Trusted Design

Technical details on the Fancy Bear Android malware (poprd30.apk)

概要

"Recently, Crowdstrike has published details about a malicious Android APK file, named poprd30.apk or Попр-Д30.apk. It seems that the malware was created by the Fancy Bear group for tracking Ukrainian field artillery units (more info on this can be found here: https://www.crowdstrike.com/wp-content/brochures/FancyBearTracksUkrainianArtillery.pdf). The corresponding APK is identified by the MD5 hash 6f7523d3019fa190499f327211e01fcb on a related blog site https://www.crowdstrike.com/blog/danger-close-fancy-bear-tracking-ukrainian-field-artillery-units/. However, not much technical details have been given by CrowdStrike on the attack. During discussions on the topic, Jeffrey Carr initiated discussions with us and has sent some questions on if the case is real and how exactly the attack works, in particular, how the malware could have been used in military conflicts..."

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

• Group 123 (update June 4th 2018) (score: 0.61)
• RuMMS: The Latest Family of Android Malware (score: 0.58)
• The Curious Case of an Unknown Trojan Targeting German-Speaking Users (score: 0.58)
• Disclosure of another 0day malware - Update and Additional Information (2012) (score: 0.57)
• TrendLabs: Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind (score: 0.56)

このPulseに関連する脅威アクター (事実ベース)

このPulseに関連する脅威アクター (推論ベース)

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

---

← Pulse一覧に戻る