FBC_smartanimo_V3Scw2tF

As of this writing, the list of "live" applications:

• com.pharaohsgold.fyter

Analysis

The analysis is shown using the com.pharaohsgold.fyter application as an example.

Traffic capturing showed the initial link and hop chain. In the traffic analyzer the chain of conversions looks like this:

The complete chain of transitions looks like this:

1. https://firebaseremoteconfig.googleapis.com/v1/projects/660195169098/namespaces/firebase:fetch
2. https://smartanimo.com/V3Scw2tF?media_source=def&hash=1623342521249-6740866168805668057&android_app_type=installed_app&google_install_referrer=def&ad_id=def&adset_id=def&adset=def&adgroup=def&device_ua=def&campaign_id=def&app_campaign=def&app_campaign_web_id=def&app_campaign_info=def&appmetrica_device_id=def&appmetrica_post_api_key=def&appmetrica_application_id=def&is_vpn_active=false&advertising_id=c01167bf-7a2f-4040-ab40-974196c0c32a
3. https://smartanimo.com/rwhGWb
4. https://smartanimo.com/LXgGWT
5. https://cas.gg-leads.xyz/click?pid=3640&offer_id=254&sub1=newcreo
6. https://first.ua/auth/signup/?refcode=47c8706f-2a30-43df-9541-2e88bed895f7&subid=3640&clickid=60c23dd2d3e5b600016f8052
7. https://first.ua/auth/signup?refcode=47c8706f-2a30-43df-9541-2e88bed895f7&subid=3640&clickid=60c23dd2d3e5b600016f8052

The process of traffic analysis looks like this:

The initial link comes from the firebaseremoteconfig service.

The result of searching for this data in the source files:

Conclusion

The result of the analysis is YARA rules based on the links found and the strings unique to this type of application.

Yara rules: https://pastebin.com/g3Kd92Ne

Password: 09YSvUUsr2