Add Android forensics, IOC threat-intel DB, Compose companion; scrub secrets from configs

2026-07-13 15:45:47 -07:00
parent 925216290f
commit e48d577bd5
387 changed files with 211976 additions and 921 deletions
--- a/data/ioc/stalkerware/ioc.yaml
+++ b/data/ioc/stalkerware/ioc.yaml
--- a/data/ioc/stalkerware/rules.yar
+++ b/data/ioc/stalkerware/rules.yar
@@ -0,0 +1,206 @@
+rule snoopza : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "Server changed to " ascii
+        $s2 = "snoopza.com" ascii
+        $s3 = "Sim Update imsi:" ascii
+        $s4 = "U5t8444cbWHTWgYtCtQE6PkPdteUIOVi" ascii
+        $s5 = "jTfELCG992ee6YounW5MV7vsYtzseOp7" ascii
+        $s6 = "getSimOperator" ascii
+        $s7 = "install error: not exist " ascii
+        $s8 = "MIPKOMONITOR" ascii
+        $s9 = "3t2PYOBHw5QQ3MraExQvUA==" ascii
+
+
+    condition:
+        uint16(0) == 0x6564 and 7 of them
+}
+
+rule mspy : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "mspy_keyboard_used" ascii
+        $s2 = "multipart/form-data; boundary=+-=+-=-------+-=+-=" ascii
+        $s3 = "mspyonline.com" ascii
+        $s4 = "inputType=0x%08x%s%s%s%s%s" ascii
+        $s6 = "/proc/%d/oom_score_adj" ascii
+        $s7 = "/trackActiveViewUnit" ascii
+        $s8 = "InstagramMessageItem" ascii
+        $s9 = "KikMessageItem" ascii
+
+    condition:
+        uint16(0) == 0x6564 and 5 of them
+}
+
+rule spyhide {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "go_to_spyhide" ascii
+        $s2 = "configure_hide" ascii
+        $s3 = "cellphone-remote-tracker.com" ascii
+        $s4 = "bi dont know!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!" ascii
+        $s5 = "bmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm" ascii
+        $s6 = "mojmadah@gmail.com" ascii
+        $s7 = "www.virsis.net/client" ascii
+        $s8 = "Gray_Dolphin" ascii
+        $s9 = "new messageeeeeeeeeeeee= " ascii
+        $s10 = "@number OOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOOout" ascii
+
+
+    condition:
+        uint16(0) == 0x6564 and 8 of them
+}
+
+rule onetopspy : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "spy-call-active" ascii
+        $s2 = "/BackupEmail/" ascii
+        $s3 = "G_IS_WHATSAPP_INSTALLED" ascii
+        $s4 = "G_LIST_RECORD_CALL_NUMBER" ascii
+        $s5 = "1topspy.com" ascii
+        $s6 = "duplicate key: " ascii
+        $s7 = "setFacebookActive" ascii
+        $s8 = "busybox rm -rf " ascii
+        $s9 = "Unknown cmd: " ascii
+        $s10 = "Testing A ton of commands" ascii
+        $s11 = "PATH_BACKUP_FILE_SMS" ascii
+
+    condition:
+        uint16(0) == 0x6564 and 9 of them
+}
+
+rule ikeymonitor : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+        author = "Jo Coscia"
+
+    strings:
+        $s1 = "emcpanel.com" nocase ascii
+        $s2 = "Keylogger_Xposed" ascii
+        $s3 = "iKeyMonitor" nocase ascii
+        $s4 = "Reg_LKConnotbE" ascii
+    condition:
+        uint16(0) == 0x6564 and 4 of them
+}
+
+rule cerberus : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+        author = "Jo"
+
+    strings:
+        $s1 = "command NOT EXECUTED. Have you enabled it in Cerberus settings" ascii nocase
+        $s2 = "support@cerberusapp.com" ascii nocase
+        $s3 = "sendaudiofile.php" ascii
+        $s4 = "comm/radar.php" ascii
+        $s5 = "notifyowner.php" ascii
+    condition:
+        uint16(0) == 0x6564 and 4 of them
+}
+
