GhostChatMalware
According to ESET Research, GhostChat is a malicious Android app (package name com.datingbatch.chatapp) disguised to appear a legitimate chat platform called Dating Apps without payment; this legitimate app is available on Google Play and is unrelated to GhostChat other than through the latter using its icon. Ghostchat’s source and mode of distribution remain unknown.From MISP Galaxy
Last reported 8 months ago, by ESET WeLiveSecurity1 report
ATT&CK techniques
6 of 10 · each with the sentence it comes from- T1005Data from Local System
“Data from Local System”
- T1033System Owner/User Discovery
“T1033”
- T1037Boot or Logon Initialization Scripts
“Boot or Logon Initialization Scripts”
- T1041Exfiltration Over C2 Channel
“Exfiltration Over C2 Channel”
- T1059Command and Scripting Interpreter
“Command and Scripting Interpreter: PowerShell”
- T1059.001PowerShell
“T1059.001”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Love? Actually: Fake dating app used as lure in targeted spyware campaign in Pakistan“Underneath the romance charade, the real purpose of the malicious app, which we named GhostChat, is exfiltration of the victim’s data – both upon first execution and continually while the app is installed on the device.”
Indicators in its reports
named in the reports above- hxxps://hitpak[.]org/notepad2.dllin 1 report
- hitpak[.]orgin 1 report
- hxxps://foxy580.github[.]io/koko/file.dllin 1 report
- foxy580.github[.]ioin 1 report
- hxxps://buildthenations[.]info/PKCERT/pkcert.htmlin 1 report
- buildthenations[.]infoin 1 report
- hxxps://hitpak[.]org/page.php?tynor=in 1 report
- b15b1f3f2227eba4…df34b9d30b6ain 1 report
- 8b103d0aa37e5297…fd4f6b2ecbaain 1 report
- 188.114.96[.]10in 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.