Domestic Kitten campaign spying on Iranian citizens with new FurBall malware | WeLiveSecurity
Tags
cmtmf-attack-pattern: Masquerade As Legitimate Application Masquerading
country: Iran
maec-delivery-vectors: Watering Hole
attack-pattern: Data Direct Access Contact List - T1432 Broadcast Receivers - T1402 Software Discovery - T1418 Application Layer Protocol - T1437 Broadcast Receivers - T1624.001 Commonly Used Port - T1436 Contact List - T1636.003 Data From Local System - T1533 Deliver Malicious App Via Other Means - T1476 Malware - T1587.001 Malware - T1588.001 Masquerade As Legitimate Application - T1444 Masquerading - T1655 System Information Discovery - T1426 Server - T1583.004 Server - T1584.004 Sms Messages - T1636.004 Software - T1592.002 Tool - T1588.002 Standard Application Layer Protocol - T1071 Commonly Used Port - T1043 Data From Local System - T1005 Masquerading - T1036 System Information Discovery - T1082 Commonly Used Port Masquerading Standard Application Layer Protocol
Show in Graph
Common Information
Type Value
UUID fd7e638a-f9e9-4c63-91c1-1fedeb2b7b20
Fingerprint 850d8c93c3ba8ec9
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 20, 2022, 11:30 a.m.
Added to db Oct. 20, 2022, 6:37 p.m.
Last updated Nov. 17, 2024, 5:55 p.m.
Headline Domestic Kitten campaign spying on Iranian citizens with new FurBall malware
Title Domestic Kitten campaign spying on Iranian citizens with new FurBall malware | WeLiveSecurity
Detected Hints/Tags/Attributes 68/4/13
Source URLs
Redirection Url
Details Source https://www.welivesecurity.com/2022/10/20/domestic-kitten-campaign-spying-iranian-citizens-furball-malware/
URL Provider
Details Provider Source level domain
Details welivesecurity.com www.welivesecurity.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 163 ✔ — https://media.cert.europa.eu/rss?type=category&id=Malware&language=en&duplicates=false 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details Domain 2 
downloadmaghaleh.com
Details File 172 
androidmanifest.xml
Details sha1 1 
bf482e86d512da46126f0e61733bca4352620176
Details MITRE ATT&CK Techniques 13 
T1476
Details MITRE ATT&CK Techniques 17 
T1444
Details MITRE ATT&CK Techniques 16 
T1402
Details MITRE ATT&CK Techniques 23 
T1418
Details MITRE ATT&CK Techniques 25 
T1426
Details MITRE ATT&CK Techniques 11 
T1432
Details MITRE ATT&CK Techniques 19 
T1533
Details MITRE ATT&CK Techniques 6 
T1436
Details MITRE ATT&CK Techniques 13 
T1437
Details Threat Actor Identifier - APT-C 11 
APT-C-50