APT: Android, Phishing, microsofT

Recently a zip was detected named Coordination of the Chief of Army Staff's Visit to China.zip. An archive with this theme sticks out like a sore thumb to threat analysts.

Indeed, upon examining the compressed PDF, it was an obviously targeted phish.

Phish lure

Figure 1: Top level PDF phish

Phish decoy

Figure 2: Decoy shown post cred theft

The first pivot an analyst makes is to look for similarly named documents, or that have similar embedded urls, which yielded the results below:

Figure 3: IDEF-themed phishing page, targeting Turks

The javascript that attempted to block “source viewing”, as seen in the image above, appeared unique. Looking at other phishing pages that contained the same blocker yielded quick results. The folks at Hunt IO regularly blog about an adjacent set of activity, as well as OSINT analysts Demon and Nouman.

Reexamining our previous set of c2s, there was another error message that we could key off. The landing page on the domain was reused, which hard coded a particular unix timestamp, corresponding to March 28th, 2025.

Figure 4: Landing page with hard coded timestamp

This landing page was similarly seen on many other similar looking domains:

Pivoting on updatemind52.com, which was also mentioned by Twitter user AiTM, we can see an APK file hosted at updatemind52.com/Love_Chat.apk. This is a mod of an open source Android RAT, Rafel Rat, the source of which can be reviewed here.

Below, we can see the decompiled APK file uploading various document types from the device to the c2.

aHR0cHM6Ly9xdWlja2hlbHBzb2x2ZS5jb20vcHVibGljL2NvbW1hbmRzLnBocA== decodes to the c2, https://quickhelpsolve.com/public/commands.php, which we saw used by this actor for credential phishing. That same domain was used in the malicious APK b8eda465ffbc197d80a9ce7ab785f07a, and with other simple pivots, we can find a cluster of other APK.

Figure 6: obligatory non-ida ida screenshot showing how the decoy was launched

The apps themselves are standard infostealers, as well as a remote shell to execute arbitrary commands. Sample permissions and actions include, but are not limited to, ADD_DEVICE_ADMIN, READ_EXTERNAL_STORAGE, MANAGE_APP_ALL_FILES_ACCESS_PERMISSION, READ_CONTACTS, READ_MEDIA_VIDEO etc.

The landing pages and decoys are similar to what one would expect. A notable Pakistani dating service was a key pivot point to find other related samples.

From the above play-googyle.com and playservicess.com, we can see a crossover in the email registrant from the whois scanner in the free community version of SilentPush. This registrant noraramly30121982@yahoo.com was seen on another similar domain in '24 mailservicess.com. Additionally, this email address, except on gmail (noraramly30121982@gmail.com) was used to register mailserver-lk.com which has been used prolifically to phish, and has been catalogued by ThreatBook, as well as our own Labs account. As always, Maltrail is a great resource for aggregating indicators from the OSINT community.

Figure 10: SilentPush free WHOIS scanner

The kutcat c2 is a modded version of Rafel-rat, notably with the credits from the original author removed from the panel. The c2 has the ability to send down arbitrary commands to compromised phones. If one has good dns telem, gj3nyrs9jqrslv5hbej92406cxin6c.burpcollaborator.net may be a useful indicator. kutcat-rat.com was also mentioned by Twitter user MHT.

Figure 11: Commands sent to selected compromised phones

Below one can see the c2 panel, which was publicly available and indexed by google, with device information, and was disabled prior to this blog post. On the server was a plethora of stolen content, including documents, raw SMS, and contact lists. In the content, it was abundantly clear that many of the victims were members of the military of multiple South Asian countries, as well as close contacts, based on phone address books that only included ranks and duty stations.

Figure 12: C2 panel

Figure 16: Victims by country

The first phone UUID in the list ffffffff-e76f-903a-ffff-ffffef05ac4a reports to be in India, and has installed an apk SetupIndiaServicesTnC.apk. The first phone on an operational server often is a test/developer account, and in this case, contained data that was part of a test rig. A consecutive UUID ffffffff-e76f-903a-ffff-ffffef05ac4b also appears in the device list. The uuid is constructed using nisrulz's easydeviceinfo.

Lastly, the threat actor also leverages windows malware, leveraging the same C2 infrastructure. These samples are available in the index.

Our github provides a download of the relevant files mentioned in the blog, except those that contain victim identifying information

Acknowledgements

The authors would like to thank the reviewers, as well as peer vendors, for their comments and corrections. Please get in touch at research@strikeready.com if you have corrections, would like us to use your group name, or would like to collaborate on research.