APT_REPORT/sidewinder

related report (20200107)

https://blog.trendmicro.com/trendlabs-security-intelligence/first-active-attack-exploiting-cve-2019-2215-found-on-google-play-linked-to-sidewinder-apt-group/

com.camero.android.camera2basic.apk -> infected.rar

ms-ethics.net

cdn.ms-ethics.net

deb-cn.net

ap1-acl.net

https://ap1-acl.net/202/KfzLXf6NisWqPtYOrrQYJfzErkCyS8ib8dz3QSsN/1115/2280/16331af8

http://ap1-acl.net/mod/

ms-db.net

aws-check.net

reawk.net

https://reawk.net/202/jQcPZ3kx6hGod25WMnTocKStUToZEPRy6WfWkEX3/-1/12571/87854fea

https://reawk.net/202/OaZbRGT9AZ6rhLMSEWSoFykWnI7FeEbXdgvNvwZP/-1/12571/10255afc

gov-pk.org

baf.gov-pk.org

mlibinternetbanking.gov-pk.org

pakcert.gov-pk.org

mail.paec.gov-pk.org

https://www.virustotal.com/graph/g2ba58f8b3f4043a7acb450ea1709cbbddd512be5f5bc4d2fa577eb7d7421b47d/drawer/node-summary/node/nap1-acl.net/1578369200420

SHA256 Package Name/File type App Name/Detection Name ec4d6bf06dd3f94f4555d75c6daaf540dee15b18d62cc004e774e996c703cb34 DEX AndroidOS_SWinderSpy.HRXA a60fc4e5328dc75dad238d46a2867ef7207b8c6fb73e8bd001b323b16f02ba00 DEX AndroidOS_SWinderSpy.HRXA 0daefb3d05e4455b590da122255121079e83d48763509b0688e0079ab5d48886 ELF AndroidOS_MtkSu.A 441d98dff3919ed24af7699be658d06ae8dfd6a12e4129a385754e6218bc24fa ELF AndroidOS_BinderExp.A ac82f7e4831907972465477eebafc5a488c6bb4d460575cd3889226c390ef8d5 ELF AndroidOS_BinderExp.A ee679afb897213a3fd09be43806a7e5263563e86ad255fd500562918205226b8 ELF AndroidOS_BinderExp.A 135cb239966835fefbb346165b140f584848c00c4b6a724ce122de7d999a3251 ELF AndroidOS_MtkSu.A a265c32ed1ad47370d56cbd287066896d6a0c46c80a0d9573d2bb915d198ae42 com.callCam.android.callCam2base callCamm

Package Name/File type App Name/Detection Name com.abdulrauf.filemanager FileCrypt Manager com.callCam.android.callCam2base callCamm com.camero.android.camera2basic Camero