Security Alert: IranGuard Spyware Campaign

A spear-phishing campaign is distributing surveillance malware named "IranGuard" targeting Iranian individuals and organizations. The malware is delivered via spear-phishing emails impersonating the "Etelaat Faraja" (فرماندهی اطلاعات فراجا - FARAJA Intelligence Command), an Iranian law enforcement intelligence agency. The campaign distributes both Android (APK) and Windows (EXE) variants of the spyware, providing comprehensive surveillance capabilities across both mobile and desktop platforms.

Malware Analysis

Android Variant (Iranguard.apk)

Detection Rate: 22/67 antivirus engines

Classification:

• Kaspersky: HEUR:Trojan-Spy.AndroidOS.Agent.abd
• ESET: Android/Spy.Agent.APU trojan
• DrWeb: Android.Backdoor.739.origin
• Avast/AVG: Android:Caspy-C [Spy]

Package Information:

• Package Name: com.example.dat.a8andoserverx
• Main Activity: com.example.dat.a8andoserverx.MainActivity
• Min SDK: 14 (Android 4.0)
• Target SDK: 22 (Android 5.1)

Certificate Information:

• CN: Ahmed
• Location: Gaza, Palestine
• Valid From: June 11, 2018
• Thumbprint: d8627113ff814745774947709c730c678832c43a

Dangerous Permissions Requested:

Malicious Behaviors (MITRE ATT&CK):

Key Capabilities:

• SMS interception and exfiltration (content://sms/inbox)
• Contact theft (ContactsContract)
• Incoming/outgoing call monitoring
• Audio recording via MediaRecorder
• GPS location tracking
• Auto-start on boot (BOOT_COMPLETED)
• Hides app icon from launcher (stealth mode)
• Requests root access (su command)

Windows Variant (Iranguard.exe)

Detection Rate: Multiple engines detect as malicious trojan

Classification:

• YARA Rule: AutoIT_Compiled - Compiled AutoIT script
• Sigma Rule: High severity - "New RUN Key Pointing to Suspicious Folder"
• Threat label: trojan.valyria

File Properties:

• File Type: PE32 executable (GUI) Intel 80386
• Compiler: AutoIt v3
• Size: 1,367,955 bytes
• PE Timestamp: 2012-01-29

Persistence Mechanism:

Registry Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Run\UQJWJJ
Value: "C:\Users\[USER]\AppData\Roaming\Windata\Iranguard.exe"

Malicious Behaviors (MITRE ATT&CK):

Key Capabilities:

• Keylogger - Records all keystrokes
• Screenshot capture - Takes desktop screenshots
• Clipboard monitoring - Steals copied data
• File download/execution - RAT functionality
• FTP communication - Data exfiltration
• Process enumeration - System reconnaissance
• Anti-analysis - Checks for mouse movement to detect sandboxes
• Persistence - Registry autorun modification

Phishing Email Analysis

The phishing email impersonates "Etelaat Faraja" (فرماندهی اطلاعات فراجا), which translates to "FARAJA Intelligence Command" - a reference to Iranian law enforcement intelligence. The email was sent to a massive distribution list including:

Email Content (Translated):

Subject: Important Directive from FARAJA Intelligence Command

The Islamic Republic of Iran Intelligence Organization Command has issued an emergency directive requiring the use of the IranGuard application for:

• Work communications
• Necessary coordination

Features of IranGuard:

• Available for Android (smartphones) and Windows (computers)
• Functions as a secure communication option during severe internet restrictions

Emergency Status: Download links provided

• Windows: hxxp[:]//up44[.]ir/yhloi2vr
• Android: hxxp[:]//up44[.]ir/saia4vhc

The email uses urgency and authority impersonation to trick victims into installing the spyware.

Attribution Indicators

While definitive attribution requires further investigation, several indicators suggest potential state-sponsored origin:

1. Target Selection: Iranian civil society, universities, government workers, human rights organizations
2. Impersonation: Uses legitimate Iranian government agency branding (FARAJA)
3. Language: Native Persian content with government-style formatting
4. Infrastructure: Uses portmap.io tunneling service to obscure C2 infrastructure
5. Certificate: Signed with name "Ahmed" from "Gaza, Palestine" - likely false flag

Indicators of Compromise (IOCs)

File Hashes

Network Indicators

Email Indicators