The Security Researchers of Lookout Company
Yesterday, the Security Researchers of Lookout Company, which is one of the largest Cyber ​​Security companies in America and in the world specializing in Mobile Security, have come up with a report that explains one of the Surveillance Campaigns that I used in the Middle East the period that passed.
The Campaign was a group of Mobile Spywares, shattered on Google Play, starting in January 2018, and up to now for the purpose of spying on users, especially Arabic-speaking users, on Lookout description.


The lookout group found that there are 71 applications raised on Google Play, they all spoke the same C2 Server, and they found that the IP sold by the C2 Server Peshawar on the Infrastructure was shared between a messaging company that is the Internet Service Provider in Syria and the Syrian Telecom Corporation STE.
STE also has a long history, as it works as hosting for the Infrastructure of the Syrian Electronic Army since it is a Hacking Group under the control of the Syrian government.
What is sweet about the topic is that when the group looked at them, they liked to do Static analysis of the applications, they found that when applications were published by the people, the people of the Syrian electronic army forgot to wipe out some of them. The application Peshawar on Path and the Username is clear in the path:
c: \ users \ allosh hacker \ documents \ visual studio 2012 \ Projects \ allosh \ allosh \ obj \ Debug \ Windows.pdb.

What is the purpose of this Malicious Apps?
The group at Lookout said that most of the applications were analyzed and all of them were subscribers to these features:
- The Application takes Screenshot from your mobile phone without your permission and sells it on the C2 Server.

  • -The application will see the Battery Status and is the mobile phone in the charger, or not
  • - The Application of course sold the Report with the current location of the mobile phone
  • - The Application sold List of Installed Applications to the mobile
  • - The Application allows the Threat Actors to strike and run, which application they want in their mood
  • - The Application sold the number of cameras on the mobile
  • - The Application chooses the camera that you like and plays it
  • - The application reports specific pop-up messages to the user
  • The application, of course, records the sound and sells it to the SEA
  • - The Application sells your call logs to your SEA to know who you are talking to and who is calling you.
  • - The Application sold a list of files on the SEA mobile
  • - The application can call any number it determines by its mood
  • - The Application sells all messages to the SEA mobile
  • - The Application sold letters from his brain to specific numbers that he was identifying
  • Of course, the Application sold a list of contacts to the SEA
  • This remains the sources of the news and contains all the details of the topic, including the technical details. Sourse