smsworm | hxxps://cafebazaar[.]ir/app/com[.]freecoins[.]newfreerobuxgenerator?l=en

Analysis

max time kernel
329s
max time network
332s
platform
android-13_x64
resource
android-33-x64-arm64-20240910-en
resource tags

arch:arm64arch:x64arch:x86image:android-33-x64-arm64-20240910-enlocale:en-usos:android-13-x64system
submitted
19/03/2025, 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cafebazaar.ir/app/com.freecoins.newfreerobuxgenerator?l=en

Score

10^/10

smsworm infostealer spyware trojan

Malware Config

Signatures

Android SMSWorm payload 1 IoCs

resource	yara_rule
behavioral1/files/fstream-10.dat	family_smsworm

SMSWorm
SMSWorm is an Android malware that can spread itself to a victim's contact list via SMS first seen in May 2021.
trojan infostealer spyware smsworm
Smsworm family
smsworm

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by VPN services to bind with the system. Allows apps to provision VPN services.	android.permission.BIND_VPN_SERVICE

Requests dangerous framework permissions 5 IoCs

description	ioc
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Allows an application to request installing packages.	android.permission.REQUEST_INSTALL_PACKAGES
Allows an application a broad access to external storage in scoped storage.	android.permission.MANAGE_EXTERNAL_STORAGE
Allows applications to use exact alarm APIs.	android.permission.SCHEDULE_EXACT_ALARM
Allows an app to post notifications.	android.permission.POST_NOTIFICATIONS

Checks CPU information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/cpuinfo	com.android.chrome

Checks memory information 2 TTPs 1 IoCs

System Checks

T1633.001

System Information Discovery

T1426

description	ioc	Process
File opened for read	/proc/meminfo	com.android.chrome

com.android.chrome
1⤵
- Checks CPU information
- Checks memory information
PID:4472

Network

MITRE ATT&CK Mobile v15

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1633

System Checks

T1633.001

Credential Access

Discovery

System Information Discovery

T1426

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

files/dom-0.html

Filesize
10KB

MD5
4e6155030737c8caea3f38222847874a

SHA1
21a873c78196a07b7468c9619051753735df6867

SHA256
bfbb2c1d4c48b7d572eba3afb3c07766f988eb75030ceef1cb5e27dd8d17eb39

SHA512
af008c30f993ae0ccb29a4496fc711054ed47e179b6dc8cddefe87792fb36ec78761e677874e02b0effa5466e3b44f739de2dc3fa5c0912691ff6e005779fb3a

Download Submit
/storage/emulated/0/Download/.pending-1742960231-bazaar.apk

Filesize
21.2MB

MD5
76136f6e2cc6af4ab9be0242309e933a

SHA1
421d2e9d15db05babf5b51899787c4a42bb8dbd6

SHA256
10c06d4dd7e63b7374a5c6949411f7da05744a2e6d0140f93250820a8f421048

SHA512
0f2ea758f3ec25b4e61efeff91b7867424e4ad990494401fed2950b02713c508bad7df83807025acb027c3b7ee29720fa6e0a7a19d8fce1cf76e1dffba627340

Download Submit
/storage/emulated/0/Download/.pending-1742960231-bazaar.apk (deleted)

Filesize
1.7MB

MD5
b82c81900e045dcbcf7f41fd574de021

SHA1
fe1d3567b8808b7f5b7a1fefd46ff563aa8553f0

SHA256
451ed19e1a23256c1c3e9dffb074ac9af58ea7999fb4296579d6c175c2cb1c51

SHA512
55e718d9ac6313a881b39a0aff37d49a850b7f14c5db262f5b58a7cd1c07b0ab1239a361c8121ee5d8ac682f1282bdd3ac95d286e7821bb72e901e04798584e9

Download Submit
/storage/emulated/0/Download/.pending-1742960466-freerobux-9-8.apk

Filesize
9.2MB

MD5
f2453811cddc90116ce63d9ea7753d55

SHA1
08a004935949cca204f25d04c36bb4d51c3a0837

SHA256
8030f845f6007789d7faed73d241f76327b385dc61330071fe330d7e5261068c

SHA512
94a4cdd7999f66d1c9c6e71e253d3628dfd8ec2079a5577a547f7a902adbf3b97291f6c0879936e0c90fc2f595911354ceb36a634985e6295bdc3b279b77f905

Download Submit
/storage/emulated/0/Download/.pending-1742960466-freerobux-9-8.apk (deleted)

Filesize
1.2MB

MD5
02e280d1120336b7c5467f96f4376b4f

SHA1
2b621164a0fca6d94c871df347851c25ed875d31

SHA256
a3fad769c39d39910b617b3484bf89baa460fd4d10d0e2329b9c9fe71d00ed9b

SHA512
fff1f80afe19331fc493c5a5b9b3d5cc5f20252539e0f285686a9c09000cae878c9908c8cfbfc0a1223d41a3673f12d519592883060900d63b0e76edda65e240

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Mobile v15

Replay Monitor

Loading Replay Monitor...

Downloads