sssnake/autarch
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

Browse Source
This commit is contained in:
SsSnake
2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/README.md Normal file
View File

@@ -0,0 +1,14 @@
# NoviSpy Indicators of Compromise
This repository contains indicators of compromise (IoCs) related to the **NoviSpy** Android spyware used by Serbian authorities to target activists and journalists. The NoviSpy spyware has been covertly installed on target Android devices using physical access while at the offices of the Serbian Security Intelligence Agency or police. It is unclear if they spyware is also capable of targeting iPhones. NoviSpy appears to have been developed specifically for the Serbian security services.
These indicators were identified through forensic research by the Amnesty International [Security Lab](https://securitylab.amnesty.org/). More information about the Serbian **NoviSpy** spyware can be found in the Amnesty International's report ["A Digital Prison": Surveillance and the suppression of civil society in Serbia](https://securitylab.amnesty.org/latest/2024/12/serbia-a-digital-prison-spyware-and-cellebrite-used-on-journalists-and-activists/).
The STIX2 file can be used with the [Mobile Verification Toolkit](https://github.com/mvt-project/mvt) to look for potential signs of compromise on Android devices. It should be possible to detect this spyware in Android *bugreports*, and AndroidQF extractions.
It includes the following files:
* `domains.txt`: List of C2 IPs used in NoviSpy spyware samples
* `package_cert_hashes.txt`: Hashes of Android APK signing certificates used by NoviSpy.
* `package_names.txt`: Android package names used in NoviSpy samples.
* `sha256.txt`: Hashes of NoviSpy spyware samples

7
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/domains.txt Normal file
View File

@@ -0,0 +1,7 @@
195.178.51.251
79.101.110.108
188.93.127.34
178.220.122.57
94.140.125.174
185.86.148.174
176.223.111.131

77
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/generate_stix.py Normal file
View File

@@ -0,0 +1,77 @@
import sys
import os
from stix2.v21 import (Indicator, Malware, Relationship, Bundle)
from stix2 import CustomObservable
# @CustomObservable('x-new-observable-2', [
# ('a_property', properties.StringProperty(required=True)),
# ('property_2', properties.IntegerProperty()),
# ], [
# 'a_property'
# ])
# class NewObservable2():
# pass
def hash_format(hash):
if len(hash) == 32:
return "md5"
elif len(hash) == 40:
return "sha1"
elif len(hash) == 64:
return "sha256"
else:
return None
if __name__ == "__main__":
stix2_file_name = "novispy.stix2"
if os.path.isfile(stix2_file_name):
os.remove(stix2_file_name)
with open("domains.txt") as f:
domains = list(set([a.strip() for a in f.read().split()]))
with open("package_names.txt") as f:
package_names = list(set([a.strip() for a in f.read().split()]))
with open("package_cert_hashes.txt") as f:
package_cert_hashes = list(set([a.strip() for a in f.read().split()]))
with open("sha256.txt") as f:
sha256_hashes = list(set([a.strip() for a in f.read().split()]))
res = []
malware = Malware(name="NoviSpy", is_family=False, description="IOCs for Serbian NoviSpy Android spyware")
res.append(malware)
for d in domains:
i = Indicator(indicator_types=["malicious-activity"], pattern="[domain-name:value='{}']".format(d), pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
for package_name in package_names:
i = Indicator(indicator_types=["malicious-activity"], pattern="[app:id='{}']".format(package_name), pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
for cert_hash in package_cert_hashes:
hash_type = hash_format(cert_hash)
if not hash_type:
raise ValueError("Unknown hash type for {}".format(cert_hash))
i = Indicator(indicator_types=["malicious-activity"], pattern=f"[app:cert.{hash_type}='{cert_hash}']", pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
for sha256_hash in sha256_hashes:
if not hash_format(sha256_hash) == "sha256":
raise ValueError("File hash is not in SHA256 format: {}".format(sha256_hash))
i = Indicator(indicator_types=["malicious-activity"], pattern=f"[file:hashes.sha256='{sha256_hash}']", pattern_type="stix")
res.append(i)
res.append(Relationship(i, 'indicates', malware))
bundle = Bundle(objects=res)
with open(stix2_file_name, "w+") as f:
f.write(bundle.serialize(pretty=True, indent=4))
print("{} file created".format(stix2_file_name))

