Hide Navigation Hide TOC

FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)

FrozenCell is the mobile component of a family of surveillanceware, with a corresponding desktop component known as KasperAgent and Micropsia.(Citation: Lookout FrozenCell)

There are multiple close variants of FrozenCell, such as VAMP(Citation: Unit42 VAMP 2017), GnatSpy(Citation: Trendmicro GnatSpy 2017), Desert Scorpion and SpyC23, which add some additional functionality but are not significantly different from the original malware.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Match Legitimate Name or Location - T1655.001 (114fed8b-7eed-4136-8b9c-411c5c7fff4b)	Attack Pattern	FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	1
FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	Stored Application Data - T1409 (702055ac-4e54-4ae9-9527-e23a38e0b160)	Attack Pattern	1
Data from Local System - T1533 (e1c912a9-e305-434b-9172-8a6ce3ec9c4a)	Attack Pattern	FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	1
Archive Collected Data - T1532 (e3b936a4-6321-4172-9114-038a866362ec)	Attack Pattern	FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	1
FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	System Network Configuration Discovery - T1422 (d4536441-1bcc-49fa-80ae-a596ed3f7ffd)	Attack Pattern	1
FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	System Information Discovery - T1426 (e2ea7f6b-8d4f-49c3-819d-660530d12b77)	Attack Pattern	1
Download New Code at Runtime - T1407 (6c49d50f-494d-4150-b774-a655022d20a6)	Attack Pattern	FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	1
FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	SMS Messages - T1636.004 (c6421411-ae61-42bb-9098-73fddb315002)	Attack Pattern	1
FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	Location Tracking - T1430 (99e6295e-741b-4857-b6e5-64989eb039b4)	Attack Pattern	1
File and Directory Discovery - T1420 (cf28ca46-1fd3-46b4-b1f6-ec0b72361848)	Attack Pattern	FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	1
Audio Capture - T1429 (6683aa0c-d98a-4f5b-ac57-ca7e9934a760)	Attack Pattern	FrozenCell - S0577 (96ea1e13-d50f-45f1-b0cf-4ac9bc5a2d62)	Malware	1
Match Legitimate Name or Location - T1655.001 (114fed8b-7eed-4136-8b9c-411c5c7fff4b)	Attack Pattern	Masquerading - T1655 (f856eaab-e84a-4265-a8a2-7bf37e5dc2fc)	Attack Pattern	2
Protected User Data - T1636 (11c2c2b7-1fd4-408f-bc2e-fe772ef9df5e)	Attack Pattern	SMS Messages - T1636.004 (c6421411-ae61-42bb-9098-73fddb315002)	Attack Pattern	2