Threat video1:00
ArcticRAT Android RAT Using xAI Triage: Detection & IOCs
ArcticRAT, once a crypto-app stealer, now uses the xAI API to triage SMS. It has 9 detection rules, 29 IOCs and a free Splunk SPL rule.
Read the full threat intel for ArcticRAT Android RAT Using xAI Triage: Detection & IOCs →
Chapters
- 0:00The hook78 samples.
- 0:04The storyZimperium analyzed 78 samples.
- 0:10Attack pathFake Google Play pages lure victims.
- 0:24AttributionNo threat actor is attributed.
- 0:28Indicators of compromise27 indicators to hunt: 19 IPs, 5 MD5 hashes and 2 package names, and more.
- 0:36MITRE ATT&CK techniques25 ATT&CK techniques, from initial access to impact.
- 0:41Remediation4 steps now: Block the ArcticRAT C2 IP addresses and TCP ports 9999.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:0078 samples. One Android RAT.
0:05Zimperium analyzed 78 samples.
0:07Now it triages data with AI.
0:11Fake Google Play pages lure victims.
0:13It abuses Accessibility Services.
0:16Raw TCP calls home.
0:18It phishes lock screen PINs.
0:20Hidden VNC streams the screen.
0:24No threat actor is attributed. Confidence: low.
0:2927 indicators to hunt: 19 IPs, 5 MD5 hashes and 2 package names, and more.
0:3725 ATT&CK techniques, from initial access to impact.
0:414 steps now: Block the ArcticRAT C2 IP addresses and TCP ports 9999.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.