www.sentinelone.com Open in urlscan Pro
172.67.74.101 Public Scan

Back to summary

URL:
https://www.sentinelone.com/labs/capratube-transparent-tribes-caprarat-mimics-youtube-to-hijack-android-phones/
Submission: On September 19 via api (September 19th 2023, 2:07:50 am UTC) from TR — Scanned from DE

Form analysis
6 forms found in the DOM

GET https://www.sentinelone.com

<form autocomplete="off" method="get" action="https://www.sentinelone.com">
  <fieldset>
    <input type="search" name="s" placeholder="Search ..." value="">
    <button class="search" type="submit">
      <span class="light">
        <img class="lazy icon-search" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='24' height='24'><rect width='100%' height='100%' fill='none'/></svg>" style=""
          data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon-white.svg" alt="Search Icon White" width="24" height="24">
        <img class="lazy icon-down" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='18' height='16'><rect width='100%' height='100%' fill='none'/></svg>" style=""
          data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close.svg" alt="Navigation Close" width="18" height="16">
      </span>
      <span class="dark">
        <img class="lazy icon-search" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='24' height='24'><rect width='100%' height='100%' fill='none'/></svg>" style=""
          data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/search-icon.svg" alt="Search Icon" width="24" height="24">
        <img class="lazy icon-down" src="data:image/svg+xml;utf8,<svg xmlns='http://www.w3.org/2000/svg' width='18' height='16'><rect width='100%' height='100%' fill='none'/></svg>" style=""
          data-src="https://www.sentinelone.com/wp-content/themes/sentinelone/carbine/assets/svg/navigation-close-dark.svg" alt="Navigation Close Dark" width="18" height="16">
      </span>
    </button>
  </fieldset>
</form>

GET https://www.sentinelone.com/

<form role="search" method="get" class="search-form" action="https://www.sentinelone.com/">
  <label>
    <span class="screen-reader-text">Search ...</span>
    <input type="search" class="search-field" placeholder="Search ..." value="" name="s">
  </label>
  <input type="submit" class="search-submit" value="Search">
</form>

<form id="mktoForm_1985" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft bf_form_init" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;" bf_offer_id="1447555792">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 0px;">
          <div class="mktoAsterix">*</div>
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Address" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="City" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="PostalCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="SIC_Code2__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseSID" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Phone" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCompany" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCountry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseState" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseEmployeeRange" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="subIndustry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="dataSource" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountType" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountOwner" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountStatus" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListCampaignCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Subscribe</button></span></div>
  <div class="marketo-legal">By clicking Subscribe, I agree to the use of my personal data in accordance with SentinelOne <a href="https://www.sentinelone.com/legal/privacy-policy/">Privacy Policy</a>. SentinelOne will not sell, trade, lease, or rent
    your personal data to third parties.</div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="1985"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="327-MNM-087">
</form>

<form id="mktoForm_2673" novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft bf_form_init" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); width: 1601px;" bf_offer_id="1447582667">
  <style type="text/css"></style>
  <div class="mktoFormRow">
    <div class="mktoFieldDescriptor mktoFormCol" style="margin-bottom: 5px;">
      <div class="mktoOffset" style="width: 5px;"></div>
      <div class="mktoFieldWrap mktoRequiredField"><label for="Email" id="LblEmail" class="mktoLabel mktoHasWidth" style="width: 0px;">
          <div class="mktoAsterix">*</div>
        </label>
        <div class="mktoGutter mktoHasWidth" style="width: 5px;"></div><input id="Email" name="Email" placeholder="Business Email" maxlength="255" aria-labelledby="LblEmail InstructEmail" type="email"
          class="mktoField mktoEmailField mktoHasWidth mktoRequired" aria-required="true" style="width: 150px;"><span id="InstructEmail" tabindex="-1" class="mktoInstruction"></span>
        <div class="mktoClear"></div>
      </div>
      <div class="mktoClear"></div>
    </div>
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Employees__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Industry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="AnnualRevenue" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Address" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="City" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="PostalCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="SIC_Code2__c" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Website" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseSID" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="Phone" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCompany" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseCountry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseState" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="demandbaseEmployeeRange" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="subIndustry" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="dataSource" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountType" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountOwner" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListAccountStatus" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoFormRow"><input type="hidden" name="watchListCampaignCode" class="mktoField mktoFieldDescriptor mktoFormCol" value="" style="margin-bottom: 5px;">
    <div class="mktoClear"></div>
  </div>
  <div class="mktoButtonRow"><span class="mktoButtonWrap mktoNative" style="margin-left: 110px;"><button type="submit" class="mktoButton">Subscribe</button></span></div>
  <div class="marketo-legal">By clicking Subscribe, I agree to the use of my personal data in accordance with SentinelOne <a href="https://www.sentinelone.com/legal/privacy-policy/">Privacy Policy</a>. SentinelOne will not sell, trade, lease, or rent
    your personal data to third parties.</div><input type="hidden" name="formid" class="mktoField mktoFieldDescriptor" value="2673"><input type="hidden" name="munchkinId" class="mktoField mktoFieldDescriptor" value="327-MNM-087">
</form>

