Malware

GhostCtrl

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Socially engineered phishing emails were also attack vectors; they had malicious URLs that led would-be victims to download these apps.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video

T1059Command and Scripting InterpreterEvidence1

ACTION CODE= 79: Run a shell command specified by the attacker and upload the output result

T1204User ExecutionEvidence1

The malicious APK, after dynamically clicked by a wrapper APK, will ask the user to install it. Avoiding it is very tricky: even if the user cancels the “ask for install page” prompt, the message will still pop up immediately.

Persistence

1 technique

T1053Scheduled Task/JobEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video

T1068Exploitation for Privilege EscalationEvidence1

It can lock the device’s screen and reset its password, and also root the infected device.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The third version of GhostCtrl incorporates obfuscation techniques to hide its malicious routines... The DEX and ELF files decrypt strings and Application Programming Interface (API) calls in the main malicious APK in runtime.

T1036MasqueradingEvidence1

the samples we analyzed masqueraded as a legitimate or popular app that uses the names App, MMS, whatsapp, and even Pokemon GO.

T1497.001System ChecksEvidence1

GhostCtrl can also pilfer information like Android OS version, username, Wi-Fi, battery, Bluetooth, and audio states, UiMode, sensor

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

ACTION CODE= 48: List the file information in the current directory and upload it to the C&C server

T1497.001System ChecksEvidence1

GhostCtrl can also pilfer information like Android OS version, username, Wi-Fi, battery, Bluetooth, and audio states, UiMode, sensor

Collection

3 techniques

T1005Data from Local SystemEvidence1

Different kinds of sensitive—and to cybercriminals, valuable—information will be collected and uploaded, including call logs, SMS records, contacts, phone numbers, SIM serial number, location, and browser bookmarks.

T1123Audio CaptureEvidence1

Its most daunting capability is how it can surreptitiously record voice or audio, then upload it to the C&C server at a certain time.

T1125Video CaptureEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video, then surreptitiously upload them to the C&C server as mp4 files.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The malicious APK will then connect to the C&C server to retrieve commands via the socket... The commands from the C&C server are encrypted and locally decrypted by the APK upon receipt.

T1568Dynamic ResolutionEvidence1

we also found that the backdoor connects to a domain rather than directly connecting to the C&C server’s IP address... We also found several Dynamic Name Servers (DNS), which at some point led to the same C&C IP address

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

All the stolen content will be encrypted before they’re uploaded to the C&C server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trend micro blog historicNews

Jul 17, 2017

Android Backdoor GhostCtrl Records Your Audio, Video | Trend Micro (US)

Android backdoor/RAT that steals extensive device data, executes remote commands, manipulates device functions, sends SMS/MMS, records audio, accesses camera features, manages files, runs shell commands, and communicates with a C2 server. Later versions add obfuscation, device admin abuse, rooting, screen locking, and password reset capabilities, giving it ransomware-like behavior.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

GhostCtrl

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Socially engineered phishing emails were also attack vectors; they had malicious URLs that led would-be victims to download these apps.

Execution

3 techniques

T1053Scheduled Task/JobEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video

T1059Command and Scripting InterpreterEvidence1

ACTION CODE= 79: Run a shell command specified by the attacker and upload the output result

T1204User ExecutionEvidence1

Persistence

1 technique

T1053Scheduled Task/JobEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video

Privilege Escalation

2 techniques

T1053Scheduled Task/JobEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video

T1068Exploitation for Privilege EscalationEvidence1

It can lock the device’s screen and reset its password, and also root the infected device.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence1

the samples we analyzed masqueraded as a legitimate or popular app that uses the names App, MMS, whatsapp, and even Pokemon GO.

T1497.001System ChecksEvidence1

GhostCtrl can also pilfer information like Android OS version, username, Wi-Fi, battery, Bluetooth, and audio states, UiMode, sensor

Discovery

2 techniques

T1083File and Directory DiscoveryEvidence1

ACTION CODE= 48: List the file information in the current directory and upload it to the C&C server

T1497.001System ChecksEvidence1

GhostCtrl can also pilfer information like Android OS version, username, Wi-Fi, battery, Bluetooth, and audio states, UiMode, sensor

Collection

3 techniques

T1005Data from Local SystemEvidence1

T1123Audio CaptureEvidence1

Its most daunting capability is how it can surreptitiously record voice or audio, then upload it to the C&C server at a certain time.

T1125Video CaptureEvidence1

It can also hijack the camera, create a scheduled task of taking pictures or recording video, then surreptitiously upload them to the C&C server as mp4 files.

Command and Control

2 techniques

T1071Application Layer ProtocolEvidence1

The malicious APK will then connect to the C&C server to retrieve commands via the socket... The commands from the C&C server are encrypted and locally decrypted by the APK upon receipt.

T1568Dynamic ResolutionEvidence1

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

All the stolen content will be encrypted before they’re uploaded to the C&C server.

INDICATORS OF COMPROMISE

IOCs tracked for this family

4 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

4 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app9 years ago

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

trend micro blog historicNews

Jul 17, 2017

Android Backdoor GhostCtrl Records Your Audio, Video | Trend Micro (US)

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching4

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.