smsworm | 926daabbdc4a53deccf965e14b082209_JaffaCakes118

General

Target

926daabbdc4a53deccf965e14b082209_JaffaCakes118
Size

6.3MB
MD5

926daabbdc4a53deccf965e14b082209
SHA1

d2a4e7d47963f586058d520bbd8be79cae5c6117
SHA256

398308f2b66f62326eb8a69e21f66dc3ecdf6ae8b6d13133adb35a3c6d362e31
SHA512

c000b6e5aa20d662f9e1608e2650f0c6bbe2ab948701a77c60b81d4191af873bc10d46d3984bb78e27eb25a1c318630d0a31b52abae3a81226883449cb4af33f
SSDEEP

98304:mp3CUsuJsSFbIum6i1bBlLXlx0wwgjNwswXac8vQ8VmQS3soX/k6btNgnsI/:m9sWssK6kz1x/lws88vQ8BS82/NtNgT/

Score

10^/10

smsworm

Android SMSWorm payload 1 IoCs

resource	yara_rule
sample	family_smsworm

Requests dangerous framework permissions 3 IoCs

description	ioc
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION

Permissions

android.permission.INTERNET

android.permission.READ_PHONE_STATE

android.permission.WRITE_EXTERNAL_STORAGE

com.android.launcher.permission.INSTALL_SHORTCUT

com.android.launcher.permission.UNINSTALL_SHORTCUT

android.permission.ACCESS_NETWORK_STATE

android.permission.ACCESS_COARSE_LOCATION

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE