April 2021

Technical Paper //Taking Action
Against Arid Viper

Authors: Michael Flossman and Michael Scott // Threat Investigators

Technical threat report: Arid Viper

2

TABLE OF CONTENTS

Executive Summary

4

Key Findings

5Timeline around recent Arid Viper Operations
Overview

89Background9

Recent Operations & Activity on Platform

9

Victimology

11

A Toolkit of Custom Malware for Multiple Platforms

12

Phenakite - Arid Viper’s iOS Implant

12

Initial Device Compromise

13

Inclusion of Public Exploits

17

Capabilities

17

Scope of iOS Targeting

20

Evolving Android Surveillanceware

21

Continued Development of Micropsia Windows Malware

29

General Micropsia Behavior & Capability

30

Persistence

30

Command and Control Communication

31

Phishing/Credential Theft
Central Elections Commission Imposter Site

33
33

Conclusion

35

Appendix36

Technical threat report: Arid Viper

3

Executive Summary
Facebook is focused on protecting our users from malicious actors who attempt to conduct
offensive cyber operations on our family of applications. This report details our investigation anddisruption of the advanced persistent threat actor known in the security industry as Arid Viper,
who we identified creating and using fake accounts in targeted cyber espionage campaigns. For
the first time, we observed Arid Viper incorporating fully functional custom iOS
surveillanceware, capable of stealing sensitive user data from iPhones without requiring devices
be jailbroken prior to compromise.
The focus of Arid Viper’s recent operation we discuss in this paper shows similar geographic andoccupational targeting as was previously reported by our industry peers. Much of Arid Viper’s
activity detailed in this report focused on individuals in Palestine, including government officials,
members of the Fatah political party, student groups, and security forces.
Arid Viper used sprawling infrastructure to support this most recent operation, including over ahundred websites that either hosted iOS and Android malware, attempted to steal credentials
through phishing, or acted as command and control (C&C or C2) servers. A prevalent threat
actor, Arid Viper appears to operate across multiple social media platforms.
We shared threat indicators with industry peers and security researchers as part of a concerted
effort to disrupt this group’s operations. For Facebook, this has meant disabling Facebook andInstagram accounts created by Arid Viper operators, releasing malware hashes and domains
associated with this threat actor, and notifying users who we believe were targeted by thisactivity in order to help them secure their accounts.

Technical threat report: Arid Viper

4

Key Findings
To protect the community, Facebook is releasing the following set of indicators aroundthis activity.

01

—

●

10 Android malware hashes●

2 iOS malware hashes●

8 desktop malware hashes●

179 domains

Facebook identified offensive cyber security activity
by the threat actor known as Arid Viper
We identified recent state-sponsored cyber espionage operations that we
attributed with high confidence to Arid Viper. Our assessment is based on
significant overlap between our findings and this actor’s known tactics,
techniques, and procedures (TTPs)1. We are aware that some of the previous
industry reports linked Arid Viper to the cyber arm of Hamas. However, wecannot conclusively confirm this connection based on our evidence.
The malware Arid Viper deployed in 2019 and 2020 appears regionally specific,
as does the victimology. Lure content and known victims suggest the target
demographic is individuals associated with pro-Fatah groups, Palestinian1

Palo Alto Networks, “Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA,” Source:

https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/ [Last
Accessed April 19, 2021]
Kaspersky, “The Desert Falcons Targeted Attacks,” Source:
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064309/The-Desert-Falcons-targ
eted-attacks.pdf [Last Accessed April 19, 2021]
Kaspersky, “Breaking The Weakest Link Of The Strongest Chain,” Source:
https://securelist.com/breaking-the-weakest-link-of-the-strongest-chain/77562/ [Last Accessed April 19, 2021]
Trend Micro, “Arid Viper: Gaza vs Israel Cyber Conflict,” Source:
https://www.trendmicro.com/en_us/research/15/b/arid-viper-gaza-vs-israel-cyber-conflict.html [Last Accessed April
19, 2021]
ClearSky, “Infrastructure and Samples of Hamas’ Android Malware Targeting Israeli Soldiers,” Source:
https://www.clearskysec.com/glancelove/ [Last Accessed April 19, 2021]
Lookout, “FrozenCell: Multi-platform surveillance campaign against Palestinians,” Source:
https://blog.lookout.com/frozencell-mobile-threat [Last Accessed April 19, 2021]

Technical threat report: Arid Viper5government organizations, military and security personnel, and student groups
within Palestine.
Although there is evidence of opportunistic targeting outside of Palestine, suchcases appear politically motivated and consistent with targeting from thisthreat actor.

02—

Arid Viper used custom surveillanceware in a fully functional
chat application which didn’t require a jailbreak for installation
Arid Viper used custom iOS surveillanceware which has not been previously
reported and reflects a tactical shift. We call this iOS component Phenakite due
to it being somewhat rare and deriving its name from the Greek word Phenakos,
meaning to deceive or cheat.
Installation of Phenakite required that victims be tricked into installing amobile configuration profile. This allowed for a device-specific signed versionof the iOS app to be installed on a victim’s device. A jailbroken device was
not required.
Post-installationPost-installation, a jailbreak was necessary for the malware toelevate its privileges to retrieve sensitive user information not accessible via
standard iOS permission requests. This was achieved with the publicly available
Osiris jailbreak that also made use of the Sock Port exploit, both of which werebundled in the malicious iOS app store packages (IPAs).
Arid Viper’s iOS surveillanceware was trojanized inside a fully functional chatapplication that used the open source RealtimeChat code for legitimate appfunctionality. This malware could also direct victims to phishing pages for
Facebook and iCloud in order to steal credentials for those services.
Arid Viper’s use of custom iOS surveillanceware shows that this capability
is becoming increasingly attainable by adversaries believed to be oflower sophistication.

Technical threat report: Arid Viper

03

—

6

Arid Viper made use of continually evolving Android and Windows
malware that it has relied on over the years
The Android tooling used by Arid Viper shares many similarities with malware
previously reported as FrozenCell and VAMP.
The Android malware deployed by Arid Viper required victims to install apps
from third-party sources on their devices. The group used a number ofconvincing, attacker-controlled sites to create the impression that the apps
were legitimate.
Arid Viper’s recent operations also used variants of a malware family known as
Micropsia, which previously has been associated with this threat actor.

04—

Arid Viper continued distributing malware via social engineering andboth attacker-controlled and 3rd party websites
Delivery of both the Android and iOS malware involved social engineering.
Android malware was typically hosted on convincing looking attackercontrolled phishing sites. At the time of writing, we discovered 41 such sites.
While Arid Viper tooling has previously been discovered in official app channels
like the Play Store, this was not found to be the case in this instance.
iOS malware was previously found to be distributed from a 3rd party Chinese
app development site. After engagement with industry partners which led to
the revocation of multiple developer certificates, Arid Viper’s ability to
distribute Phenakite was disrupted. They have since been observed trying to set
up their own infrastructure to distribute their iOS implant.

Technical threat report: Arid Viper

Timeline around recent Arid Viper Operations

7

Technical threat report: Arid Viper

8

Overview
Background
Over the past several years the operations of the advanced persistent threat (APT) actor Arid
Viper, also called Desert Falcon and APT-C-23, attributed by some in the broader security
community to the cyber arm of Hamas, have been detailed numerous times2. These reports
described various aspects of activity by a long-running persistent threat actor operating out of
Gaza, Palestine, to conduct targeted intelligence-gathering operations since it emerged in 2011.
The campaigns attributed to this group show how a relatively low-sophistication adversary used
a combination of social engineering, phishing sites, and a continually evolving toolkit of Windows
and Android malware to successfully run offensive cyber operations. Some of the past industry
reports detailed that targeting occured against a very regionally specific set of victims with ties
to pro-Fatah organisations, Palestinian political groups, or the Israeli Defense Force.

Recent Operations & Activity on Platform
In mid-2019, as part of our continuous monitoring and enforcement against APTs, Facebook
observed a spike in Arid Viper’s activity involving the creation of dozens of fake Facebook andInstagram profiles.

2

Palo Alto Networks, “Targeted Attacks in the Middle East Using KASPERAGENT and MICROPSIA,” Source:
https://unit42.paloaltonetworks.com/unit42-targeted-attacks-middle-east-using-kasperagent-micropsia/ [Last
Accessed April 19, 2021]
Kaspersky, “The Desert Falcons Targeted Attacks,” Source:
https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064309/The-Desert-Falcons-targ
eted-attacks.pdf [Last Accessed April 19, 2021]
Kaspersky, “Breaking The Weakest Link Of The Strongest Chain,” Source:
https://securelist.com/breaking-the-weakest-link-of-the-strongest-chain/77562/ [Last Accessed April 19, 2021]
Trend Micro, “Arid Viper: Gaza vs Israel Cyber Conflict,” Source:
https://www.trendmicro.com/en_us/research/15/b/arid-viper-gaza-vs-israel-cyber-conflict.html [Last Accessed April
19, 2021]
ClearSky, “Infrastructure and Samples of Hamas’ Android Malware Targeting Israeli Soldiers,” Source:
https://www.clearskysec.com/glancelove/ [Last Accessed April 19, 2021]
Lookout, “FrozenCell: Multi-platform surveillance campaign against Palestinians,” Source:
https://blog.lookout.com/frozencell-mobile-threat [Last Accessed April 19, 2021]

Technical threat report: Arid Viper

This spike in account creation towards the later half of 2019 was observed
alongside an increase in attempts to distribute both iOS and Android malware
as well as phish credentials from users.

9

Technical threat report: Arid Viper

10

Facebook’s automated malware analysis detection systems flagged many of Arid Viperaccounts when they began sending malware on-platform or posted links to sites hosting custom
malware. Like other hacking groups in the region, Arid Viper has relied heavily on social
engineering to initially infect victim devices and has not deviated from this low-cost approach.

Victimology
Based on the analysis of lure documents used in Arid Viper’s malware and other signals,
much of this group's targeting was against individuals in Palestine. Of note, the targets
included individuals affiliated with the Palestinian National Authority, Fatah, other oppositional
government organisations, security services, and student groups:• Palestinian National Authority• Palestinian Preventative Security• Ministry of National Economy• Palestinian National Liberation• Palestinian Liberation Org

Movement Fatah• Palestinian Special Police• Student movements aligned with Fatah• Ministry of Interior• Other Government employees• Ministry of Education

Technical threat report: Arid Viper

11

A Toolkit of Custom Malware for Multiple Platforms
None of the prior reporting on Arid Viper’s activities mention that the group had developed an
iOS capability.

