Medium
A new Android malware leveraging a COVID-19 theme to infect devices and steal victim data. The distribution method used by this malware is not currently known, but it cannot be found in the official Google Play Store, so the apps must be side-loaded by users. Various icons are used for the application but consistent across the samples is the package name “DZ.Eagle.Master” and the application label “Covid.” Once installed on the device, the malware checks in to the C2 server while simultaneously providing it with device information, such as the network operator, model, manufacturer, and IP address. In response, the C2 server provides the malware with a configuration file, “settings.xml.” The C2 server can also issue one of several commands. These commands include closing the malware, displaying messages, and exfiltrating the contact list, phone calls, device information, and SMS messages. The location of the C2 server combined with the package name indicates that Algerian users are likely being targeted. Notably, this malware is using an old, compromised code signing certificate.