Zver.app new signature

Introduction

An analysis of another type of application from this actor can be found at this link https://teletype.in/@hawkeye/tz2kx3E6P.

Here we will look at applications of a different type from this actor.

List of live applications:

List of deleted applications:

The analysis will be demonstrated using the com.love.correspondence application as an example.

The traffic analysis shows the initial link and the chain of conversions.

Traffic analyzer screenshot (Full size)

Based on the traffic analyzer, the chain of requests looks like this:

Once you know the original link, you can start looking for it in the application code.

Screenshot of the code section with the link (Full size)

There is also code in the code below that uses this link

Using the link in the code (Full size)

There is also another variation on the use of the link in the code, using the example of the com.old.king application

Another example of using a link in an appendix (Full Size)

They differ slightly, but there are differences. Both uses of the link will be used to create a YARA-rule.

The result of the analysis of applications of this type is the YARA-rule, which allows to accurately identify applications belonging to this type.

Password: 4HScAiF2aM