220913-fmkvfaadhq_pw_infected[.]zip

General

Target

220913-fmkvfaadhq_pw_infected.zip
Size

44.5MB
MD5

65760832eefb64a3710c062e3ea56d99
SHA1

8c5649d0fec474849140f2b65a58aed0facdd527
SHA256

fc7bc4f7130cdaa774c8126344a051364bf45fe00b1f938ed1ac1206ee6291b4
SHA512

151bb8780d661666794583d18afe9f32ddd92da2b6a7647841a950874a0e0d594fc08c46f4e184d1fc0f66dc88d4c175900ff3345fabf0b81c1c68346a9ef16e
SSDEEP

786432:utBeeO2TJ6rbtX2Ai/aaf/eGQi3huhPyNLK6TJNlvIteKP0rgRtZBuFD+5DH0:yJ6rZFqxHzh6PyB1JNlQteKPuaegDH0

Score

7^/10

Malware Config

Signatures

Requests dangerous framework permissions 2 IoCs

description	ioc
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Files

220913-fmkvfaadhq_pw_infected.zip
.zip

Password: infected
World of Guns Gun Disassembly_v2.2.2a8_apkpure.com.apk
.apk android arch:arm

com.nobleempire.wog

com.unity3d.player.UnityPlayerActivity

Activities

com.unity3d.player.UnityPlayerActivity

android.intent.action.MAIN

com.facebook.CustomTabActivity

android.intent.action.VIEW

com.unity.purchasing.googleplay.VRPurchaseActivity

com.google.vr.vrcore.ACTION_NONE

Permissions

android.permission.INTERNET
android.permission.CAMERA
android.permission.WRITE_EXTERNAL_STORAGE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
com.android.vending.BILLING
com.sec.android.provider.badge.permission.READ
com.sec.android.provider.badge.permission.WRITE
com.htc.launcher.permission.READ_SETTINGS
com.htc.launcher.permission.UPDATE_SHORTCUT
com.sonyericsson.home.permission.BROADCAST_BADGE
com.sonymobile.home.permission.PROVIDER_INSERT_BADGE
com.anddoes.launcher.permission.UPDATE_COUNT
com.majeur.launcher.permission.UPDATE_BADGE
com.huawei.android.launcher.permission.CHANGE_BADGE
com.huawei.android.launcher.permission.READ_SETTINGS
com.huawei.android.launcher.permission.WRITE_SETTINGS
android.permission.READ_APP_BADGE
com.oppo.launcher.permission.READ_SETTINGS
com.oppo.launcher.permission.WRITE_SETTINGS
me.everything.badger.permission.BADGE_COUNT_READ
me.everything.badger.permission.BADGE_COUNT_WRITE
android.permission.VIBRATE
android.permission.RECEIVE_BOOT_COMPLETED
com.nobleempire.wog.permission.RECEIVE_ADM_MESSAGE
com.amazon.device.messaging.permission.RECEIVE

Receivers

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_ACCESS_TOKEN_CHANGED

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

universal.tools.notifications.ScheduledNotificationsRestorer

android.intent.action.BOOT_COMPLETED

universal.tools.notifications.AdmBroadcastReceiver

com.amazon.device.messaging.intent.REGISTRATION
com.amazon.device.messaging.intent.RECEIVE

Services

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

universal.tools.notifications.FCMService

com.google.firebase.MESSAGING_EVENT

Sharing

General

Malware Config

Signatures

Files

Password: infected

com.nobleempire.wog

com.unity3d.player.UnityPlayerActivity

Activities

com.unity3d.player.UnityPlayerActivity

com.facebook.CustomTabActivity

com.unity.purchasing.googleplay.VRPurchaseActivity

Permissions

Receivers

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

universal.tools.notifications.ScheduledNotificationsRestorer

universal.tools.notifications.AdmBroadcastReceiver

Services

com.google.firebase.messaging.FirebaseMessagingService

universal.tools.notifications.FCMService