+rule viptelefonprogrami : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $b64 = /[a-zA-Z0-9+\/]{70,}==/
+        $re1 = /com\/[a-z]{8}\/[a-z]{8}\/protocol\/a;/
+        $re2 = /com\/[a-z]{8}\/[a-z]{8}\/registration\/a;/
+        $re3 = /com\/[a-z]{8}\/[a-z]{8}\/util\/a;/
+
+    condition:
+        uint16(0) == 0x6564 and #b64 > 1000 and all of ($re*)
+}
+
+rule viptelefonprogrami_jkl : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "base64_decode" ascii
+        $s2 = "MD5Transform" ascii
+        $s3 = "Java_com_example_hellojni_HelloJni_get2" ascii
+        $s4 = "tijni" ascii
+        $s5 = "error - 2" ascii
+        $s6 = "Success !!" ascii
+        $s7 = "Fail !!" ascii
+
+    condition:
+        uint16(0) == 0x457f and 6 of them
+}
+
+rule android_police : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "ANDROID_MONITOR_CHECKER" ascii
+        $s2 = "AudioRecordThread" ascii
+        $s3 = "CameraCapturer.java" ascii
+        $s4 = "Not on camera thread." ascii
+        $s5 = "Stop camera1 session on camera" ascii
+        $s6 = "Wrong thread." ascii
+        $s7 = "YuvConverter.convert" ascii
+        $s8 = "bb392ec0-8d4d-11e0-a896-0002a5d5c51b" ascii
+        $s9 = "disableNetworkMonitor" ascii
+        $s10 = "info_prog_rec_screen_whatch_start" ascii
+
+    condition:
+        uint16(0) == 0x6564 and 8 of them
+}
+
+rule tracku : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "/Hike/Media/hike Voice Messages" ascii
+        $s2 = "/viber/media/Viber Images" ascii
+        $s3 = "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" ascii
+        $s4 = "AudioTrackJavaThread" ascii
+        $s5 = "Bxt2y1rUKoGVnD3pi73LivcES" ascii
+        $s6 = "Camera device is in use already." ascii
+        $s7 = "FITNESS_LOCATION_READ" ascii
+        $s8 = "GetBucketLocation" ascii
+        $s9 = "c/c/a/b/b$a" ascii
+        $s10 = "org/webrtc/VideoFrameDrawer" ascii
+        $s11 = "T56yAzZC2uHe7k" ascii
+
+    condition:
+        uint16(0) == 0x6564 and 9 of them
+}
+
+rule italianstalkerware : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+
+    strings:
+        $s1 = "DataMariaDbSalentoBellaSarda" nocase ascii
+        $s2 = "IsScreenOnServiceMarinellaBella" ascii
+        $s3 = "preInstallServiceAnacondameritocronicavolenzia" nocase ascii
+        $s4 = "ScreenIsOnReceiverMarinellaBella" ascii
+
+    condition:
+        uint16(0) == 0x6564 and 4 of them
+}
+
+rule tispy : stalkerware {
+    meta:
+        ref = "https://github.com/AssoEchap/stalkerware-indicators"
+        sha256 = "0d8befa2d86f456dcaea8e14ed3d3d84fb3f523eb1168530660027be6bbc516f"
+
+    strings:
+        $func = { 6E 10 3? 01 06 00 0C 02 6E 10 3? 01 05 00 0C 00 71 10 ?? 00 00 00 0C 03 12 00 21 31 35 10 1A 00 48 01 03 00 21 24 94 04 00 04 48 04 02 04 B1 41 13 04 80 FF 35 41 08 00 D9 01 01 80 D9 01 01 7F }
+
+    condition:
+        uint16(0) == 0x6564 and $func
+}
--- a/data/ioc/stalkerware/samples.csv
+++ b/data/ioc/stalkerware/samples.csv
--- a/data/ioc/stalkerware/watchware.yaml
+++ b/data/ioc/stalkerware/watchware.yaml
@@ -0,0 +1,350 @@
+- name: WiseMo
+  names:
+  - WiseMo
+  type: watchware
+  packages:
+  - com.wisemo.host.v10
+  certificates:
+  - 9B48840CBF93379410172B4B85989624D2B33D59
+  websites:
+  - wisemo.com
+  - www.wisemo.com
+  c2:
+    domains:
+    - mycloud1.wisemo.com
+    - mycloud.wisemo.com
+    - mtracker.fortess.net
+    - mycloud-cs10.wisemo.com
+    - mycloud-cs17.wisemo.com
+    - mycloud-cs17a.wisemo.com
