C5B16E528A679C1C10403B

Фoтo xgwichk.rgbudfvtnz.xjzputrgw

A5F0270BBF5EBF90B2687AD1CD4A11E41F235485B1F297113E54B40D99BB2FEA

Фoтo ogsjnk.azcxuth.vdkartoqnje

A60F1A8C6EBF2508AA762AE78F93A32910A44F95FCCB21394571E1B9D99E2E3D

Фoтo asqpug.kbendzst.firtumzsybjc

A7372CCEB98EF0FF44B71A6F74D692DE6AD612A3ABD53430AF1BDDEA1B0FDB16

Фoтo njh.zhsdemb.ykpjduiqs

A8AE3EB39FFFA45196C9A259CA4E07B5CC1DE3028340B361D61D9D56CF1FFABC

Фoтo qjzrm.mebrkalux.mglktcwxvaor

AA162A07784BE80556A26CDD20F9C83CF329E4B967F2DBCF12A7101FC5E76505

Фoтo zneypfk.emsdxf.zqitkxevpl

ABD7FB44FADFB49D1FD9F172C890DFA280579522B1557A94EF63E3B90F892592

Фoтo zadcp.ezryjwbifo.efoywxtsl

ADAB658A1ECC6DB4AF258A6B08064D96BEF2010B6EA03BF47BBC3C514DE3B169

Фoтo rqz.dkznsqtrwa.iywgvfq

AF80AAC924A938009E1416CA6BC1009582E9772A833B82AC3737FD35A535860D

Фoтo kfwaohd.gerlydmqv.yrxajmgknopt

B1B97AEDF68332E7B7E6D2F14FFF825D2BBB8BE0BCB0FF65AEEBFBB2872024B2

Фoтo ano.vhyarqcpfu.oqgdeta

B249538698654E63020576D703B4092570DF46CD43016838EE0224BA2CD5E311

Фoтo jfplewr.xumhzrq.cnrvpzowtqls

B2D229C24E0F9FEDC9A8E10229F6CFC03D76B2094543C772629AA85C4F322DA9

Фoтo jnqhixy.axqcogdn.asfhzc

B36A77848A1FE6E4B99218B9030DD6B7B13AA62F649EC5F8AF7E0131A92DA3CF

Фoтo nwol.wslgctpfe.tpra

B3C1E205D871615D635B830CA54047F7D11CFFD788C3203CE20E0BB997E08890

Фoтo klvr.jfznsmcut.ubnlhovemar

B40A45282D5AF29880118C77336AD491F3CFC4C9BD795A7997C8724AC9054A80

Фoтo qrkct.deongfm.jkczp

Page 331: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

B4C9D1A051CAE8F0CC9B06886E192D4766F9D41643559BE94E82980253B21DBD

Фoтo divnao.boagykepvl.dhptmelfcyoi

B50A794C196D4917B98618FB20DA4F5FD38BEA22ADE6D7CC1FA095C40BD4BCEF

Фoтo eqadb.vacglbu.dkgmajyiof

B631521CF13553C42885DD57C60D27B304305BAA56C552153F5A1C21F9945933

Фoтo rck.qbczstwxmj.ehnbtsc

B709CD1B90EC4E2AA2FFC83947DF70BF48E66DDA810035BBD6092B434589B795

Фoтo mpet.gbiqmshay.gqksxf

B7CC210A87C57DFC6AB9D445A6AB33DCD36632A0B40A33DD9337FF85EC904129

Фoтo lqvwf.pntojz.blzdua

B7EE1630F4AF90F7E8276C4103CEF7D8417237BF93B0E98A3C521ECCB47062E6

Фoтo mpan.xdnqzotuwg.qvuglpxfzk

B9553F6BDE522C5B1369DCE83584C49D9F6572607F07544B25AA44D9AC0FCFF3

Фoтo yhnd.bmnpswjghu.tqgsywc

B977E35E1A0544222C527AE4B79AAF56873EA1BC586F39F38ACA6D9B92A696A7

Фoтo ubrjzf.ihqkcyal.vduoz

BA596468284E10A9D94379F2171F76A8949A5D88B1E337D14DD471E8C2A5F658

Фoтo ethlwdp.sphdcver.bvopzrelifyg

BAEC1153A3E7EFCCBB7E20ADEC7B9DD4EEF7F416AD5D80E9AB3152473E5D02EE

Фoтo rdqlt.alosphdme.dsaq

BB675256BA1E56E2E5EB124D4C3C54ED5B4D9FE6E215F5F0FCECBB4A55B1BCCB

Фoтo kqoyt.zhcewmn.uoilkrqbh

