Rewterz Threat Advisory – CVE-2020-4008 – VMware Carbon Black Cloud macOS Sensor
December 16, 2020Rewterz Threat Alert – Active QakBot Malspam Activity
December 16, 2020Rewterz Threat Advisory – CVE-2020-4008 – VMware Carbon Black Cloud macOS Sensor
December 16, 2020Rewterz Threat Alert – Active QakBot Malspam Activity
December 16, 2020Severity
High
Analysis Summary
APT-C-27 also known as GpldMouse threat group. he APT group is reportedly targeting the Middle East region. Android devices are targeted – The researchers also detected multiple samples designed to target Android devices. Multiple related Android samples with C2 205.251.145[.]29 295.yao[.]cl 94.177.251[.]146 have been found. Those recent Android backdoors are disguised as commonly used applications such as Android system. Once these false ‘HD.APK’ files are downloaded on the device, attackers use the C2 server to capture details such as GPS Positioning and perform tasks like recording and photographing from the device.
Impact
- File recording
- Information theft
- Exposure of data
Indicators of Compromise
Filename
- HD[.]apk
IP
- 205[.]251[.]145[.]29
- 94[.]177[.]251[.]146
MD5
- 14d9cea1080b4ef3e41329d7fb84f70b
SHA-256
- 621741a6bd764a7e0af6294dc209e645cc4b958fd68c0b12760c9cad2e019328
SHA1
- eb3499938fa32d1cdcef3529e5d90146e6fe3a96
URL
- http[:]//chatsafe[.]tecnova[.]com[.]br/Super/HD[.]apk
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.
- Always download legitimate updates from the play store.