APKLAB.io

is an Intelligence-driven Threat Hunting Platform for the Security Analyst Community by @AvastThreatLabs

[APKLAB.io @apklabio]

Hey, fellow mobile malware researchers! During the #COVID19 crisis, lots of actors started to design apps aimed at phishing users into downloading and installing malware. We are therefore making our internal customized telemetry for Covid19 public, here:
https://t.co/Rv2d2Gsp0E

[NI@FI@70 @ni_fi_70]

@LukasStefanko @malwrhunterteam There are 3 other distribution domains for this Spyware

/cbrewardsapply.com /cbrewards.xyz /cbcplus.in

THX @apklabio

[APKLAB.io @apklabio]

@ni_fi_70 @B0rys_Grishenko @Avast Thanks, everyone for the reports on the unavailability of the service. We are currently in the progress of fixing it.

[APK-47 @midnight_comms]

left a few things out -- the additional downloaded APK is: 2971c15d7534dffd37535535d5dba4479355f153 [SHA-1] via haeundaejugong[.]com | GET /data/app.php?type=apk&value=replace & signing cert has been used for multiple apps: 2be2bc2a98e47e1468248f7ddcfd5ca3 [MD5] h/t @apklabio

[NI@FI@70 @ni_fi_70]

@arturaugustyni2 @CERT_OPL @CSIRT_KNF @CERT_Polska @apkdetect @ThreatLabsPL @pmmkowalczyk @PPiekutowski @kilijanek @B0rys_Grishenko Two more hashes found (thx @apklabio)
174 targedet Banking Apps

https://t.co/IDZrDDJRBb

[NI@FI@70 @ni_fi_70]

@V3nkat3 @Nethanella @alberto__segura @bl4ckh0l3z @ReBensk @JAMESWT_MHT @James_inthe_box dd8a5a1a8632d661f152f435b7afba825e474ec0d03d1c5ef8669fdc2b484165
efb92fb17348eb10ba3a93ab004422c30bcf8ae72f302872e9ef3263c47133a7
8a6889610a18296e812fabd0a4ceb8b75caadc5cec1b39e8173c3e0093fd3a57 samples can be downloaded from @apklabio or @koodous_project enjoy it ;-)

[NI@FI@70 @ni_fi_70]

@ReBensk @malwrhunterteam @cryptax @bl4ckh0l3z @JAMESWT_MHT @500mk500 another one
https://t.co/6Sjyra4HBi

some of the nasty C2s /vip.paramera.shop /grouplearn.shop /weathercycl.club /implemente.life

good place to search for is @apklabio

[Nikolaos Chrysaidos @virqdroid]

Sample:
https://t.co/AUcHecVgzd

[APKLAB.io @apklabio]

Note: We support only x86 version
https://t.co/thUJ7uvY06

[APKLAB.io @apklabio]

Happy New Year from the https://t.co/WIJSa61qSk Team!

What's new?
🎁 Support for Android 11. Now you can select from each binary (.apk) options, in which Android version you want to perform the analysis.

@avast_antivirus @AvastThreatLabs

[NI@FI@70 @ni_fi_70]

@DjoNn35 @LukasStefanko @James_inthe_box @TRCert thx @apklabio 31 samples found on this domain
https://t.co/mGphz8dkRj

and 149 on corresponding IP
https://t.co/4VX8t5764z

[APKLAB.io @apklabio]

IoCs:
ThemeZone - Shawky App Free - Shock My Friends: https://t.co/ywCoHOC5Jm
Tap Roulette ++Shock my Friend: https://t.co/tEQUCV67JG

[APKLAB.io @apklabio]

Threat Intelligence:

iOS and Android "Shocking" scams spreading via TikTok - 7 apps with 2.4M+ downloads.

Some feature HiddenAds adware while others charge exorbitant amounts for fake 'Shock your friends' apps.

More details here: https://t.co/SjKyl9sMY2 kudos to @JVAvast

[APKLAB.io @apklabio]

@malwrhunterteam Five more samples under the same C&C (akrde[.]com)
https://t.co/ug2MtG7eZ0

[APKLAB.io @apklabio]

@s_metanka @virqdroid Hi @s_metanka, we are working on bringing the service online again. Sorry for any inconvenience.

[APKLAB.io @apklabio]

@cybergibbons @olihough86 You got now ⚡️ Check your inbox.

[Avast @Avast]

Avast's Mobile Threat Labs team, @apklabio discovered a #Cerberus banking #Trojan on #GooglePlay targeting Android users—disguised as a genuine app to access banking data of unsuspecting users. Avast reported it to Google so they can quickly remove it.

https://t.co/MqAReAFg3J

[Re-ind @ReBensk]

#Android #Banking #Trojan #Malware
@apklabio @virqdroid @malwrhunterteam
https://t.co/XvnGUa4Pej is helping to detect more joker Trojans from Google Play:

[APKLAB.io @apklabio]

Downloads payload from: hxxp://23.106.124.183:2055/get/0c0fa330-0c13-4530-a024-108acf00573e/280b15a8-142d-400e-a1a6-c5004c3c62e1 (still active)

Other known C2s: futurepark[.]top, woodenhillz[.]top, greengrime[.]top, quickquake[.]top

[APKLAB.io @apklabio]

Long time no see! #Cerberus banker dropper found again in @GooglePlay. Masks as currency convertor act as currency stealer.

Target users in Spain, incl. @GooglePlay geo-restrictions.

Hash: https://t.co/4KT3D9liu9

[APKLAB.io @apklabio]

Multiple versions have been uploaded before activation.
Uses a native library https://t.co/fiHfj6IJL1 to drop/load the banker.
This lib is present in multiple versions of the app, at least since v 1.0.17, removed again in later versions 1.0.24+, became active only recently.