<form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

<form novalidate="novalidate" class="mktoForm mktoHasWidth mktoLayoutLeft" style="font-family: inherit; font-size: 13px; color: rgb(51, 51, 51); visibility: hidden; position: absolute; top: -500px; left: -1000px; width: 1600px;"></form>

Text Content

🔥 LABScon 2023, Sept 20-23: Where cybersecurity expertise meets real-time
research.
View the talks and request your invite now. Avoid the FOMO. 🔥

 * 
 * 


 * ABOUT
 * CVE DATABASE
 * CONTACT
 * VISIT SENTINELONE.COM

en
 * English
 * 日本語
 * Deutsch
 * Español
 * Français
 * Italiano
 * Dutch
 * 한국어


Get a Demo

Back

 * ABOUT
 * CVE DATABASE
 * CONTACT
 * VISIT SENTINELONE.COM

Get a Demo

Advanced Persistent Threat


CAPRATUBE | TRANSPARENT TRIBE’S CAPRARAT MIMICS YOUTUBE TO HIJACK ANDROID PHONES

Alex Delamotte / September 18, 2023


EXECUTIVE SUMMARY

 * SentinelLabs identified three Android application packages (APK) linked to
   Transparent Tribe’s CapraRAT mobile remote access trojan (RAT).
 * These apps mimic the appearance of YouTube, though they are less fully
   featured than the legitimate native Android YouTube application.
 * CapraRAT is a highly invasive tool that gives the attacker control over much
   of the data on the Android devices that it infects.


BACKGROUND

Transparent Tribe is a suspected Pakistani actor known for targeting military
and diplomatic personnel in both India and Pakistan, with a more recent
expansion to the Indian Education sector. Since 2018, reports have detailed the
group’s use of what is now called CapraRAT, an Android framework that hides RAT
features inside of another application. The toolset has been used for
surveillance against spear-phishing targets privy to affairs involving the
disputed region of Kashmir, as well as human rights activists working on matters
related to Pakistan.

Transparent Tribe distributes Android apps outside of the Google Play Store,
relying on self-run websites and social engineering to entice users to install a
weaponized application. Earlier in 2023, the group distributed CapraRAT Android
apps disguised as a dating service that conducted spyware activity.

One of the newly identified APKs reaches out to a YouTube channel belonging to
Piya Sharma, which has several short clips of a woman in various locales. This
APK also borrows the individual’s name and likeness. This theme suggests that
the actor continues to use romance-based social engineering techniques to
convince targets to install the applications, and that Piya Sharma is a related
persona.

CapraRAT is a comprehensive RAT that provides the actors with the ability to
harvest data on demand and exfiltrate it. Notable features include:

 * Recording with the microphone, front & rear cameras
 * Collecting SMS and multimedia message contents, call logs
 * Sending SMS messages, blocking incoming SMS
 * Initiating phone calls
 * Taking screen captures
 * Overriding system settings such as GPS & Network
 * Modifying files on the phone’s filesystem


APP ANALYSIS

CapraRAT is distributed as an Android APK. When the tool was initially named by
Trend Micro, their research team noted that CapraRAT may be loosely based on the
AndroRAT source code.

We performed static analysis on two YouTube-themed CapraRAT APKs:
8beab9e454b5283e892aeca6bca9afb608fa8718 – yt.apk, uploaded to VirusTotal in
July 2023. 83412f9d757937f2719ebd7e5f509956ab43c3ce – YouTube_052647.apk,
uploaded to VirusTotal in August 2023. We also identified a third APK called
Piya Sharma, the YouTube channel persona described earlier:
14110facecceb016c694f04814b5e504dc6cde61 – Piya Sharma.apk, uploaded to
VirusTotal in April 2023

The yt and YouTube APKs apps are disguised as YouTube, borrowing the YouTube
icon.

