DCHSpyMalware
According to Lookout, DCHSpy is an Android surveillanceware tool leveraged by Iranian cyber espionage group MuddyWater. DCHSpy collects WhatsApp data, accounts, contacts, SMS, files, location, and call logs, and can record audio and take photos.From MISP Galaxy
Last reported 13 months ago, by Group-IB1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1665Hide Infrastructure
“…has revealed active use of Amazon Web Services (AWS) for hosting malicious assets, and Cloudflare services have been leveraged to hide infrastructure fingerprints and impede analysis.”
- T1684Social Engineering
“Phishing Awareness: Conduct regular employee training on recognizing and reporting phishing and social engineering attempts.”
What the reports say
1 report, newest first · the exact sentence from each-
Tracking MuddyWater in Action: Infrastructure, Malware and Operations during 2025“Recent reporting suggests potential MuddyWater involvement in mobile targeting operations utilizing the DCHSpy Android malware.”
Indicators in its reports
named in the reports above- 40dead1e1d831076…5af71a9b5e05in 1 report
- filetransfer[.]ioin 1 report
- sync[.]comin 1 report
- 5f22f4c4fdb36c4f…7b9ef0b691c2in 1 report
- f782dfdc7ce624f9…561c8af13db0in 1 report
- hxxps://netivtech[.]org/registerin 1 report
- netivtech[.]orgin 1 report
- hxxps://netivtech[.]org/imalivein 1 report
- hxxps://netivtech[.]org/requestin 1 report
- hxxp://46.101.36[.]39:443/imalivein 1 report
- 46.101.36[.]39in 1 report
- hxxp://46.101.36[.]39/registerin 1 report
- hxxp://46.101.36[.]39:443/requestin 1 report
- hxxps://netivtech[.]org/rq13in 1 report
- hxxps://netivtech[.]org/adadin 1 report
- hxxps://netivtech[.]org/aq36in 1 report
- 162.255.119[.]28in 1 report
- www.netivtech[.]orgin 1 report
- 91.195.240[.]19in 1 report
- 104.21.81[.]7in 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.