BCA324DA4098367C8B5486B56E8B6E5140AC026F4F0AE744F7D8ED3177AF75D0

Фoтo ygo.yzrdbgaw.tqkvxm

BEF43A3572D53721D781FB6854DC6E637A9C1122AEEE2F944EDF7BB2EBE7E10A

Фoтo yjkfld.nsckpef.vsfkirpyqj

C0A15BA4379389113E3177F7B711AC2D4F4BB7E1C83134E5C15DCCABC1BB7E22

Фoтo ijd.tzslmfuaig.idhyug

C1167293233B729D7791A72A77E5C2D385F535FE122BA94A4EE8254C035A529E

Фoтo xvd.cryzbgui.hvrpmjco

C1F2B04B0305C58BF1F4A0132E4C446F04594D9FDFD9EEB9FDD01F0BA21FA1C0

Фoтo dhvgju.tezsflyk.wbpam

C272C8D64F1BD98906479E9EF983C67B3A4E0B8D1FC807837E769722F85FABB2

Фoтo widjlm.btsgfw.baqizsldg

C3722CA36A7CBA89F1DF0D86FC550E2174E78361EC67AD755796D84A286835D7

Фoтo ugstpv.umainzgye.ldcv

C58EBFD17DC8CEE694D69B743661727C686773DDE72667549A7DC2336A8192F7

Фoтo gaxfnb.phrksnol.ifzcnoxdw

C6830E501CAA73E79A5E718E9A557EBAFB7A9 Фoтo yhdtekr.fpbuezodil.dymebrnlvhfx

Page 332: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

8C7C123B99A65FB706DB3B83CD6

C6AE19FF809DDF986795F81334385647CB4EE05A84B539A969DC20993E5E4A25

Фoтo vcnlx.wakuzhcqj.tylqmrzfo

C9E545666BA170DEE39B123C33C4B6C198ECE260AB6F45BE8BCCE7858CDE88BF

Фoтo inxsp.ukmebpx.tebdghsu

CA09E0A0004164D660ACFF4E7DE50EEA3451224B968667A3192E372650E0002D

Фoтo hadwy.gvwojp.iprlx

CAC7284B8180758690290B42DA985413E5F1CDBFC25D7CFB91AF692678082F0E

Фoтo sxec.ydvhckp.pguvrdejayhn

CB7237C664479F9948653B17B09D78FC83847DCEC74E29BB23DE76287D0B2416

Фoтo kjfbim.evcfwqz.flnxqmbsch

CC32D4EDC7E7250A590C0CD3A8B366173FBC9FF0079802A17955551AC400EA26

Фoтo nkhi.fgvcblmd.cheqwi

CC9AA017753E95A9E41BC319A12D679194BEB4DC0E9D686AA46B55714E8319ED

Фoтo cvx.dpmaxtv.laqpic

CD0FD9F7C47F3763B23AA619D7DFF487851FB8E04464773A7D6D904DD93106F6

Фoтo apwbjys.hmieqwpg.jxykba

CDBFFE13A0DCF067D4BFFD72AF5113ADB6FAFC13C39EFC95F266653BFABB8B89

Фoтo pksa.umciyvqdzt.pwyheacmi

CDCDAEE0E62E9D5DF1B28FF455C9E0B8BD2AF0B9856DC4E98CF5D4D6742253B9

Фoтo fcdezgl.kieydgsj.psrdmlzfiuxj

CF3F5A8B08F12323274BBF1735AEFE8701AD7034FFEDF9A41AAF0903C1953A41

Фoтo rjya.gkbezadqh.dtwf

CF6A5DF03DB294C2322BFDB563C906C134BB9A73112D11BD38F4B99E3306CEBD

Фoтo zcfrv.mlrovs.onruf

D162FFB0521C659F516CA39A4342CEB6D46F81CD7F56BA46869FB5BCBE2E6F09

Фoтo qmspk.sfbitakqu.mujibactroy

D1CF94EBB6EE0067E31A832E6C8382842A4DEB0C4AD922381F52C5BD714AA039

Фoтo griuly.uqjyog.dqhbtxomv

D23A532D8A6ED58FBE2A8F93427C6C6672C7CD5CD400AE6D98E066BD0A00E4FB

Фoтo htwlg.diakfwhpos.hfvatcjdzuqg

D35450D40EFB759F61B7240E12CD5A8808E58C92F5DFE4039C40F23A5ECBE2C2

Фoтo fbum.junylfb.sxnmid

D3DDF1517A599A5667FA840D677DD80E5DA0372A4A87EDD670F34AF8B59C4878

Фoтo qxyeaoj.gybwcpufq.gtbwejfhkaz

