TF-MAL-apk.pineflower
📛 Threat Title
Malware family: PINEFLOWER
Description
ThreatFox malware family `apk.pineflower`. Printable name: PINEFLOWER.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.pineflower
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.pineflower
IOC database
- Type
- domain
- Value
apk.pineflower- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.pineflower
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.pineflower
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:apt.etda.or.th
Threat Group Cards: A Threat Actor Encyclopedia Tool: PINEFLOWER ... Last change to this tool card: 22 June 2023 Download this tool card in JSON format All groups using tool PINEFLOWER ... 2 groups listed (2 APT, 0 other, 0 unknown) ↑
-
web:assets.kpmg.com
In addition to spear phishing, APT42 involves in surveillance activities by infecting mobile devices of the victims with Android malware such as VINETHORN and PINEFLOWER which are dropped via text messages. With nation-backed interests, patience and perseverance, APT42 is expected to continue operations.
-
web:attack.mitre.org
APT42 is an Iranian-sponsored threat group that conducts cyber espionage and surveillance. [1] The group primarily focuses on targets in the Middle East region, but has targeted a variety of industries and countries since at least 2015. [1] APT42 starts cyber operations through spearphishing emails and/or the PINEFLOWER Android malware , then monitors and collects information from the ...
-
web:bazaar.abuse.ch
Malware samples associated with tag PINEFLOWER MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with PINEFLOWER . Database Entry
-
web:malpedia.caad.fkie.fraunhofer.de
According to Mandiant, PINEFLOWER is an Android malware family capable of a wide range of backdoor functionality, including stealing system inform information, logging and recording phone calls, initiating audio recordings, reading SMS inboxes and sending SMS messages. The malware also has features to facilitate device location tracking, deleting, downloading, and uploading files, reading ...
-
web:openhunting.io
Notably, the author also noted that the malware stored files ready for exfiltration in a directory named '.data_gsc98647a3', the string we identified in our PINEFLOWER samples. It seemed likely that CORRUPT KITTEN and PINEFLOWER were one and the same.
-
web:services.google.com
APT42 likely delivers its Android malware such as VINETHORN and PINEFLOWER via text messages. Between July 2020 and March 2021, the group successfully used PINEFLOWER Android malware to compromise several dozen Android devices we believe belong to individuals residing in Iran.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.pcrisk.com
PINEFLOWER malware overview The PINEFLOWER malware family compromises programs with a broad range of malicious functionalities. One of these features includes backdoor capabilities, wherein a program opens a "backdoor" for additional malware to infiltrate a compromised device.
-
web:www.vectra.ai
APT42 often crafts tailored lures impersonating journalists or legitimate institutions in phishing emails. Operations have included credential theft from Microsoft 365 environments and mobile device surveillance using Android malware like PINEFLOWER .
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.