Rewterz Threat Alert – Cross-Platform Spyware Called GravityRAT

Severity

Medium

Analysis Summary

GravityRAT is a spyware tool targeting and spreading via traveling apps, some of which are legitimate apps on the Google Play store. The modified version appears to have been modified for the sole purpose of installing the spyware; the code for Travel Mate is available on Github. Once modified, attackers change the name to Travel Mate Pro. Upon installation, the app attempts to gain access to photos, media, and files stored on the victim’s device. Exfiltration of device data, contact lists, email addresses, call, and text logs is the purpose of this instance. The code used is not based on any similar code or other spyware apps. The C2 address is hardcoded and is used to download files of varying types to the device. The spyware issues commands to obtain system info, search for doc types files, list running processes, log keystrokes, and more. New versions of GravityRAT are written in .NET and Python; the .NET versions target Sharify and MelodyMate, and the Python version targets GoZap. Multiplatform versions include StrongBox, TeraSpace, OrangeVault, and CvStyler. Android versions include SavitaBhabi (also a Windows version). An assumption can be made that the current version of GravityRAT uses similar infection methods to previous versions – targeting users by sending them links to the malicious apps. The main modification is that the RAT can now infect multiple platforms.

Impact

• Data Exfiltration
• Unauthorized Remote Access

Indicators of Compromise

Domain Name

• n4[.]nortonupdates[.]online
• n1[.]nortonupdates[.]online
• n3[.]nortonupdates[.]online
• n2[.]nortonupdates[.]online
• dailybuild[.]mozillaupdates[.]com
• enigma[.]net[.]in
• ud04[.]microsoftupdate[.]in
• ud04[.]microsoftupdate[.]in
• bollywoods[.]co[.]in
• u04[.]msoftserver[.]eu
• gyzu[.]mozillaupdates[.]us
• ud03[.]microsoftupdate[.]in
• teraspace[.]co[.]in
• cvstyler[.]co[.]in
• titaniumx[.]co[.]in
• melodymate[.]co[.]in
• chuki[.]mozillaupdates[.]us
• daily[.]windowsupdates[.]eu
• u01[.]msoftserver[.]eu
• sake[.]mozillaupdates[.]us
• u03[.]msoftserver[.]eu
• nightly[.]windowsupdates[.]eu
• ud01[.]microsoftupdate[.]in
• orangevault[.]net
• u02[.]msoftserver[.]eu
• gozap[.]co[.]in
• zen[.]mozillaupdates[.]us
• ud02[.]microsoftupdate[.]in
• savitabhabi[.]co[.]in
• nightlybuild[.]mozillaupdates[.]com
• click2chat[.]org
• strongbox[.]in
• x-trust[.]net
• wesharex[.]net
• chat2hire[.]net

MD5

• c7b8e65e5d04d5ffbc43ed7639a42a5f
• c39ed8c194ccf63aab1db28a4f4a38b9
• 31f64aa248e7be0be97a34587ec50f67
• 78506a097d96c630b505bd3d8fa92363
• e202b3bbb88b1d32dd034e6c307ceb99
• 285e6ae12e1c13df3c5d33be2721f5cd
• 9d48e9bff90ddcae6952b6539724a8a3
• e73b4b2138a67008836cb986ba5cee2f
• cceca8bca9874569e398d5dc8716123c
• defcd751054227bc2dd3070e368b697d
• 9f6c832fd8ee8d8a78b4c8a75dcbf257
• df6e86d804af7084c569aa809b2e2134
• 86c865a0f04b1570d8417187c9e23b74
• 0c103e5d536fbd945d9eddeae4d46c94
• 0c26eb2a6672ec9cd5eb76772542eb72
• 6689ecf015e036ccf142415dd5e42385

SHA-256

• 3d7c39362eaaccd75dbf2632e692adbdfda29c920505fd6f2a65340d194decbd
• b0dec6e41d8933014c5b3197710ede57d50684751e1d1d5572464b272ac01beb
• 848c0c356f963de258702b0893fce8739f90509710cab15037f86ee19b5866f8
• 44bd4a5f338322e35e08dc666694da6fba56ec2c916de37cd69b51ef52fa4af3
• 5bb50eb2eea26890819e5de23660990e18389b6dc5e0f5cbbae8ae59585c9885
• 1060ab3241b3e62e89f5f4bae80664ad895b7c35f5a516bf2f83629c501e8d62
• 666fd534ca14e5c3a2881cbff2156282e44953ba9b15db62b8d739f8fe0bba28
• 5de1179101f35ad885bccd234a8dc750983a58a77083cc9985c2b47692379e2a
• 1e76eee21cfefb00b3f6374b00f328a91fa3dab6fcc9dba88b03bd2f296dc587
• 35e20ad36ce7ccb8228032744647bdb1656d160395b4129354961df6815b3777
• 7134f1112bb4a79c94f1a2aa9c97fd4036882c28105957e39e06347987891c82
• c39270febb9097def21777c994d10738ba2a915c88f516fb1e896e5d7240cc0d
• 770d646088c2feb2d0940625ad0157b0e6c3477181e59d0e98ab3dbff8f2e301
• 71264d9c67800d3bedc6facb6915e855f7531c12445af58f47167e81c735c892
• 2de7e5863ff8d41aec1028c0eaf5e022e065a76e3a8b4923a5c590a7d463297e
• 54c13bb3b3834971a043ab72ae0bed24707aa9212b8437f6b8ee1ceb06660075

SHA1

• b2eae33f6b3279ccbd0eaaa98184575d04425cca
• 3dd34a5cb05a138527659dc458c1cf21ed7d42c9
• 82fe3ad0b1975cd1cb9111935deb2ef1f53392d4
• 7f5f3165304b1f26a21fc9de239d1833fdaeec30
• 9d1d1d513e9d60adce64a49be9d61246e8cc061f
• 05cc5d489370ebd03df86189a67dbdf433ba2f2d
• c40407c8872bb0ac8fccabc8fed4648ca32839db
• 0f81d016311782dd0a1eb98eeb5cb6f4c0befe41
• 0ba17df88b7ffa0cd43595c609f09c6e3ada2817
• a0e5ef02e09abf0059f0ead597cd20ee96d3ff0e
• c244a48eeb31935e5334b6a65551b0f350cb0ab1
• 5db47c79c633b9f6127a0de92f22b8dee2f938ee
• 0857144f7a6678c18ce344bb312994034974a67c
• b46956404c7402b6c8743be5af428510d27b6880
• bf51483581e66da30ac2a6d2ff5588c994ec9e14
• 806cd9cf2107123064dc50b8ac8597f64e952b59

Remediation

• Block the threat indicators at their respective controls.
• Do not click on links attached in untrusted emails or from random sources on the internet.
• Do not install unintended and unnecessary applications on your device.