Degree of destruction<\/strong>: average<\/p>\n Prevalence rate: <\/strong>average<\/p>\n These are malware that often includes adware or install toolbars or such aims but is not like other malicious malware. This category of malware maybe perform some actions which are not approved or expected by the user and are malicious but some users believe that the advantages of using these kinds of applications are more than their defects and consider the arbitrary use of them has no problem.<\/p>\n Notifier malware families send ads notification to users by using notification services. If a user clicks on each of the notifications on the phone, the advertising page will open in the browser.<\/p>\n The name of this application is Maddahi- e-Ashura and uses advertising services named Pushe to show its notifications and advertising links. Pushe is a push notification service related to an Iranian company named Ronash (Ronash. co and pushe. co)<\/p>\n This service is embedded for mobile and web developers to show their notifications so they can send them to their users according to rules set in the company. Application developers will send notifications to their subscribers by user panel which this company provides them, but these notifications can be annoying and destructive, without user permission and acceptance and especially without necessary checking based on what title and content they have.<\/p>\n After running the program, the different sections of the application will be run by recalling some files that are in the application assets folder of the program. For different sections of this application, it needs to connect to the specified address to be executed. For instance, it sends a message to the user that to play the videos, the user should download the player file from \u201cHTTPS [:]\/\/myket.ir\/app\/ com.Devi.MXplayer \/? Lang =fa\u201d (right now there no other application in this address). By Telegram channel https[:]\/\/t.me\/ myappforyou\u201d you can connect with the developers and if the user does not have the Telegram app on the phone, the user will encounter this message: \u201cthere is no Telegram on your phone\u201d.<\/p>\n Regarding static checking of the application, according to manifest.xml, about permissions and application and then after checking application code, it is easy to see this application using notification sending services. Also, the type that it uses to send its notifications is \u201cJSON\u201d which means sending desired content in the form of JSON to the application. According to the notification sending service of the Pushe to the user\u2019s phone, sending content (title, text, icon, image, etc.) to the user is possible.<\/p>\n Also, the application uses the user\u2019s location to send purposeful notifications (advertising). The use Token of this application in Pushe is as follows:<\/p>\n add(new AbstractMap.SimpleEntry(“http:\/\/4.ifcfg.me\/json”, “ip”));<\/p>\n add(new AbstractMap.SimpleEntry(“http:\/\/ifcfg.me\/json”, “ip”));<\/p>\n add(new AbstractMap.SimpleEntry(“http:\/\/ipinfo.io\/json”, “ip”));<\/p>\n add(new AbstractMap.SimpleEntry(“http:\/\/ip-api.com\/json\/?callback=yourfunction”, “query”));<\/p>\n add(new AbstractMap.SimpleEntry(“https:\/\/api.ipify.org?format=json”, “ip”));<\/p>\n add(new AbstractMap.SimpleEntry(“http:\/\/icanhazip.com\/”, “”));<\/p>\n add(new AbstractMap.SimpleEntry(“http:\/\/ip.ronash.co\/geoip”, “ip”));<\/p>\n android.net.ConnectivityManager.getActiveNetworkInfoWhat is PUA?<\/h3>\n
What is the Notifier malware family?<\/h3>\n
Technical Explanation<\/h2>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2020\/11\/adware.png\")
<\/p>\n<meta-data android:name=\"co.ronash.pushe.token\" android:value=\"PUSHE_48483076454\"\/><\/code><\/p>\n<uses-permission android:name=\"android.permission.ACCESS_COARSE_LOCATION\u201d\/ ><\/code><\/p>\n\n
<service android:name=\".pushejsonservice\"\/><\/code><\/p>\n<receiver android:name=\".pushejsonservice$pushejsonservice_BR\" android:permission=\"com.google.android.c2dm.permission.SEND\"><\/code><\/p>\n<intent-filter><\/code><\/p>\n<action android:name=\"android.intent.action.BOOT_COMPLETED\"\/><\/code><\/p>\n<\/intent-filter><\/code><\/p>\n<intent-filter><\/code><\/p>\n<action android:name=\"com.google.android.c2dm.intent.RECEIVE\"\/><\/code><\/p>\n<category android:name=\"moharam.madahi.mv\"\/><\/code><\/p>\n<\/intent-filter><\/code><\/p>\n<intent-filter><\/code><\/p>\n<action android:name=\"com.google.android.c2dm.intent.REGISTRATION\"\/><\/code><\/p>\n<category android:name=\"moharam.madahi.mv\"\/><\/code><\/p>\n<\/intent-filter><\/code><\/p>\n<\/receiver><\/code><\/p>\n\n
<uses-permission android:name=\"android.permission.RECEIVE_BOOT_COMPLETED\"\/><\/code><\/p>\n<receiver android:name=\".pushejsonservice$pushejsonservice_BR\" android:permission=\"com.google.android.c2dm.permission.SEND\"><\/code><\/p>\n<intent-filter><\/code><\/p>\n<action android:name=\"android.intent.action.BOOT_COMPLETED\"\/><\/code><\/p>\n<\/intent-filter><\/code><\/p>\n<intent-filter><\/code><\/p>\n<action android:name=\"com.google.android.c2dm.intent.RECEIVE\"\/><\/code><\/p>\n<category android:name=\"moharam.madahi.mv\"\/><\/code><\/p>\n<\/intent-filter><\/code><\/p>\n<intent-filter><\/code><\/p>\n<action android:name=\"com.google.android.c2dm.intent.REGISTRATION\"\/><\/code><\/p>\n<category android:name=\"moharam.madahi.mv\"\/><\/code><\/p>\n<\/intent-filter><\/code><\/p>\n<\/receiver><\/code><\/p>\n\n
<receiver android:name=\"co.ronash.pushe.receiver.UpdateReceiver\"><\/code><\/p>\n<intent-filter><\/code><\/p>\n<action android:name=\"android.intent.action.PACKAGE_REPLACED\"\/><\/code><\/p>\n<data android:path=\"moharam.madahi.mv\" android:scheme=\"package\"\/><\/code><\/p>\n<\/intent-filter><\/code><\/p>\n<\/receiver><\/code><\/p>\n\n
\n
\nandroid.net.NetworkInfo.isConnectedOrConnecting
\nandroid.net.wifi.WifiManager.getConnectionInfo
\nandroid.net.ConnectivityManager.getNetworkInfo
\nandroid.net.NetworkInfo.isConnected
\nandroid.net.NetworkInfo.getState<\/p>\n\n
\n
\n
How to deal with it and disinfect the system<\/h2>\n