448
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.stix2 Normal file
View File

@@ -0,0 +1,448 @@
{
"type": "bundle",
"id": "bundle--842bf1e2-05c8-4c9a-9a56-869349aaa6ba",
"objects": [
{
"type": "malware",
"spec_version": "2.1",
"id": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831",
"created": "2024-12-13T21:15:49.152925Z",
"modified": "2024-12-13T21:15:49.152925Z",
"name": "NoviSpy",
"description": "IOCs for Serbian NoviSpy Android spyware",
"is_family": false
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--f2784a32-7e47-4aab-a222-08d07d708db9",
"created": "2024-12-13T21:15:49.153129Z",
"modified": "2024-12-13T21:15:49.153129Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='176.223.111.131']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.153129Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4969eaf8-2825-4533-9df5-b21d1f0bf8de",
"created": "2024-12-13T21:15:49.157137Z",
"modified": "2024-12-13T21:15:49.157137Z",
"relationship_type": "indicates",
"source_ref": "indicator--f2784a32-7e47-4aab-a222-08d07d708db9",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--250d0468-85be-4f64-b713-9f16f38e701b",
"created": "2024-12-13T21:15:49.158284Z",
"modified": "2024-12-13T21:15:49.158284Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='195.178.51.251']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.158284Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--fa40d886-20de-4838-8fd1-8c47f8265360",
"created": "2024-12-13T21:15:49.158783Z",
"modified": "2024-12-13T21:15:49.158783Z",
"relationship_type": "indicates",
"source_ref": "indicator--250d0468-85be-4f64-b713-9f16f38e701b",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c1727649-7998-4c5c-8c42-c87ff8911991",
"created": "2024-12-13T21:15:49.158896Z",
"modified": "2024-12-13T21:15:49.158896Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='94.140.125.174']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.158896Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--deda9142-7d08-438b-b220-c5dd09ec8376",
"created": "2024-12-13T21:15:49.159288Z",
"modified": "2024-12-13T21:15:49.159288Z",
"relationship_type": "indicates",
"source_ref": "indicator--c1727649-7998-4c5c-8c42-c87ff8911991",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--9df7f73a-a2b5-4fb9-89b5-c4c398ae52be",
"created": "2024-12-13T21:15:49.159389Z",
"modified": "2024-12-13T21:15:49.159389Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='178.220.122.57']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.159389Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1c009626-3d8b-4377-ac44-f2bcf48a3197",
"created": "2024-12-13T21:15:49.15967Z",
"modified": "2024-12-13T21:15:49.15967Z",
"relationship_type": "indicates",
"source_ref": "indicator--9df7f73a-a2b5-4fb9-89b5-c4c398ae52be",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--3ce2e4ce-9693-4073-b64f-4dfe00db29ad",
"created": "2024-12-13T21:15:49.159762Z",
"modified": "2024-12-13T21:15:49.159762Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='185.86.148.174']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.159762Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6a30d4d1-8752-4b53-8233-fbddf71ab0ae",
"created": "2024-12-13T21:15:49.160037Z",
"modified": "2024-12-13T21:15:49.160037Z",
"relationship_type": "indicates",
"source_ref": "indicator--3ce2e4ce-9693-4073-b64f-4dfe00db29ad",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--27792ca5-0167-446d-a885-78056ccb9555",
"created": "2024-12-13T21:15:49.160125Z",
"modified": "2024-12-13T21:15:49.160125Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='188.93.127.34']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.160125Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--e10509b1-4007-493e-b23f-5ca2e5a2c7e1",
"created": "2024-12-13T21:15:49.160459Z",
"modified": "2024-12-13T21:15:49.160459Z",
