Coronavirus Update App Leads to Project Spy Android and iOS Spyware
Tags
cmtmf-attack-pattern: Masquerading
country: Afghanistan Austria Bangladesh Grenada India Iran Pakistan Saudi Arabia Romania
attack-pattern: Data Model Credentials - T1589.001 Exploits - T1587.004 Exploits - T1588.005 Hardware - T1592.001 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Server - T1583.004 Server - T1584.004 Vulnerabilities - T1588.006 Masquerading - T1036 Masquerading
Show in Graph
Common Information
Type Value
UUID 3308c5fc-1c39-46b6-ade9-ff65b4985085
Fingerprint a73c0811c8a302e1
Analysis status DONE
Considered CTI value 2
Text language
Published April 14, 2020, midnight
Added to db Oct. 15, 2024, 5:37 p.m.
Last updated Oct. 15, 2024, 5:38 p.m.
Headline Coronavirus Update App Leads to Project Spy Android and iOS Spyware
Title Coronavirus Update App Leads to Project Spy Android and iOS Spyware
Detected Hints/Tags/Attributes 55/3/8
Source URLs
Redirection Url
Details Source https://www.trendmicro.com/en_ca/research/20/d/coronavirus-update-app-leads-to-project-spy-android-and-ios-spyware.html
URL Provider
Details Provider Source level domain
Details trendmicro.com www.trendmicro.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
spy.cashnow.ee
Details Domain 1 
cashnow.ee
Details Domain 1 
ftp.xxxx.com
Details Domain 1 
xyz.cashnow.ee
Details sha256 1 
e394e53e53cd9047d6cff184ac333ef7698a34b777ae3aac82c2c669ef661dfe
Details sha256 1 
e8d4713e43241ab09d40c2ae8814302f77de76650ccf3e7db83b3ac8ad41f9fa
Details sha256 1 
29b0d86ae68d83f9578c3f36041df943195bc55a7f3f1d45a9c23f145d75af9d
Details sha256 1 
3a15e7b8f4e35e006329811a6a2bf291d449884a120332f24c7e3ca58d0fbbdb