Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
6 IOCs
Shocking FireScam Android Malware Telegram Premium Spyware Exposed
Threat Actors
Malware Families
Excerpt
FireScam is a recently identified Android malware that masquerades as a “Telegram Premium” application. Its distribution method leverages GitHub.io-based phishing sites impersonating the legitimate Russian RuStore app store, thereby deceiving unwary users into installing a bogus APK. With its multifaceted spyware and information-stealing capabilities , FireScam represents a crucial case study in modern mobile malware, demonstrating innovative evasion techniques, comprehensive…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability(1)
Victim
Indicators of Compromise
Open the mindmap →6 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | 12305b2cacde34898f02bed0b12f580aff46531aa4ef28ae29b1bf164259e7d1 | Medium | Score 53/100 | First seen |
| MD5 | 5d21c52e6ea7769be45f10e82b973b1e | Medium | Score 53/100 | First seen |
| MD5 | cae5a13c0b06de52d8379f4c61aece9c | Medium | Score 53/100 | First seen |
| SHA256 | b041ff57c477947dacd73036bf0dee7a0d6221275368af8b6dbbd5c1ab4e981b | Medium | Score 53/100 | First seen |
| URL | https://s-usc1b-nss-2100.firebaseio.com/.ws?ns=androidscamru-default-rtdb&v=5&ls=* | High | Score 58/100 | First seen |
| URL | https://s-usc1b-nss-2100.firebaseio.com/.ws?ns=androidscamru-default-rtdb&v=5&ls= | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…