+    - mycloud-cs5a.wisemo.com
+    - mycloud-cs9.wisemo.com
+
+- name: FamiSafe
+  type: watchware
+  packages:
+  - com.wondershare.famisafe
+  - com.wondershare.famisafe.kids
+  certificates:
+  - 61B90229F79F730043D06FEE46BB8FD9E3A0E70B
+  - 095514BA4F28DBE521C74ABF77972BE3C86A50A5
+  websites:
+  - famisafe.wondershare.com
+  - famisafeapp.wondershare.com
+  - accounts.wondershare.com
+  c2:
+    domains:
+    - 300624.com
+    - analytics.300624.com
+    - api.wondershare.cc
+    - app-api-pro.wondershare.cc
+    - data-api.famisafe.com
+    - dc.wondershare.cc
+    - famisafe-b6807.firebaseio.com
+    - sparrow.wondershare.com
+
+- name: KasperskySafeKids
+  type: watchware
+  packages:
+  - com.kaspersky.safekids
+  c2:
+    domains:
+    - kaspersky-safe-kids.firebaseio.com
+
+- name: KidsControl
+  type: watchware
+  packages:
+  - app.gpsme
+  websites:
+  - kid-control.com
+  - kid-control.ru
+  c2:
+    domains:
+    - api.kid-control.com
+    - beta.kid-control.com
+    - ios.kid-control.com
+    - go.kid-control.com
+    - go2.kid-control.com
+    - gpsme1.kid-control.com
+    - s.kid-control.com
+    - s4.kid-control.com
+    - s5.kid-control.com
+    - s6.kid-control.com
+    - s7.kid-control.com
+    - s8.kid-control.com
+    - s9.kid-control.com
+    - s10.kid-control.com
+
+- name: FindMyKids
+  type: watchware
+  packages:
+  - org.findmykids.app
+  ios_bundles:
+  - com.wheremychildren.ios
+  certificates:
+  - 2A57777E3B9491A37392AFCE2E69D030DBF95037
+  websites:
+  - findmykids.org
+  - discount.findmykids.org
+  c2:
+    domains:
+    - r.findmychilds.org
+    - wss.findmychilds.org
+    - where-is-my-children.firebaseio.com
+
+- name: Accountable2you
+  type: watchware
+  packages:
+  - com.accountable2you.ap1
+  certificates:
+  - 78CFFA689DD23FDD7E84DDFBF28F86D4843C6129
+  websites:
+  - accountable2you.com
+  c2:
+    domains:
+    - accountable2you.com
+    - webservice.accountable2you.com
+    - accountable2you-android.firebaseio.com
+    - api.accountable2you.com
+
+- name: ZoeMob
+  type: watchware
+  packages:
+  - com.zoemob.gpstracking
+  certificates:
+  - F9761F7C7AA6317B667671CB8F66479970630EAD
+  websites:
+  - www.zoemob.com
+  - zoemob.com
+  - panel.zoemob.com
+  c2:
+    domains:
+    - apis.zoemob.com
+    - zoemob.firebaseio.com
+
+- name: Life360
+  type: watchware
+  packages:
+  - com.life360.android.safetymapd
+  ios_bundles:
+  - com.life360.safetymap
+  certificates:
+  - 19C0868F028757F49FD8F7BDF39FF70C771D622B
+  websites:
+  - www.life360.com
+  - life360.com
+  - life360-wordpress.s3.amazonaws.com
+  - life360.zendesk.com
+  c2:
+    domains:
+    - gpi4.life360.com
+    - life360-dev.tile-api.com
+    - life360.atlassian.net
+    - life360-location-dev.tile-api.com
+    - gpi3.life360.com
+    - i.lf360.co
+    - gpi4.dev.life360.com
+    - life360feedback.typeform.com
+    - api-cloudfront.life360.com
+    - life360-com-l360safetycenter.firebaseio.com
+
+- name: MicrosoftFamilySafe
+  type: watchware
+  packages:
+  - com.microsoft.familysafety
+  websites:
+  - family.microsoft.com
+  c2:
+    domains:
+    - location.family.microsoft.com
+    - mobileaggregator.family.microsoft.com
+    - safedriving.family.microsoft.com
+
+- name: GeoZilla
+  type: watchware
+  packages:
+  - com.geozilla.family
+  certificates:
+  - EE74E09E40A324B806AE5ED68A4543E50C3B6FC2
+  websites:
+  - geozilla.com
+  - geozillahelp.zendesk.com
+  c2:
+    domains:
+    - api.geozilla.com