D564BD79CD46D201789D75F252A80C1467B704795A72916AD7EF5C56069BCE41

Фoтo swgvpnf.kabtighyx.icwoszqkvfr

D5A61E987A8D671CE9C6C161AE33E3F8DFEA16731337971BCCC9B5A725407F18

Фoтo zcqdog.zmtedk.pqngfvomx

Page 333: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

D5D5BB10101EE40E7FA059A14942E4B1228F1D06B39902E1FED5F74D3C5C5742

Фoтo ebrw.zwbplige.howmjbxti

D7297D87E30E42AE5250182E2A9A3E3285542C5DE5E977A0EA95369EF953A1C0

Фoтo ydzkqs.rbcoyse.qcopkfs

D747EFF8858643DB7BDF23AC429820BC0A308E038A32DD7EBC5DFFBC42EA0FCF

Фoтo saqfkm.hgyjbr.rchyqdpvmxsw

D809805D330781A09E3D6E54E4F1B0EBA597178C3BAEBA82D2647F0A30085161

Фoтo mlvgurf.dhuyakrq.sykfhvx

D829D2D4904F4D3019C08521C3021ED0C4121CEA46CFD539B186C5FE26346D0D

Фoтo jxhdpcr.lpjyegt.wqtngm

D925AC63E5D388E2D98DE30B63377D5A4AA2D1C3E1A096BF889B4B2E1825F00E

Фoтo rud.zipqtlwrkf.hitdavopf

DADA9DCF11F9A7444B46BA18415C246A038AB847010B7B74B9FE443416A2C918

Фoтo qgdxkci.mvfqxzjp.fpjt

DC70BAC2C08A210AD140271B0919FC9AF2491B164CEE357761EC91FC298BD5D0

Фoтo ntfq.gansvkw.kgaesvcp

DC90AEE9F39C82FBC305FB08B7AF385A09E8B3AE82FC0E402BA84E04459C2078

Фoтo henw.jlcownsx.jkrlgpyixnsm

DC9F0E28A35671BD0906DBE33280E2DE6D37B08BF93CA3977530C526B8B92EB3

Фoтo vceibrd.vubkjdren.nzhpojqgald

DCFD5C0DB975CEDB38BBAD0E9FDD21458867319A00082B42A1757B35A67025CC

Фoтo miscne.gnfdulypr.osfw

DD6A403FE23C90C6FD81D0157924C19030F25D3BD446B5B5CD2BC49908875674

Фoтo aevpmjw.isaxthk.dvfhblsnm

DE3EEE1C4BA40750F0BDB8820E7BDDF1947DE2E6CEFDAD9FE58FBA0B6AF29E56

Фoтo elnkv.jgaclnow.ysrkuxt

DE5186B2B98CA2F4122080A0297A264A2F5B8299155484A849D8384BC5BA892E

Фoтo nmtje.wrdvgpzn.xtasnfwi

DEA45A780FDAEA22763DE41104A9423BC1D683D1EF473F6695593538A8997B9F

Фoтo bcpr.fpmndqygau.odyilsvaujk

DEDF110A2875AE96DA1ABA699931F5A9B7183E9033E936DE3F657771228B45B5

Фoтo rukv.qzftisx.rhneb

DF9011B0BEE078F1E6DA60F2B0DB05B85C8F62455FE44FF637A69FE9C69A886D

Фoтo fkctp.krdnupx.otrvjughkife

DFBD8A65EC4F6751BD78F02BB8F6C166E06C2CEAD2D34303D5E6DBDFA077B863

Фoтo fabq.hvnxmke.pdrfwsthg

E0BA2ED70B321DBE342CB12D7EB21CAC5FDCAFF83316F3EA4A823E2830DC67C9

Фoтo dybae.haxyvzwstm.ghqryswvft

E0D7EEBDE17BA8B253E43252373E50F2718CF Фoтo bjwpyak.wjltbgrfud.yfabicsqwdgh

Page 334: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

DCD3FC4A270E2C606BD376DAA95

E1CEF08AFFA09233BF3ABDB8AF66983FAD30FFADA6D4E25E9F62514734DAE70B

Фoтo zmbg.lebwsrvgpu.futmcdvoiz

E2791AAF88EC8412C4E75EC3855D860E78B6B8ED8525C9A8CAE59835C3D08DA3

Фoтo ixt.jysxzr.gwkjyeihl

E35B19F4E805C1D92FD2B3462B7FAC746D05CE9B75B92CE0990A68CB5A7374B7

Фoтo vuj.tqzowar.cemwfoi

