GPlayed's younger brother is a banker — and it's after Russian banks
Tags
country: Russia
attack-pattern: Data Credentials - T1589.001 Domains - T1583.001 Domains - T1584.001 Malware - T1587.001 Malware - T1588.001 Network Security Appliances - T1590.006 Sms Messages - T1636.004
Show in Graph
Common Information
Type Value
UUID 3f44ecc3-957c-46f3-aa3c-24d0a77c51ec
Fingerprint afac1d91ad920385
Analysis status DONE
Considered CTI value 0
Text language
Published Oct. 29, 2018, 11:30 a.m.
Added to db Sept. 26, 2022, 9:30 a.m.
Last updated Nov. 14, 2024, 2:04 p.m.
Headline Vulnerability Information
Title GPlayed's younger brother is a banker — and it's after Russian banks
Detected Hints/Tags/Attributes 62/2/10
Source URLs
Redirection Url
Details Source https://blog.talosintelligence.com/2018/10/gplayerbanker.html
URL Provider
Details Provider Source level domain
Details talosintelligence.com blog.talosintelligence.com
Attributes
Details Type #Events CTI Value
Details Domain 3 
sub1.tdsworker.ru
Details Domain 52 
android.app
Details Domain 904 
snort.org
Details File 1 
index_main.html
Details File 3 
package.apk
Details File 1 
playmarket.dll
Details sha256 1 
81d4f6796509a998122817aaa34e1c8c6de738e1fff5146009c07be8493f162c
Details sha256 1 
3c82d98f63e5894f53a5d2aa06713e9212269f5f55dcb30d78139ae9da21e212
Details Url 1 
http://sub1.tdsworker.ru:5555/sms
Details Url 1 
http://sub1.tdsworker.ru:6565/index_main.html