Applications icons on an Android device, including YouTube_052647.apk
Application icons, including the Piya Sharma app YouTube_052647.apk displays the
YouTube website when launched

The app requests several permissions. YouTube is an interesting choice for
masquerading the app: some permissions, like microphone access, make sense for
recording or search features. Other permissions–like the ability to send and
view SMS–are less relevant to the expected app behaviors.




Permissions prompts during install of the weaponized YouTube app



Installation permissions requested by the Piya Sharma APK

When the app is launched, MainActivity’s load_web method launches a WebView
object to load YouTube’s website. Because this loads within the trojanized
CapraRAT app’s window, the user experience is different from the native YouTube
app for Android and akin to viewing the YouTube page in a mobile web browser.

Smali snippet of the load_web method in MainActivity


KEY COMPONENTS

Because CapraRAT is a framework inserted into a variety of Android applications,
the files housing malicious activity are often named and arranged differently
depending on the app. The CapraRAT APKs we analyzed contain the following files:

Name yt.apk Configuration com/media/gallery/service/settings Version MSK-2023
Main com/media/gallery/service/MainActivity Malicious Activity
com/media/gallery/service/TPSClient

Name YouTube_052647.apk Configuration com/Base/media/service/setting Version
A.F.U.3 Main com/Base/media/service/MainActivity Malicious Activity
com/Base/media/service/TCHPClient

Name Piya Sharma.apk Configuration com/videos/watchs/share/setting Version
V.U.H.3 Main com/videos/watchs/share/MainActivity Malicious Activity
com/videos/watchs/share/TCPClient

CapraRAT’s configuration file, which is named interchangeably setting or
settings, holds the default configuration information, as well as metadata like
versioning. The CapraRAT version syntax seen in YouTube_052647.apk and Piya
Sharma.apk–A.F.U.3 and V.U.H.3, respectively–matches the convention used to
track Transparent Tribe’s Windows tool, CrimsonRAT. However, there is no
tangible relationship between these version numbers and the C2 domains as we saw
in CrimsonRAT.

Thanks to creative spelling and naming conventions, the RAT’s configuration
provides consistent static detection opportunities, with each of the following
present in the samples from earlier in 2023 as well:

 	is_phical
 	isCancl
 	isRealNotif
 	SERVERIP
 	smsMoniter
 	smsWhere
 	verion


MainActivity is responsible for driving the application’s key features. This
activity sets persistence through the onCreate method which uses Autostarter, an
open-source project with code that lets developers automatically launch an
Android application. The TPSClient class is initialized as an object called
mTCPService; then, this method calls the serviceRefresh method, which creates an
alarm at the interval specified in the settings file’s timeForAlarm variable. In
this example, the value 0xea60 is equal to 60,000 milliseconds, meaning the
alarm and persistence launcher run once per minute.

The RAT’s core functionality is in an activity similar to the Extra_Class
activity from the March 2023 samples reported by ESET. Henceforth, we call this
activity TPSClient for simplicity. These files are rather large, decompiling to
over 10,000 lines of Smali code. By comparison, the March versions’ equivalents
have only about 8,000 lines.

TPSClient contains CapraRAT’s commands, which are invoked through the run method
via a series of switch statements that map the string command to a related
method.

The smsmons command logic inside the run method of TPSClient

Many of these commands have been documented in previous research, though there
are several changes in these new versions. The hideApp method now checks if the
system is running Android version 9 or earlier and if the mehiden variable in
the setting(s) config file was set to False; if applicable, the app will be
hidden from the user’s view. While similarities between CapraRAT and AndroRAT
are seemingly minimal at this point in CapraRAT’s development, the AndroRAT
source code documentation notes that the tool becomes unstable after Android
version 9, so there are likely underlying changes to the OS that make this
method behave differently depending on the OS version.

TPSClient has a method check_permissions() that is not in Extra_Class. This
method checks the following series of Android permissions and generates a string
with a True or False result for each:

 * READ_EXTERNAL_STORAGE
 * READ_CALL_LOG
 * CAMERA
 * READ_CONTACTS
 * ACCESS_FINE_LOCATION
 * RECORD_AUDIO
 * READ_PHONE_STATE

Interestingly, some other older versions contain this method, suggesting that
the samples may be tailored for targets or are potentially developed from
different branches.


