furball | 3c273166c5221614198a7bbe0ed8ed0738ca4b62321a8d44a43fa7353a9f7d70[.]zip

General

Target

3c273166c5221614198a7bbe0ed8ed0738ca4b62321a8d44a43fa7353a9f7d70.zip
Size

4.1MB
MD5

16aa7bf904f0e97475dcd8e5e9704151
SHA1

900335646d68cf3fe8dcf5edef3d3a9beda306ca
SHA256

24dff35f884edbe5c1dad00ff4ceb6a429857f9eef9e179658105d77793df37b
SHA512

158ac70a93d67b025501e872fe01e4301799f3e55c1de4da7e6ad061e41dbe1dc1cff34d06f0c7116e78537ad23fea04409fd66100ce8a846b28d4812eba1a64
SSDEEP

98304:Yh/o/rqn8Kh2nT0Qwwe3OYzX6Xbw6BKwcfbRXaqS8iD7imn:YRL2TS3lzX8wW5MlS8i7

Score

10^/10

furball

Malware Config

Extracted

Family

furball

C2

http://www.googleassisstants.com/mmh

Signatures

Furball family
furball

Declares services with permission to bind to the system 2 IoCs

description	ioc
Required by notification listener services to bind with the system. Allows apps to listen to and interact with notifications on the device.	android.permission.BIND_NOTIFICATION_LISTENER_SERVICE
Required by accessibility services to bind with the system. Allows apps to access accessibility features.	android.permission.BIND_ACCESSIBILITY_SERVICE

Requests dangerous framework permissions 15 IoCs

description	ioc
Allows an application to collect component usage statistics.	android.permission.PACKAGE_USAGE_STATS
Allows an application to read SMS messages.	android.permission.READ_SMS
Allows access to the list of accounts in the Accounts Service.	android.permission.GET_ACCOUNTS
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an application to read the user's contacts data.	android.permission.READ_CONTACTS
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE
Allows an application to read the user's call log.	android.permission.READ_CALL_LOG
Allows an application to read or write the system settings.	android.permission.WRITE_SETTINGS
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an application to record audio.	android.permission.RECORD_AUDIO
Allows an application to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether.	android.permission.PROCESS_OUTGOING_CALLS
Allows an application to receive SMS messages.	android.permission.RECEIVE_SMS
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE

Files

3c273166c5221614198a7bbe0ed8ed0738ca4b62321a8d44a43fa7353a9f7d70.zip
.zip

Password: infected
3c273166c5221614198a7bbe0ed8ed0738ca4b62321a8d44a43fa7353a9f7d70
.apk android

Password: infected

com.arzdigitals

com.arzdigitals.MainActivity

Activities

com.arzdigitals.MainActivity

android.intent.action.MAIN

Permissions

android.permission.INTERNET
com.arzdigitals.DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION
android.permission.VIBRATE
android.permission.PACKAGE_USAGE_STATS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.QUICKBOOT_POWERON
android.permission.READ_SMS
android.permission.REAL_GET_TASKS
android.permission.GET_ACCOUNTS
android.permission.ACCESS_COARSE_LOCATION
com.android.browser.permission.READ_HISTORY_BOOKMARKS
android.permission.ACCESS_NETWORK_STATE
android.permission.READ_CONTACTS
android.permission.ACCESS_FINE_LOCATION
android.permission.WAKE_LOCK
android.permission.READ_PHONE_STATE
android.permission.READ_CALL_LOG
android.permission.READ_LOGS
android.permission.WRITE_SETTINGS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.CAMERA
android.permission.RECORD_AUDIO
android.permission.PROCESS_OUTGOING_CALLS
android.permission.RECEIVE_SMS
android.permission.BIND_ACCESSIBILITY_SERVICE
android.permission.MANAGE_EXTERNAL_STORAGE
android.permission.FOREGROUND_SERVICE

Receivers

com.android.google.play.OnBootManager

android.intent.action.BOOT_COMPLETED
android.intent.action.ACTION_POWER_CONNECTED

Services

com.android.google.play.NotifObs

android.service.notification.NotificationListenerService

com.android.google.play.RecorderService

android.accessibilityservice.AccessibilityService

Sharing

General

Malware Config

Extracted

Signatures

Files

Password: infected

Password: infected

com.arzdigitals

com.arzdigitals.MainActivity

Activities

com.arzdigitals.MainActivity

Permissions

Receivers

com.android.google.play.OnBootManager

Services

com.android.google.play.NotifObs

com.android.google.play.RecorderService