"relationship_type": "indicates",
"source_ref": "indicator--27792ca5-0167-446d-a885-78056ccb9555",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--875840ea-0bed-4549-8144-13cec119acb9",
"created": "2024-12-13T21:15:49.16055Z",
"modified": "2024-12-13T21:15:49.16055Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[domain-name:value='79.101.110.108']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.16055Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ebbe0980-44ed-4e6f-81de-8a97538f35ab",
"created": "2024-12-13T21:15:49.160853Z",
"modified": "2024-12-13T21:15:49.160853Z",
"relationship_type": "indicates",
"source_ref": "indicator--875840ea-0bed-4549-8144-13cec119acb9",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--ab6fe00c-d3bd-4f53-93bf-2d31e08cf40d",
"created": "2024-12-13T21:15:49.160941Z",
"modified": "2024-12-13T21:15:49.160941Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[app:id='com.gu.activity']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.160941Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--dbc74918-cdd0-4844-8111-b234ac3673f0",
"created": "2024-12-13T21:15:49.161701Z",
"modified": "2024-12-13T21:15:49.161701Z",
"relationship_type": "indicates",
"source_ref": "indicator--ab6fe00c-d3bd-4f53-93bf-2d31e08cf40d",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b7c463ad-22d9-4005-85d2-0a822592ef82",
"created": "2024-12-13T21:15:49.161792Z",
"modified": "2024-12-13T21:15:49.161792Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[app:id='com.serv.services']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.161792Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--252eb7b0-5033-48d9-b950-8811ae8b1766",
"created": "2024-12-13T21:15:49.162131Z",
"modified": "2024-12-13T21:15:49.162131Z",
"relationship_type": "indicates",
"source_ref": "indicator--b7c463ad-22d9-4005-85d2-0a822592ef82",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--909b894a-de5f-4525-8cef-ce3892b03226",
"created": "2024-12-13T21:15:49.162221Z",
"modified": "2024-12-13T21:15:49.162221Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[app:id='com.li.activity']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.162221Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--93936df0-ebcc-489f-b902-e47c183f6cc3",
"created": "2024-12-13T21:15:49.16251Z",
"modified": "2024-12-13T21:15:49.16251Z",
"relationship_type": "indicates",
"source_ref": "indicator--909b894a-de5f-4525-8cef-ce3892b03226",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--b727dda3-c853-4e50-a76f-ede055c5d9d0",
"created": "2024-12-13T21:15:49.1626Z",
"modified": "2024-12-13T21:15:49.1626Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[app:id='com.accesibilityservice']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.1626Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--5797281f-343a-4131-b2c9-1951a121e8c6",
"created": "2024-12-13T21:15:49.162892Z",
"modified": "2024-12-13T21:15:49.162892Z",
"relationship_type": "indicates",
"source_ref": "indicator--b727dda3-c853-4e50-a76f-ede055c5d9d0",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--060f709b-6b13-4039-9f3b-35474b92a528",
"created": "2024-12-13T21:15:49.162979Z",
"modified": "2024-12-13T21:15:49.162979Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[app:cert.sha256='3ac97735164824657b683e805133b1274b2dedabf9fdd6aa9aca31089d501e64']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.162979Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--9ffa5599-cf6c-44a0-8482-949626ad5d60",
"created": "2024-12-13T21:15:49.164295Z",
"modified": "2024-12-13T21:15:49.164295Z",
"relationship_type": "indicates",
"source_ref": "indicator--060f709b-6b13-4039-9f3b-35474b92a528",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--e0c172bb-e8eb-434e-8266-09feafdaa206",
"created": "2024-12-13T21:15:49.164396Z",
