Malwaremedium
Fake AV Investigation Unearths KevDroid, New Android Malware
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-11882 | Memory Corruption RCE in Microsoft Office via Legacy Equation Editor | 7.8 | 100% | KEVRansomwarePoC ×10 | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cgalim.com | s identified at the following URL during March 2018: hxxp://cgalim[.]com/admin/hr/1.apk The stealer exfiltrates data on the same s |
| domain | ebsmpi.com | pose of this binary is to download additional files: hxxp://ebsmpi[.]com/ipin/360/Ant_4.5.exe hxxp://ebsmpi[.]com/ipin/360/Ant_3.5 |
| domain | ps.pndsn.com | iguration containing the token of the attacker and the URL: ps.pndsn.com Process sub-c-2199cb5c-f20a-11e7-acf8-26f7716e5467 pub-c-cd |
| sha256 | 4cb16189f52a428a49916a8b533fdebf0fe95970b4066ce235777d3e95bff95b | e0eb1ffe7f6425c4dcfde2cdd1027dde6d07386c17f878: Ant_3.5.exe 4cb16189f52a428a49916a8b533fdebf0fe95970b4066ce235777d3e95bff95b: 360TS_Setup_Mini.exe RTF: 6b1f2dfe805fa0e27139c5a484004259 |
| sha256 | 6b1f2dfe805fa0e27139c5a4840042599262dbbf4511a118d3fba3d4ec35f2d7 | 0fe95970b4066ce235777d3e95bff95b: 360TS_Setup_Mini.exe RTF: 6b1f2dfe805fa0e27139c5a4840042599262dbbf4511a118d3fba3d4ec35f2d7 |
| sha256 | 7a82cc0330e8974545d5a8cdca95b8d87250224aabc6a4f75a08dddaebb79670 | 7872e826869d270cbd5c0dc4efafff6c958bd1350ce1db973eb: hr.doc 7a82cc0330e8974545d5a8cdca95b8d87250224aabc6a4f75a08dddaebb79670: hr.doc 90abfe3e4f21b5a16cd1ff3c485f079f73f5e7bbaca81691720 |
| sha256 | 86887ce368d9a3e7fdf9aa62418cd68daeea62269d17afb059ab64201047e378 | 080b97516dbe2e93ffaa3ac6fb0a4050a7616016c10d32: Ant_3.5.exe 86887ce368d9a3e7fdf9aa62418cd68daeea62269d17afb059ab64201047e378:Servlet.exe (hr.doc variant) 9ff7240c77fca939cde0eb1ffe7f64 |
| sha256 | 90abfe3e4f21b5a16cd1ff3c485f079f73f5e7bbaca816917204858bb08007fc | 74545d5a8cdca95b8d87250224aabc6a4f75a08dddaebb79670: hr.doc 90abfe3e4f21b5a16cd1ff3c485f079f73f5e7bbaca816917204858bb08007fc: Ant_4.5.exe d24d1b667829db9871080b97516dbe2e93ffaa3ac6fb0a |
| sha256 | 9ff7240c77fca939cde0eb1ffe7f6425c4dcfde2cdd1027dde6d07386c17f878 | ea62269d17afb059ab64201047e378:Servlet.exe (hr.doc variant) 9ff7240c77fca939cde0eb1ffe7f6425c4dcfde2cdd1027dde6d07386c17f878: Ant_3.5.exe 4cb16189f52a428a49916a8b533fdebf0fe95970b4066c |
| sha256 | c015292aab1d41acd0674c98cd8e91379c1a645c31da24f8d017722d9b942235 | 5489e1f8a9fe19b160f112726e7ac2687e429695723bca6a Variant 2: c015292aab1d41acd0674c98cd8e91379c1a645c31da24f8d017722d9b942235 C2: hxxp://cgalim[.]com/admin/hr/pu/pu.php PubNubRAT: URL: |
| sha256 | d24d1b667829db9871080b97516dbe2e93ffaa3ac6fb0a4050a7616016c10d32 | d1ff3c485f079f73f5e7bbaca816917204858bb08007fc: Ant_4.5.exe d24d1b667829db9871080b97516dbe2e93ffaa3ac6fb0a4050a7616016c10d32: Ant_3.5.exe 86887ce368d9a3e7fdf9aa62418cd68daeea62269d17af |
