Android VNC RAT: libavnc.so LibVNCServer, mastermaestrosafety.appspot.com Google Cloud C2, Google Play Taklidi

Genel Bakis

Bu ornek, Android VNC RAT olarak siniflandirilan 2.2MB'lik bir APK. LibVNCServer kutuphanesi (libavnc.so) kullanarak kurban cihazin ekranini gizlice yayin yapan bu malware, mastermaestrosafety.appspot.com Google Cloud uzerinde barindirilan bir C2 adresine baglaniyor. Google Play uygulamasini taklit ederek gizleniyor.

Teknik Analiz

VNC Yayin Yetenekleri

lib/armeabi/libavnc.so — gomulu LibVNCServer kutuphane
rfbInitSockets, rfbHttpInitSockets — VNC socket baslatma
rfbCheckPasswordByList, rfbDecryptPasswdFromFile — sifre dogrulama
rfbEncryptBytes — VNC sifreleme
rfbRegisterProtocolExtension, rfbUnregisterProtocolExtension
start_vnc, Java_de_abr_android_avnc_lib_LvWrapper_nstart_1vnc
nreversecon — ters baglanti modu (C2 cihaza baglanir)

C2 ve Bulut Altyapisi

mastermaestrosafety, mastermaestrosafety.appspot.com — Google Cloud C2
appspot.com uzerinde barindirma: meşru bulut hizmetine gizlenme

Google Play Taklidi

Google Play referanslari fazla goruluyor (135 kez!) — Google Play uygulamasini taklit
APK Signing Block mevcut (imzali APK)

Teknik Ozellikler

Ozellik	Deger
Format	Android APK
Boyut	2.191.141 bayt
VNC Kutuphane	libavnc.so (LibVNCServer)
C2	mastermaestrosafety.appspot.com (Google Cloud)
Ters Baglanti	nreversecon (C2'den cihaza)
Gizlenme	Google Play taklidi

IOC Ozeti

Domain: mastermaestrosafety.appspot.com
SHA256: f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2

IOC List (2 indicators)

IOC — Android VNC RAT

# SHA256
f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2

# DOMAIN
mastermaestrosafety.appspot.com

Type	Value	Note
sha256	f4d7e9ec4eda034c29b8d73d479084658858f56e67909c2ffedf9223d7ca9bd2
domain	mastermaestrosafety.appspot.com

C2 Servers (1 recorded servers for this family)

Address	Type	Port	Protocol	Status	Country
mastermaestrosafety.appspot.com	domain	443	HTTPS	active	—

C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.