• Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Transform
      • SOC Consultancy
      •     SOC Maturity Assessment
      •     SOC Model Evaluation
      •     SOC Gap Analysis
      •     SIEM Gap Analysis
      •     SIEM Optimization
      •     SOC Content Pack
    • Train
      • Security Awareness and Training
      • Tabletop Exercise
      • Simulated Cyber Attack Exercises
    • Respond
      • Incident Response
      • Incident Analysis
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Press Release
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
Rewterz Threat Alert – WolfRAT Info Stealing Malware
May 21, 2020
Rewterz Threat Advisory – CVE-2020-3280 – Cisco Unified Contact Center Express Remote Code Execution Vulnerability
May 21, 2020

Rewterz Threat Alert – COVID-19 Themed Android Malware Steals SMS and Contacts

May 21, 2020

Severity

Medium

Analysis Summary

A new Android malware leveraging a COVID-19 theme to infect devices and steal victim data. The distribution method used by this malware is not currently known, but it cannot be found in the official Google Play Store, so the apps must be side-loaded by users. Various icons are used for the application but consistent across the samples is the package name “DZ.Eagle.Master” and the application label “Covid.” Once installed on the device, the malware checks in to the C2 server while simultaneously providing it with device information, such as the network operator, model, manufacturer, and IP address. In response, the C2 server provides the malware with a configuration file, “settings.xml.” The C2 server can also issue one of several commands. These commands include closing the malware, displaying messages, and exfiltrating the contact list, phone calls, device information, and SMS messages. The location of the C2 server combined with the package name indicates that Algerian users are likely being targeted. Notably, this malware is using an old, compromised code signing certificate.

image-21.png

Impact

  • Information theft
  • Exposure of sensitive data

Indicators of Compromise

MD5

  • 2d84a8bbd77aee8432742dc28eef2da3
  • 4271184bc33ee9672fe4713f14e43bd6
  • 51a4472a506795e386906541c3483080
  • a81c5c3da9d41069af9ab00780dbe09e

SHA-256

  • bb1b70b7f6d8fc18e5a5fd743242836475bc6ad978780adec18a8f92c7e9cf89
  • 14609dc616d6889dd02a29051261bc36cb97f6608e51564fdcef5075cf6750d5
  • adf46dc686d35a659a3cff76648c9c036dfc95167b9f4dcb7409dc79d92eb510
  • 9fdc84a3a0d3bc8545a9dec8e8fd5e762cb7cb763af9661aa77f94a459da6396

SHA1

  • 63152ae5ea7408e8d6998c84b105e7cf703b1670
  • 54b8ea2943ffee7a7d7b7ea0201fac7a3659eaa2
  • 58cfeec8493417a1f0e6157a3328d10b0467342f
  • df72e5e9275abd377125098194add7055ab1539e

Remediation

  • Block all threat indicators at your respective controls.
  • Always download recommended/ legitimate applications from playstore.
  • Services
    • Assess
      • Compromise Assessment
      • APT Assessment
      • Penetration Testing
      • Secure Architecture Design & Review
      • Red Team Assessment
      • Purple Team Assessment
      • Social Engineering
      • Source Code Review
    • Respond
      • Incident Response
      • Incident Analysis
  • Transform
    • SOC Consultancy
    •     SOC Maturity Assessment
    •     SOC Model Evaluation
    •     SOC Gap Analysis
    •     SIEM Gap Analysis
    •     SIEM Optimization
    •     SOC Content Pack
  • Train
    • Security Awareness and Training
    • Tabletop Exercise
    • Simulated Cyber Attack Exercises
  • Managed Security
    • Managed Security Monitoring
      • Remote SOC
      • Onsite SOC
      • Hybrid SOC
    • Managed Security Services
      • Managed Detection and Response
      • Managed Endpoint Detection and Response
      • Managed Threat Intelligence
      • Managed Threat Hunting
      • Managed Risk-Based SOAR
      • Managed Penetration Testing
  • Solutions
  • Resources
    • Blog
    • Threat Advisory
  • Company
    • About Us
    • Careers
    • Contact
COPYRIGHT © REWTERZ. ALL RIGHTS RESERVED.