{
  "name": "Playing Possum: What's the Backdoor Up To?",
  "slug": "playing-possum-whats-the-backdoor-up-to",
  "description": "This report analyzes the Wpeeper backdoor targeting Android systems. Wpeeper utilizes compromised WordPress sites as relay C2 servers to hide its true C2. It uses HTTPS requests with Session fields to differentiate command types. Commands are encrypted with AES and signed to prevent takeover. Wpeeper originated from repackaged apps in UPtodown Store. It was distributed through sites appflyer.co and dn.jnipatch.com. On April 22, Wpeeper suddenly ceased activity for unknown reasons.",
  "published": "2024-05-03T08:47:23+00:00",
  "created_at": "2024-05-03T08:47:23+00:00",
  "modified_at": "2024-05-03T09:49:49+00:00",
  "created_at_opencti": "2024-05-03T08:47:23+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2024-05-03",
    "android",
    "backdoor",
    "wpeeper"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "www.yitaichi.com"
      },
      {
        "id": "",
        "name": "www.francescocutrupi.com"
      },
      {
        "id": "",
        "name": "www.elcomparadorseguros.com"
      },
      {
        "id": "",
        "name": "www.cureoscitystaging.com"
      },
      {
        "id": "",
        "name": "www.civitize.com"
      },
      {
        "id": "",
        "name": "www.chasinglydie.com"
      },
      {
        "id": "",
        "name": "https://wyattotero.com/AQVLLY/"
      },
      {
        "id": "",
        "name": "https://www.yitaichi.com/K7ODU6/"
      },
      {
        "id": "",
        "name": "https://www.francescocutrupi.com/WJYP89/"
      },
      {
        "id": "",
        "name": "https://www.elcomparadorseguros.com/A5FDX7/"
      },
      {
        "id": "",
        "name": "https://www.cureoscitystaging.com/YKUCU8/"
      },
      {
        "id": "",
        "name": "https://www.chasinglydie.com/7V5QT0/"
      },
      {
        "id": "",
        "name": "https://www.civitize.com/0SA67H/"
      },
      {
        "id": "",
        "name": "https://vaticanojoyas.com/R5Q7G4/"
      },
      {
        "id": "",
        "name": "https://wendyllc.com/QD8490/"
      },
      {
        "id": "",
        "name": "https://web.rtekno.com/5XPOS2/"
      },
      {
        "id": "",
        "name": "https://trashspringield.com/GYNH3A/"
      },
      {
        "id": "",
        "name": "https://tartarcusp.com/BZRAWE/"
      },
      {
        "id": "",
        "name": "https://toubainfo.com/G1ACF0/"
      },
      {
        "id": "",
        "name": "https://stilesmcgraw.com/1WN2BH/"
      },
      {
        "id": "",
        "name": "https://speedyrent-sa.com/AIOFB2/"
      },
      {
        "id": "",
        "name": "https://socktopiashop.com/4WYZ7I/"
      },
      {
        "id": "",
        "name": "https://snipsnack.com/T8Q2BN/"
      },
      {
        "id": "",
        "name": "https://schatzrestaurant.com/J2WMA6/"
      },
      {
        "id": "",
        "name": "https://scatsexo.com/NVZ4L0/"
      },
      {
        "id": "",
        "name": "https://rastellimeeting.com/9Q4GOM/"
      },
      {
        "id": "",
        "name": "https://qualitygoodsforconfectioners.com/3QLS47/"
      },
      {
        "id": "",
        "name": "https://petintrip.com/QPNQSM/"
      },
      {
        "id": "",
        "name": "https://ocalacommercialconstruction.com/WXFHF6/"
      },
      {
        "id": "",
        "name": "https://nutrivital-in.com/7DB9BC/"
      },
      {
        "id": "",
        "name": "https://nt-riccotech.com/Q4LQKN/"
      },
      {
        "id": "",
        "name": "https://naroyaldiamonds.com/WZJ236/"
      },
      {
        "id": "",
        "name": "https://mrscanology.com/8GVHT3/"
      },
      {
        "id": "",
        "name": "https://masterlogisticsfzco.com/5CBSYC/"
      },
      {
        "id": "",
        "name": "https://kiwisnowman.com/DC4O03/"
      },
      {
        "id": "",
        "name": "https://hhfus.com/CUGCCO/"
      },
      {
        "id": "",
        "name": "https://gadeonclub.com/Q9DVGH/"
      },
      {
        "id": "",
        "name": "https://fontshown.com/4D69BN/"
      },
      {
        "id": "",
        "name": "https://focusframephoto.com/1J10V9/"
      },
      {
        "id": "",
        "name": "https://eamdomai.com/e?token=Tp5D1nRiu3rFOaCbT4PVcewqIhqbQspd8/3550AI/b1MMJttn+xr4oEFJiGx1bCZztteCi5dG1gYFlNTL0Fp8UaMxROCw4cr225ENjOCmT8oQUyMTjjuTo10fAuFsz9j"
      },
      {
        "id": "",
        "name": "https://essentialelearning.com/EVSKOT/"
      },
      {
        "id": "",
        "name": "https://dodgeagonize.com/KJSLOT/"
      },
      {
        "id": "",
        "name": "https://dibplumber.com/LCN9UJ/"
      },
      {
        "id": "",
        "name": "https://dn.jnipatch.com/downloads/latest/device/android"
      },
      {
        "id": "",
        "name": "https://dermocuidado.com/8QSCZP/"
      },
      {
        "id": "",
        "name": "https://coexisthedge.com/ZF57OA/"
      },
      {
        "id": "",
        "name": "https://carshringaraligarh.com/TBHH4O/"
      },
      {
