diff --git a/SMSFactory/README.md b/SMSFactory/README.md new file mode 100644 index 0000000..25657d5 --- /dev/null +++ b/SMSFactory/README.md @@ -0,0 +1,39 @@ +# IOC for SMSFactory + +## Android + +SMSFactory has a few versions, each with numerous samples that are nearly identical in their malicious features. +The IOCs include several samples from each version as well as C2 servers used to deliver commands. + +### Most recent version with SMS and call features +SHA256 Package name +453df13d0a713ceaaf4790d7d08475a5f770e0ddf3b99c7355e99ff1819f5e83 com.older.appearedbringing +5e0b625abb4125ffeb1ec375f36ad22d8f4699bb411067434b3a71688959e495 xyz.toe.punishmentdemo +315aa2102b04fef28347788c8e32b6b45c0fd395106f6415f8d08db368c85053 xyz.milfs.ebonyignored +adea95a9b678220b6a5c54d54c3043f20c26ed9cbcc4ce304f2a737a98e7d1b4 com.introducing.incestpointer +26d527ffdbe35c1a3cac05a490bca36d3eae13a897648ee7ff81e0c412ce5a54 net.apart.behavioralrefinance +a01808e5b4d57f31bd17b1d8a2422d23d52f618e3284732449f7d22139d0eb36 xyz.bachelor.desktopscooking + +### Version with conditions and admin access +SHA256 Package name +a57fdb5f8845022cbcb33e62bfe8fc8757391b64fbfb6be87eb7e71e92c538f5 way.heaven.cringe.stop +5e13ba4cd22e59f9dec180a050865348f8c64147527f5d52a6f467e51201a29a mueres.vives.elige.wise +befbb3ab3711a991903a0cdac8d9f3782bc460c75fece4d9e8b01aba7394acd7 panama.tony.exit.roma +58557cbb1cffa5f50bd2f70e205edca5f2b037bda0e99a2dfe3b1035cc0ff497 scope.submarine.maza.zoo +a9c24f54503c58b73bffa20bd4fb77bd424e01d3014a949a41de638f6841a45f casius.klay.tropa.roop +a0d0ded55f9bf2d286c5eac230b998a5e4ec6bbd894ff2dd0da97fd1079b4a92 period.inform.crash.troupe + +### Older game hack version with an icon +SHA256 Package name +d7a6f57c30e04623b105fc83c0b8e85787e327accd0bf691af3b1da655f1d160 com.fortnite +0e278d7faf8dd97689297435f08bb5561c36151b4a3ef2c3ab0d024165170091 com.enlighten.lastlight.hack +ff2a35970052a0d66802d543260f4eafc8ceac4ea0d3a709a1859b0f5914bef9 net.peakgames.amy.hack +06d1759e8b4cdce0bc2faa5f4678d83d64887570dd0dd6a04b596052ab2c7edd com.outfit7.mytalkingtomfree.hack +13f6322973ce58a0e20607e6167f3fb7925c494cdd627bdabdc2d78f87f3c38a com.pockettrend.neomonsters.hack +07fb68ae79c38a3a17222e7fa67bcb5e0bee5a8fe46e4a6b5caaf16135241f45 com.gamefirst.chibisurvivorlord.hack + +### C2 +sms.service.mobilelinks[.]xyz +krinterro[.]com +phone.relario[.]xyz +sms.relario[.]xyz \ No newline at end of file diff --git a/SMSFactory/SMSFactory IOC.csv b/SMSFactory/SMSFactory IOC.csv new file mode 100644 index 0000000..62fefef --- /dev/null +++ b/SMSFactory/SMSFactory IOC.csv @@ -0,0 +1,19 @@ +SHA256,Package name +453df13d0a713ceaaf4790d7d08475a5f770e0ddf3b99c7355e99ff1819f5e83,com.older.appearedbringing +5e0b625abb4125ffeb1ec375f36ad22d8f4699bb411067434b3a71688959e495,xyz.toe.punishmentdemo +315aa2102b04fef28347788c8e32b6b45c0fd395106f6415f8d08db368c85053,xyz.milfs.ebonyignored +adea95a9b678220b6a5c54d54c3043f20c26ed9cbcc4ce304f2a737a98e7d1b4,com.introducing.incestpointer +26d527ffdbe35c1a3cac05a490bca36d3eae13a897648ee7ff81e0c412ce5a54,net.apart.behavioralrefinance +a01808e5b4d57f31bd17b1d8a2422d23d52f618e3284732449f7d22139d0eb36,xyz.bachelor.desktopscooking +a57fdb5f8845022cbcb33e62bfe8fc8757391b64fbfb6be87eb7e71e92c538f5,way.heaven.cringe.stop +5e13ba4cd22e59f9dec180a050865348f8c64147527f5d52a6f467e51201a29a,mueres.vives.elige.wise +befbb3ab3711a991903a0cdac8d9f3782bc460c75fece4d9e8b01aba7394acd7,panama.tony.exit.roma +58557cbb1cffa5f50bd2f70e205edca5f2b037bda0e99a2dfe3b1035cc0ff497,scope.submarine.maza.zoo +a9c24f54503c58b73bffa20bd4fb77bd424e01d3014a949a41de638f6841a45f,casius.klay.tropa.roop +a0d0ded55f9bf2d286c5eac230b998a5e4ec6bbd894ff2dd0da97fd1079b4a92,period.inform.crash.troupe +d7a6f57c30e04623b105fc83c0b8e85787e327accd0bf691af3b1da655f1d160,com.fortnite +0e278d7faf8dd97689297435f08bb5561c36151b4a3ef2c3ab0d024165170091,com.enlighten.lastlight.hack +ff2a35970052a0d66802d543260f4eafc8ceac4ea0d3a709a1859b0f5914bef9,net.peakgames.amy.hack +06d1759e8b4cdce0bc2faa5f4678d83d64887570dd0dd6a04b596052ab2c7edd,com.outfit7.mytalkingtomfree.hack +13f6322973ce58a0e20607e6167f3fb7925c494cdd627bdabdc2d78f87f3c38a,com.pockettrend.neomonsters.hack +07fb68ae79c38a3a17222e7fa67bcb5e0bee5a8fe46e4a6b5caaf16135241f45,com.gamefirst.chibisurvivorlord.hack \ No newline at end of file diff --git a/SMSFactory/SMSFactory IOC.pdf b/SMSFactory/SMSFactory IOC.pdf new file mode 100644 index 0000000..7191318 Binary files /dev/null and b/SMSFactory/SMSFactory IOC.pdf differ