furball | a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d

General

Target

a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d
Size

2.5MB
MD5

6129cc4392d2e10ffdb80db67ca2534b
SHA1

444f8a87f7c6c07be063b3d0b62f4c6dba0773e9
SHA256

a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d
SHA512

4dc459c898655ba3d9cd78bc429ce08efa3a5744c731a7cc2f07f34033f71e9509a009256611a5138e7c058283b1f525eab264baf23c2984d128f8be96db9130
SSDEEP

49152:GYhyQc1ry4hxvXxZoPeNk+JyUE0GLNMLi6NER+JwyniEWWoXf4i:G6dWrnPQeNxETbN6i6NSLEToQi

Score

10^/10

furball

Malware Config

Extracted

Family

furball

C2

http://www.firmwaresystemupdate.com/mmh

Signatures

Furball family
furball

Declares services with permission to bind to the system 1 IoCs

Processes:

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE

Requests dangerous framework permissions 8 IoCs

Processes:

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE

Files

a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d
.apk android

com.kabood.koroshkabir

com.kabood.koroshkabir.MainActivity

Activities

com.kabood.koroshkabir.MainActivity

android.intent.action.MAIN

com.kabood.koroshkabir.RssActivity

com.kabood.koroshkabir.RssActivity

com.kabood.koroshkabir.ListActivity

com.kabood.koroshkabir.ListActivity

com.kabood.koroshkabir.SearchActivity

com.kabood.koroshkabir.SearchActivity

com.kabood.koroshkabir.PageActivity

com.kabood.koroshkabir.PageActivity

com.kabood.koroshkabir.WebActivity

com.kabood.koroshkabir.WebActivity

com.kabood.koroshkabir.HtmlActivity

com.kabood.koroshkabir.HtmlActivity

com.kabood.koroshkabir.BookmarksActivity

com.kabood.koroshkabir.BookmarksActivity

com.kabood.koroshkabir.SettingActivity

com.kabood.koroshkabir.SettingActivity

com.kabood.koroshkabir.UpdateActivity

com.kabood.koroshkabir.UpdateActivity

com.kabood.koroshkabir.AudioPlayer

com.kabood.koroshkabir.AudioPlayer

com.kabood.koroshkabir.VideoPlayer

com.kabood.koroshkabir.VideoPlayer

com.kabood.koroshkabir.ImageViewActivity

com.kabood.koroshkabir.ImageViewActivity

com.kabood.koroshkabir.GalleryActivity

com.kabood.koroshkabir.GalleryActivity

com.kabood.koroshkabir.PayActivity

com.kabood.koroshkabir.PayActivity

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
com.google.android.c2dm.permission.RECEIVE
android.permission.WAKE_LOCK
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.READ_PHONE_STATE
android.permission.VIBRATE
android.permission.PACKAGE_USAGE_STATS
android.permission.QUICKBOOT_POWERON
android.permission.READ_SMS
android.permission.REAL_GET_TASKS
android.permission.GET_ACCOUNTS
com.android.browser.permission.READ_HISTORY_BOOKMARKS
android.permission.READ_CONTACTS
android.permission.READ_CALL_LOG
android.permission.READ_LOGS
android.permission.WRITE_SETTINGS
android.permission.WRITE_EXTERNAL_STORAGE

Receivers

co.ronash.pushe.receiver.UpdateReceiver

android.intent.action.PACKAGE_REPLACED

com.google.android.gms.gcm.GcmReceiver

com.google.android.c2dm.intent.RECEIVE
com.google.android.c2dm.intent.REGISTRATION

co.ronash.pushe.receiver.FallbackGcmNetworkManagerReceiver

co.ronash.pushe.CHECK_TASKS

com.android.google.service.OnBootManager

android.intent.action.BOOT_COMPLETED
android.intent.action.ACTION_POWER_CONNECTED

Services

co.ronash.pushe.service.GcmService

com.google.android.c2dm.intent.RECEIVE

co.ronash.pushe.service.FallbackGcmTaskRunner

co.ronash.pushe.ACTION_TASK_READY

co.ronash.pushe.service.GcmTaskRunner

com.google.android.gms.gcm.ACTION_TASK_READY

co.ronash.pushe.service.InstanceIDService

com.google.android.gms.iid.InstanceID

com.android.google.service.NotificationObserverService

android.service.notification.NotificationListenerService

Android Permissions

a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

com.google.android.c2dm.permission.RECEIVE

android.permission.WAKE_LOCK

android.permission.RECEIVE_BOOT_COMPLETED

android.permission.READ_PHONE_STATE

android.permission.VIBRATE

android.permission.PACKAGE_USAGE_STATS

android.permission.QUICKBOOT_POWERON

android.permission.READ_SMS

android.permission.REAL_GET_TASKS

android.permission.GET_ACCOUNTS

com.android.browser.permission.READ_HISTORY_BOOKMARKS

android.permission.READ_CONTACTS

android.permission.READ_CALL_LOG

android.permission.READ_LOGS

android.permission.WRITE_SETTINGS

android.permission.WRITE_EXTERNAL_STORAGE

Sharing

General

Malware Config

Extracted

Signatures

Files

com.kabood.koroshkabir

com.kabood.koroshkabir.MainActivity

Activities

com.kabood.koroshkabir.MainActivity

com.kabood.koroshkabir.RssActivity

com.kabood.koroshkabir.ListActivity

com.kabood.koroshkabir.SearchActivity

com.kabood.koroshkabir.PageActivity

com.kabood.koroshkabir.WebActivity

com.kabood.koroshkabir.HtmlActivity

com.kabood.koroshkabir.BookmarksActivity

com.kabood.koroshkabir.SettingActivity

com.kabood.koroshkabir.UpdateActivity

com.kabood.koroshkabir.AudioPlayer

com.kabood.koroshkabir.VideoPlayer

com.kabood.koroshkabir.ImageViewActivity

com.kabood.koroshkabir.GalleryActivity

com.kabood.koroshkabir.PayActivity

Permissions

Receivers

co.ronash.pushe.receiver.UpdateReceiver

com.google.android.gms.gcm.GcmReceiver

co.ronash.pushe.receiver.FallbackGcmNetworkManagerReceiver

com.android.google.service.OnBootManager

Services

co.ronash.pushe.service.GcmService

co.ronash.pushe.service.FallbackGcmTaskRunner

co.ronash.pushe.service.GcmTaskRunner

co.ronash.pushe.service.InstanceIDService

com.android.google.service.NotificationObserverService

Android Permissions

a3797856766fef6651f8c679febd12378fc3196c5cc74923d90377045107700d