We believe this recent development reflects the group’s
knowledge that some of their targets owned iPhones instead ofWindows desktop or Android devices. It likely led them to fill atooling gap, similar to the technological shift observed in 2014
and 2015 where Arid Viper expanded their offensive tooling fromprimarily desktop to include an Android capability.
Below, we share our technical analysis of their recently discovered custom iOS malware,
followed by analysis of their current Android capability, and a brief summary of their continued
use of Micropsia, a malware variant previously associated with this threat actor.

In all cases the successful installation of these tools did not
require any exploits. This suggests that Arid Viper operators
continue to heavily rely on social engineering to distribute theirmalware.
1. Phenakite - Arid Viper’s iOS Implant
The latest tooling addition to Arid Viper’s arsenal, what we have internally named Phenakite, iscustom iOS malware discovered inside a fully functional trojanized chat application called Magic
Smile. It makes use of publicly available code for both the legitimate chat component as well as
the Sock Port exploit and Osiris jailbreak that would be used post installation. Facebook initiallyfound Phenakite samples on a third party mobile application development site and later on Arid
Viper controlled infrastructure.

Technical threat report: Arid Viper

12

Screenshots of the trojanized chat application that Arid Viper promoted on theirwebsite. We also later saw this app on a third party app development site. Whilethe chat component was fully functional, malicious code would silently run in the
background and retrieve sensitive information without user knowledge.

1.1. Initial Device Compromise
Phenakite was initially hosted on a website that contained tools and services to help with thedevelopment of Android and iOS apps. This website also included another component for iOS
developers which they could download and install, likely for testing and limited distribution. This
process involved the use of legitimate developer certificates which meant that devices didn’t
have to be jailbroken. 3 As shown below, installing a malicious app required some degree of social
engineering of the victim or physical access to their unlocked device.
If socially engineered, the victim must first be tricked into visiting an unofficial app store, third
party app development site, or attacker controlled website hosting Phenakite. Then, a user
would be prompted to install a mobile configuration profile that, if accepted, would allow for thedelivery and installation of Phenakite. This would be specifically signed for the target’s iPhone.

3

Configuration Profile Examples, Source:
https://developer.apple.com/library/archive/documentation/NetworkingInternet/Conceptual/iPhoneOTAConfiguration/
ConfigurationProfileExamples/ConfigurationProfileExamples.html [Last Accessed April 19, 2021]

Technical threat report: Arid Viper

On the left: a page hosting Phenakite was found on a third party site that provides app
development tools and services. On the right: the attacker controlled infrastructure
promoting the trojanized Magic Smile chat application.

13

Technical threat report: Arid Viper

Shown above is what a target would see during this process and the verified
signing certificate chain. The signer used above is from the app delivery site and is
not directly unique to Arid Viper because of how the distribution site works androtates through signing profiles. The unsigned XML representation of this is below.

14

Technical threat report: Arid Viper

When Arid Viper previously had their tooling on the 3rd party app development site
zc.pgyer[.]com, the profile that targets received would look similar to the screenshots shown
earlier. If installed, key information would be sent from the target’s device to the store, which
could then be used to sign a device specific version of Arid Viper’s malware. This generalinstallation flow is expected and intended for use by developers and enterprises.

In other Phenakite samples analyzed, a team name of Brenda Braun and a team identifier of

J22DGC9C5A were observed. When notified of this Apple was quick to take action against thisdeveloper and revoke their certificate.

The embedded provisioning profile present in one of the Magic Smile samples contained 74
unique device identifiers. When a developer certificate is used to install an iOS application, the15Technical threat report: Arid Viper

16

unique device identifier (UDID) of a target iPhone needs to first be added to the associatedprovisioning profile before the app can be installed. For this reason, the provisioning profile
contains a list of all UDIDs for devices that had this app installed which provides some insight
into how many devices Arid Viper may have compromised at a minimum. A small subset of theseidentifiers have UDIDs that are 24 characters in length, indicating that they’re iPhone XS models
or newer.

1.2. Inclusion of Public Exploits
While Phenakite does not require a jailbreak for installation, once on a device, it still must adhere
to the usual operating system security controls that prevent access to sensitive informationfrom unauthorized applications. To circumvent that, Phenakite comes bundled with the publicly
available Osiris jailbreak and also includes the Sock Port exploit. This means that Phenakite iscapable of using Osiris to jailbreak all 64 bit devices on iOS 11.2 to 11.3.1 and Sock Port to extend
this to devices running iOS 10.0 to 12.2 (and potentially 12.4 and greater).

Code snippets from Phenakite showing calls to the Osiris jailbreak on the left,
and inclusion of the Sock Port exploit on the right.

1.3. Capabilities
The ability for Phenakite to gather sensitive user data from a compromised device is highly
dependent on the successful execution of the exploits that it comes with. If Osiris jailbreak is
successful then Phenakite has the following capabilities.

Technical threat report: Arid Viper

17• Retrieve photos from the camera roll

• Retrieve text messages• Take images with the device camera• Upload WhatsApp media data

• Retrieve contacts• Searches for ChatStorage.sqlite,• Silently record audio with the device
microphone• Search for and return the path of files
with a doc or PDF extension• Search through application data stored
to /var/mobile/Library &/var/mobile/Containers/Shared/
AppGroup

Accounts3.sqlite, CallHistory.storedata,notes.sqlite, Calendar.sqlite,
AddressBook.sqlitedb,
itunesstored2.sqlitedb, Bookmarks.db,
sms.db,• Retrieve attacker specified files• Collect any content sent or received via thetrojanized chat application• Retrieve device metadata
Phenakite was also found to direct users to phishing sites for iCloud and Facebook if, during thechat application sign up process, they opted to use either of these services for authentication.

Technical threat report: Arid Viper

Code snippet in Phenakite that’s responsible for initially going into the WhatsApp/Message/Media directory and uploading any files present before recursively uploading
any files in subdirectories.

18

Technical threat report: Arid Viper

19

Man-in-the-middling traffic during local testing of a patched version of Phenakite found it to beperiodically recording audio and notifying C2 infrastructure, in this case our local test server.

Similarly, Phenakite periodically uses the camera of a compromised device to take photos andsends these automatically to attacker infrastructure.

1.4. Scope of iOS targeting
Facebook did not find any evidence to suggest Arid Viper had widely deployed Phenakite. We
identified only a handful of posts that contained links to websites known to host Arid Viper
malware. A misconfigured Firebase server with which infected devices would communicate
showed 81 users at the time of analysis. Closer inspection of the publicly exposed data on thisfirebase instance suggests that at least several of the devices were fake adversary-controlled
accounts, used to engage with and further socially engineer victims. For these reasons, the true
number of targets is likely lower, which suggests Arid Viper sparingly used this malware.
Throughout Facebook’s analysis of Phenakite, we regularly shared IOCs and TTPs with industry
peers. This included full URLs to sites hosting malware as well as samples of the malware itself
that we found and analyzed. Because of these actions, and through industry collaboration, thedeveloper certificates used to sign Phenakite were quickly revoked and it appears Arid Viper's
iOS operations have paused at the time of this writing. This becomes more apparent when wecompare the frequency with which links to Arid Viper’s iOS malware were detected on Facebook
to the revocation of Arid Viper’s developer certificates.

Technical threat report: Arid Viper20

2. Evolving Android Surveillanceware
Analysis of the Android surveillanceware used by Arid Viper in their recent campaign revealed
many similarities to tooling previously attributed to APT-C-23, also known as Two-tailed
scorpion. The ever-changing malware family attributed to APT-C-23 over the years includes
VAMP, GnatSpy, FrozenCell, DesertScorpion, and ViperRAT. Facebook found recent variants
pretending to be popular Android applications for dating, networking, and regional banking in
the Middle East. Unlike Arid Viper’s iOS malware, the analyzed Android samples did not containany legitimate functionality. The main changes from earlier research centered primarily aroundcode obfuscation being added by those developing this malware.

Technical threat report: Arid Viper

21

As with previous Arid Viper Android malware, many are trojanized chat applications that appear
to facilitate dating. This approach is consistent with Arid Viper’s use of social engineering toengage potential victims from a romantic angle.

Technical threat report: Arid Viper

22

Consistent with past reports of Arid Viper disguising their malware as updates for legitimate
apps, we found several fake app updates.

Unlike Phenakite that came bundled with exploits in order to retrieve sensitive user data, theAndroid malware purely relies on a user granting it the required permissions upon installation. In
some cases, the Android malware contained functionality that forced targets to disable Google
Play Protect and give the app device admin permissions, making it harder to remove.

Technical threat report: Arid Viper

23

The analyzed Arid Viper Android malware contained the following functionality:• Record calls• Retrieve contact information• Record environment audio for a specified• Track device location

time period• Retrieve device metadata• Take screenshots or record video• Retrieve calendar information• Intercept and retrieve text messages• Retrieve call logs

• Take pictures with the device camera• Copy, move, delete, and retrieve attacker• Call attacker specified numbers

specified files• Restart wifi

• Open or delete attacker-specified apps

• Make USSD calls with the prefix *130* or• Dynamically update command and*111*5* that are appended with

control infrastructure settings to attacker

attacker-controlled values

specified values• Dynamically check the device’s accessand permissions• Logs device use information such as when
shutdowns occur• Scrapes notification information for
WhatsApp, Instagram, Imo, Viber,
and Skype• Uses the device camera to take a photo if it
detects a user present

While analyzing recent Android surveillanceware used by Arid Viper we found that C2
communication typically involved malware first contacting a number of attacker controlled sitesthat had the sole purpose of providing implants with a primary C2 with which to upload user
data. This was likely implemented as a way to add additional complexity around theidentification of Arid Viper’s primary C2s. In addition, the values for those C2 domains firstcontacted weren’t hardcoded in the Java layer, where they would be clearly visible, instead they
were encrypted and stored in a separate ELF binary.

Technical threat report: Arid Viper

24

The majority of Android samples were found to include an additional ELF binary named
libchat-lib.so. The purpose of this shared object was to likely slow down static analysis and makeit harder to retrieve the initial command and control value.

