Daam Android Botnet

Original Issue Date:- May 25, 2023

Virus Type:-Android Botnet

Severity:- Medium

It has been reported that an android malware, namely "Daam" is spreading, which is capable of stealing sensitive data, bypassing antivirus programs, and deploying ransomware on the targeted devices.

The Daam malware is communicating with various Android APK files to infect the device. It is being distributed through third-party websites or applications downloaded from untrusted/unknown sources.

Once it is placed in the device, the malware tries to bypass the security check of the device. After a successful attempt, it attempts to steal sensitive data, and permissions such as reading history and bookmarks, killing background processing, and reading call logs etc. It is also capable of hacking call recording, contacts, gaining access to the camera, modifying device passwords, capturing screenshots, stealing SMS, downloading/uploading files, etc., and transmitting to the C2 server from the victim's device.

The Daam malware utilizes the AES encryption algorithm to encrypt files in the victim's device. Then, other files are deleted from the local storage and leaving only the encrypted files with “.enc” extension and a ransom note "readme_now.txt".

Admin panel of the Daam Android malware [Source: Cyble]

Indicator of Compromise:

MD5 Hashes

49cfc64d9f0355fadc93679a86e92982
99580a341b486a2f8b177f20dc6f782e
ee6aec48e19191ba6efc4c65ff45a88e

SHA 1 Hashes

67a3def7ad736df94c8c50947f785c0926142b69
bc826967c90acc08f1f70aa018f5d13f31521b92
f3b135555ae731b5499502f3b69724944ab367d5

SHA 256 Hashes

37d4c5a0ea070fe0a1a2703914bf442b4285658b31d220f974adcf953b041e11
184356d900a545a2d545ab96fa6dd7b46f881a1a80ed134db1c65225e8fa902b
0fdfbf20e59b28181801274ad23b951106c6f7a516eb914efd427b6617630f30

C2 URL

hxxp://192.99.251[.]51:3000/socket.io/

Best Practices and Recommendations:

Reduce the risk of downloading potentially harmful apps by limiting your download sources to official app stores, such as your device’s manufacturer or operating system app store.
Prior to downloading / installing apps on android devices (even from Google Play Store):

Always review the app details, number of downloads, user reviews, comments and "ADDITIONAL INFORMATION" section.
Verify app permissions and grant only those permissions which have relevant context for the app's purpose.
Do not check "Untrusted Sources" checkbox to install side loaded apps.

Install Android updates and patches as and when available from Android device vendors.
Do not browse un-trusted websites or follow un-trusted links and exercise caution while clicking on the link provided in any unsolicited emails and SMSs.
Install and maintain updated anti-virus and antispyware software.
Look for suspicious numbers that don't look like real mobile phone numbers. Scammers often mask their identity by using email-to-text services to avoid revealing their actual phone number. Genuine SMS messages received from banks usually contain sender id (consisting of bank’s short name) instead of a phone number in sender information field.
Do extensive research before clicking on link provided in the message. There are many websites that allow anyone to run search based on a phone number and see any relatable information about whether or not a number is legit.
Only click on URLs that clearly indicate the website domain. When in doubt, users can search for the organisation's website directly using search engines to ensure that the websites they visited are legitimate.
Consider using Safe Browsing tools, filtering tools (antivirus and content-based filtering) in your antivirus, firewall, and filtering services.
Exercise caution towards shortened URLs, such as those involving bit.ly and tinyurl. Users are advised to hover their cursors over the shortened URLs (if possible) to see the full website domain which they are visiting or use a URL checker that will allow the user to enter a short URL and view the full URL. Users can also use the shortening service preview feature to see a preview of the full URL.
Look out for valid encryption certificates by checking for the green lock in the browser's address bar, before providing any sensitive information such as personal particulars or account login details.
Customer should report any unusual activity in their account immediately to the respective bank with the relevant details for taking further appropriate actions.

References: