adware[.]zip | Triage

Sharing

Copy URL Twitter E-mail

General

Target

adware.zip
Size

3.3MB
MD5

1a0afca26e0e5df4235823c296072d50
SHA1

d589f3cbb2e075704d662253845d304668efb28b
SHA256

5568f0c783557a58313445ff215de26dacf9a70dec61df1d858c0be04d2f62b4
SHA512

6cefbb58636becdfe71f5c95568e1bb393f2f2a69444ef20d7a3be4092141bb9de56859208ee282c5b01796bd1f0875fc26151ce188ac7f7f6763bf393069169
SSDEEP

49152:zg/sdqiz39Xw9e8S2/pwecA4k+ywkKxolyRV7d21fFZ588X+veu:zg/sEM9Xoe8Tpth4BxoERQfb5Bu

Score

6^/10

Malware Config

Signatures

Requests dangerous framework permissions 4 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Files

adware.zip
.zip

Password: infected
e8947bc9fb2bd597daba3064d5fab275d8df2beac92f301063f22fe276dcbc10.apk
.apk android arch:arm64 arch:arm

com.herocraft.game.birdsonwire.freemium

fn.xhrbc.E

Activities

fn.xhrbc.E

android.intent.action.MAIN

fn.xhrbc.Swtfj

android.intent.action.VIEW
NotifActivity

Permissions

android.permission.INTERNET
com.google.android.c2dm.permission.RECEIVE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.USE_FULL_SCREEN_INTENT
com.google.android.gms.permission.AD_ID
android.permission.FOREGROUND_SERVICE
android.permission.READ_EXTERNAL_STORAGE
android.permission.POST_NOTIFICATIONS
android.permission.WAKE_LOCK

Receivers

fn.xhrbc.fbOI

android.net.wifi.STATE_CHANGE
android.net.wifi.WIFI_STATE_CHANGED
android.net.conn.CONNECTIVITY_CHANGE

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

Services

fn.xhrbc.Xw

com.google.firebase.MESSAGING_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT