BADCALL

Description

(US-CERT) This report provides analysis of four (4) malicious executable files. The first three (3) files are 32-bit Windows executables that function as proxy servers and implement a ‘Fake TLS’ method similar to the behavior described in a previously published NCCIC report, MAR-10135536-B. The fourth file is an Android Package Kit (APK) file designed to run on Android platforms as a fully functioning Remote Access Tool (RAT).

Names

Name
BADCALL

Category

Malware

Type

• Backdoor

Information

• https://www.us-cert.gov/ncas/analysis-reports/ar19-252a

Mitre Attack

• https://attack.mitre.org/software/S0245/

Malpedia

• https://malpedia.caad.fkie.fraunhofer.de/details/apk.badcall
• https://malpedia.caad.fkie.fraunhofer.de/details/win.badcall

Alienvault Otx

• https://otx.alienvault.com/browse/pulses?q=tag:BADCALL

Other Information

Uuid

d8dc5d70-d4ba-42ab-9637-a4cac3b2bb6b

Last Card Change

2020-04-22