fluhorse | 0a577ee60ca676e49add6f266a1ee8ba5434290fa8954cc35f87546046008388[.]zip

General

Target

0a577ee60ca676e49add6f266a1ee8ba5434290fa8954cc35f87546046008388.zip
Size

17.3MB
MD5

75a42c18b306cf5f4d997a3ec6ce04f5
SHA1

a5bb0cb2371899b6334856609649a2f86df6ff7e
SHA256

9d2289684756122d252b08d6829f2dac5a3a13b94feffa95725c61d4a49f03b7
SHA512

a5e20120c7373335331553ea9b52ba7da6e415ab0adfb05b0e3aa110993a0cd9f9b0718e8c8694b6caddfd4a54a1d988d8dbf07675e92261feaa16d0cab33ce1
SSDEEP

393216:EkVM3IWDTujQEZLHSQoIdwDmV0v/md1fi1tMIbn7jFXgpTP:EP3rpEr2Idwy31fYvn7jFXqTP

Score

10^/10

fluhorse

FluHorse payload 2 IoCs

resource	yara_rule
sample	family_fluhorse
sample	family_fluhorse

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

0a577ee60ca676e49add6f266a1ee8ba5434290fa8954cc35f87546046008388.zip
.zip

Password: infected
0a577ee60ca676e49add6f266a1ee8ba5434290fa8954cc35f87546046008388
.apk android arch:arm64 arch:arm arch:x64

com.dsfdgfd.sdfsdf

com.dsfdgfd.sdfsdf.MainActivity

Activities

com.dsfdgfd.sdfsdf.MainActivity

android.intent.action.MAIN

Permissions

android.permission.RECEIVE_SMS
android.permission.READ_SMS
android.permission.READ_PHONE_STATE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.WAKE_LOCK

Receivers

com.shounakmulay.telephony.sms.IncomingSmsReceiver

android.provider.Telephony.SMS_RECEIVED