✕

Rewterz Annual Threat Intelligence Report 2025 - Download Now

Request a Demo
Rewterz

Rewterz Threat Alert – Legion Loader’s Nest of Malware

December 26, 2019
Rewterz

Rewterz Threat Alert – ISO Files in Email Attachments Delivering Malware

December 26, 2019

Rewterz Threat Alert – Android Trojan Delivered via Chat Application

Severity

Medium

Analysis Summary

A number of malicious code attacks that were targeted at Android users in South Korea. The attacker induced the victim to install and use the malicious Android application by disguising it as a common mobile application in South Korea. After analysis, it was found that the attack activity is consistent with the KONNI Android Trojan disclosed by ESTsecurity, both in terms of attack methods and Trojan horse framework.

9eee32d09e7b13f25465ef0dd4be503e.png

Fake download page of GooglePlay

65329adad4995f5b94437ec93ae8e92f.png

After the APK Trojan is executed, it will request “http: // [C2] /manager/files/To_[IMEI].txt ” every 3 seconds , and then execute the instructions issued by the attacker based on the returned data, and then execute the The result is transmitted back to the server through the upload interface; when the Trojan starts, it will upload the phone information, SDCard file directory, and the list of installed applications to the C2 server.

Impact

Exposure of sensitive information

Indicators of Compromise

MD5

  • 2487a29d1193b5f48d29df02804d8172
  • 2cbf145eb39818d2b43b8c03ddb28ddf
  • 9e9745415793488ecf0774c7477bf2ae
  • e039be15ddf7334311ee01711ba69481

Remediation

  • Block all threat indicators on your respective controls.
  • Always download applications from legitimate accounts.

Reading this advisory was a good start.

Make it a habit.

Rewterz publishes threat advisories ahead of mainstream cybersecurity media, informed by an AI-Native Autonomous SOC that sees regional threat actor activity in real time. Subscribe to receive each new advisory as it publishes, plus a monthly Middle East threat landscape brief drawn from our own SOC telemetry. For teams evaluating their detection coverage, a 30-minute consultation with a senior analyst is also available, at your pace, when you're ready.

Request a demo