E3645438B391ACD9AB6573369D74991847B53D326E4DAD2EE35677E253FBE557

Фoтo pcskhlo.hcbdijgzlv.dhrqzausgfoy

E424E42B251F0AF9A7277A9D9FAD95E2233C4B2ADEC863FADF9E4D373C0A2AD0

Фoтo aiwgpko.jfmwzuhk.xzialvrb

E4BF220B68F0A1B3EDCBE06A5D43EC29B998B6155C22662614FABE8F42CB51F6

Фoтo knryvo.otenraw.aoxwhfb

E54E483C9E65A546A6E1F81B411681DC858E88ADAADA1F5CC86F4EB5AF9EAC6B

Фoтo etd.prvzhtn.spueiflghn

E6DA4898D829385E33F94B0F56C7FB6D0F8A9314A5C48DB8E2B5E04D3F54A298

Фoтo axunlh.opjhxwcad.qlbvxoj

E881678ADFE2D5F3D86AD52979AFEFA0649301D6F6FEB45496AF032D9C35DA89

Фoтo flv.oifvjlhn.cbvadnf

EDEF5A9389515105B742DBE06414C8BD00D1654A2F233776B4E59526F175D882

Фoтo qxhacu.dvxpqljnh.ebnaiyfwjpg

EECAC1219685683DB4CD7BBCE1C2BBCF8B1B0180504B8024454BD600E4E13D4F

Фoтo zfwg.fidnsp.zyjgueo

EEF5D063539F9B528969E55A3E4A8EA36B3CF4C0B80163E129BE3151C6AFBCE0

Фoтo dhlb.xljutdia.ycmbi

EF1137E1FCD927C80E0FA0D2B5655C9D246496407DB4787ECB461CBD3FB907C2

Фoтo auksdxj.sqdipmztkr.pjtfdne

EF79580FE6268F713276E73583D5116F66A31CDDADCF24DF4726B0CD21154712

Фoтo lyprft.xgsmewrjl.gory

F0086181F685C1F5DA02AAF17C294DACBE178C7D43CD2A279F86AA80D05605C4

Фoтo oyacnjt.rvaqwpd.cyknoizflvud

F154D3A8368ABE68DE81B1F5EF2C4345FB08163A310230E21D791BCD8E2F9E84

Фoтo wbnmhzp.eawgrm.punkdfew

F181E100091035724F1CD58C2CC2649B7AFD81B77A94BB24BA3F6AD2B4EA95A6

Фoтo pft.briovajcg.boqfic

F212A27055F5116091930C21B6D7B1713C23C01B06DC68BDABC36745FFF0A28D

Фoтo lxyr.sdqbpchyn.nvplkd

F22374CCB6F1C48B534A3D14E85A27EAF13C24859D79355762812128B8220C7F

Фoтo dokm.eixvwcyaf.bpjkdmq

Page 335: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

SHA256 Label Package Name

F22AA84A6F284EBACE1AC70668FD14C26B43D2EA99ECCA95BEA0FB5E0C040031

Фoтo ndyuotb.vztsqimk.blngaj

F232634A4CA934C25F051257EF18A0D6085B06ED3653705DBC65B87419219868

Фoтo zrdqt.keqxtcsfj.jtpqalbnh

F28906C265D9AAC117A20F936825F2772924E1B6AC77D3B33926D91E7803851C

Фoтo vmj.nzdmtire.cteq

F2AE52C6AEDE5D6FEB1DC67A6221A05D65F9A5BE3B09C581A6EF1E3430C1868E

Фoтo fzlyqu.iwnqdguptb.oivyaecu

F2C8E982C58D7C03B69A48B5F37CAA870D94BA6660F24D69E5E14FF54A607D9F

Фoтo nra.tjcnelwax.oghxtzfqedil

F2FBA0AFA7A0FE05CAC74A8EE4B40A059CAC37E8571DBA179AA2ED25B367E295

Фoтo bntpu.zryveonq.mcgitkjbzvdr

F41EE536FD5F8758D804B13266866DD44B0EB68C7A2060CCE578BC0549A3BE25

Фoтo zewcx.dqaukywv.enigvthksfqd

F48AEDD4FE7CCF57715BE29DAEDBDFD6FB8BE942321BB1EF99DD6089F7694F87

Фoтo fawu.bmvqpis.hmei

F4BF3B205F0A5FBA64B8229EB4BA802E479E9D9533E2308A4EF3F81D17E6FE93

Фoтo efnzvw.znlcwhg.brpzown

F51B320EC6F2ADECF3C8A620A0209536CDF2515930DD5B2D8A2C72A3104A014C

Фoтo bdtne.zyngvu.oxpeac

