Threat video1:00
GhostMap Android ZIP Parser Crash Loop: Detection & IOCs
GhostMap lets a malformed APK trigger a system_server crash loop that survives reboot: 9 detection rules, 11 IOCs and a free Splunk SPL rule.
Read the full threat intel for GhostMap Android ZIP Parser Crash Loop: Detection & IOCs →
Chapters
- 0:00The hookOne malformed APK maps about 16 MB out-of-bounds.
- 0:05The storyA banking dropper crashes analysis tools when installed.
- 0:13Attack pathA third compression method bypasses both Android libraries.
- 0:29AttributionNo threat actor: this was defensive research.
- 0:34Indicators of compromise5 indicators to hunt: 3 file names and 2 paths.
- 0:39MITRE ATT&CK techniques6 ATT&CK techniques, from initial access to impact.
- 0:44Remediation3 steps now: Install apps only from Google Play and other trusted stores.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00One malformed APK maps about 16 MB out-of-bounds.
0:05A banking dropper crashes analysis tools when installed.
0:09System_server restarts repeatedly, surviving reboots.
0:13A third compression method bypasses both Android libraries.
0:18That creates an out-of-bounds mmap past the file end.
0:21Reading the excess triggers SIGBUS.
0:23System_server dies and restarts, surviving reboots indefinitely.
0:30No threat actor: this was defensive research.
0:345 indicators to hunt: 3 file names and 2 paths.
0:396 ATT&CK techniques, from initial access to impact.
0:443 steps now: Install apps only from Google Play and other trusted stores.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.