| sha256 | dd3f5ad44a80e7872e826869d270cbd5c0dc4efafff6c958bd1350ce1db973eb | t_3.5.exe hxxp://ebsmpi[.]com/ipin/360/desktops.ini Sample: dd3f5ad44a80e7872e826869d270cbd5c0dc4efafff6c958bd1350ce1db973eb: hr.doc 7a82cc0330e8974545d5a8cdca95b8d87250224aabc6a4f75a0 |
| sha256 | f33aedfe5ebc918f5489e1f8a9fe19b160f112726e7ac2687e429695723bca6a | evDroid: URL: hxxp://cgalim[.]com/admin/hr/1.apk Variant 1: f33aedfe5ebc918f5489e1f8a9fe19b160f112726e7ac2687e429695723bca6a Variant 2: c015292aab1d41acd0674c98cd8e91379c1a645c31da24f8 |
| url | http://cgalim.com/admin/1211me/Ant_3.5.exe | iginal server: hxxp://cgalim[.]com/admin/1211me/Ant_4.5.exe hxxp://cgalim[.]com/admin/1211me/Ant_3.5.exe hxxp://cgalim[.]com/admin/1211me/desktops.ini The downloa |
| url | http://cgalim.com/admin/1211me/Ant_4.5.exe | ample that downloads the same files on our original server: hxxp://cgalim[.]com/admin/1211me/Ant_4.5.exe hxxp://cgalim[.]com/admin/1211me/Ant_3.5.exe hxxp://cgali |
| url | http://cgalim.com/admin/1211me/desktops.ini | me/Ant_4.5.exe hxxp://cgalim[.]com/admin/1211me/Ant_3.5.exe hxxp://cgalim[.]com/admin/1211me/desktops.ini The downloaded executables are RATs developed in .NET, an |
| url | http://cgalim.com/admin/hr/1.apk | mple was identified at the following URL during March 2018: hxxp://cgalim[.]com/admin/hr/1.apk The stealer exfiltrates data on the same server at the fo |
| url | http://cgalim.com/admin/hr/hr.doc | overed a Windows binary on the server at the following URL: hxxp://cgalim[.]com/admin/hr/hr.doc The purpose of this binary is to download additional file |
| url | http://cgalim.com/admin/hr/pu/pu.php | b1d41acd0674c98cd8e91379c1a645c31da24f8d017722d9b942235 C2: hxxp://cgalim[.]com/admin/hr/pu/pu.php PubNubRAT: URL: hxxp://cgalim[.]com/admin/hr/hr.doc hxxp: |
| url | http://ebsmpi.com/ipin/360/Ant_3.5.exe | additional files: hxxp://ebsmpi[.]com/ipin/360/Ant_4.5.exe hxxp://ebsmpi[.]com/ipin/360/Ant_3.5.exe hxxp://ebsmpi[.]com/ipin/360/desktops.ini We found an add |
| url | http://ebsmpi.com/ipin/360/Ant_4.5.exe | The purpose of this binary is to download additional files: hxxp://ebsmpi[.]com/ipin/360/Ant_4.5.exe hxxp://ebsmpi[.]com/ipin/360/Ant_3.5.exe hxxp://ebsmpi[.] |
| url | http://ebsmpi.com/ipin/360/desktops.ini | in/360/Ant_4.5.exe hxxp://ebsmpi[.]com/ipin/360/Ant_3.5.exe hxxp://ebsmpi[.]com/ipin/360/desktops.ini We found an additional sample that downloads the same fil |
From the original article
6 min read at blog.talosintelligence.com
This blog post is authored by Warren Mercer , Paul Rascagneres , Vitor Ventura and with contributions from Jungsoo An. Several days ago, EST Security published a post concerning a fake antivirus malware targeting the Android mobile platform. In the Korean media , it was mentioned that there could be a link between this Android malware and Group 123.
blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.