Malwarecritical
Android Trojan Found in Targeted Attack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2009-3129 | CVE-2009-3129: Memory Corruption RCE in Microsoft Excel via FEATHEADER Record | — | 84% | KEV | — KEV |
| CVE-2010-3333 | Stack Buffer Overflow in Microsoft Office RTF Parsing Allows Remote Code Execution | — | 89% | KEV | — KEV |
| CVE-2012-0158 | Remote Code Execution in Microsoft MSCOMCTL.OCX (Windows Common Controls) | — | 100% | KEVRansomware | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | dlmdocumentsexchange.com | nterestingly, there is a domain which used to point there, “DlmDocumentsExchange.com”. The domain was registered on March 8th, 2013: Registratio |
| ipv4 | 64.78.161.133 | it to the command and control server. The C2 URL is: hxxp://64.78.161.133/*victims’s_cell_phone_number*/process.php In addition to th |
| ipv4 | 64.78.161.33 | o this, the malware also reports to another script, “hxxp://64.78.161.33/android.php”. First, it will get the “nativenumber” variabl |
| md5 | 0b8806b38b52bebfe39ff585639e2ea2 | ference.apk”. This malicious APK is 334326 bytes file, MD5: 0b8806b38b52bebfe39ff585639e2ea2 and is detected by Kaspersky Lab products as “Backdoor.Andr |
| md5 | c4c4077e9449147d754afd972e247efc | The referenced “Document.apk” is 333583 bytes in size, MD5: c4c4077e9449147d754afd972e247efc. It has the same functionality as the one described above b |
| url | http://64.78.161.133/*victims’s_cell_phone_number*/process.php | upload it to the command and control server. The C2 URL is: hxxp://64.78.161.133/*victims’s_cell_phone_number*/process.php In addition to this, the malware also reports to another sc |
| url | http://64.78.161.33/android.php” | ition to this, the malware also reports to another script, “hxxp://64.78.161.33/android.php”. First, it will get the “nativenumber” variable from the “t |
From the original article
5 min read at securelist.com
In the past, we’ve seen targeted attacks against Tibetan and Uyghur activists on Windows and Mac OS X platforms. We’ve documented several interesting attacks ( A Gift for Dalai Lamas Birthday and Cyber Attacks Against Uyghur Mac OS X Users Intensify ) which used ZIP files as well as DOC, XLS and PDF documents rigged with exploits.
By @Securelist · securelist.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.