Exposed Criminal Server Hosted DDoS Tools, Spyware APKs and Phishing Pages

Oct 8, 2024 · Original article ↗

Summary

Researchers found an exposed server containing DDoS tools, SpyNote APKs disguised as popular apps, phishing pages targeting cryptocurrency and messaging services, and files displaying a mobile ransom demand.

Key points

A rudimentary Python script targeted aisrael.org with repeated HTTP requests; accompanying instructions prepared a server to download the ZxCDDoS tool.
Two APKs impersonating Chrome and Telegram showed typical SpyNote capabilities; the Chrome-spoofing sample connected to a listed command-and-control IP.
Phishing pages impersonated Binance, WeChat, Coinbase and Kraken, with HTML referencing the EagleSpy Android RAT.
Mobile pattern and PIN pages sent entered device credentials to an unidentified Telegram account.
A separate APK disguised as Education Hub was flagged as riskware, with no observed C2 communication reported.
Ransom-themed pages demanded payment, but the researchers described the payment setup as unfinished, noting an unusable QR code and a wallet address inconsistent with the stated USDT type.

Article Details

Attack Vectors: The ddos.py script attempts to disrupt aisrael.org by sending repeated HTTP requests.
The server contained commands for downloading and setting up the ZxCDDoS DDoS program.
SpyNote APKs disguised as Chrome and Telegram apps; the reported C2 for Chrome.apk is 142.93.113[.]245:7771.
Phishing pages impersonated Binance, WeChat, Coinbase, and Kraken login interfaces to steal credentials.
Mobile unlock pages prompted users for PINs or unlock patterns and reportedly sent entered information to an unidentified Telegram account.
A ransomware-themed page redirected users to a ransom note demanding payment and threatening to upload stolen information.
Defensive Notes: The article reports that rn.apk was flagged as riskware by VirusTotal, not detected as SpyNote, and had no observable C2 communication.
The article reports that the QR code in crypto.html did not lead to a website and that the displayed wallet address did not appear valid for the stated USDT TRC20 type.

Indicators of compromise

Type	Indicator	Context
IPV4	`137[.]184[.]53[.]152`	Host of the exposed directory containing malicious files.
IPV4	`142[.]93[.]113[.]245`	Reported C2 address used by Chrome.apk.
SHA256	`6613f6fcc52a2027e822f32f73d94a32b098eaf686dc059ed79fbe35f1afd35f`	Hash of a Python DDoS script targeting a website.
SHA256	`7154e3d34508eb20ac372a65aca79b716398ff8be08cd53619c90f1d71e7e43c`	Hash of crypto.html, identified as a ransom note.
SHA256	`979047adffa36a68f41d95e5ed28b2bf77592419636c16f3fb888f8c57555bb2`	Hash of ransomware.html, listed among ransomware-related files.
SHA256	`98d8e7539a94c278b1ba4a537953e74d03483f88ecb06f5c78038933d8e4b1d3`	Hash of a SpyNote sample spoofing the Chrome browser.
SHA256	`d2047e97aa22d77f9946b60f846c8728c4fbd6a6b87013d47458f289db6a4e1f`	Hash of Bash commands for downloading DDoS software.
SHA256	`e509059e222b1c30c00854d44aaf8c7450cb5a2b7c39750ff2519e759952ba2a`	Hash of Test(12).apk, identified as a SpyNote sample.
SHA256	`ee4db5932813e8ea41779f00398bad0e98cc4536c5b88eaa3a902aac27340a18`	Hash of rn.apk, found on the exposed server and discussed as potential riskware.
SHA256	`ef5ee8cefc7f68680824fff6f8435bd857a0befca8b8dd534a23116bc5c340ed`	Hash of a SpyNote sample spoofing the Telegram app.