#Firestarter apk help install

Thus, they will prevent the payload from falling into researchers’ or law enforcement’s hands. This new loader has two important features for the attackers.įirst, it allows them to make a decision who receives the payload, having the ability to verify the victim before sending the payload. The necessity for a New Loaderīetter control of the compromised devices even if the C2 is down. Now this malicious app contains additional malicious code that attempts to download a payload based on information obtained from the compromised device.Īfter getting the Google FMC token (Step 1) the operators have everything they need to send the Google FMC message containing the URL for the malware to download, geographic location, IP address, IMEI, and email address from the victims, allowing them to decide which victims should receive the payload. In the background, however, the malicious app is attempting to download a payload using FCM. Once the message of uninstallation is shown, the icon is removed from the user interface. This is often a lure to make the victim believe that there was no malicious install, researchers said. Once the app, which purports to be a chat platform is downloaded and opened, users receive a message that chats are continually loading, the application is not supported, and uninstallation is ongoing (as shown in the sequence below). The filename of those Android applications (kashmir_sample.apk or Kashmir_Voice_v4.8.apk) shows continued interest in India, Pakistan, and the Kashmir crisis.

#Firestarter apk help install

Users are tempted to install a malicious app on their mobile device, likely done via direct messages that utilize social engineering, researchers said. They are using a legitimate service within Google’s infrastructure which makes it harder for detection across users’ networks. The DoNot APT group is making strides to experiment with new methods of delivery for their payloads.