smsworm | com-procreate-pro_paint-2[.]apk

General

Target

com-procreate-pro_paint-2.apk
Size

30.3MB
MD5

8d426e98c5954302cd674cf424b1f1f9
SHA1

b765963a0241b203c0a7e374e9aea7acf768d2b7
SHA256

07d7f96a455dc8fed93f17eda927b6ed6bc79bcaa651a65d02a782af6cf9c0c2
SHA512

acf97c9c3e901c1f337d76960d7bc651085b2ba3188bd279ffd312b42102ed8ec78059bfd968aef3ad538f0e4548a66b05ad2f2b5affc3fb1b95dd383efe86ab
SSDEEP

786432:zDhvOp2o6UOKJhcJ6+v4IQzfGe+n/Zfa87PQF/FVb:FOQoWkQ64TQjGxn/Zy8TQF/FVb

Score

10^/10

smsworm

Malware Config

Signatures

Android SMSWorm payload 1 IoCs

resource	yara_rule
sample	family_smsworm

Smsworm family
smsworm

Requests dangerous framework permissions 6 IoCs

description	ioc
Allows an application to read from external storage.	android.permission.READ_EXTERNAL_STORAGE
Allows an application to write to external storage.	android.permission.WRITE_EXTERNAL_STORAGE
Required to be able to access the camera device.	android.permission.CAMERA
Allows an app to access approximate location.	android.permission.ACCESS_COARSE_LOCATION
Allows an app to access precise location.	android.permission.ACCESS_FINE_LOCATION
Allows read only access to phone state, including the current cellular network information, the status of any ongoing calls, and a list of any PhoneAccounts registered on the device.	android.permission.READ_PHONE_STATE

Files

com-procreate-pro_paint-2.apk
.apk android arch:arm64 arch:arm arch:x86 arch:x64

com.procreate.pro_paint

com.procreate.pro_paint.Cantistas.bissmilah

Activities

com.procreate.pro_paint.Cantistas.bissmilah

android.intent.action.MAIN

io.presage.mraid.browser.ShortcutActivity

android.intent.action.MAIN

io.presage.mraid.browser.Android8AndLaterShortcutActivity

android.intent.action.MAIN

Permissions

android.permission.ACCESS_NETWORK_STATE
android.permission.INTERNET
android.permission.READ_EXTERNAL_STORAGE
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.ACCESS_WIFI_STATE
android.permission.CAMERA
android.permission.ACCESS_COARSE_LOCATION
android.permission.VIBRATE
android.permission.ACCESS_FINE_LOCATION
android.permission.READ_PHONE_STATE
com.android.alarm.permission.SET_ALARM
android.permission.RECEIVE_BOOT_COMPLETED
com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Receivers

com.appodeal.ads.AppodealPackageAddedReceiver

android.intent.action.PACKAGE_ADDED

com.tapjoy.InstallReferrerReceiver

com.android.vending.INSTALL_REFERRER

io.presage.core.receiver.UserPresentReceiver

android.intent.action.USER_PRESENT

io.presage.core.receiver.BootCompletedReceiver

android.intent.action.LOCKED_BOOT_COMPLETED
android.intent.action.BOOT_COMPLETED

io.presage.core.receiver.TimeSetReceiver

android.intent.action.TIME_SET

io.presage.core.receiver.CarrierConfigChangedReceiver

android.telephony.action.CARRIER_CONFIG_CHANGED

io.presage.core.receiver.NextAlarmClockChangedReceiver

android.app.action.NEXT_ALARM_CLOCK_CHANGED

io.presage.core.receiver.EventReminderReceiver

android.intent.action.EVENT_REMINDER

io.presage.core.receiver.BluetoothReceiver

android.bluetooth.device.action.ACL_CONNECTED
android.bluetooth.device.action.ACL_DISCONNECTED
android.hardware.usb.action.USB_ACCESSORY_DETACHED

io.presage.core.receiver.PackageFullyRemovedReceiver

android.intent.action.PACKAGE_FULLY_REMOVED

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

android.intent.action.BOOT_COMPLETED

com.yandex.metrica.MetricaEventHandler

com.android.vending.INSTALL_REFERRER

com.yandex.metrica.ConfigurationServiceReceiver

com.yandex.metrica.configuration.service.PLC

Services

com.yandex.metrica.MetricaService

com.yandex.metrica.IMetricaService

com.yandex.metrica.ConfigurationService

com.yandex.metrica.configuration.ACTION_INIT

Android Permissions

com-procreate-pro_paint-2.apk

Permissions

android.permission.ACCESS_NETWORK_STATE

android.permission.INTERNET

android.permission.READ_EXTERNAL_STORAGE

android.permission.WRITE_EXTERNAL_STORAGE

android.permission.ACCESS_WIFI_STATE

android.permission.CAMERA

android.permission.ACCESS_COARSE_LOCATION

android.permission.VIBRATE

android.permission.ACCESS_FINE_LOCATION

android.permission.READ_PHONE_STATE

com.android.alarm.permission.SET_ALARM

android.permission.RECEIVE_BOOT_COMPLETED

com.google.android.finsky.permission.BIND_GET_INSTALL_REFERRER_SERVICE

Sharing

General

Malware Config

Signatures

Files

com.procreate.pro_paint

com.procreate.pro_paint.Cantistas.bissmilah

Activities

com.procreate.pro_paint.Cantistas.bissmilah

io.presage.mraid.browser.ShortcutActivity

io.presage.mraid.browser.Android8AndLaterShortcutActivity

Permissions

Receivers

com.appodeal.ads.AppodealPackageAddedReceiver

com.tapjoy.InstallReferrerReceiver

io.presage.core.receiver.UserPresentReceiver

io.presage.core.receiver.BootCompletedReceiver

io.presage.core.receiver.TimeSetReceiver

io.presage.core.receiver.CarrierConfigChangedReceiver

io.presage.core.receiver.NextAlarmClockChangedReceiver

io.presage.core.receiver.EventReminderReceiver

io.presage.core.receiver.BluetoothReceiver

io.presage.core.receiver.PackageFullyRemovedReceiver

com.startapp.sdk.adsbase.remoteconfig.BootCompleteListener

com.yandex.metrica.MetricaEventHandler

com.yandex.metrica.ConfigurationServiceReceiver

Services

com.yandex.metrica.MetricaService

com.yandex.metrica.ConfigurationService

Android Permissions

com-procreate-pro_paint-2.apk