Shown above is an example of how the initially contacted C2 domain is stored in thelibchat-lib.so file of recent malware. ASCII characters are on the right with theirequivalent hex representation on the left and, of note is that all encrypted content was
found to be prepended with the same 16 bytes.
The initial C2 value is derived by taking the encrypted content above, base64 decoding it,
and decrypting the output with AES in CBC mode and with PKCS7 padding specified.
The secret key in analyzed samples was static and was the SHA256 hash for the string
AppCompatActivity_SPECIAL. The initialization vector used was a 16 byte array of 0’s. To get
the complete plaintext C2, the resulting string post AES decryption would be parsed, with

Technical threat report: Arid Viper

25

instances of & and % being removed and occurrences of the @ symbol being replaced with ‘s’.
An example of this output pre-substitution and removal of these characters is shown below.
h&&&tt&&&&&p@://@ite%%%%%%@.g%%%oo%%%gle.%%%%%com/vi%ew/c%%%&&ak%&e-%mak%%%%er/&%%%%man&%%%dm@
https://sites.google.com/view/cake-maker/mandms
Included in the appendix is a simple decryption script that takes the encrypted and base64
encoded initial C2 string as shown above and attempts to decrypt it. This script assumes thatthe secret key is based on the AppCompatActivity_SPECIAL string, a 16 byte IV consisting of
all zeros is used, and requires bouncy castle (we used bcprov-jdk15on-163.jar).
Responses from initial C2s used to be JSON objects that an infected device would parse,
however it appears Arid Viper was experimenting with different approaches. Initial C2s
frequently had the primary C2 domain slightly obfuscated and hidden in the returned HTML
content. This can be seen below where a partial snippet of webpage source code shows the titleof an initial C2 to the STACKS ZADAR WEBSITE. When rendered in a browser, this doesn’t
provide much indication that something is amiss, however when this page is parsed by an Arid
Viper sample created in late 2019 and 2020 we can see that it extracts this value and modifies itslightly to derive the primary C2 domain of stacks-zadar.website.

Source code for one of the initial C2s that Arid Viper’s Android malware
communicates with and uses to derive the primary command and control server.

Technical threat report: Arid Viper

Code found in Arid Viper’s Android surveillanceware that strips out the title of thepage returned by the initial C2.

The title extracted from the initial C2 is then used to derive the primary command and control
server before being saved to shared preferences with, in this case, the key of
API_SETACTIVEACCOUNTS.
Like earlier Android malware variants associated with Arid Viper, such as ViperRAT and
FrozenCell, these newer samples made use of the publicly available Lingala Zip4J library tocompress files that are later uploaded to command and control infrastructure. Compressed
content from this library can be password protected, which this actor previously chose to do
through hard coded pass phrases. Over the years however, Arid Viper moved away from hard
coded pass phrases, choosing instead device-specific passphrases, such as the android_id
value. To facilitate decryption, Arid Viper includes this value in the filename of uploaded data.

26

Technical threat report: Arid Viper

27

2.1. Android Phishing Sites
Rather than trying to send malware binaries directly to their intended victims, Arid Viper createsa comprehensive set of authentic looking sites to host their malware in an attempt to makethem appear legitimate. While some of these sites are almost exact clones of websites for
legitimate applications such as ‘Wanna Meet’, others were built from the ground up by Arid Viper
developers or modified from publicly available templates. These fake sites were used to host themalware and were not part of command and control infrastructure.

It appears that a substantial amount of time has been spent by this threat actor to continuously
create and design sites used to host their surveillanceware.

Technical threat report: Arid Viper28

On some of their Android phishing sites, targets are required to provide a coupon code or credit
card details before the surveillanceware is served up. In the course of the social engineering
dialogue, it is believed the Arid Viper account would provide the coupon code to the intended
target. This likely helped limit the unwanted distribution of their malware and may havefurthered the illusion that targets were downloading legitimate software.

A phishing site for a trojanized version of the communication application Threemathat requires a user to have a coupon code before being able to download it.

3. Continued Development of Micropsia Windows Malware
Over the time that we’ve been tracking Arid Viper, they have continually modified and updated
their Windows malware arsenal, presumably as part of an ongoing cat and mouse game to avoid
detection by anti-virus software. In 2017, Palo Alto Networks Unit 42 reported on two malware
families: KasperAgent and Micropsia, and today we still see variants of Micropsia in use. Arid
Viper has continued to develop new variants of the malware in multiple programming languages
including Pascal, Delphi, Visual Studio C++, and even Python, as Unit 42 recently reported.

Technical threat report: Arid Viper

29

We track these variants with several names, depending on the language they’re written in, thatfall under the Micropsia malware family; Primewire (C++), fgref (C++), Sears (C++), Rahman(C++). PyMicropsia (Python), and Pierogi (Delphi/Free Pascal). While these variants are written
in a variety of programming languages, they have similar capabilities, share a common high level
code structure, and have, on occasion, used the same command and control infrastructure.