"modified": "2024-12-13T21:15:49.164396Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[app:cert.sha256='35926e966186c8f2deec66864389d73989c75c85cb6668da2f455db6fe67e91f']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.164396Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--6d1b9b2a-051d-4b38-91ef-b60ee17d2acb",
"created": "2024-12-13T21:15:49.16473Z",
"modified": "2024-12-13T21:15:49.16473Z",
"relationship_type": "indicates",
"source_ref": "indicator--e0c172bb-e8eb-434e-8266-09feafdaa206",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--c0b0fa21-3f5b-4201-b0cf-ec0a44a70335",
"created": "2024-12-13T21:15:49.164823Z",
"modified": "2024-12-13T21:15:49.164823Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[app:cert.sha256='38693e1ea0fbf39d28f66b1714fdeed4e23b3973276481097d2d66e87f3647eb']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.164823Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--c565aa18-93ff-4c29-861f-0e13e453f7c8",
"created": "2024-12-13T21:15:49.165381Z",
"modified": "2024-12-13T21:15:49.165381Z",
"relationship_type": "indicates",
"source_ref": "indicator--c0b0fa21-3f5b-4201-b0cf-ec0a44a70335",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--a3f22e28-75cd-467f-8349-a8c0a0ea3654",
"created": "2024-12-13T21:15:49.165549Z",
"modified": "2024-12-13T21:15:49.165549Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[file:hashes.sha256='d55e492d5fce87898e065572a5553d1ac1389cd12bf3d28cabc1218cb29780af']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.165549Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--ba7b7587-af4c-4d9d-a5df-4f5b24385d72",
"created": "2024-12-13T21:15:49.166296Z",
"modified": "2024-12-13T21:15:49.166296Z",
"relationship_type": "indicates",
"source_ref": "indicator--a3f22e28-75cd-467f-8349-a8c0a0ea3654",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--99079f12-e131-4be9-b257-412671922265",
"created": "2024-12-13T21:15:49.1664Z",
"modified": "2024-12-13T21:15:49.1664Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[file:hashes.sha256='54ee2c4f3e2396b6f92def135d68abd35d63ca7f9c304633a36f705ba4728cb7']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.1664Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--4dfed635-fac9-4408-95ba-0b0f3a07820d",
"created": "2024-12-13T21:15:49.166781Z",
"modified": "2024-12-13T21:15:49.166781Z",
"relationship_type": "indicates",
"source_ref": "indicator--99079f12-e131-4be9-b257-412671922265",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--9e6318cc-56ee-4be1-849a-f0339837d0a1",
"created": "2024-12-13T21:15:49.166874Z",
"modified": "2024-12-13T21:15:49.166874Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[file:hashes.sha256='99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.166874Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--cd1d9312-c9e5-42c9-931b-b673e1f3a7f1",
"created": "2024-12-13T21:15:49.167212Z",
"modified": "2024-12-13T21:15:49.167212Z",
"relationship_type": "indicates",
"source_ref": "indicator--9e6318cc-56ee-4be1-849a-f0339837d0a1",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
},
{
"type": "indicator",
"spec_version": "2.1",
"id": "indicator--4b278e85-9d79-45ca-babc-b33402c71e56",
"created": "2024-12-13T21:15:49.167352Z",
"modified": "2024-12-13T21:15:49.167352Z",
"indicator_types": [
"malicious-activity"
],
"pattern": "[file:hashes.sha256='087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e']",
"pattern_type": "stix",
"pattern_version": "2.1",
"valid_from": "2024-12-13T21:15:49.167352Z"
},
{
"type": "relationship",
"spec_version": "2.1",
"id": "relationship--1a3a8e01-7c95-4d72-87d7-5b47940259f3",
"created": "2024-12-13T21:15:49.167815Z",
"modified": "2024-12-13T21:15:49.167815Z",
"relationship_type": "indicates",
"source_ref": "indicator--4b278e85-9d79-45ca-babc-b33402c71e56",
"target_ref": "malware--fc5f2370-9d5b-4660-98d2-f7668b235831"
}
]
}

