APT36 Uses Fake Viber App to Distribute CapraRAT Android Spyware

Summary

Researchers linked APT36 infrastructure to CapraRAT APKs, including one impersonating Viber. The spyware requests permissions that could enable surveillance, message interception, and access to device data.

Key points

Researchers found APT36-linked infrastructure hosted through Contabo services, including an IP identified as a Crimson RAT command-and-control server.
Malicious APKs communicating with another identified IP were confirmed as CapraRAT payloads.
One APK impersonated Viber and used the package name com.viber.updates.links; two others used com.moves.media.tubes.
The samples requested permissions including microphone, camera, location, SMS, contacts, and call-log access.
The article lists three APK MD5 hashes and the command-and-control IP 161.97.180[.]199 as indicators of compromise.
Recommended precautions include installing apps from trusted sources and using mobile threat defense to detect suspicious permissions and network activity.

Article Details

Attack Vectors: APT36 used social engineering and Android APKs disguised as Viber to distribute CapraRAT.
The APKs requested permissions enabling call control, audio recording, SMS access, camera access, contact and call-log access, location tracking, device information access, and internet communication.
Defensive Notes: Install apps only from trusted sources such as Google Play Store and avoid APKs from unknown websites.
Use mobile threat defense to detect spyware behaviors, unusual permission use, and suspicious network communication.
Educate users about messaging-app impersonation and suspicious installation prompts or app behavior.

Indicators of compromise

Type	Indicator	Context
IPV4	`161[.]97[.]180[.]199`	Command-and-control IP address associated with the reported malware infrastructure.
MD5	`34546a79de045b7ee4c0c8d4cbeb6778`	MD5 hash identified in the article as an APK file indicator.
MD5	`91f5009c786618bbbd798ee777b061e3`	MD5 hash identified in the article as an APK file indicator.
MD5	`f73f1a694d2a5c7e6d04fbc866a916bd`	MD5 hash of an APK sample identified as impersonating Viber.