C2 & INFRASTRUCTURE

In CapraRAT’s configuration file, the SERVERIP variable contains the
command-and-control (C2) server address, which can be a domain, IP address, or
both. The C2 port is in hexadecimal Big Endian format; the human readable port
can be obtained by converting into decimal, resulting in port 14862 for yt.apk,
port 18892 for YouTube_052647.apk, and port 10284 for Piya Sharma.apk.

C2 configuration from yt.apk (left) and YouTube_052647.apk (right)

The shareboxs[.]net domain used by YouTube_052647.apk has been associated with
Transparent Tribe since at least 2019. Interestingly, the ptzbubble[.]shop
domain was registered the same week of ESET’s report outlining the group’s
Android apps that leveraged other C2 domains.

The IP addresses associated with C2 from the two YouTube samples have Remote
Desktop Protocol port 3389 open with the service identified as Windows Remote
Desktop, indicating the group uses Windows Server infrastructure to host the
CapraRAT C2 application. The Piya Sharma app’s C2 IP, 209[.]127.19.241, has a
certificate with common name value WIN-P9NRMH5G6M8, a longstanding indicator
associated with Transparent Tribe’s CrimsonRAT C2 servers.

84[.]46.251.145–the IP address hosting ptzbubble[.]shop domain–shows historical
resolutions associated with Decoy Dog Pupy RAT DNS tunneling lookups. Any
connection between these campaigns is unclear; it is plausible that a service
hosted on this IP was infected by that campaign. Based on the query dates, the
claudfront[.]net lookup was during the time the CapraRAT actor was using this IP
address to host ptzbubble[.]shop, while a lookup to allowlisted[.]net was in
December 2022, which was potentially before this actor started using the IP.

Resolution history for IP hosting ptzbubble[.]shop, 84[.]46.251.145


CONCLUSION

Transparent Tribe is a perennial actor with reliable habits. The relatively low
operational security bar enables swift identification of their tools.

The group’s decision to make a YouTube-like app is a new addition to a known
trend of the group weaponizing Android applications with spyware and
distributing them to targets through social media.

Individuals and organizations connected to diplomatic, military, or activist
matters in the India and Pakistan regions should evaluate defense against this
actor and threat.

Defensive and preventative measures should include:

 * Do not install Android applications outside of the Google Play store.
 * Be wary of new social media applications advertised within social media
   communities.
 * Evaluate the permissions requested by an application, particularly an
   application you are not particularly familiar with. Do these permissions
   expose you to more risk than the potential benefit of the app?
 * Do not install a third-party version of an application already on your
   device.


INDICATORS OF COMPROMISE (IOC)

Files Hashes – SHA1
14110facecceb016c694f04814b5e504dc6cde61 – Piya Sharma APK
83412f9d757937f2719ebd7e5f509956ab43c3ce – CapraRAT, YouTube_052647.apk
8beab9e454b5283e892aeca6bca9afb608fa8718 – CapraRAT, yt.apk

C2 Network Communications
newsbizshow.net
ptzbubble.shop
shareboxs.net

95[.]111.247.73
209[.]127.19.241

apt
Mobile Malware


SHARE

PDF

ALEX DELAMOTTE

Alex's passion for cybersecurity is humbly rooted in the early aughts, when she
declared a vendetta against a computer worm. Over the past decade, Alex has
worked with blue, purple, and red teams serving companies in the technology,
financial, pharmaceuticals, and telecom sectors and she has shared research with
several ISACs. Alex enjoys researching the intersection of cybercrime and
state-sponsored activity. She relentlessly questions why actors pivot to a new
technique or attack surface. In her spare time, she can be found DJing or
servicing her music arcade games.

Prev

BLOATED BINARIES | HOW TO DETECT AND ANALYZE LARGE MACOS MALWARE FILES


RELATED POSTS


JUMPCLOUD INTRUSION | ATTACKER INFRASTRUCTURE LINKS COMPROMISE TO NORTH KOREAN
APT ACTIVITY

July 20 2023


KIMSUKY STRIKES AGAIN | NEW SOCIAL ENGINEERING CAMPAIGN AIMS TO STEAL
CREDENTIALS AND GATHER STRATEGIC INTELLIGENCE

June 06 2023


KIMSUKY EVOLVES RECONNAISSANCE CAPABILITIES IN NEW GLOBAL CAMPAIGN

May 04 2023


SEARCH

Search ...


SIGN UP

Get notified when we post new content.

