Between December 2015 and June 2016 a new Android RAT (remote access trojan) has been targeting users living in China with the aim of collecting their personal data and sending it to a C&C server hosted in Italy.
According to an analysis shared with Softpedia by Bitdefender researchers Alin Barbatei and Marius Mihai Tivadar, the Italian connection goes deeper, as the RAT's source code is also full of Italian text strings.
Only Chinese users using four models are targeted
The RAT is coded in such a way that targets only Chinese users that own four types of phones: Samsung N9005 Galaxy Note 3 LTE, Samsung SM-G355HN Galaxy 2 Core, LG D820 Nexus 5 and G355H Galaxy Core II (SM-G355HN).
The crooks behind this campaign achieve this by filtering the IMEI code of the device they infect. If the code is not between certain ranges, then the infection is abandoned.
The name of the two apps used to infect users are "it.cyprus.client" and "it.assistenzaumts.up...
Intelligence View
⚡ tsecurity.de Intelligence
New Android RAT Targeting Users in China
Between December 2015 and June 2016 a new Android RAT (remote access trojan) has been targeting users living in China with the aim of collecting their personal data and sending it to a C&C server hosted in Italy. According to an…
Reagiere als Erste:r — dein Feedback zählt!
SOCIAL SHARE CARD GENERATOR