Android VNC RAT: libavnc.so LibVNCServer, mastermaestrosafety.appspot.com Google Cloud C2, Google Play Taklidi

Genel Bakis

Bu ornek, Android VNC RAT olarak siniflandirilan 2.2MB'lik bir APK. LibVNCServer kutuphanesi (libavnc.so) kullanarak kurban cihazin ekranini gizlice yayin yapan bu malware, mastermaestrosafety.appspot.com Google Cloud uzerinde barindirilan bir C2 adresine baglaniyor. Google Play uygulamasini taklit ederek gizleniyor.

Teknik Analiz

VNC Yayin Yetenekleri

lib/armeabi/libavnc.so — gomulu LibVNCServer kutuphane
rfbInitSockets, rfbHttpInitSockets — VNC socket baslatma
rfbCheckPasswordByList, rfbDecryptPasswdFromFile — sifre dogrulama
rfbEncryptBytes — VNC sifreleme
rfbRegisterProtocolExtension, rfbUnregisterProtocolExtension
start_vnc, Java_de_abr_android_avnc_lib_LvWrapper_nstart_1vnc
nreversecon — ters baglanti modu (C2 cihaza baglanir)

C2 ve Bulut Altyapisi

mastermaestrosafety, mastermaestrosafety.appspot.com — Google Cloud C2
appspot.com uzerinde barindirma: meşru bulut hizmetine gizlenme

Google Play Taklidi

Google Play referanslari fazla goruluyor (135 kez!) — Google Play uygulamasini taklit
APK Signing Block mevcut (imzali APK)

Teknik Ozellikler

Ozellik	Valor
Format	Android APK
Tamanho	2.191.141 bayt
VNC Kutuphane	libavnc.so (LibVNCServer)
C2	mastermaestrosafety.appspot.com (Google Cloud)
Ters Baglanti	nreversecon (C2'den cihaza)
Gizlenme	Google Play taklidi

IOC Ozeti

Domain: mastermaestrosafety.appspot.com
SHA256: f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2

Lista IOC (2 indicadores)

IOC — Android VNC RAT

# SHA256
f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2

# DOMAIN
mastermaestrosafety.appspot.com

Tipo	Valor	Nota
sha256	f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2
domain	mastermaestrosafety.appspot.com

Servidores C2 (1 servidores registrados para esta família)

Endereço	Tipo	Porta	Protocolo	Status	País
mastermaestrosafety.appspot.com	domain	443	HTTPS	active	—

Os endereços C2 são fornecidos apenas a partir de amostras de malware verificadas manualmente pela equipe KEYDAL. O uso comercial é proibido.