Falso sito del Servizio Sanitario Nazionale distribuisce StreamRat su Android e XWorm su Windows
Summary
CERT-AGID analyzed a campaign that impersonates Italy’s Servizio Sanitario Nazionale (SSN) to deliver different malware depending on the visitor’s device. Android users are offered an APK that installs StreamRat, while Windows users receive a BAT loader that uses PowerShell and ultimately executes XWorm. The supplied article does not include the indicators referenced by its “Download IoC” link.
Key points
- The fake SSN page checks the browser User-Agent and serves a different file to Android and Windows devices.
- On Android, SSN.apk decodes and installs a second APK containing StreamRat. The malware uses a fake update prompt to persuade users to enable Android Accessibility services.
- StreamRat can inspect screens and interface structure, simulate user interactions, capture screens, run device commands, and display attacker-supplied HTML overlays that can collect entered information.
- StreamRat reports the foreground app to its server and can receive overlays dynamically, so targets can be changed without redistributing the malware.
- On Windows, SSN Windows.bat launches hidden PowerShell, retrieves 2.jpg from one of several URLs, extracts a Base64-encoded .NET assembly, and loads it in memory. The chain ultimately executes XWorm, a Windows remote access Trojan.
- The article’s IoC section points to a “Download IoC” link, but no IOC values are present in the supplied content.
Attack Vectors
- A fake SSN webpage uses device-based delivery to provide an Android APK or a Windows BAT file.
- The Android app uses a fake update prompt to persuade users to enable Accessibility services.
- The Windows BAT file retrieves and loads a .NET assembly through a hidden PowerShell process.
Tags
Threat ResearchMalware DistributionImpersonationAndroid MalwareRemote Access Trojan
MITRE ATT&CK
T1059.001The Windows BAT loader starts a hidden PowerShell process to retrieve and process the next-stage payload.T1105The Windows loader retrieves 2.jpg from one of several URLs as part of the payload-delivery chain.T1626.001The Android malware prompts users to enable Accessibility services, which it then uses to observe screens and interact with the interface.