android spyware

Confucius New Spyware Linked to India-Pakistan Conflict

Introduction

Lookout researchers discovered two new types of Android surveillance software: and SunBird. These surveillance are used by Confucius APT . Confucius first appeared in 2013. It is a hacker group with Indian national background and its main target is Pakistan and other South Asian regions.

The targets of these include personnel related to the Pakistani military, nuclear authorities, and Kashmir Indian election officials.  and SunBird have sophisticated functions that can extract the encrypted message content and geographic location of SMS, applications, and other types of sensitive information.


confucius hornbill and sunbird

Malicious features of SunBird and

SunBird has a remote access Trojan horse (RAT) function, while Hornbill is a cautious monitoring tool used to extract sensitive data.

Both types of malware can leak large amounts of data, such as:

  • call records
  • Contact person
  • Phone number, IMEI/Android ID, model and manufacturer, and Android version
  • Location
  • Stored pictures
  • WhatsApp voice

Both types of malware can also perform the following actions on the device:

  • Request device administrator permissions
  • Screenshot
  • Take pictures with the device camera
  • Record the environment and call audio
  • Get WhatsApp messages and contacts through accessibility
  • Get WhatsApp notifications through accessibility features

SunBird features

SunBird has more malicious features. It attempts to periodically upload data that it has access to to its command and control (C2) server. The victim’s data is collected in a SQLite database and then compressed into a ZIP file when uploaded to the C2 infrastructure.

Hornbill features

In contrast, Hornbill is more like a passive reconnaissance tool. The malware only uploads data when it is initially run, not at regular intervals like SunBird. The data collected by Hornbill is stored in a hidden folder in external storage. Once the call recordings or audio recordings are uploaded to the C2 infrastructure, they will be deleted from the device to avoid suspicion.