154
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/novispy.yara Normal file
View File

@@ -0,0 +1,154 @@
rule APT_serbia_novispy_android_accesibilityservice {
meta:
description = "Rule for Serbian NoviSpy Android spyware APK, com.accesibilityservice version"
author = "Donncha O Cearbhaill, Amnesty International"
sample = "99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602"
strings:
$dex = { 64 65 78 0A 30 33 ?? 00 }
// C2 communication
$c2_1 = "195.178.51.251"
$c2_2 = "79.101.110.108"
$c2_3 = "188.93.127.34"
// Unique Strings
$u_1 = "kataklinger vibercajzna" ascii nocase
$u_2 = "select action_command.* from action_command where action_id = ? and trigger_type = ?" ascii nocase
$u_3 = "6FDF20EAFA2D58AF609C72AE7092BB45" ascii nocase
$u_4 = "{\"cellChangeMonitoring\":true,\"signalStrengthMonitoring\":true,\"temperatureDelta\":1," ascii nocase
$u_5 = "{\"fileUpload\":false,\"audioRecording\":false,\"cellChangeMonitoring\":true,"ascii nocase
$u_6 = "\"serverIp\":\"188.93.127.34\"" ascii nocase
$u_7 = "ucitavanjepodataka" ascii nocase
// Other strings
$s_1 = "test.dat" ascii
$s_2 = "/active.config" ascii
$s_3 = "message_map.ser" ascii
$s_4 = "event type =" ascii
$s_5 = "change type subtree" ascii
$s_6 = "change type content description" ascii
$s_7 = "change type pane title" ascii
$s_8 = "content change type pane_appeared" ascii
$s_9 = "window state changed" ascii
$s_10 = "notification state changed" ascii
$s_11 = "window content changed" ascii
$s_12 = "view scrolled" ascii
$s_13 = "type selection changed" ascii
$s_14 = "type announcement" ascii
$s_15 = "scroll position =" ascii
$s_16 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;os=%s"
$s_17 = "imei=%s;imsi=%s;phone=%s;sim_serial=%s;roaming=%s;os=%s"
$s_18 = "last message = %s, level = %d, hash = %s, node count = %d"
$s_19 = "MyAccessibilityService"
condition:
$dex at 0 and (
any of ($u*) or
any of ($c2*) or
7 of ($s*)
)
}
rule APT_serbia_novispy_android_serv_services {
meta:
description = "Rule for Serbian NoviSpy Android spyware APK, com.serv.services version"
author = "Donncha O Cearbhaill, Amnesty International"
sample = "087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e"
strings:
$dex = { 64 65 78 0A 30 33 ?? 00 }
// C2 communication
$c2_comm_1 = "178.220.122.57"
// Unique Strings
// C2 commands received via SMS
$sms_c2_cmd_1 = "C_ARF" ascii
$sms_c2_cmd_2 = "C_ARN" ascii
$sms_c2_cmd_3 = "C_AWF" ascii
$sms_c2_cmd_4 = "C_AWI" ascii
$sms_c2_cmd_5 = "C_AWN" ascii
$sms_c2_cmd_6 = "C_CRF" ascii
$sms_c2_cmd_7 = "C_CRN" ascii
$sms_c2_cmd_8 = "C_LCW" ascii
$sms_c2_cmd_9 = "C_MNS" ascii
$sms_c2_cmd_10 = "C_MXS" ascii
$sms_c2_cmd_11 = "C_R_F" ascii
$sms_c2_cmd_12 = "C_R_N" ascii
$sms_c2_cmd_13 = "C_SMF" ascii
$sms_c2_cmd_14 = "C_SMN" ascii
$sms_c2_cmd_15 = "C_SWF" ascii
$sms_c2_cmd_16 = "C_SWN" ascii
$sms_c2_cmd_17 = "C_UIR" ascii
$sms_c2_cmd_18 = "C_UMF" ascii