3.1. General Micropsia Behavior & Capability
Despite the wide range of Micropsia variants developed by the actor, there are some generalsimilarities in terms of behavior and capabilities. Most samples are found to have a combinationof the following features:●

Drop or contain decoy documents●

Allow an attacker to run arbitrary commands●

Allow an attacker to download and run arbitrary files●

Use Base64 to obfuscate command and control communications●

Achieve persistence via a shortcut LNK in the startup folder●

Take and upload screenshots●

Install a keylogger●

Extract and upload stored credentials●

Search for files of specific types and add them to RAR archives for exfiltration

3.2. Persistence
Most of the samples investigated attempt to establish persistence on the system.
They often do this by creating a shortcut to the malware in the AppData\Roaming\Microsoft\
Windows\Start Menu\Programs\Startup directory. The shortcut points to the malware’s
location on disk. Additionally, some of the samples had the capability to also establish
persistence via the Windows registry (Microsoft\Windows\CurrentVersion\Run).
These persistence methods allow the samples to survive reboots.

Technical threat report: Arid Viper

3.3. Command and Control Communication
Despite the constant development and modification of the Microspsia malware, the data andformat of the command and control communication remains similar. The initial C2 beacon
generally consists of some combination of the following details about the victim environment:●

Computer Name●

Installed Antivirus software●

Operating system version●

Path to sample●

Sample name●Version of the malware

The chart above helps to visualize our observation of Micropsia variant usage over the past
couple years, based on the compile date of the sample. For some of the samples we were notable to get a useful compile date, and the PyMicropsia samples have the standard PyInstaller
compile date, so for those samples we used the date first observed in the wild or the earliest
submission date to VirusTotal as an estimate.

30

Technical threat report: Arid Viper

31

In mid-2018, we started seeing a new Micropsia variant written in C++ which we track as
Primewire. This variant has similarities to Delphi samples published by Cisco in mid-2017 thatwere reportedly used to target Palestinians. Like other malware used by Arid Viper there are
frequent references to popular culture, and in this case, Game of Throne themed strings were
present. One area where Arid developers like to make regular changes to the code is in the C2
beacon formatting. Some Primewire samples utilize “multipart/form-data” for command andcontrol check-ins, similar to earlier Micropsia samples, whereas other samples combine the C2parameters into a single “application/x-www-form-urlencoded” POST body.
Around the same time in 2018 as Primewire was in use, another new variant that we call “Fgref”
appeared, also written in C++ but with only a 70% code similarity to Primewire. We’ve identified
a number of Fgref samples compiled from summer 2018 through fall 2019, with an additional
sample surfacing in October 2020. Another very similar variant we call “Sears” appeared in late2019 and used until early 2020. Sears implemented a slight change to the C2 format, butotherwise shared a 96% code similarity to Fgref.
An additional C++ Micropsia variant, which we track as “Rahman” appeared in mid-2020 and
was used at least through the end of the year. This variant has an approximately 90% code
similarity to Fgref and Sears, so again it is only a minor revision of their previous malware with
distinctive command and control traffic.
The most widely used variant we’ve seen was reported on by Cybereason in February 2020,
which they called “Pierogi”. Many of the samples were written in Delphi, like the originalMicropsia samples, and packed with the BobSoft Mini-Delphi packer, however, Pierogi variants
were also seen that were compiled in Free Pascal. The earliest Pierogi samples we’ve found dateback to the fall of 2019 (Delphi), with the Free Pascal versions appearing a few months later inthe winter of the same year. Pierogi uses either “multipart/form-data'' or“application/x-www-form-urlencoded” data for check-ins depending on the sample, and“application/x-www-form-urlencoded” data for uploading screenshots (not all samples havethis functionality) etc. Pierogi usage continues, with samples identified as recently as
November 2020.
The python variant of Micropsia, named PyMicropsia by Unit 42, appears to have been in thewild for some time and was previously undetected by the security community. The earliest
submission date to VirusTotal was in January of 2019, and the odd strings align with those foundTechnical threat report: Arid Viper

32

in Fgref samples from that same timeframe, e.g. “Gal_Gadot”. The PyMicropsia samples are
distinctive since they beacon with the standard python-requests user-agent.
We have also identified a variant we call Glasswire that appears to be written and compiled in
Embarcadero Delphi, and the samples are often packed with BobSoft Mini-Delphi packer. Thisvariant is very similar to Pierogi (which is normally compiled with the Free Pascal compiler), butmany samples have the same C2 variable names and format as the C++ Rahman samples seen in
mid-late 2020. Glasswire dates back to mid-2020 and has been seen as recently as March 2021.
These samples have interesting Program Name compiler metadata including“ProxyHostDownload”, “extraWebServer”, “AZ5”, and “pyDownApp”.

4. Phishing & Credential Theft
Arid Viper has also utilized phishing emails and links to phishing web pages that spoof popular
web services including Facebook and Yahoo email. These are unsophisticated sites that simply
mirror content from the legitimate site, and rely on look-alike domain names such as
fasebaook.com (Facebook), autlook.live (Outlook) and log-yoahao.co (Yahoo), which have thepotential to be confused for the real site by non-native English speakers.

