CraxsRATMalware
Last reported 2 years ago, by Group-IB2 reports
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1056.001Keylogging
“This means it can see the victim’s balance, harvest the second credential issued for two-factor authentication, and implement keylogging functions, allowing it to capture credentials.”
- T1036Masquerading
“GoldDigger spreads via fake websites masquerading as Google Play pages and fake corporate websites in Vietnam.”
What the reports say
2 reports, newest first · the exact sentence from each-
Beware CraxsRAT: Android Remote Access malware strikes in Malaysia“Beware CraxsRAT: Android Remote Access malware strikes in Malaysia”
-
Let’s dig deeper: dissecting the new Android Trojan GoldDigger with Group-IB Fraud Matrix“Other noteworthy Android malware families currently targeting the region include the Gigabud family, SpyNote, HookBot, PWNDROID4, CraxsRAT, TgToxic, and Anubis (Godfather’s predecessor), etc.”
Indicators in its reports
named in the reports above- ks8cb[.]ccin 1 report
- ms2ve[.]ccin 1 report
- zu7kt[.]ccin 1 report
- d8834a21bc70fbe2…e35be1b7276bin 1 report
- hds6y[.]ccin 1 report
- smgeo[.]ccin 1 report
- www.dg1e[.]comin 1 report
- wbke[.]ccin 1 report
- c2b91a1d4b3d1dff…7320709230a1in 1 report
- 139a5bcc92044e2e…abac6a1634bcin 1 report
- 569626b0b6ef277c…ac492fb4e6a7in 1 report
- 6171db5548941aff…9b72fcffbb60in 1 report
- 0ffd769fec531474…972dd82414f5in 1 report
- 6a8c601ba5a0eaeb…11bd07457407in 1 report
- 43d058aacb210c33…9e233b3f1cd4in 1 report
- 03b30ad69bd7c4ef…db6b46fb6164in 1 report
- b80a297daeb4ae11…5ceeff53267cin 1 report
- 380abc14ee41ad14…8d8f86287427in 1 report
- 5827a6e0251a095b…e9f48fe61ff1in 1 report
- fbb2ec92e725740c…14aab6cfb0e3in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.