Corona Updates

MITRE ATT&CK: S0425 View on attack.mitre.org

Aliases: Wabi Music, Concipit1248, Corona Updates

First seen
2020-03-01 00:00:00
Malware type
spyware
Family
Malware family
Operating systems
android
Profile updated
2026-07-07 15:28:18

Targeted industries: healthcare-and-pharmaceutical government-and-public-sector

Context

Corona Updates is Android spyware that took advantage of the Coronavirus pandemic. The campaign distributing this spyware is tracked as Project Spy. Multiple variants of this spyware have been discovered to have been hosted on the Google Play Store.

Malware & tools used

  • SMS Control (attack-pattern)
  • Call Log (attack-pattern)
  • Access Notifications (attack-pattern)
  • Location Tracking (attack-pattern)
  • Data from Local System (attack-pattern)
  • Video Capture (attack-pattern)
  • Contact List (attack-pattern)
  • SMS Messages (attack-pattern)
  • Audio Capture (attack-pattern)
  • Web Protocols (attack-pattern)
  • System Network Configuration Discovery (attack-pattern)
  • System Information Discovery (attack-pattern)
  • Exfiltration Over Unencrypted Non-C2 Protocol (attack-pattern)
  • Internet Connection Discovery (attack-pattern)
  • Wi-Fi Discovery (attack-pattern)

Reports & references

  • MITRE ATT&CK — S0425 (report)
  • Trend Micro — Coronavirus Update App Leads To Project Spy Android And Ios Spyware (report)

External references