+    - files.geozilla.com
+    - geozilla.autosmartins.com
+    - geozillafamily-c92d0.firebaseio.com
+    - geozillafamily.firebaseio.com
+    - iot.geozilla.com
+
+- name: KidsLox
+  type: watchware
+  packages:
+  - com.kidslox.app
+  certificates:
+  - 4BBD8F7E244B86B6B82F2A343EE8EDB5E797FEF8
+  websites:
+  - kidslox.com
+  - kidsloxsupport.zendesk.com
+  - www.advanced.kidslox.com
+  c2:
+    domains:
+    - kidslox.page.link
+    - kidslox.firebaseio.com
+    - activity.kdlparentalcontrol.com
+    - admin.kdlparentalcontrol.com
+
+- name: FamiShield
+  names:
+  - Mitbe
+  type: watchware
+  packages:
+  - com.USIB.Child.ChildControl
+  certificates:
+  - 4598FFB867E28560BC1198D61EC83A1CCA0F1612
+  websites:
+  - famishield.usibtheteam.com
+  c2:
+    domains:
+    - parental-control-d4a98-default-rtdb.asia-southeast1.firebasedatabase.app
+
+- name: Qustodio
+  type: watchware
+  websites:
+  - qustodio.com
+  - www.qustodio.com
+  packages:
+  - com.qustodio.qustodioapp
+  ios_bundles:
+  - com.qustodio.par.qustodio-family-parental-control-app
+  - com.qustodio.mdm.app.family.pro
+
+- name: ScreenTime
+  type: watchware
+  websites:
+  - screentimelabs.com
+  packages:
+  - com.screentime.rc
+  ios_bundles:
+  - com.screentime
+
+- name: MMGuardian
+  type: watchware
+  packages:
+  - com.mmguardian.parentapp
+  - com.mmguardian.tabletsecurity
+  - com.mmguardian.childapp
+  certificates:
+  - 842933609E604063B55C04BBB47763AC7C0FC327
+  websites:
+  - www.mmguardian.com
+  - mmguardian.com
+  - family.mmguardian.com
+
+- name: FlareFamilyLocator
+  type: watchware
+  packages:
+  - com.probit.flare
+
+- name: FamilyOrbit
+  type: watchware
+  websites:
+  - familyorbit.com
+  - www.familyorbit.com
+  c2:
+    domains:
+    - www.familyorbit.com
+    - www.familyorbit.net
+  packages:
+  - com.familyorbit.child
+  certificates:
+  - DB8DF9C3D6524B298F3EAD22E6A77D7FB2F1003A
+
+- name: Trulpe
+  type: watchware
+  websites:
+  - truple.io
+  - app.truple.io
+  packages:
+  - com.camhart.netcountable
+
+- name: Boomrang
+  type: watchware
+  websites:
+  - useboomerang.com
+  packages:
+  - com.nationaledtech.Boomerang
+  certificates:
+  - E6157A76E1DCF43159529212009A0AA335499B7D
+
+- name: MobileFence
+  type: watchware
+  websites:
+  - www.mobilefence.com
+  - mobilefence.com
+  packages:
+  - com.mobilefence.family
+
+- name: Kidgy
+  type: watchware
+  websites:
+  - kidgy.com
+  packages:
+  - com.parental.control.kidgy
+
+- name: Kiddoware
+  type: watchware
+  websites:
+  - kiddoware.com
+  packages:
+  - com.kiddoware.kidsplace
+
+- name: Netnanny
+  type: watchware
+  websites:
+  - www.netnanny.com
+  - netnanny.com
+  packages:
+  - com.contentwatch.ghoti.cp2.child
+  ios_bundles:
+  - com.contentwatch.ghoti.cp2.parent
+  distribution:
+  - install.netnanny.com
+  c2:
+    domains:
+    - parent.netnanny.com
+
+- name: SeekDroid
+  type: watchware
+  websites:
+  - seekdroid.com
+  packages:
+  - org.gtmedia.seekdroid
+
+- name: LockItTight
+  type: watchware
+  websites:
+  - www.lockittight.com
+  - lockittight.com
+  packages:
+  - com.timeon.litclient
+    
+- name: SafeNet
+  type: watchware
+  websites:
+    - safenet.family
+  packages:
+    - com.cisai.safenetchild
+  certificates:
+    - 7F0D7ED5D614B03962014483E654A215A40F029F
+  c2:
+    ips:
+      - 103.10.24.124
+
+- name: Discovenger
+  type: watchware
+  websites:
+    - discovenger.com
+  packages:
+    - com.discovenger.app