Triout
Malware family · 6 sample(s) · 6 indicator record(s) · 1 signing certificate(s) · Active 2019-03-21 → 2019-03-23 (experimental)
About Triout
Spyware framework with extensive surveillance capabilities, distributed disguised as adult apps (com.xapps.SexGameForAdults). The C2 is a const-string in the of psp/jsp/datamd/v; - either plainly readable (contains “.”) or Caesar-shifted by +1 (a “/” marks the shifted flavor; shift back one to recover it).
Indicators
| Indicator | Type | Sample | First seen |
|---|---|---|---|
| 188.165.28.251 | ip | 0585702e00fc… | 2019-03-23 |
| 188.165.28.251 | ip | e0c1d15b86a6… | 2019-03-22 |
| 188.165.28.251 | ip | 43046a925c47… | 2019-03-21 |
| 188.165.28.251 | ip | b72a67a1c6f8… | 2019-03-21 |
| 188.165.28.251 | ip | f198deeca3fb… | 2019-03-21 |
| 188.165.28.251 | ip | 4f05b0943066… | 2019-03-21 |