Koktevrat Propose Change

Koktevrat is an Android malware family identified in a fake government application campaign targeting users in Poland. The malware was distributed as MandatGo, an application impersonating a non-existent Polish government service for paying fines and promoted through Facebook advertisements offering discounts on parking fees. The initial APK acts as a dropper: after installation, it decrypts and dynamically loads embedded DEX code and retrieves an additional payload, which is subsequently installed as the second stage. The malware uses obfuscation and dynamic class loading to hinder static analysis.

The second stage is a fully featured Android RAT that abuses the Accessibility Service to control the infected device and interact with applications. Its capabilities include screen capture and continuous screen streaming, UI-tree collection, simulated clicks and text input, clipboard access, keylogging, SMS collection, application enumeration, HTML overlays, and execution of remote commands. Overlays can be selectively displayed over targeted applications, including banking applications, enabling credential and sensitive-data theft. The malware also implements anti-uninstallation functionality and can attempt to disable Google Play Protect.

Koktevrat maintains persistent communication with its C2 infrastructure through a background service and uses Firebase Cloud Messaging (FCM) to obtain a device token and signal connectivity. It periodically performs a four-hour heartbeat and can establish TCP proxy tunnels through the C2. The analyzed samples contain two hard-coded WebSocket C2 domains, streams-tv[.]lol and stream-plus[.]lat; the malware also implements dynamically generated C2 domains.

The family name Koktevrat is a working designation derived from the notification channel identifier koktevran_channel. No reliable attribution to an existing Android malware family was established during the analysis.

References

There is no Yara-Signature yet.