Rewterz Threat Alert – COVID-19 Themed Android Malware Steals SMS and Contacts

Severity

Medium

Analysis Summary

A new Android malware leveraging a COVID-19 theme to infect devices and steal victim data. The distribution method used by this malware is not currently known, but it cannot be found in the official Google Play Store, so the apps must be side-loaded by users. Various icons are used for the application but consistent across the samples is the package name “DZ.Eagle.Master” and the application label “Covid.” Once installed on the device, the malware checks in to the C2 server while simultaneously providing it with device information, such as the network operator, model, manufacturer, and IP address. In response, the C2 server provides the malware with a configuration file, “settings.xml.” The C2 server can also issue one of several commands. These commands include closing the malware, displaying messages, and exfiltrating the contact list, phone calls, device information, and SMS messages. The location of the C2 server combined with the package name indicates that Algerian users are likely being targeted. Notably, this malware is using an old, compromised code signing certificate.

Impact

• Information theft
• Exposure of sensitive data

Indicators of Compromise

MD5

• 2d84a8bbd77aee8432742dc28eef2da3
• 4271184bc33ee9672fe4713f14e43bd6
• 51a4472a506795e386906541c3483080
• a81c5c3da9d41069af9ab00780dbe09e

SHA-256

• bb1b70b7f6d8fc18e5a5fd743242836475bc6ad978780adec18a8f92c7e9cf89
• 14609dc616d6889dd02a29051261bc36cb97f6608e51564fdcef5075cf6750d5
• adf46dc686d35a659a3cff76648c9c036dfc95167b9f4dcb7409dc79d92eb510
• 9fdc84a3a0d3bc8545a9dec8e8fd5e762cb7cb763af9661aa77f94a459da6396

SHA1

• 63152ae5ea7408e8d6998c84b105e7cf703b1670
• 54b8ea2943ffee7a7d7b7ea0201fac7a3659eaa2
• 58cfeec8493417a1f0e6157a3328d10b0467342f
• df72e5e9275abd377125098194add7055ab1539e

Remediation

• Block all threat indicators at your respective controls.
• Always download recommended/ legitimate applications from playstore.