F56B05C0611AD73A2AC6A1033D11F82B47CFC5D663F7BFDFC506EDCF44E668BF

Фoтo ncuekws.ilhkda.ersqb

F626A73545BA0A8D44536DF754EB3451A22E55709CD606CC17F1DDFA2642C8A7

Фoтo rvgnoyz.nzrqlfwedo.hmfawvr

F698FEFCF85EB7E6BDEF6764BDF2DBB866F4895B64D5FBA6A9A167523C9C87D9

Фoтo pkvj.migdjzvp.sniafglcheom

F7DD4D78142F9D8BE9E816116A0693543A9DAD2F8795BEFF6985F7CAF4764AAC

Фoтo sfxhgmp.bnlirouacq.ohxsnlpkjaet

FD952F7DD52EF80DCEB5C454F4672A44C0CB2B7C09F75467CE97988281292041

Фoтo wql.pehvblxau.vjtgsmxlrup

FE2AA5592693050E3E4EDF94E3DEFE5ED489076B45AC2AAA6FA3B67B77828A9E

Фoтo rvdzkha.xvqdnar.xlwhkjpigtz

Page 336: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

Command and Control Domains and IP addresses:

Domains IP addresses

myownorbitco.com 195.22.126.81

prytommomill.com 195.22.126.160

pathereet.com 185.110.132.0 - 185.110.132.255

dismissolved.com

visiprovisi.com

strategytory.com

potommotratetory.com

ototricanne.com

lovtommofoundry.com

coansoletory.com

strategytweet.com

anemoikingdom.com

barairhate.com

hotonorows.com

tommorytary.com

pesonaective.com

privatislation.com

titruslamb.com

bcontension.com

hotowaboards.com

improvetype.com

matcehfoundry.com

preditories.com

hotomrymomill.com

competeworks.com

casualfoundry.com

brownmator.com

tocorymbusadvisor.com

gsbecominupport.com

nermerchandising.com

pathereet.com

greodglobal.com

becomingsupport.com

nermerchandising.com

Page 337: New Mobile Malware Uses Layered Obfuscation and … New Mobile Malware Uses Layered Obfuscation and Targets Russian Banks Appendix TrendLabs Security Intelligence Blog Jordan Pan and

Trend Micro Incorporated, a global leader in security software, strives to make the

world safe for exchanging digital information. Our innovative solutions for consumers,

businesses and governments provide layered content security to protect information

on mobile devices, endpoints, gateways, servers and the cloud. All of our solutions

are powered by cloud-based global threat intelligence, the Trend Micro™ Smart

Protection Network™, and are supported by over 1,200 threat experts around the

globe. For more information, visit www.trendmicro.com.

©2018 by Trend Micro, Incorporated. All rights reserved. Trend Micro and the Trend

Micro t-ball logo are trademarks or registered trademarks of Trend Micro,

Incorporated. All other product or company names may be trademarks or registered

trademarks of their owners.

10101 N. De Anza Blvd.

Cupertino, CA 95014

U.S. toll free: 1 +800.228.5651

Phone: 1 +408.257.1500

Fax: 1 +408.257.2003


Recommended