An Advanced persistent threat (APT) group has expanded its malware arsenal to incorporate a brand new distant entry trojan in its espionage assaults geared toward Indian army and other entities.
Dubbed CapraRAT, an Android RAT that displays a excessive “diploma of crossover” with one other malware often called CrimsonRAT that is related to Earth Karkaddan.
The primary indicators of APT36 existence started when distributing information stealing malware by means of phishing emails with malicious PDF attachments focusing on Indian army and authorities personnel, banking on social engineering and a USB-based worm as entry factors. though latest campaigns have developed to distribute ObliqueRAT.
CrimsonRAT is normal as a .NET binary whose prime goal is to acquire and exfiltrate data, together with screenshots, keystrokes, and information from detachable drives, and add them to the attacker’s C2 server.
CapraRAT, added to the arsenal which is disguised as a YouTube app, is alleged to be a modified model of an open-source RAT referred to as AndroRAT and comes with a wide range of knowledge exfiltration capabilities, together with the flexibility to reap victims’ places, cellphone logs, and call info.
To mitigate such assaults, customers are suggested to be careful for unsolicited emails, keep away from clicking on hyperlinks or downloading e-mail attachments from unknown senders, set up apps solely from trusted sources, and train warning on the subject of granting permissions to the apps
Indicators of Compromise
- AndroRAT and CapraRAT SHA-256
- d9979a41027fe790399edebe5ef8765f61e1eb1a4ee1d11690b4c2a0aa38ae42 –
- 51a6ca006305c9a0e83b462b1198241e842ef98aa2b78c918c422ed48c70bf75 –
- 83d75ff6063050305b86413d2e265b9458a9542743d357e61338107fb20a9416 –
- 1b9cc0d92fdd6fcfa10d721300c873a9d5fb50ecea03e8a80e37f40cc0af0c22 –
- d62705186c488bb26fccdb1404931223a887004fd6704ac1483e599a15e92792 –
- 83a4718fd650f78bf1aed4a5eb560950aab8bc2ea432598402c38568f7e462ab –
- 8304a6d1410629d7bc79b78f7f719530be0be764a4e0527bb3a3cf456ce2036a –
- 4ce9fee0295cbb745c37e0f1da085ef500159b5bd9e5ec8c986e9cce38882c50 –
- 6478764346de677ed2a6f8c54daad96b6bdccb96449787c1db66a32f62175756 –
- c90b3f9f0b226857fa8ec270032f4f1595579e9487e87a3ecad714a1205695f4 –
- 136cbcacf832aca13f7a9ec442079b1a504a6d3d3f720c6fec547f855ae08cea –
- a78d9964db54d2430644a4cd6b2f3640f91f6aa282e5591435b4e652897aa30f –
- 0463363b4f3f452aaf2bee4f864f4db851e4fa803446fc3e141b772fb1d8fe48 –
- ba8d242b784bab8b450b34fcf7c60f1d9bfbb7dc7d98b52502f3672fbe049d68 –
- 319140d52c310dc1642aa972586997e73c73c46a5227f7ecf176bcdaefd7266f –
- 22c8a08107622ec75c7d5a9d177a665cd914182cf36288270e737832b76e4012 –
- 00f9f51505658a8d007907e234fc112034c620b0dfeaec95aa19188b6644dffd –
- a0fb5419f7fb9718a721712dbd24c1edbff3b64db93fe809136dc5ff6193f13b –
- 09735ba9d19aa5ad79deed47008fb528ac8ae5c2a8f91f4bba35d8079059ad21 –
- 11bc9fb270769dd57b046541a84c28821546594c9c6a7000c3917b994a592740 –
- dd16ed0d8ee0011042f3447f44816c8098808fd58e0eddadd644c730a1176f36 –
- ac7874792f81476704ca91519efb75d313b01f087a64e82c9eed7984b74e3e5f –
- ed380756ba34416db2ac117791ef0e1ea0c41cfaa0966a6ecde8d92bd2763ee9 –
- 2be3c42c1a6094764e5c4e6abfb7afdd71c935a3431094b4be8723812a064f37 –
- 35b2f67a5e452b68bfcbbb43289fcb04e15da5efc043ff2eb1b93145c027dfe6 –
- a76a1771d106a83adb3bb1cc2bad1cf8a9f774d586fc764511297ed6157c44e8 –
