MalwareUsed by 1 actor

FunkyBot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Roaming Mantis

It is known to infect victims with the following range of malware families for the Android OS: FakeCop, FakeSpy, MoqHao and FunkyBot.

via medium csis techblogmedium.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Last year, FortiGuard Labs identified a malware campaign targeting Japanese users. The campaign impersonated a logistics company and deployed an Android malware called FakeSpy.

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

KeepAliceMain This Class is used as persistence mechanism by the malware... This class periodically re-launches the main service used by the malware to create a gRPC connection to a remote server.

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

KeepAliceMain This Class is used as persistence mechanism by the malware... This class periodically re-launches the main service used by the malware to create a gRPC connection to a remote server.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

The code of the packer in the sample we analysed was obfuscated.

T1027.002Software PackingEvidence1

As in their previous campaigns, this payload consists of a packer and a payload.

T1140Deobfuscate/Decode Files or InformationEvidence1

The different values of the configuration variable ‘ type’ correspond to different decryption routines... 2/3 : variations of XOR based decryption with the value `0x51` (81).

T1564Hide ArtifactsEvidence1

the code accesses the folder /data/data/<appname>/app_csn0/ and creates a folder ‘ .unzip’ in it. Note that the name of the folder contains a dot as the first character, making it invisible to a normal ls command.

T1620Reflective Code LoadingEvidence1

The payload is started by calling the method `runCode` class `com.wfk.injectplugin.EntryPoint` through Java reflection.

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence1

After the connection to the server is started, the malware proceeds to collect and send the following information about the device: IMEI IMSI Phone number List of contacts

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

Finally, the resulting string is decrypted using DES and a key is generated using the value `d2a57dc1d883fd21fb9951699df71cc7` as its seed

T1071Application Layer ProtocolEvidence1

This class periodically re-launches the main service used by the malware to create a gRPC connection to a remote server.

T1102Web ServiceEvidence1

this malware uses social media to obtain its C2: it downloads the webpage of a photo-less Instagram account. It then extracts the biography field of this account and decodes it using Base64.

T1132Data EncodingEvidence1

It then extracts the biography field of this account and decodes it using Base64.

T1568Dynamic ResolutionEvidence1

The server address is not hardcoded in the `classes.dex` file, but it is retrieved during execution.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

After the connection to the server is started, the malware proceeds to collect and send the following information about the device: IMEI IMSI Phone number List of contacts

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app7 years ago

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ip.v4●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

medium csis techblogNews

Jun 25, 2020

The RoamingMantis Group’s Expansion to European Apple Accounts and Android Devices | by Aleksejs Kuprins | CSIS TechBlog | Medium

Android malware family used by the RoamingMantis group in campaigns targeting mobile users.

fortinet threat researchNews

Sep 4, 2019

FunkyBot: A New Android Malware Family Targeting Japan

A newly identified Android malware family used in phishing campaigns targeting Japanese users. It is delivered via a packer and payload architecture, establishes a gRPC connection to a remote C2 retrieved from an Instagram profile, collects device data including IMEI, IMSI, phone number and contacts, sends and receives SMS messages, can set itself as the default SMS handler, uploads received SMS to the C2, and spreads in a worm-like fashion by sending SMS messages to contacts.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

FunkyBot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

Roaming Mantis

It is known to infect victims with the following range of malware families for the Android OS: FakeCop, FakeSpy, MoqHao and FunkyBot.

via medium csis techblogmedium.com

MITRE ATT&CK

Techniques & procedures

14 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Last year, FortiGuard Labs identified a malware campaign targeting Japanese users. The campaign impersonated a logistics company and deployed an Android malware called FakeSpy.

Persistence

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

KeepAliceMain This Class is used as persistence mechanism by the malware... This class periodically re-launches the main service used by the malware to create a gRPC connection to a remote server.

Privilege Escalation

1 technique

T1547Boot or Logon Autostart ExecutionEvidence1

KeepAliceMain This Class is used as persistence mechanism by the malware... This class periodically re-launches the main service used by the malware to create a gRPC connection to a remote server.

Stealth

5 techniques

T1027Obfuscated Files or InformationEvidence1

The code of the packer in the sample we analysed was obfuscated.

T1027.002Software PackingEvidence1

As in their previous campaigns, this payload consists of a packer and a payload.

T1140Deobfuscate/Decode Files or InformationEvidence1

The different values of the configuration variable ‘ type’ correspond to different decryption routines... 2/3 : variations of XOR based decryption with the value `0x51` (81).

T1564Hide ArtifactsEvidence1

T1620Reflective Code LoadingEvidence1

The payload is started by calling the method `runCode` class `com.wfk.injectplugin.EntryPoint` through Java reflection.

Discovery

1 technique

T1033System Owner/User DiscoveryEvidence1

After the connection to the server is started, the malware proceeds to collect and send the following information about the device: IMEI IMSI Phone number List of contacts

Command and Control

5 techniques

T1001Data ObfuscationEvidence1

Finally, the resulting string is decrypted using DES and a key is generated using the value `d2a57dc1d883fd21fb9951699df71cc7` as its seed

T1071Application Layer ProtocolEvidence1

This class periodically re-launches the main service used by the malware to create a gRPC connection to a remote server.

T1102Web ServiceEvidence1

this malware uses social media to obtain its C2: it downloads the webpage of a photo-less Instagram account. It then extracts the biography field of this account and decodes it using Base64.

T1132Data EncodingEvidence1

It then extracts the biography field of this account and decodes it using Base64.

T1568Dynamic ResolutionEvidence1

The server address is not hardcoded in the `classes.dex` file, but it is retrieved during execution.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

After the connection to the server is started, the malware proceeds to collect and send the following information about the device: IMEI IMSI Phone number List of contacts

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

2 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

4 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

ip.v4●●●●●●●●●●●●View more in app7 years ago

hash.sha256●●●●●●●●●●●●View more in app7 years ago

ip.v4●●●●●●●●●●●●View more in app7 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

medium csis techblogNews

Jun 25, 2020

The RoamingMantis Group’s Expansion to European Apple Accounts and Android Devices | by Aleksejs Kuprins | CSIS TechBlog | Medium

Android malware family used by the RoamingMantis group in campaigns targeting mobile users.

fortinet threat researchNews

Sep 4, 2019

FunkyBot: A New Android Malware Family Targeting Japan

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping14

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.