S0551 GoldenEagle
GoldenEagle is a piece of Android malware that has been used in targeting of Uyghurs, Muslims, Tibetans, individuals in Turkey, and individuals in China. Samples have been found as early as 2012.
| Item |
Value |
| ID |
S0551 |
| Associated Names |
|
| Type |
MALWARE |
| Version |
1.0 |
| Created |
24 December 2020 |
| Last Modified |
25 March 2021 |
| Navigation Layer |
View In ATT&CK® Navigator |
Techniques Used
| Domain |
ID |
Name |
Use |
| mobile |
T1437 |
Application Layer Protocol |
- |
| mobile |
T1437.001 |
Web Protocols |
GoldenEagle has used HTTP POST requests for C2. |
| mobile |
T1429 |
Audio Capture |
GoldenEagle has recorded calls and environment audio in .amr format. |
| mobile |
T1533 |
Data from Local System |
GoldenEagle has retrieved .doc, .txt, .gif, .apk, .jpg, .png, .mp3, and .db files from external storage. |
| mobile |
T1407 |
Download New Code at Runtime |
GoldenEagle can download new code to update itself. |
| mobile |
T1646 |
Exfiltration Over C2 Channel |
GoldenEagle has exfiltrated data via both SMTP and HTTP. |
| mobile |
T1420 |
File and Directory Discovery |
GoldenEagle has looked for .doc, .txt, .gif, .apk, .jpg, .png, .mp3, and .db files on external storage. |
| mobile |
T1430 |
Location Tracking |
GoldenEagle has tracked location. |
| mobile |
T1636 |
Protected User Data |
- |
| mobile |
T1636.002 |
Call Log |
GoldenEagle has collected call logs. |
| mobile |
T1636.003 |
Contact List |
GoldenEagle has collected a list of contacts. |
| mobile |
T1636.004 |
SMS Messages |
GoldenEagle has collected SMS messages. |
| mobile |
T1513 |
Screen Capture |
GoldenEagle has taken screenshots. |
| mobile |
T1582 |
SMS Control |
GoldenEagle has sent messages to an attacker-controlled number. |
| mobile |
T1418 |
Software Discovery |
GoldenEagle has collected a list of installed application names. |
| mobile |
T1409 |
Stored Application Data |
GoldenEagle has extracted messages from chat programs, such as WeChat. |
| mobile |
T1632 |
Subvert Trust Controls |
- |
| mobile |
T1632.001 |
Code Signing Policy Modification |
GoldenEagle has modified or configured proxy information. |
| mobile |
T1426 |
System Information Discovery |
GoldenEagle has checked for system root. |
| mobile |
T1512 |
Video Capture |
GoldenEagle has taken photos with the device camera. |
References