$sms_c2_cmd_19 = "C_UMN" ascii
$sms_c2_cmd_20 = "C_UWF" ascii
$sms_c2_cmd_21 = "C_UWN" ascii
$sms_c2_cmd_22 = "C_WLF" ascii
$sms_c2_cmd_23 = "C_WLN" ascii
// C2 commands received via FTP.
// This is not a comprehensive list of commands, generic command names are excluded to prevent false positives.
$ftp_c2_cmd_1 = "CALL_REC_OFF" ascii
$ftp_c2_cmd_2 = "CALL_REC_ON" ascii
$ftp_c2_cmd_3 = "CHARGING_REC_OFF" ascii
$ftp_c2_cmd_4 = "CHARGING_REC_ON" ascii
$ftp_c2_cmd_5 = "SECURE_REC_OFF" ascii
$ftp_c2_cmd_6 = "SECURE_REC_ON" ascii
$ftp_c2_cmd_7 = "SSD_MOBILE_OFF" ascii
$ftp_c2_cmd_8 = "SSD_MOBILE_ON" ascii
$ftp_c2_cmd_9 = "SSD_WIFI_OFF" ascii
$ftp_c2_cmd_10 = "SSD_WIFI_ON" ascii
$ftp_c2_cmd_11 = "UPLOAD_INTERVAL" ascii
$ftp_c2_cmd_12 = "UPLOAD_MOBILE_OFF" ascii
$ftp_c2_cmd_13 = "UPLOAD_MOBILE_ON" ascii
$ftp_c2_cmd_14 = "UPLOAD_WIFI_OFF" ascii
$ftp_c2_cmd_15 = "UPLOAD_WIFI_ON" ascii
$ftp_c2_cmd_16 = "AUTO_WIFI_INTERVAL" ascii
$ftp_c2_cmd_17 = "WIFI_LOCK_ON" ascii
$ftp_c2_cmd_18 = "WIFI_LOCK_OFF" ascii
$ftp_c2_cmd_19 = "AUTO_WIFI_ON" ascii
$ftp_c2_cmd_20 = "AUTO_WIFI_OFF" ascii
$ftp_c2_cmd_21 = "START_AUDIO" ascii
// App local settings configured based on C2 commands.
$setting_1 = "UIR" ascii
$setting_2 = "ULW" ascii
$setting_3 = "ULM" ascii
$setting_4 = "SSW" ascii
$setting_5 = "SSM" ascii
$setting_6 = "CRN" ascii
$setting_7 = "SRN" ascii
$setting_8 = "CRC" ascii
$setting_9 = "MXS" ascii
$setting_10 = "MNS" ascii
$setting_11 = "AWF" ascii
$setting_12 = "AWI" ascii
$setting_13 = "CHR" ascii
$setting_14 = "WLS" ascii
$setting_15 = "A_R_N" ascii
$setting_16 = "A_R_F" ascii
$setting_17 = "U_I" ascii
$setting_18 = "U_W_N" ascii
$setting_19 = "S_W_N" ascii
$setting_20 = "U_M_F" ascii
$setting_21 = "S_M_F" ascii
$setting_22 = "A_W_F" ascii
$setting_23 = "A_W_I" ascii
$setting_24 = "W_L_N" ascii
$setting_25 = "C_R_F" ascii
$setting_26 = "CH_R_F" ascii
$setting_27 = "S_R_N" ascii
condition:
$dex at 0 and (
any of ($c2_comm*) or
20 of ($sms_c2_cmd*) or
20 of ($ftp_c2_cmd*) or
20 of ($setting*)
)
}

3
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_cert_hashes.txt Normal file
View File

@@ -0,0 +1,3 @@
3ac97735164824657b683e805133b1274b2dedabf9fdd6aa9aca31089d501e64
35926e966186c8f2deec66864389d73989c75c85cb6668da2f455db6fe67e91f
38693e1ea0fbf39d28f66b1714fdeed4e23b3973276481097d2d66e87f3647eb

4
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/package_names.txt Normal file
View File

@@ -0,0 +1,4 @@
com.serv.services
com.accesibilityservice
com.li.activity
com.gu.activity

4
data/ioc/spyware/amnesty/2024-12-16_serbia_novispy/sha256.txt Normal file
View File

@@ -0,0 +1,4 @@
54ee2c4f3e2396b6f92def135d68abd35d63ca7f9c304633a36f705ba4728cb7
d55e492d5fce87898e065572a5553d1ac1389cd12bf3d28cabc1218cb29780af
99673ce7f10e938ed73ed4a99930fbd6499983caa7a2c1b9e3f0e0bb0a5df602
087fc1217c897033425fe7f1f12b913cd48918c875e99c25bdb9e1ffcf80f57e