This threat is a trojanspy comes in a form of an Windows spyware threat that has an android variant which gives the malicious hacker or cybercriminals full remote access to your mobile device. It uses techniques previously unseen in the wild to record the activity of WhatsApp users.
This threat facilitates the attacker with 12 commands to perform malicious activities on any given android smartphone and tablets. The attackers have now developed a windows variant.
When installed, the spyware constitutes of various components on windows platform:
- Audio.exe
- keylogger.exe
- Msconf.exe
- Network.exe
- REcodin_2.exe
- ScreenShot.exe
The above components are written in Python language and compiled with PY2exe tool. This allows them to run without Python supporting environment in OS, except REcodin_2.exe which is a .NET compiled executable used for monitor Skype calls.
This threat also creates creates a Run entry (Software\Microsoft\Windows\CurrentVersion\Run) for starting up on system reboot.
Payload
Connects to a remote host
We have seen this threat connect to a remote host, including the following Command and Corntrol (C2) servers:
- 79.3.197.89
- 217.194.13.133
- negg1.ddns.net
- url.plus
Malware connects to a remote host to allow backdoor access and control of and send stolen information from your mobile device to the malicious hacker or cybercriminal for nefarious purposes.
Allows backdoor access and control
This threat can give a malicious hacker access and control of your PC. They can then perform a any of the following different actions without your consent:
- Executing arbitrary commands such as taking pictures or recording audio
- Gathering personal information such as your user names, passwords, card number, messages, and other important information
- Changing some of your device settings such as periodically sending system notifications, setting itself as your favorite app, mornitoring popular apps - Facebook Messenger, Skype, Viber, and WhatsApp.
This analysis was published using the following sample file SHA256:
Windows samples:
- 012966cc1b714531790dd3f5f6cc040b2232fea98b0dbe56a24b13ae72160be5
- 74b1d9c27313dd8a266bf3011896cc9673653a84c2475bed483fa72a1dfb9361
- 5f567844bd0da47426d14426d8acbfefad6426c1139648969e3b0dd5352d3ed5
- c74108a74a9afd47eee894921784fd1ea26a80627afd2fe2103b388abafdc2cc
- 7a35a20bb3fc5d879b99a71d9c5c5475752b900a3082aa5c4f2d6d23aa78dee2
- 48477ffcc2cf57e34fbc45599efa830620dc18139dbbb8dfe59d56fd87728b25
Android samples:
- f241af9ba7501e28974729c229b445ee709a7ef438448b6e9f88ff7ff7228cb2
- e6aba7629608a525b020f4e76e4694d6d478dd9561d934813004b6903d66e44c
- af848999a4b8df0e33f5a05a618c83d1f3052d4026ab77b2acf66def71df754e
- 2d087d89364b22d180a7e8e923a6dca5fd6d131dad12db9dd2a2ae5c4b9d9675
- 1fa0d2414e029c042eb78d4f53010c3af161edb815e97a021c24f8a03033a07
- 78a81cc9b7caac10a7c68be8496d948121abc5f4df9a098f2e1469ddbea55be0
- 2d087d89364b22d180a7e8e923a6dca5fd6d131dad12db9dd2a2ae5c4b9d9675