confucius new spyware linked to india-pakistan conflict

IOCs

23.82.19[.]250
184.154.203[.]90
69.175.35[.]98
pieupdate[.]online
chatk.goldenbirdcoin[.]com
cucuchat[.]com
samaatv[.]online
tea-time[.]link
data10.000webhostapp[.]com
global134.000webhostapp[.]com
wixten.000webhostapp[.]com
sunshinereal.000webhostapp[.]com
e98b3df01b001a7cd8ff100bd65ac67c
97c12ee4d59af04e64f5dae9bc5a92f5
24767cf4175dfa56e32add9ff2f30074
85c157f182033e5999c60dc13a970fae
542549a5c39cb4e5c1bc86c1218854ba
23b65624a76a76aeed5e5ef6c0193d99
12f2de45996193308bba54bad36d8161
5096e026de33e6f50c8f300dd962d8bf
e62cfc995f8e3969e03427ee80343482
2b5cacb40496d10bd26ddca104e2654b
8b4b967aedccd0f1b21a3a061c19931c
c20d9820aacc5e7ff1b695243a127c6f
5ef8141b587b93d6f3ee1aa8cc4462f6
ff501ad25de38de5fcd63700c76a11a8
f659b0ea432adcfcffd4932ecd50197a
871d7972616ce32f28545efd6b1c137d
4c1dd98caa88db24eb5504e95f8c5c2e
20e57ef23b828e1f966851cb4d24dc22
d553de4ba8af81c9fe02a75a2e1e0637
34125e25b269b5a775eadc3a759621b5
e05fa4663e1af93fd3058b537dd70e17
6536e404a8621ac51a5f7f2e2474b77d
3447dc3890c8f232a4968113c18c2f78
76a673d12d24b62abdd972841c2a28d6
403afaec02f45686858a0f5bc81c255e
0f88ccd9a2837016f88ec43b6f7507dc
fab0fd5058254da0d613135f93ba514b
5a139982345e70d9af67091ecd88a63f
8f569f9d247b120a229fb90fb3353343
7c60b7b4d15b0451b12f7bf6a8b8a8ac
a0b2c7449e44b456515375dd706cd563
9e685d071b5d97a701d03fe6cfde3d5f
eec36f55eb121eb662986b7959bbc915
99dd07614da9ae5b455326380ddca7ff
b6b239ccef57a261a254f5167357dc9096618939
1f1bab3c5a60275384083ef9e2a5b9fe6c194a35
704579a14a2ee80c89ad12019e19e50eb27dffea
3372458b73d3d5c3957a75dfe6cff62c5cd3cd4f
77867ddb68b68a340ccdb79bd9d46281d5956fa5
c504cef5e0e04b15d21388e6f9cc2c320071d50b
0cc49097778372fdf1ba2143e31a8f235342f9c9
9b684cff07f98083bdb085cb846929ebca2c3df1
2ecb5b88b12ba44cfce2f51df7f16fbd4754aea2
665d23eda84cd008ccde013bde6a836976bcc4fc
a38931d68b26f04a94241f2155bcbf465b3fa99a
df5188225ab6de0a6e71635e997c4473c02d6527
e01729e5ceb827318e5198a24a12ae6d6bbc4ab3
8ae67888befb4f01f216d94f07051fc047150ceb
41268c45dc2453469ea8a0a0c615bdb562d1d9de
a4161cfe2d6146566094ee979ea893cd2fe3ae72
03d199cff2be8667932933d1bcb6bb58d364545a
fc2929a021ca1e83f0d87ca9c9c85df0057373e5
a6128100cd9c505e12af16a163d4fea35c42808a
6b75e6df7744a232a350658ad06e9574483a0b8b
be524a5a42b4b3f48f5571311f9be683024b6939
2fd402c23f6827c049b92af19d4815c03cde407f
b847ffa3d097c9eb1ddfc0dd3133582988fde885
9b10e71f3d38e73d3637bf14d93404175bf4c276
ae1cd2a583082eeb540c567a051135d5147e97db
a0ed91b759a0015145ab301a3bba8f6cd868b394
afdc1db55e84e868e8ecdb3489309e1e19453779
27cabf2a24a87324f922becd5ae2dcf7bf4ae4bd
6779ebdd14113ce304172b078d859684248ee114
6bb91b2b97f08eb116982a5039d859ada94c37fd
e3cd30bbc7e9e0b8c4275c4d2b8ac876a7fc9b9b
07f1b2d8b34ce31296f6f5fe336ebae90293119e
15e18ac163275bdcf8e391a90127db5206ab4fdd
a5224bf9444736970dc357da3b309ad089aa7912
257bb82955818c1b3e2fc9581475c3d71df489e6
fde11af0c9ede7ad1f2b4e8bd6d55c1ef90eff72
01a91eb4cf0a8cfd048d98d3006e7b39a3d61f81
a843bc9bc76935886b7cddebb49d15797d87b32e890ff324f15a4831e69117c4
7c0049a97bfe039137de32496c6785e0b5071a20fc8712aa61865c8e1edfe109
44369e95eeb231a6357e19b4e25cb63c6b4a22b996e59ab9818457b11cc51edc
f2b237e2712dd64435f4a2015540899c6f5c8143247bae1f08ca720c6ca8a734
e417aaf51b265a8c9632ce892160fb57d14fe94a7f5a355db940a6cf84db1522
fd6ec7c28d8ded04f5df6a4391c58c98e9fc00bd1d07b1d62aa928a7664c1cb1
10ef8bd4287ada30a74cb5d10f23fae496fb5fafebc9e440d76e5214268c5ed7
4e044d850d3e1bf2929301ae3145842d49bc28a8af6a780b6e826f305fcda003
e9762f181a416e02ac8c3623da827ab8a858baed51e8884c4899a34d54544868
ad9116e592ec89cf795a946e85701d1acdd0397b3b59e3f0d62efb697aa54c26
b849b10a07719aadbf5a1a5307699af86b274d8c466f0c4aafeb40e27a10cbc5
3825c9b32f94988a3426b2d6c89dac18f54958c8b7a683365d2f6e9c96bedf5e
26e26961542e625a3203f2078e0a4ff1e10f63a8c635bc0d2d26c9acd7952607
b5875d6a29f2627e9eaef323e4593d6625f4ed24070d2996e2001d1e985e95fb
303af8a84def41eb797043eb323b0e8ff8bb9386955880588a7272905a7574bb
85e3e04826756e02e5a14bbeae555df23ab986641190b600c627dc4f7e468af6
5d0bea134e387d3b33085ad0b391bd58cd0e7fddf45e21d23862345f1e28914a
5e13410fa9dea72af217f26527f553c432b7bef2a34e6c9df8b0b86c48e3016c
311b661a411433ae27efe4d9cec87a5699d70fc54ed4d897113947a394c3fecd
9fb1ea32d332b023cfca2d4ca52a4bf5b66689ff4206f5e2733abadca3f29a7f
b0b90abff8a2eb5ba7c6d2c346fabc0f8f6a0034b6189a87f723e11fcd554511
23c0e06aae4e0662c4f88d0c079cdda5e8005f46896f7a5ba52e414db7c8efa5
6ca7fda71126ce64d3263e6e1471eda0921ce3796e71f89e40c1073fcc81a213
f9d66d0bd54f4622a40cf6ce219e5ada87ac08751f0fff932ce60128cedc9f2f
08f6c0253a924f3a9e356d5f574d09697399d7ea7e748f85e77bef6a03763f1c
a8e32546684f5332d09346d64566bd89556b3a83d213b924a3d378c7309453d7
85d4eea8f2064fce43aae845d5685f300d1c93e52033df4e4e8b88e57a6abad2
2bb1fa6fcf2e98362bffae651fb8cf9b5b9b42bee74cefebbd6185d0edd2ec0b
e9b65d94acceb6b3452c80563dbe2a6c9db5a3ba3396ce69ea35f22e7532d491
2ff950b3519facc3c8b50475f13daa440a73bb50b6099c0188ea587f83dfc937
b25fec26920d7cadf372ff488c2312eb82bd15e4c2aa0ab2b3b9ca0d7a8ab789
2af10722c0263417808f55965f1993ea9a51f3c1de344d90a21ce6ae03cab5f5
87211d049676200ba655b406bf745d300e09dc29c14ac9a04a388da51feb7ba9
b53a4688b9525368a72d309329d178353c9ab374ac0b4a047cd0545635602be1