Rewterz Threat Alert – WolfRAT Info Stealing Malware
May 21, 2020Rewterz Threat Advisory – CVE-2020-3280 – Cisco Unified Contact Center Express Remote Code Execution Vulnerability
May 21, 2020Rewterz Threat Alert – WolfRAT Info Stealing Malware
May 21, 2020Rewterz Threat Advisory – CVE-2020-3280 – Cisco Unified Contact Center Express Remote Code Execution Vulnerability
May 21, 2020Severity
Medium
Analysis Summary
A new Android malware leveraging a COVID-19 theme to infect devices and steal victim data. The distribution method used by this malware is not currently known, but it cannot be found in the official Google Play Store, so the apps must be side-loaded by users. Various icons are used for the application but consistent across the samples is the package name “DZ.Eagle.Master” and the application label “Covid.” Once installed on the device, the malware checks in to the C2 server while simultaneously providing it with device information, such as the network operator, model, manufacturer, and IP address. In response, the C2 server provides the malware with a configuration file, “settings.xml.” The C2 server can also issue one of several commands. These commands include closing the malware, displaying messages, and exfiltrating the contact list, phone calls, device information, and SMS messages. The location of the C2 server combined with the package name indicates that Algerian users are likely being targeted. Notably, this malware is using an old, compromised code signing certificate.
Impact
- Information theft
- Exposure of sensitive data
Indicators of Compromise
MD5
- 2d84a8bbd77aee8432742dc28eef2da3
- 4271184bc33ee9672fe4713f14e43bd6
- 51a4472a506795e386906541c3483080
- a81c5c3da9d41069af9ab00780dbe09e
SHA-256
- bb1b70b7f6d8fc18e5a5fd743242836475bc6ad978780adec18a8f92c7e9cf89
- 14609dc616d6889dd02a29051261bc36cb97f6608e51564fdcef5075cf6750d5
- adf46dc686d35a659a3cff76648c9c036dfc95167b9f4dcb7409dc79d92eb510
- 9fdc84a3a0d3bc8545a9dec8e8fd5e762cb7cb763af9661aa77f94a459da6396
SHA1
- 63152ae5ea7408e8d6998c84b105e7cf703b1670
- 54b8ea2943ffee7a7d7b7ea0201fac7a3659eaa2
- 58cfeec8493417a1f0e6157a3328d10b0467342f
- df72e5e9275abd377125098194add7055ab1539e
Remediation
- Block all threat indicators at your respective controls.
- Always download recommended/ legitimate applications from playstore.