smsworm | dec_amongUs[.]zip | Triage

Sharing

General

Target

dec_amongUs.zip
Size

5.8MB
MD5

40a52d51bcdd8ffd999d6a8958587ea9
SHA1

e92caa1ad8a0dff720cd0eacf6c72e87a96a3c27
SHA256

453c506378fa71efc871a8f4442b49b6d59a513def153bfec9813856d6d93a1b
SHA512

351f40a0edf0bd547562401171641060435469f065fc9862639f53a31203aa7a4cf28970eba68399c2b7a346591e8013fa02e51c0e9471f240dac7e65481d583
SSDEEP

98304:dWUsDvz3mc/ty9CGVfdOT5jtPCxIr/Tl/j3HxrKDDxe8a3VF1O+dO8dnLTYTbLAZ:dW13v/ty7dET5jt5Tl/7HxkelVDldbn5

Score

10^/10

smsworm

Malware Config

Signatures

Android SMSWorm payload 1 IoCs

resource	yara_rule
static1/unpack001/adcc3a2f7cef4a20d5985f7d6c2290a0	family_smsworm

Smsworm family
smsworm

Requests dangerous framework permissions 2 IoCs

description	ioc
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION

Files

dec_amongUs.zip
.zip

Password: infected
adcc3a2f7cef4a20d5985f7d6c2290a0
.apk android

amoungus.among.us.free.online.game

amoungus.among.us.free.online.game.MainActivity

Activities

amoungus.among.us.free.online.game.MainActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_WIFI_STATE
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.BLUETOOTH
android.permission.INTERNET
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE
android.permission.WAKE_LOCK
com.google.android.c2dm.permission.RECEIVE

Receivers

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

android.intent.action.BOOT_COMPLETED

com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

com.google.firebase.iid.FirebaseInstanceIdReceiver

com.google.android.c2dm.intent.RECEIVE

Services