Movatterモバイル変換

eSurv

eSurv is mobile surveillanceware designed for the lawful intercept market that was developed over the course of many years.^[1]

ID: S0507

ⓘ

Type: MALWARE

ⓘ

Platforms: Android, iOS

Version: 1.1

Created: 14 September 2020

Last Modified: 29 March 2024

Version Permalink

Mobile Layer

Techniques Used

Domain	ID		Name	Use
Mobile	T1429		Audio Capture	eSurv can record audio.^[1]
Mobile	T1533		Data from Local System	eSurv can exfiltrate device pictures.^[1]
Mobile	T1407		Download New Code at Runtime	eSurv’s Android version is distributed in three stages: the dropper, the second stage payload, and the third stage payload which isExodus.^[1]
Mobile	T1521	.002	Encrypted Channel:Asymmetric Cryptography	eSurv’s Android version has used public key encryption for C2 communication.^[1]
		.003	Encrypted Channel:SSL Pinning	eSurv’s Android version has used certificate pinning for C2 communication.^[1]
Mobile	T1627	.001	Execution Guardrails:Geofencing	eSurv imposes geo-restrictions when delivering the second stage.^[1]
Mobile	T1646		Exfiltration Over C2 Channel	eSurv has exfiltrated data using HTTP PUT requests.^[1]
Mobile	T1430		Location Tracking	eSurv can track the device’s location.^[1]
Mobile	T1636	.003	Protected User Data:Contact List	eSurv can exfiltrate the device’s contact list.^[1]
Mobile	T1426		System Information Discovery	eSurv’s iOS version can collect device information.^[1]

References

A. Bauer. (2019, April 8). Lookout discovers phishing sites distributing new iOS and Android surveillanceware. Retrieved September 11, 2020.

×

[8]ページ先頭

©2009-2026 Movatter.jp