- 350c4b3ec14629a942d3abc4e8a711f88fbf50ea55970c8f047653c16dae581c –
- bbd12bd5eaabed07f670a8fe681ec52705a45ddb7e4f9f2b304188e62d25294d –
- 18029be2b0bf5284713f9cf61ba5e160ae10a581f346fdd396065d5728906768 –
- 396a46e9595fe6bdae709ab3171900ebd4fd1c6e1cd8ad94d17d2dcacb6bf6b6 –
- 1c9024f2d696f949091be27aced113f4e98bc46c0580eb93e644a51b269c76e4 –
- 7862eae57c6555f838fd09a5b95a31a2011b992e9a2ba49e3c6b259b1c315429 –
- 8c867aeb8b8411e3487af4a030845d66c70a85934f460611a8637e67bbc5434a –
- 96102f8e48ed9c2ae8f58b005a82c1f19d30bd110d8009414974fe5d99087950 –
- a3c483f20a5a70ff6e7c9c8b8d0476e4d6a6ff3a77179e136169b58aedfb31be –
- 84c2d61e083fa5f9c8118738c4c0bebc15de31d6f9cf416f9cced7aef6aecc56 –
- d723869a8f5ffdc9c60539b5358ba9d284e22ee0e5007410f5844946871744c9 –
- d3fb855cccb4fe347d142c48266d8f5395595462c751c9a70db58efc5b0335fe –
- 80d6be8218cfc1545bb036a679ae28c9b3fcb34b7de980c5a255abc4fe35a453 –
- be91ae324b338d8cef69b3f56ed44c2447fe9dcf1da52e71e3fdfa6c77f1dea2 –
- 0602df185fd259231d4041f7b6f8c1472f911b660f242f69b17da98e2535f5c2 –
- 874b1ef11c72dcc18f6eca31b80dc63203aebf5416247b4c429f6a74b57ac37b –
- e28059072fe6c8269c0cba48d63fa39915f6075cd25031d8bbcc1eeb1ba7226c –
- f908923d7248c8639c18ade4d4b2a32d0faee2ca5c6a241593a99f656b72d5bf –
- e5f23ea7a7d4d5850e25500a3d686db8598106d42f2d565e3c2cffce2daea9ab –
- e54aa0d51716c129bf67df682c959362117dfd67f5bcf0b767059816e73ab7e6 –
- e393efe4e9566a9f9f6fb9f9b115c18297aac298bd66c426b52a1b059f89cbef –
- 1a425c66fb788af65d9455c8ecaab42c2b48a19b09901ba8fd9a85f93d637fa7 –
- 065ac185eebacd9dc3b0a457eb17535d48d5ea26de6839cac2ca6a771fbcaac6 –
- 3fa4c9531ee15d3eae49f5d13aa3308ece77be747ee00198f8cfdf46c81cbb3b –
- a9309189d6b0fc07143ce2a871a85ba017750006ca6727be16329f7a3ef6da27 –
- b48c3cb304aac4fa4ca9aa9eb6a90463d343d6abe985a0b0beca175937f2e91c –
- 4a951bf2eaf75a5c3437f8255ed7707511f303984becdadcaa4151e8de0f9e90 –
- db54820a956615536550e4f78085f23be65bc796d0a636632c9a328a50d97e20 –
- 8e56fb851e4bbda3005e72c4312f64a89ca1e53892b2060c452615ad3fd6b698 –
- c346d7cc8dbc2f06aed5821ecb5490fb258749961c4f2b4a491599146e422b93 –
- 61afe61b5e5e7a74c00962142241caae6d4e5d44d97095b812624dae50d7f129 –
- 1ac82cc23419b035bbbe5112409198e8b7b27be4d81337550cf3c0089370446c –
- bb553e2e8bfc4bebb21552ed1068565f9609ad5dcc8fea58dc0ff1082c775df5 –
- 6e0a12cdd778951163ccf481ffb2fc3724b382e4ca8e941b7dfdd8b0f8375cb3 –
- 18463da5cf780724c302a26703f59a75da279cdb035650fafcea048618805681 –
- af9e87c3cd2f99993548a9a9cfcc0b3df7b45626448fe0065ef88595688c50d3 –
- 2259c89d2c5e1d8324f075135b03492f393860b9911855e84f50ed6b3699ac4d –
- 1ca07e066880859cc6b67ba73e1dfc599751fc3ac356d43ef85520536473b384 –
- 8153cde5c62679afc8f230dbb19d66b1724f4c4fefa68b5c92994ab42fe293de –
- 8cb542f5793279b8a11af28e9352f41d400856a28e40ed1daa323b47f9ea3e3c –
- afc9fbb1ff8cfdd79a781bf493dc426bb059916debbb98c1b7c20a9d0f24a5f7 –
- 7654dc94bca98e9811eff54d8fc44d1da6c6377132dded797e31e41d6f57edfa –
- a707d3f235eb1a5d37bfe88e4abb9996e9c140bc32aead9a1840e152313d5412
ObliqueRat Downloader URLs
hxxps://sharingmymedia[.]com/files/1More-details[.]doc
hxxps://sharingmymedia[.]com/files/Criteria-of-Army-Officers[.]doc
hxxps://sharingmymedia[.]com/files/7All-Selected-list[.]xls
hxxp://iiaonline[.]in/sasha[.]jpg
hxxp://iiaonline[.]in/timon[.]jpeg
hxxp://iiaonline[.]in/DefenceLogo/theta[.]bmp