4.1. Central Elections Commission Impostor Site
In late November 2019, Arid Viper actors registered the domain enti5abat[.]pw (enti5abattranslates to elections in Arabic) and created a website which mimics the Palestine Central
Elections Commission (CEC), whose actual domain is elections[.]ps. The spoof site borrowed thegeneral format and included the logo from the CEC and in some cases mirrored actual content
from the real CEC website. The crucial difference with the spoofed side is that if a user clicks thesocial media links at the top, instead of opening up a new window to the CEC’s YouTube, Twitteror Facebook page as they do on the legitimate page, instead they are presented a fake login
page for the respective service (Facebook, Yahoo, Google) to trick targets into submitting
their credentials.
This was significant because Palestine has not had a Presidential election since 2005, although
there were discussions about having elections in both 2014 and 2018 that eventually fellthrough. In the early fall of 2019, Mahmoud Abbas, President of the Palestinian National
Authority, announced at the UN General Assembly that he intended to set a date in early 2020

Technical threat report: Arid Viperfor general elections to be held finally. After initially rejecting the terms Abbas had laid out for
the elections, Hamas agreed to participate. After further delays, the Palestinian Presidential
elections are schedule to happen in May 2021, and so far we have not seen a similar attempt by
Arid Viper to re-engage in this type of activity for the upcoming elections.

33

Technical threat report: Arid Viper

34

Conclusion
Facebook's investigation found that the long running threat actor known as Arid Viper recently
expanded their offensive toolkit to include iOS malware that we believe is being deployed intargeted attacks against pro-Fatah groups and individuals. As the technological sophisticationof Arid Viper can be considered to be low to medium, this expansion in capability should signal
to defenders that other low-tier adversaries may already possess, or can quickly develop,
similar tooling.
Our hope is that by sharing insights into these attacks, the increased awareness will allow those
directly impacted by these attacks to avoid device compromise, that security teams will have abetter understanding of the possible attack vectors that can take place against theirorganization's mobile fleet and that these new signals will allow the larger security community to
track this persistent threat actor.

Technical threat report: Arid Viper

35

APPENDIX
Indicators of Compromise
I.

Domains used by Arid Viper

Google Sites Pages
These sites were found to contain the primary C2 address semi-obfuscated in their page title:• sites.google[.]com/view/cake-maker/mandms• sites.google[.]com/view/claudia-rose/get_page• sites.google[.]com/view/brandon-clarkson/access_page• sites.google[.]com/view/amber-stack/valid• sites.google[.]com/view/john-hernandez/path_page• sites.google[.]com/view/jasmine-king/new_page• sites.google[.]com/view/geo-taro/stacks• sites.google[.]com/view/charlok/adlov

iOS Firebase Instance• magicchat-1f275.firebaseio[.]com

Android Firebase Instances
The following Firebase instances were used by Arid Viper malware to store chat threads fromtrojanized apps as well as exfiltrated information.
• dash-chat-c02b3.firebaseio[.]com• samehnew-10a7c.appspot[.]com• dash-chat-c02b3.appspot[.]com• play-store-51182.firebaseio[.]com• hidden-chat-e58d7.firebaseio[.]com• play-store-51182.appspot[.]com• hidden-chat-e58d7.appspot[.]com• stand-by-97c5c.firebaseio[.]com• calculator-1e016.firebaseio[.]com• stand-by-97c5c.appspot[.]com• calculator-1e016.appspot[.]com• es-last-telegram.firebaseio[.]com• samehnew-10a7c.firebaseio[.]com• es-last-telegram.appspot[.]com

Technical threat report: Arid Viper

36• winetalk-9ff2d.firebaseio[.]com• nachat-152615.firebaseio[.]com• winetalk-9ff2d.appspot[.]com• nachat-152615.appspot[.]com• moone-b9497.firebaseio[.]com• chat-14bb1.firebaseio[.]com• moone-b9497.appspot[.]com• chat-14bb1.appspot[.]com

Android C2 Domains• kevin-good[.]top• vickeryduncan[.]site• marty-colvard[.]top• moggfelicio[.]info• anna-sanchez[.]online• stevensmalley[.]pro• robert-conley[.]space• kentporter[.]site• wendy-johnston[.]pw• chad-jessie[.]info• jennifer-marler[.]pw• lordblackwood[.]club• goerge-amper[.]website• julie-parker[.]top• stacks-zadar[.]website• tim-jordan[.]info• joe-rumley[.]pw• hannah-parsons[.]info• richardbeman[.]info

Android Malware Hosting Sites
Below is a list of websites that were controlled by Arid Viper and used to promote and host theirmalware:• social-store[.]online• sandra-franklin[.]fun• power-messenger[.]com• hidden-chat[.]online• dash-chat[.]site• wannameet[.]co• claytoniosep[.]live• loyronald[.]site• chat-update[.]live• gp-market[.]com• apps-store[.]online• beauty-msg[.]com• williedvazquez[.]club• melissa-garcia[.]site• paulycongalton[.]pro• apps-download[.]store• goo-ply-download[.]com• smart-messenger[.]online• stand-by[.]site• mix-store[.]online• jayboyadams[.]club• products-office[.]online• social-store[.]online• wine-talk[.]online• fast-download[.]pro• day-on[.]siteTechnical threat report: Arid Viper37• side-talk[.]com• fire-upload[.]host• app-market[.]online• files-store[.]host• telegrom[.]org• heidi-minaya[.]host• vista-chat[.]com• sha-talk[.]co• lets-msger[.]fun• whispers-talk[.]site• hookupdating[.]club• pure-talk[.]site• hookupmsg[.]club• digital-apps[.]store• amanda-hart[.]website

