{"Event":{"info":"OSINT - Malicious applications stayed at Google Appstore for months","Tag":[{"colour":"#211c1c","exportable":true,"name":"Android Malware"},{"colour":"#001a40","exportable":true,"name":"ms-caro-malware-full:malware-platform=\"AndroidOS\""},{"colour":"#ffffff","exportable":true,"name":"tlp:white"},{"colour":"#00223b","exportable":true,"name":"osint:source-type=\"blog-post\""},{"colour":"#850048","exportable":true,"name":"workflow:todo=\"create-missing-misp-galaxy-cluster-values\""}],"publish_timestamp":"0","timestamp":"1521797622","analysis":"2","Attribute":[{"comment":"","category":"External analysis","uuid":"5ab38865-2bf4-47ff-bed8-4cd4950d210f","timestamp":"1521796197","to_ids":false,"value":"https://blog.fosec.vn/malicious-applications-stayed-at-google-appstore-for-months-d8834ff4de59","Tag":[{"colour":"#00223b","exportable":true,"name":"osint:source-type=\"blog-post\""}],"disable_correlation":false,"object_relation":null,"type":"link"},{"comment":"","category":"External analysis","uuid":"5ab4c44e-68e0-4c6b-a64b-4e95950d210f","timestamp":"1521796188","to_ids":false,"value":"According to estimates from downloads, at least 640,000 and at most 2.6 million Android subscribers have been infected with this malicious code. If the subscription price is just 0.1$/day, then every day the subscriber was hooked 64.000$-260.000$, so no one knows how many USD a year.","Tag":[{"colour":"#00223b","exportable":true,"name":"osint:source-type=\"blog-post\""}],"disable_correlation":false,"object_relation":null,"type":"comment"},{"comment":"C&C","category":"Network activity","uuid":"5ab4c654-02e8-4593-a7b0-469e950d210f","timestamp":"1521796692","to_ids":true,"value":"139.162.12.9","disable_correlation":false,"object_relation":null,"type":"ip-dst"},{"comment":"","category":"Network activity","uuid":"5ab4c66d-2c44-4d7b-ac13-442f950d210f","timestamp":"1521796717","to_ids":true,"value":"gamestore.vn/?page=wapreg&mm=2201","disable_correlation":false,"object_relation":null,"type":"url"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-a8e0-4032-a804-4d10950d210f","timestamp":"1521797111","to_ids":true,"value":"vn.lichvannien.lichamduongvietnam","disable_correlation":false,"object_relation":null,"type":"filename"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-4b34-447f-b729-490a950d210f","timestamp":"1521797111","to_ids":true,"value":"com.antivirus.virusremover.security","disable_correlation":false,"object_relation":null,"type":"filename"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-e1d0-4f47-87b0-4aff950d210f","timestamp":"1521797111","to_ids":true,"value":"com.weatherforecast.weatherwidget","disable_correlation":false,"object_relation":null,"type":"filename"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-b048-4be2-a6a6-406b950d210f","timestamp":"1521797111","to_ids":true,"value":"com.captain.qrcodescanner.barcodescannerreader","disable_correlation":false,"object_relation":null,"type":"filename"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-81e0-4f35-ab10-44ea950d210f","timestamp":"1521797111","to_ids":true,"value":"com.captainstudio.musicplayerandvideoplayer","disable_correlation":false,"object_relation":null,"type":"filename"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-6d40-409f-be23-47bd950d210f","timestamp":"1521797111","to_ids":true,"value":"com.captain.lovebyte.lovedaycounter","disable_correlation":false,"object_relation":null,"type":"filename"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-e5a4-4492-bf54-4556950d210f","timestamp":"1521797111","to_ids":true,"value":"com.captain.callrecorder","disable_correlation":false,"object_relation":null,"type":"filename"},{"comment":"","category":"Payload delivery","uuid":"5ab4c7f7-64ac-4a3e-846f-42a5950d210f","timestamp"