        "id": "",
        "name": "https://carloadspry.com/SJI4C1/"
      },
      {
        "id": "",
        "name": "https://beanblisscafe.com/MX1OAS/"
      },
      {
        "id": "",
        "name": "https://barbeariadomarfim.com/BN2TTO/"
      },
      {
        "id": "",
        "name": "https://avsecretarial.com/PYWDEL/"
      },
      {
        "id": "",
        "name": "https://atba3li.com/Z99QQ6/"
      },
      {
        "id": "",
        "name": "https://4devsolutions.com/4NUAK1/"
      },
      {
        "id": "",
        "name": "https://appflyer.co/downloads/latest/device/android/"
      },
      {
        "id": "",
        "name": "http://snipsnack.com/T8Q2BN/"
      },
      {
        "id": "",
        "name": "web.rtekno.com"
      },
      {
        "id": "",
        "name": "dn.jnipatch.com"
      },
      {
        "id": "",
        "name": "wyattotero.com"
      },
      {
        "id": "",
        "name": "wendyllc.com"
      },
      {
        "id": "",
        "name": "vaticanojoyas.com"
      },
      {
        "id": "",
        "name": "trashspringield.com"
      },
      {
        "id": "",
        "name": "toubainfo.com"
      },
      {
        "id": "",
        "name": "tartarcusp.com"
      },
      {
        "id": "",
        "name": "stilesmcgraw.com"
      },
      {
        "id": "",
        "name": "speedyrent-sa.com"
      },
      {
        "id": "",
        "name": "socktopiashop.com"
      },
      {
        "id": "",
        "name": "snipsnack.com"
      },
      {
        "id": "",
        "name": "schatzrestaurant.com"
      },
      {
        "id": "",
        "name": "rastellimeeting.com"
      },
      {
        "id": "",
        "name": "scatsexo.com"
      },
      {
        "id": "",
        "name": "qualitygoodsforconfectioners.com"
      },
      {
        "id": "",
        "name": "ocalacommercialconstruction.com"
      },
      {
        "id": "",
        "name": "petintrip.com"
      },
      {
        "id": "",
        "name": "nutrivital-in.com"
      },
      {
        "id": "",
        "name": "naroyaldiamonds.com"
      },
      {
        "id": "",
        "name": "nt-riccotech.com"
      },
      {
        "id": "",
        "name": "mrscanology.com"
      },
      {
        "id": "",
        "name": "hhfus.com"
      },
      {
        "id": "",
        "name": "masterlogisticsfzco.com"
      },
      {
        "id": "",
        "name": "kiwisnowman.com"
      },
      {
        "id": "",
        "name": "gadeonclub.com"
      },
      {
        "id": "",
        "name": "fontshown.com"
      },
      {
        "id": "",
        "name": "focusframephoto.com"
      },
      {
        "id": "",
        "name": "essentialelearning.com"
      },
      {
        "id": "",
        "name": "eamdomai.com"
      },
      {
        "id": "",
        "name": "dodgeagonize.com"
      },
      {
        "id": "",
        "name": "dibplumber.com"
      },
      {
        "id": "",
        "name": "dermocuidado.com"
      },
      {
        "id": "",
        "name": "coexisthedge.com"
      },
      {
        "id": "",
        "name": "carshringaraligarh.com"
      },
      {
        "id": "",
        "name": "carloadspry.com"
      },
      {
        "id": "",
        "name": "beanblisscafe.com"
      },
      {
        "id": "",
        "name": "barbeariadomarfim.com"
      },
      {
        "id": "",
        "name": "avsecretarial.com"
      },
      {
        "id": "",
        "name": "atba3li.com"
      },
      {
        "id": "",
        "name": "appflyer.co"
      },
      {
        "id": "",
        "name": "4devsolutions.com"
      },
      {
        "id": "",
        "name": "e5af8e705e079d28f795cf490a66f74415699c9674833e2524eb746004d56a6b"
      }
    ],
    "malware": [
      {
        "id": "a6ba744a-4ce3-4f61-b6ac-f85cfc20d41f",
        "name": "Wpeeper",
        "slug": "wpeeper"
      }
    ],
    "attack_patterns": [
      {
        "id": "4d36ebe8-4925-419a-bdd5-73f6427a975d",
        "name": "T1064"
      },
      {
        "id": "a72ebeae-8e62-4039-8135-e9c611011fdc",
        "name": "T1573"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "dc342445-1b78-48b4-aa06-89ed2ad7c28e",
        "name": "T1071"
      },
      {
        "id": "7d7ac733-6442-416f-8669-c302dd0843b9",
        "name": "T1036"
      },
      {
        "id": "50514c04-b3a2-4abf-a855-e3a434200c87",
        "name": "T1204"
      },
      {
        "id": "0156fcda-e385-4662-b388-086c3e16feec",
        "name": "T1140"
      },
      {
        "id": "81ee4813-4f68-4984-bec1-980d7c5b56eb",
        "name": "T1132"
      },
      {
        "id": "0c836307-129e-4ff7-a532-180c633cacba",
        "name": "T1027"
      },
      {
        "id": "0b2b1ecd-d52e-492a-af08-050954bc03e5",
        "name": "T1056"
      },
      {
        "id": "ca53b2fa-42a8-45ec-9682-0cf54bf280f3",
        "name": "T1090"
      }
    ]
  },
  "external_refs": [
    "https://blog.xlab.qianxin.com/playing-possum-whats-the-wpeeper-backdoor-up-to/",
    "https://otx.alienvault.com/pulse/6634c0bb7202460298c07786"
  ]
}