GnatSpy Android Mobile Malware

GnatSpy is a family of malware which includes threats such as VAMP and FrozenCell. This family of mobile malware targets images, text messages, contacts and call history on infected devices. It can connect to Command and Control (C2) domains which can be used to exfiltrate data.

The attackers send malicious files directly to the device for the users to download and install.

The communication with the C2 servers is encoded to avoid detection.  Below shows the URL.

The following domains were used by various C&C servers:

• aryastark[.]info
• cecilia-gilbert[.]com
• cerseilannister[.]info
• claire-browne[.]info
• daario-naharis[.]info
• harvey-ross[.]info
• jorah-mormont[.]info
• kaniel-outis[.]info
• kristy-milligan[.]website
• lagertha-lothbrok[.]info
• max-eleanor[.]info
• olivia-hartman[.]info
• ragnar-lothbrok[.]info
• rose-sturat[.]info
• saratancredi[.]info
• useraccount[.]website
• victor-stewart[.]info

Apps/files with the following hashes are connected to GnatSpy:

Affected Platforms

• All Android Devices

Duncan

Duncan is a technology professional with over 20 years experience of working in various IT roles. He has a interest in cyber security, and has a wide range of other skills in radio, electronics and telecommunications.