Loading malware…
2 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
The Rogue malware family is an MRAT. This type of malware can gain control over the host device and exfiltrate any kind of data (photos, location, contacts, messages, etc.), modify the files on the device, download additional payloads and basically anything else that comes to mind.
The Rogue malware family is an MRAT. This type of malware can gain control over the host device and exfiltrate any kind of data (photos, location, contacts, messages, etc.), modify the files on the device, download additional payloads and basically anything else that comes to mind.
16 distinct techniques documented for this family, organized by ATT&CK tactic.
If the user tries to revoke the admin permission, an onscreen message designed to strike terror in the heart of the user appears: “Are you sure to wipe all the data??”
root Executes a shell command. The output of the command is stored in the Firebase Database.
by comparing specific pre-defined values to ones given by the system, Rogue can detect a virtual environment, which may lead to a delay\abort of its malicious intentions.
When Rogue successfully gains all of the required permissions... it hides its icon as a camouflage defense, making sure it will not be easy to get rid of it.
Rogue uses the accessibility service for logging and documenting the user’s actions... Rogue logs the following user actions: TYPE_VIEW_TEXT_CHANGED TYPE_VIEW_FOCUSED TYPE_VIEW_CLICKED
deviceInfo Collects information about the device: • Phone number • Network provider • Username • List of device user accounts • SDK version • User-visible version string • Device serial number • Device name, brand, board, manufacturer • IMEI • Battery level • Network connection status • WiFi connection information, DHCP status • WiFi scan results with available Access Points • IPv4 and IPv6 addresses
fileExplorer Store a list of directories by a provided path in the Firebase Database.
by comparing specific pre-defined values to ones given by the system, Rogue can detect a virtual environment, which may lead to a delay\abort of its malicious intentions.
getInstalledApps Stores the current timestamp and list of installed applications in the Firebase Database.
Rogue uses the accessibility service for logging and documenting the user’s actions... Rogue logs the following user actions: TYPE_VIEW_TEXT_CHANGED TYPE_VIEW_FOCUSED TYPE_VIEW_CLICKED
takeScreenShot Takes a screenshot of the current screen. The screenshot is uploaded to the Firebase Cloud Store.
recordAudio Starts recording from a microphone for a provided duration. The audio is recorded to a local file. After recording, the audio-file is uploaded to the Firebase Cloud Store.
recordCamera Starts recording from selected cameras and for a provided duration. The video is recorded to a local file. After recording, the video-file is uploaded to the Firebase Cloud Store.
zipFiles Zips files in a specified path. The resulting zip-file is uploaded to the Firebase Cloud Store.
Rogue uses Firebase’s services as a C&C (command and control) server, which means that all of the commands that control the malware and all of the information stolen by the malware is delivered using Firebase’s infrastructure.
installApp Installs an application from a provided URL. ... fileDownloadToLocal Downloads a file from a provided URL to a provided local path.
The Rogue malware family is an MRAT. This type of malware can gain control over the host device and exfiltrate any kind of data (photos, location, contacts, messages, etc.), modify the files on the device, download additional payloads and basically anything else that comes to mind.
Rogue uses Firebase’s services as a C&C (command and control) server, which means that all of the commands that control the malware and all of the information stolen by the malware is delivered using Firebase’s infrastructure.
57 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.