Android VNC RAT: libavnc.so LibVNCServer, mastermaestrosafety.appspot.com Google Cloud C2, Google Play Taklidi

Genel Bakis

Bu ornek, Android VNC RAT olarak siniflandirilan 2.2MB'lik bir APK. LibVNCServer kutuphanesi (libavnc.so) kullanarak kurban cihazin ekranini gizlice yayin yapan bu malware, mastermaestrosafety.appspot.com Google Cloud uzerinde barindirilan bir C2 adresine baglaniyor. Google Play uygulamasini taklit ederek gizleniyor.

Teknik Analiz

VNC Yayin Yetenekleri

lib/armeabi/libavnc.so — gomulu LibVNCServer kutuphane
rfbInitSockets, rfbHttpInitSockets — VNC socket baslatma
rfbCheckPasswordByList, rfbDecryptPasswdFromFile — sifre dogrulama
rfbEncryptBytes — VNC sifreleme
rfbRegisterProtocolExtension, rfbUnregisterProtocolExtension
start_vnc, Java_de_abr_android_avnc_lib_LvWrapper_nstart_1vnc
nreversecon — ters baglanti modu (C2 cihaza baglanir)

C2 ve Bulut Altyapisi

mastermaestrosafety, mastermaestrosafety.appspot.com — Google Cloud C2
appspot.com uzerinde barindirma: meşru bulut hizmetine gizlenme

Google Play Taklidi

Google Play referanslari fazla goruluyor (135 kez!) — Google Play uygulamasini taklit
APK Signing Block mevcut (imzali APK)

Teknik Ozellikler

Ozellik	Wert
Format	Android APK
Größe	2.191.141 bayt
VNC Kutuphane	libavnc.so (LibVNCServer)
C2	mastermaestrosafety.appspot.com (Google Cloud)
Ters Baglanti	nreversecon (C2'den cihaza)
Gizlenme	Google Play taklidi

IOC Ozeti

Domain: mastermaestrosafety.appspot.com
SHA256: f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2

IOC-Liste (2 Indikatoren)

IOC — Android VNC RAT

# SHA256
f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2

# DOMAIN
mastermaestrosafety.appspot.com

Typ	Wert	Bemerkung
sha256	f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2
domain	mastermaestrosafety.appspot.com

C2-Server (1 erfasste Server für diese Familie)

Adresse	Typ	Port	Protokoll	Status	Land
mastermaestrosafety.appspot.com	domain	443	HTTPS	active	—

C2-Adressen stammen ausschließlich aus vom KEYDAL-Team manuell verifizierten Malware-Samples. Kommerzielle Nutzung ist untersagt.