Lookout Security Intelligence Team Discovery of AzSpy
How Lookout Detects and Protects Against Threats like AzSpy
Lookout Security Intelligence teams leverage both static and dynamic analysis with our machine learning engine to discover new threats. The market for commercial spyware is constantly growing and appeals to more than your standard user – it has been seen in targeted nation state attacks in the past as well. The Lookout team is continuing to monitor this family’s capabilities and any new samples that may be ingested.
Key Facts
- New commercial Android spyware
- Can pull data about device location, storage, and phone number. It also has keylogging capabilities.
- Could be distributed via phishing or URL shorteners
Background and Discovery Timeline
Researchers recently identified a small spyware family which appears to have been created by an Azerbaijani developer. While there are not many samples of this spyware to date, it appears to be part of a new commercial Android spy platform, known as FullSpy for Android, with a user login page to monitor infected devices. The malware pretends to be an application called “Google Services” with a replica Google icon, likely in an attempt to seem innocuous. However, the applications actually contain standard surveillanceware capabilities, and various commands give the actor control over the phone, allowing for exfiltration of sensitive data.
Capabilities and Affected Parties
The spyware can access the phone’s hardware serial number, phone number, battery status, connection type, internal and external storage availability, network operator, GPS location, Android version, and whether the device is rooted. Additionally, it has keylogger functionalities for a hardcoded list of applications like Chrome, Firefox, and Yandex browser.
Aside from uncovering the login pages to manage infected devices, Lookout also discovered another part of the infrastructure that presents itself as a well-designed site to download a program advertised as “Smart Telegram for WordPress”. This site is potentially a watering hole in progress, because while the APK can be downloaded from the site, it is not found through easily clickable links, but rather by knowing the appropriate file path. This could indicate that further development is still needed, or the app is potentially distributed via deep phishing links or URL shorteners.
Authors
Lookout
Lookout, Inc. is the data-centric cloud security company that uses a defense-in-depth strategy to address the different stages of a modern cybersecurity attack. Data is at the core of every organization, and our approach to cybersecurity is designed to protect that data within today’s evolving threat landscape no matter where or how it moves.
.png)
