GhostSpy Web-Based Android RAT : Advanced Persistent RAT with Stealthy Remote Control and Uninstall Resistance

GhostSpy is a sophisticated Android malware that abuses Accessibility Services and Device Admin privileges to stealthily gain full control over infected devices, enabling extensive spying and anti-uninstallation measures. It also bypasses banking app protections through UI reconstruction, posing serious privacy and financial risks. #GhostSpy #AndroidRAT #AccessibilityAbuse #DeviceAdmin

Keypoints

GhostSpy initially infects devices via a dropper APK that exploits Accessibility Services and UI automation to silently install a secondary payload (update.apk) with elevated privileges.
The malware auto-grants itself all required permissions by simulating user interactions, enabling features like keylogging, screen capture, microphone/camera spying, SMS and call log theft, and GPS tracking without user awareness.
It uses Device Admin APIs and overlay windows to prevent uninstallation by displaying fake warning dialogs, making removal by non-technical users almost impossible.
GhostSpy circumvents banking app screenshot restrictions by reconstructing the UI skeleton to harvest sensitive data from protected apps.
The malware maintains persistent C2 communication for real-time remote control, including commands for factory reset and data exfiltration.
Its infrastructure includes multiple active C2 servers and is linked to Brazilian threat actors, demonstrated by Telegram and YouTube channels showcasing the malware.
Detection and mitigation require comprehensive mobile threat defense, user education on sideloading risks, and monitoring of suspicious Accessibility Service usage and network traffic.

MITRE Techniques

[T1660] Phishing – Initial delivery using a fake app update prompt to trick users into installing the dropper. (‘displays a deceptive interface, typically presenting a fake app update prompt’)
[T1541] Foreground Persistence – The malware maintains persistence by requesting Device Admin permissions and displaying overlays. (‘uses Device Admin APIs and creates overlay windows to prevent uninstallation’)
[T1603] Scheduled Task/Job – Employs recurring Accessibility Services to automate permission granting and monitoring. (‘auto grants permissions by simulating user interactions across screen areas’)
[T1626.001] Device Administrator Permissions – Gains elevated privileges to enable remote wipe and block removal. (‘requests Device Administrator privileges to entrench itself’)
[T1628] Hide Artifacts – Uses full-screen overlays and system dialog hijacking to obscure its presence. (‘displays fake warning messages via overlays to block uninstallation’)
[T1629.001] Prevent Application Removal – Detects uninstall attempts and reacts by showing fake warning dialogs. (‘monitors uninstallation UI and overlays fake warnings to deter removal’)
[T1516] Input Injection – Simulates permission dialog clicks via Accessibility API to auto-accept permissions. (‘simulates user clicks on permission dialogs using AccessibilityNodeInfo.ACTION_CLICK’)
[T1414] Clipboard Data – Captures clipboard contents to steal sensitive information. (‘steals clipboard data as part of credential and personal data theft’)
[T1417.001] Keylogging – Uses Accessibility API to monitor keystrokes and input events. (‘captures text input events such as passwords and chat messages’)
[T1420] File and Directory Discovery – Collects files including images and media from the device gallery. (‘transmits gallery images by enumerating stored photos’)
[T1430] Location Tracking – Continuously obtains precise GPS location data from the device. (‘requests high-accuracy location updates via FusedLocationProviderClient’)
[T1418] Software Discovery – Gathers information about installed apps and system state. (‘monitors installed applications and device identifiers’)
[T1426] System Information Discovery – Collects device model, OS version, and manufacturer details. (‘gathers Android ID, model, and OS version to form a unique fingerprint’)
[T1422] Internet Connection Discovery – Monitors network status to maintain C2 connectivity. (‘checks internet connection status to manage C2 channel’)
[T1636.002] Call Log Collection – Extracts call history data from the device. (‘queries call logs and exfiltrates call details’)
[T1636.004] SMS Messages Collection – Reads SMS inbox and sends message data to attackers. (‘accesses SMS inbox via content://sms/inbox provider’)
[T1513] Screen Capture – Captures screenshots and video frames using MediaProjection API. (‘mirrors screen activity and records screen content’)
[T1512] Video Capture – Records camera video streams covertly via Camera2 API. (‘initiates continuous camera recording using Camera2 API’)
[T1437] Application Layer Protocol – Communicates over HTTP/S protocols with C2 servers. (‘persistent socket connection to C2 server for remote control’)
[T1521] Encrypted Channel – Uses encrypted channels for C2 communication. (‘C2 communication over SSL/TLS with pinning mechanisms’)
[T1646] Exfiltration Over C2 Channel – Sends stolen data to C2 infrastructure via socket events. (‘exfiltrates sensitive files, keylogs, and location over C2 connections’)

Indicators of Compromise

[APK Hash] dropper and payload identification – e9f2f6e47e071ed2a0df5c75e787b2512ba8a601e55c91ab49ea837fd7a0fc85 (dropper), 73e647287408b2d40f53791b8a387a2f7eb6b1bba1926276e032bf2833354cc4 (payload)
[URL] Command and Control servers – https://stealth.gstpainel.fun, https://gsttrust.org
[IP Address] C2 server endpoints – 37.60.233.14 (ports 3000, 4200)
[Package Name] Malicious app identifier – com.support.litework (used by both dropper and payload APKs)

SHARE THIS STORY

WhatsApp X (Twitter)Telegram Bluesky Facebook LinkedIn Threads Email Print