Malvertisement link, attacks windows but I don't know about android

[soijds231]

accidentally clicked on this advert on an app on my android phone

I have run it through some online malware analysis tools and it appears like it evades sandboxes on windows devices. I have no idea how to check if it has downloaded a payload on my phone however. What should be the next steps I go through. 

 

https://     aw14209e.aweb  .page/p/  9202258e-40a1-4548-b1d8-0a2873da4b92

 

[mbam_mtbr]

Hi @soijds231,

I tested the link in an Android Emulator.  No payload dropped.  On Android, you would see something downloaded to your Downloads folder, and also have to confirm the install.  Looks like a money scam from the webpage info:

FORTY "Done For You" Campaigns

Made Us Over $92,412.82 
Just Copy & Past...Each Campaign Generates Passive Income Daily...
Now It's Your Turn to Make Big Money!

Step 1. Login To Clone-ME...Members Area & Enter your PayPal Account. Step 2. Deploy...Send Traffic (We'll Teach You a Simple FREE Method Inside) Step 3. Monetize...Click "Refresh" to see the Amount of Commissions You've Earned Each Day!

Needless to say, but don't sign up for this "money maker". 🙄  I'll send this over to your web team to block.

Thanks for letting us know,

Nathan

[Dashke]

On 9/12/2021 at 12:40 PM, soijds231 said:

accidentally clicked on this advert on an app on my android phone

I have run it through some online malware analysis tools and it appears like it evades sandboxes on windows devices. I have no idea how to check if it has downloaded a payload on my phone however. What should be the next steps I go through. 

 

https://     aw14209e.aweb  .page/p/  9202258e-40a1-4548-b1d8-0a2873da4b92

 

Thank you very much for reporting this link!

We have added it to our database.

Fortunately, there are no drive-by downloads detected in the page, so your phone should be safe. :)

[soijds231]

Thanks for the reply! 

I am just wondering as I fiddled around in a windows sandbox and once I got around the sandbox evasion it appears to show a mitre attack crypto api that aims to steal credentials. I can link the report if desired? Or is it just aiming at attacking vulnerable windows systems instead? As the static code analysis for android gave me nothing too.

I only have a pretty basic understanding on this subject so I appreciate any knowledge you can share. 

 

Thanks again for getting back to me everyone! 

[mbam_mtbr]

2 hours ago, soijds231 said:

Thanks for the reply! 

I am just wondering as I fiddled around in a windows sandbox and once I got around the sandbox evasion it appears to show a mitre attack crypto api that aims to steal credentials. I can link the report if desired? Or is it just aiming at attacking vulnerable windows systems instead? As the static code analysis for android gave me nothing too.

I only have a pretty basic understanding on this subject so I appreciate any knowledge you can share. 

 

Thanks again for getting back to me everyone! 

Hi @soijds231,

I'd probably ask that over in the Windows side of the forums.  One way or another, the link will be blocked on both mobile and PC.

Nathan