Micropsia C2 domains• marwapetersson[.]info• overingtonray[.]info• norayowell[.]info• scorerabbate[.]site• ansonwhitmore[.]live• irenewansley[.]icu• nicoledotson[.]icu• judystevenson[.]info• mikkelbourke[.]pro• gallant-william[.]icu• belcherjacky[.]info• linda-callaghan[.]icu

iOS Malware Hosting Sites• zc.pgyer[.]com/5SRZ (third party site)• magicsmile[.]fun• zc.pgyer[.]com/avwvei (third party site)• magic-smile[.]fun• magic-store[.]online• magic-smile[.]co• magic4smile[.]com

iOS Malware C2 Domains• margarita-smith[.]hostCredential Theft Domains• fasibauik[.]co• fasebaak[.]com• fasebcak[.]co• fasebaok[.]co• fasebcck[.]com• fasebaook[.]com• fasebcoki[.]com• fasebaok[.]com• fasebcak[.]com• log-yoahao[.]co• fasbcaok[.]com• log-yoheo[.]info

Technical threat report: Arid Viper38• fecolooklegon[.]000webhostapp[.]com• iklood[.]co• faseback[.]com• ikoad[.]co• fcaibaak[.]com• enti5abat[.]pw• fasitoak[.]com

Suspicious / Uncategorized Domains
Domains that were down at the time of analysis but are believed to be a mix of credential
phishing, C2s, and fake sites hosting Arid Android and Windows malware.
• vista-chat[.]com• rythergannon[.]info• lets-msger[.]fun• isaac-rowland[.]space• hookupdating[.]club• charmainellauzier[.]host• fire-upload[.]host• amyacunningham[.]us• files-store[.]host• lonakodas[.]club• hamas31[.]000webhostapp[.]com• skelly-chester[.]icu• krasil-anthony[.]icu• alttaeb[.]info• stikerscloud[.]com• cynthiaecook[.]club• donnamfelton[.]club• alishatnixon[.]site• accounts-goog-le[.]com• randy-severs[.]info• palpolice[.]icu• spartacuscrixus[.]club• moi-pna[.]pw• advanced-files[.]club• shortesly[.]website• leticialittle[.]pro• putanything[.]com• bourneliam[.]info• uri-ready[.]website• katesalinas[.]icu• url-redirect[.]website• autlook[.]live• cathy-seliver[.]icu• darrell-ferris[.]site• wab-wahtsapp[.]com• tommy-swope[.]site• networkmiddleast[.]net• herman-poore[.]info• robertking[.]site• kimberlycamp[.]club• jodiecarey[.]live• enough-hamas[.]000webhostapp[.]com• stevenfloyd[.]icu• hadfnews[.]000webhostapp[.]com• melissa-gonzalez[.]com• vedioplayers2020[.]000webhostapp[.]co• jeremy-tanner[.]livem• frowtisice[.]club• drivesuplouders[.]000webhostapp[.]com• ubanks[.]icu• touch[.]ps

Technical threat report: Arid Viper

39• gifts-store[.]net

II.

Malware Hashes

iOS Hashes
MD5 Hash

C2s

Hosted on

e567efd5c800c5b0c6eb5aa0bccc10e9(Mach-O)

margarita-smith[.]hostmagicchat-1f275.fireba
seio[.]com

magic4smile[.]com

4a3ba18ecc4b74d4321912882e175976(Mach-O)

margarita-smith[.]hostmagicchat-1f275.fireba
seio[.]com

zc.pgyer[.]com

Android Hashes
Representative set of hashes:
MD5 Hashes• a7a07b5c9d606fbc5480ebd5acd2cf1d• 6b2970664cac51054906983f97bd5419• 64034ca28c0844690f0a195534fff168• c3a7779e3eee4885078e03601fb2648b• 58333095cd9c36b7388901ce997baa0c• dd8485d87d8998d47de4f5dfcc9213e1• 82254d20e63491be3dfcdc0ad9a9dc6b• 8b48cec7cb30ff0f02b06c51aa15f24f• 250da45d3c509420836958547c8496ab• 8b074a0c693d287fca74231d2d6d3a99

Micropsia Hashes
Hashes for representative variants:

MD5 Hash

Variant

Compiler

a913d9d9dfc7670df5f3a235b1398be8

Micropsia

Delphi6e7b5c71f7ea462c47dc992090cd4d58

Primewire

VS C++

Technical threat report: Arid Viper40

7ea20c7c999bbd59e9b90309c0afa972

Fgref

VS C++

1507f7ecc5fe8ef4c90c853d64e1a9f9

Sears

VS C++

bbe4dddc09dcef160db0fd4c24c4f052

RahmanVS C++

e8effd3ad2069ff8ff6344b85fc12dd6

Pierogi

Free Pascal

ca1d9908f32ee5c0bdd9b4efec79108f

PyMicropsia

Python7833c0f413c1611f7281ac303bcef4b3

Glasswire

Embarcadero Delphi