smsworm | d588fa6445658d0efb0eb9aeaceda48472ea81da762f94d3d48564e033ad60aa[.]apk

General

Target

d588fa6445658d0efb0eb9aeaceda48472ea81da762f94d3d48564e033ad60aa.apk
Size

10.2MB
MD5

593140f9f7914ee990b96819c6435a20
SHA1

13a1b7746e4b43d1d63bdbd745a02dd05ec031ee
SHA256

d588fa6445658d0efb0eb9aeaceda48472ea81da762f94d3d48564e033ad60aa
SHA512

1767217695b713cbfa833b7c3a150dd7f40f89addd2fa1ea2f233f0e46b818ef498c019fb56d689c071c6e82bc2704af3c0df7ae13392ff9e255450716d46b1d
SSDEEP

196608:7d7pyOZTZ27Emt7w3ZaOh4YeGHkGhWr8naMuuls+DycZlBEQ+ep5:B7E4tZmt7w3Z1vbRYnMuqs+l

Score

10^/10

smsworm

Malware Config

Signatures

Android SMSWorm payload 1 IoCs

resource	yara_rule
sample	family_smsworm

Smsworm family
smsworm

Declares services with permission to bind to the system 1 IoCs

description	ioc
Required by remote views services to bind with the system. Allows apps to share and display views across different processes.	android.permission.BIND_REMOTEVIEWS

Files

d588fa6445658d0efb0eb9aeaceda48472ea81da762f94d3d48564e033ad60aa.apk
.apk android arch:arm64 arch:arm arch:mips arch:mips64 arch:x86 arch:x64

aplic1423116.muo

aplic1423116.muo.preinicio

Activities

aplic1423116.muo.preinicio

android.intent.action.MAIN
android.intent.action.VIEW
android.intent.action.VIEW
android.intent.action.VIEW

aplic1423116.muo.SearchableActivity

android.intent.action.SEARCH

aplic1423116.muo.ExpandedControlsActivity

android.intent.action.MAIN

com.facebook.CustomTabActivity

android.intent.action.VIEW

Permissions

android.permission.FOREGROUND_SERVICE
android.permission.INTERNET
android.permission.ACCESS_NETWORK_STATE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.ACCESS_WIFI_STATE
android.permission.RECEIVE_BOOT_COMPLETED

Receivers

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

android.intent.action.BOOT_COMPLETED

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.facebook.sdk.ACTION_CURRENT_ACCESS_TOKEN_CHANGED

com.appnext.base.receivers.AppnextBootReciever

android.intent.action.BOOT_COMPLETED

Services

aplic1423116.muo.MyFcmListenerService

com.google.firebase.MESSAGING_EVENT

aplic1423116.muo.MyInstanceIDListenerService

com.google.firebase.INSTANCE_ID_EVENT

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.MESSAGING_EVENT

com.google.firebase.iid.FirebaseInstanceIdService

com.google.firebase.INSTANCE_ID_EVENT

Android Permissions

d588fa6445658d0efb0eb9aeaceda48472ea81da762f94d3d48564e033ad60aa.apk

Permissions

android.permission.FOREGROUND_SERVICE

android.permission.INTERNET

android.permission.ACCESS_NETWORK_STATE

android.permission.WAKE_LOCK

com.google.android.c2dm.permission.RECEIVE

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

android.permission.ACCESS_WIFI_STATE

android.permission.RECEIVE_BOOT_COMPLETED

Sharing

General

Malware Config

Signatures

Files

aplic1423116.muo

aplic1423116.muo.preinicio

Activities

aplic1423116.muo.preinicio

aplic1423116.muo.SearchableActivity

aplic1423116.muo.ExpandedControlsActivity

com.facebook.CustomTabActivity

Permissions

Receivers

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

com.facebook.CurrentAccessTokenExpirationBroadcastReceiver

com.appnext.base.receivers.AppnextBootReciever

Services

aplic1423116.muo.MyFcmListenerService

aplic1423116.muo.MyInstanceIDListenerService

com.google.firebase.messaging.FirebaseMessagingService

com.google.firebase.iid.FirebaseInstanceIdService

Android Permissions

d588fa6445658d0efb0eb9aeaceda48472ea81da762f94d3d48564e033ad60aa.apk