TF-MAL-apk.furball
📛 Threat Title
Malware family: FurBall
Description
ThreatFox malware family `apk.furball`. Printable name: FurBall.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.furball
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.furball
IOC database
- Type
- domain
- Value
apk.furball- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.furball
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.furball
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:advisory.eventussecurity.com
In an ongoing cyber espionage campaign, the Iranian-backed hacking group domestic kitten also known as APT-C-50 is distributing updated Android malware named Furball for its espionage activities to evade antivirus detection. Furball is programmed to exfiltrate SMS messages, device location, and recordings of phone calls.
-
web:malpedia.caad.fkie.fraunhofer.de
apk. furball (Back to overview) FurBall Propose Change Actor (s): Domestic Kitten According to Check Point, they uncovered an operation dubbed "Domestic Kitten", which uses malicious Android applications to steal sensitive personal information from its victims: screenshots, messages, call logs, surrounding voice recordings, and more.
-
web:openhunting.io
Opensource Threat Hunting & Intelligence (Check Point) The capabilities of the Domestic Kitten malware (which we are calling FurBall ), include: collecting device identifiers, grabbing SMS messages and call logs, surround recording with the device microphone, call recording, stealing media files (such as videos and photos), obtaining a list of installed applications, tracking the device ...
-
web:radar.certfa.com
Threat Overview APT-C-50's Domestic Kitten surveillance operation, linked to the Iranian government, targets over 1,200 Iranian citizens including dissidents, opposition forces, and minorities. Since 2017, ten campaigns delivered the FurBall malware via Iranian blogs, Telegram channels, and SMS links. FurBall collects device data, call logs, SMS messages, and media files, tracking victims ...
-
web:sos-vo.org
Furthermore, multiple cybersecurity firms have reported on Domestic Kitten, which they believe is an Iran-sponsored hacking group. ESET researchers sampled and analyzed the latest FurBall malware version, which has many similarities with previous versions but now includes obfuscation and command-and-control (C2) updates.
-
web:www.breachsense.com
Complete malware remediation now requires addressing both the infected endpoint and the stolen authentication data. Your malware incident response playbook must account for both.
-
web:www.broadcom.com
FurBall is reported to be delivered via SMS messages containing direct links to malware binaries or through malicious mobile apps disguised as legitimate ones. The malware has capabilities to collect a variety of information from the compromised devices but also allows the attackers to execute arbitrary commands on them.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
-
web:www.pcrisk.com
What is FurBall ? FurBall is the name of a malicious program that targets Android Operating Systems (OSes). FurBall operates as spyware - i.e., spies on victims and extracts sensitive data from their devices. According to the findings of ESET's WeLiveSecurity researchers, there is evidence connecting this malware with the Domestic Kitten campaign. These operations are well known to the cyber ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.