*
























Subscribe
By clicking Subscribe, I agree to the use of my personal data in accordance with
SentinelOne Privacy Policy. SentinelOne will not sell, trade, lease, or rent
your personal data to third parties.

Thanks! Keep an eye out for new content!


RECENT POSTS

 * Bloated Binaries | How to Detect and Analyze Large macOS Malware Files
   August 29, 2023
 * Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector
   August 17, 2023
 * Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile
   Engineering Company
   August 7, 2023


LABS CATEGORIES

 * Crimeware
 * Security Research
 * Adversary
 * Advanced Persistent Threat
 * LABScon
 * Security & Intelligence


SENTINELLABS

In the era of interconnectivity, when markets, geographies, and jurisdictions
merge in the melting pot of the digital domain, the perils of the threat
ecosystem become unparalleled. Crimeware families achieve an unparalleled level
of technical sophistication, APT groups are competing in fully-fledged cyber
warfare, while once decentralized and scattered threat actors are forming
adamant alliances of operating as elite corporate espionage teams.


LATEST TWEET

Could not authenticate you.


RECENT POSTS

 * Bloated Binaries | How to Detect and Analyze Large macOS Malware Files
   August 29, 2023
 * Chinese Entanglement | DLL Hijacking in the Asian Gambling Sector
   August 17, 2023
 * Comrades in Arms? | North Korea Compromises Sanctioned Russian Missile
   Engineering Company
   August 7, 2023


SIGN UP

Get notified when we post new content.

*
























Subscribe
By clicking Subscribe, I agree to the use of my personal data in accordance with
SentinelOne Privacy Policy. SentinelOne will not sell, trade, lease, or rent
your personal data to third parties.

Thanks! Keep an eye out for new content!

 * Twitter
 * LinkedIn

©2023 SentinelOne, All Rights Reserved.







PRIVACY PREFERENCE CENTER

When you visit any website, it may store or retrieve information on your
browser, mostly in the form of cookies. This information might be about you,
your preferences or your device and is mostly used to make the site work as you
expect it to. The information does not usually directly identify you, but it can
give you a more personalized web experience. Because we respect your right to
privacy, you can choose not to allow some types of cookies. Click on the
different category headings to find out more and change our default settings.
However, blocking some types of cookies may impact your experience of the site
and the services we are able to offer.
More information
Allow All


MANAGE CONSENT PREFERENCES

FUNCTIONAL COOKIES

Functional Cookies

These cookies enable the website to provide enhanced functionality and
personalisation. They may be set by us or by third party providers whose
services we have added to our pages. If you do not allow these cookies then some
or all of these services may not function properly.

STRICTLY NECESSARY COOKIES

Always Active

These cookies are necessary for the website to function and cannot be switched
off in our systems. They are usually only set in response to actions made by you
which amount to a request for services, such as setting your privacy
preferences, logging in or filling in forms. You can set your browser to block
or alert you about these cookies, but some parts of the site will not then work.
These cookies do not store any personally identifiable information.

PERFORMANCE COOKIES

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and
improve the performance of our site. They help us to know which pages are the
most and least popular and see how visitors move around the site. All
information these cookies collect is aggregated and therefore anonymous. If you
do not allow these cookies we will not know when you have visited our site, and
will not be able to monitor its performance.

TARGETING COOKIES

Targeting Cookies

These cookies may be set through our site by our advertising partners. They may
be used by those companies to build a profile of your interests and show you
relevant adverts on other sites. They do not store directly personal
information, but are based on uniquely identifying your browser and internet
device. If you do not allow these cookies, you will experience less targeted
advertising.

Back Button Back



Vendor Search Search Icon
Filter Icon

Clear
checkbox label label
Apply Cancel
Consent Leg.Interest
checkbox label label
checkbox label label
checkbox label label

Confirm My Choices


By clicking “Accept All Cookies”, you agree to the storing of cookies on your
device to enhance site navigation, analyze site usage, and assist in our
marketing efforts.

Cookies Settings Accept All Cookies


We'd like to show you notifications for the latest news and updates.


AllowCancel

www.sentinelone.com Open in urlscan Pro 172.67.74.101 Public Scan

Form analysis 6 forms found in the DOM

GET https://www.sentinelone.com

GET https://www.sentinelone.com/

Text Content

www.sentinelone.com Open in urlscan Pro
172.67.74.101 Public Scan

Form analysis
6 forms found in the DOM