Mantax Otax: Indonesian Mobile Ransomware with Spyware Integration
Source AlienVault OTX General
Description
Mantax Otax is an Android malware targeting devices running Android 9 and earlier. It combines ransomware and spyware capabilities, encrypting files with AES and appending .enc extensions. The malware requests extensive permissions, including device administrator and accessibility access, to steal sensitive data such as screen recordings, browser history, PINs, contacts, call logs, SMS, and chats from WhatsApp and Telegram. It communicates with command and control servers via HTTPS and WebSockets, using dynamic domain resolution through GitHub. Version 2 introduces advanced features like UI hijacking, screen blocking, touch input interception, harassment capabilities, and remote text-to-speech. Data exfiltration is facilitated through Firebase and Catbox services, enabling a double-extortion scheme with an interactive ransom chat portal.
Impact
The malware can encrypt user files, causing data loss unless a ransom is paid. It also steals extensive sensitive personal data, including communications and device information, which can lead to privacy breaches and further exploitation. The combination of ransomware and spyware functionalities increases the overall risk to affected users. The advanced features in version 2 enhance the malware's ability to control the device and harass victims, potentially increasing the difficulty of removal and the impact on user experience.
Defensive guidance
No specific patch or remediation is indicated for this malware. Mitigation should focus on preventing infection by avoiding installation of untrusted applications, restricting app permissions especially device administrator and accessibility access, and using reputable mobile security solutions. Users should keep their devices updated to versions later than Android 9 where possible, as this malware targets Android 9 and earlier. There is no vendor advisory or official fix available; therefore, users should rely on security best practices to reduce risk.
Indicators of compromise
Domains 4
- apimantax.otax.fun
- apixnxx.otax.fun
- cromwell.danzzichosting.my.id
- nodemyayun.otax.store
URLs 6
- https://apimantax.otax.fun
- http://38.45.65.159:2034
- http://96.9.212.22:2034
- http://cromwell.danzzichosting.my.id:62114
- http://nodemyayun.otax.store
- https://apixnxx.otax.fun
IP addresses 2
- 38.45.65.159CC=US ASN=AS174 cogent communications
- 96.9.212.22CC=US ASN=AS20278 nexeon technologies inc.
Hashes 392
- MD5 of 83df0b5583e5f5a282bc0987e220166f0367288b069146ae7d44f4a2d4b21d22
- SHA1 of 83df0b5583e5f5a282bc0987e220166f0367288b069146ae7d44f4a2d4b21d22
- MD5 of 4104fae6bac93d50aeb3a3e24d41aee10b96b7049ead0c0717f02b71d57657ca
- MD5 of 8459c2d6ca0967673eb4e6037ba41e5395d47278543cf90604951d0656ec8e4c
- MD5 of f01678f275f88d33c445f16c3680bbbc51e0b2205bf6d0b66f9b137bb7153d73
- SHA1 of 4104fae6bac93d50aeb3a3e24d41aee10b96b7049ead0c0717f02b71d57657ca
- SHA1 of 8459c2d6ca0967673eb4e6037ba41e5395d47278543cf90604951d0656ec8e4c
- SHA1 of f01678f275f88d33c445f16c3680bbbc51e0b2205bf6d0b66f9b137bb7153d73