TF-MAL-apk.henbox
📛 Threat Title
Malware family: HenBox
Description
ThreatFox malware family `apk.henbox`. Printable name: HenBox.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
apk.henbox
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.henbox
IOC database
- Type
- domain
- Value
apk.henbox- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-apk.henbox
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/apk.henbox
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
HenBox is Android malware that attempts to only execute on Xiaomi devices running the MIUI operating system. HenBox has primarily been used to target Uyghurs, a minority Turkic ethnic group.
-
web:exchange.xforce.ibmcloud.com
Palo Alto's Unit 42 takes a deep dive into Henbox , a new Android malware family named " HenBox ". HenBox decoys itself as popular Android software, such as VPN apps, however the malicious apps themselves are found on third-party sites, not on the Google Play store.
-
web:learn.microsoft.com
Remediate security weaknesses discovered through security recommendations, and create exceptions if needed, in Defender Vulnerability Management.
-
web:malpedia.caad.fkie.fraunhofer.de
HenBox (Back to overview) This threat actor targets Uighurs—a minority ethnic group located primarily in northwestern China—and devices from Chinese mobile phone manufacturer Xiaomi, for espionage purposes.
-
web:openhunting.io
The stolen information includes personal and device information. Of note, in addition to tracking the compromised device's location, HenBox also harvests all outgoing phone numbers with an "86" prefix, which is the country code for the People's Republic of China (PRC). It can also access the phone's cameras and microphone.
-
web:threatintelligence.garden.handsomezebra.com
HenBox Description (Palo Alto) Once installed, HenBox steals information from the devices from a myriad of sources, including many mainstream chat, communication, and social media apps.
-
web:unit42.paloaltonetworks.com
Unit 42 discovers HenBox , an Android Malware family masquerading as legitimate apps on third-party app stores.
-
web:www.breachsense.com
Malware incident response is the coordinated process of identifying, containing, eradicating, and recovering from malware infections. It includes isolating infected systems, analyzing the malware's behavior, remediating affected accounts, and implementing controls to prevent reinfection.
-
web:www.cisa.gov
It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.
-
web:www.ncsc.gov.uk
How to defend organisations against malware or ransomware attacks.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.