smsworm | MUNDOLATINO_9[.]8[.]zip

General

Target

MUNDOLATINO_9.8.zip
Size

10.1MB
MD5

8b6621a29bbcb69c3318c18d781ce5e9
SHA1

7e82dbe6ce37e54e2cc34d57827f01b5c081d4ce
SHA256

f78d82b2415db2e11c060f35651176cbc04289d8e5fadcfa3af032c0c2e7def8
SHA512

23c78b5f0477d892f25c18171e5ac9c4129aad1650230dc5940ef30aa13e5cffbbcc1c54fd4a966abadae5a1044ac62302424d12ea9a94758dd9d7d77f8b8c5c
SSDEEP

196608:19kYd7pyOZVDutq54+TsDZnxLclh/281hGAmoSr/eersYyu5ZDBEGUpg:fk47E4pR5ri1ah/vHvK/frss

Score

10^/10

smsworm

Malware Config

Signatures

Android SMSWorm payload 1 IoCs

Processes:

resource	yara_rule
sample	family_smsworm

Smsworm family
smsworm

Declares services with permission to bind to the system 1 IoCs

Processes:

description	ioc
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS

Files

MUNDOLATINO_9.8.zip
.apk android arch:arm64 arch:arm arch:mips arch:mips64 arch:x86 arch:x64

mundolatino.apliblm

mundolatino.apliblm.preinicio

Activities

mundolatino.apliblm.preinicio

android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

mundolatino.apliblm.SearchableActivity

android.intent.action.SEARCH

mundolatino.apliblm.ExpandedControlsActivity

android.intent.action.MAIN

com.facebook.CustomTabActivity

android.intent.action.VIEW

Permissions

android.permission.FOREGROUND_SERVICE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_BOOT_COMPLETED

Receivers

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

android.intent.action.BOOT_COMPLETED

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_ACCESS_TOKEN_CHANGED

com.appnext.base.receivers.AppnextBootReciever

android.intent.action.BOOT_COMPLETED

Services

mundolatino.apliblm.MyFcmListenerService

com.google.firebase.MESSAGING_EVENT

mundolatino.apliblm.MyInstanceIDListenerService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

Android Permissions

MUNDOLATINO_9.8.zip

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

Resubmissions

Sharing

General

Malware Config

Signatures

Files

mundolatino.apliblm

mundolatino.apliblm.preinicio

Activities

mundolatino.apliblm.preinicio

mundolatino.apliblm.SearchableActivity

mundolatino.apliblm.ExpandedControlsActivity

com.facebook.CustomTabActivity

Permissions

Receivers

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.appnext.base.receivers.AppnextBootReciever

Services

mundolatino.apliblm.MyFcmListenerService

mundolatino.apliblm.MyInstanceIDListenerService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.iid.FirebaseInstanceIdService

Android Permissions

MUNDOLATINO_9.8.zip