smsworm | 2936207e-6d88-4986-881a-549cfb937563_oogleWebBrowserAndroid[.]apk

Sharing

Copy URL Twitter E-mail

General

Target
2936207e-6d88-4986-881a-549cfb937563_oogleWebBrowserAndroid.apk
Size 12.1MB
Sample241012-rnfgwsvcrf
SHA256 e6746d0069dea77ecd1d7a611c45e5af220643c23f7b473e1bc2ed8aa2923475
MD5 d0d130c855a790da28fdd744535ef07f
SHA1 e9760321509f198ffd80667cc8fa34c4c76f4cc7
SHA512 e6a08e435d5ea53de01c765c7747e2bcfea9dc99e67ac4e8b5d5cdfd7f07894e9554b04aca9d0310a7cc09b180bfa84f7e9192c03e79ae8f664a230a740a2a5f
SSDEEP 196608:wvyd7pyOZgwi70nk6zLxs1yuyc3u4Ly3UUnKEO++lUU4tjBZPqECEtZWk:wvi7E4gh0k6z2UHc3u4GnKA+lUx
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

smsworm

Malware Config

Signatures

Android SMSWorm payload 1 IoCs

resource	yara_rule
sample	family_smsworm

Smsworm family
smsworm

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows an application to record audio.	android.permission.RECORD_AUDIO
Required to be able to access the camera device.	android.permission.CAMERA

File Explorer

2936207e-6d88-4986-881a-549cfb937563_oogleWebBrowserAndroid.apk

.apk 12.1MB

2936207e-6d88-4986-881a-549cfb937563_oogleWebBrowserAndroid.apk

SHA256 e6746d0069dea77ecd1d7a611c45e5af220643c23f7b473e1bc2ed8aa2923475
MD5 d0d130c855a790da28fdd744535ef07f
SHA1 e9760321509f198ffd80667cc8fa34c4c76f4cc7
SHA512 e6a08e435d5ea53de01c765c7747e2bcfea9dc99e67ac4e8b5d5cdfd7f07894e9554b04aca9d0310a7cc09b180bfa84f7e9192c03e79ae8f664a230a740a2a5f
SSDEEP 196608:wvyd7pyOZgwi70nk6zLxs1yuyc3u4Ly3UUnKEO++lUU4tjBZPqECEtZWk:wvi7E4gh0k6z2UHc3u4GnKA+lUx
MD5 SHA1 SHA512 SSDEEP

android arch:arm64 arch:arm arch:mips arch:mips64 arch:x86 arch:x64

Android SMSWorm payload

oogle.chrome.web

oogle.chrome.web.preinicio

android.intent.action.MAIN android.intent.action.VIEW android.intent.action.VIEW android.intent.action.VIEW

com.google.android.gms.ads.AdActivity

oogle.chrome.web.SearchableActivity

android.intent.action.SEARCH

oogle.chrome.web.ExpandedControlsActivity

android.intent.action.MAIN

oogle.chrome.web.t_qr

oogle.chrome.web.t_vistafb

oogle.chrome.web.t_url

oogle.chrome.web.t_html

oogle.chrome.web.t_video

oogle.chrome.web.t_video_exoplayer

oogle.chrome.web.t_video_pro

oogle.chrome.web.t_radio

oogle.chrome.web.t_buscchats

oogle.chrome.web.t_buscchats_lista

oogle.chrome.web.t_menugrid

oogle.chrome.web.t_submenu

oogle.chrome.web.t_rss

oogle.chrome.web.t_rssdetalle

oogle.chrome.web.t_oficinas

oogle.chrome.web.t_chat_contra

oogle.chrome.web.t_chat

oogle.chrome.web.preperfil

oogle.chrome.web.chat_perfil

oogle.chrome.web.guardarprimeravez

oogle.chrome.web.eliminarperfil

oogle.chrome.web.codigo

oogle.chrome.web.chat

oogle.chrome.web.contactar

oogle.chrome.web.t_buscador_form

oogle.chrome.web.cats

oogle.chrome.web.t_buscador

oogle.chrome.web.t_detalle

oogle.chrome.web.t_menu

oogle.chrome.web.t_mapa_web

oogle.chrome.web.t_and

oogle.chrome.web.finalizar

oogle.chrome.web.notifs

oogle.chrome.web.notifs_cats

oogle.chrome.web.privados

oogle.chrome.web.profile

oogle.chrome.web.fotogal

oogle.chrome.web.t_buscusus

oogle.chrome.web.t_buscvideos

oogle.chrome.web.t_buscvideo

oogle.chrome.web.t_gal

oogle.chrome.web.t_gal_foto

oogle.chrome.web.t_card

com.facebook.ads.AudienceNetworkActivity

com.adcolony.sdk.AdColonyInterstitialActivity

com.adcolony.sdk.AdColonyAdViewActivity

com.appnext.ads.interstitial.InterstitialActivity

com.appnext.ads.fullscreen.FullscreenActivity

com.appnext.banners.BannerActivity

com.google.android.gms.auth.api.signin.internal.SignInHubActivity

com.google.android.gms.common.api.GoogleApiActivity

com.facebook.FacebookActivity

com.facebook.CustomTabMainActivity

com.facebook.CustomTabActivity

android.intent.action.VIEW

com.startapp.sdk.adsbase.consent.ConsentActivity

com.startapp.sdk.ads.list3d.List3DActivity

com.startapp.sdk.ads.interstitials.OverlayActivity

com.unity3d.services.ads.adunit.AdUnitActivity

com.unity3d.services.ads.adunit.AdUnitTransparentActivity

com.unity3d.services.ads.adunit.AdUnitTransparentSoftwareActivity

com.unity3d.services.ads.adunit.AdUnitSoftwareActivity

com.appnext.core.ResultActivity

com.appnext.core.result.ResultPageActivity

oogle.chrome.web.s_widget_vistafb

oogle.chrome.web.s_cargar_icos

oogle.chrome.web.s_cargar_sliderheader

oogle.chrome.web.s_cargar_fondo

oogle.chrome.web.s_cargar_icos_gen

oogle.chrome.web.s_guardarperfil

oogle.chrome.web.s_mediaplayer_exo

oogle.chrome.web.RegistrationIntentService

oogle.chrome.web.MyFcmListenerService

com.google.firebase.MESSAGING_EVENT

oogle.chrome.web.MyInstanceIDListenerService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.android.gms.cast.framework.media.MediaNotificationService

com.google.android.gms.cast.framework.ReconnectionService

com.appnext.core.AdsService

com.google.android.gms.auth.api.signin.RevocationBoundService

com.google.firebase.components.ComponentDiscoveryService

com.google.android.gms.measurement.AppMeasurementService

com.google.android.gms.measurement.AppMeasurementJobService

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

com.startapp.sdk.cachedservice.BackgroundService

com.startapp.sdk.jobs.SchedulerService

com.google.android.datatransport.runtime.backends.TransportBackendDiscovery

com.google.android.datatransport.runtime.scheduling.jobscheduling.JobInfoSchedulerService

com.appnext.base.services.OperationService

com.appnext.base.services.OperationJobService

com.appnext.base.services.EventsJobIntentService

Android Permissions

2936207e-6d88-4986-881a-549cfb937563_oogleWebBrowserAndroid.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.ACCESS_FINE_LOCATION

android.permission.RECORD_AUDIO

android.permission.MODIFY_AUDIO_SETTINGS

android.permission.CAMERA

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED