> For the complete documentation index, see [llms.txt](https://0xsec.gitbook.io/0xsec/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://0xsec.gitbook.io/0xsec/malware-analysis/2026-02-14-apt36.md). # Operation Ghazwa: Disecting APT36's RAT ### Overview **Operation C-Major** aka: APT 36, APT36, C-Major, COPPER FIELDSTONE, Earth Karkaddan, Green Havildar, Mythic Leopard, ProjectM, Storm-0156, TMP.Lapis, Transparent Tribe Group targeting Indian Army or related assets in India, as well as activists and civil society in Pakistan. Attribution to a Pakistani connection has been made by TrendMicro and others. ### Technical Analysis After getting apk file I staright jumped to `AndroidManifest.xml` to see what permissions were declared in it and I came through some permissions like `ACCESS_FINE_LOCATION, READ_MEDIA_AUDIO/IMAGES/VIDEO`, read and write permissions for storage, access to camera, reading contacts and call logs, `FOREGROUND_SERVICE` permission with location, camera, microphone and even capture screen contents `FOREGROUND_SERVICE_MEDIA_PROJECTION` so that it can spy on victim even when phone is in sleep mode by running continously in background and for that it also asks for permissions to `IGNORE_BATTERY_OPTIMIZATIONS`. So, it is basically a RAT from this basic overview, and this apk is being shipped as `com.ghazwa.updates`.

Figure 1: Dangerous Permissions

`SYSINFO` is Deivce fingerprinting and recon module that is responsible for getting information about the device like build version, IP, network information, device name, IMEI numbers, country code, operator name, SIM country code, serial number of SIM. Similar to what I have analzed in [AndroRAT](https://0xsec1.github.io/posts/AndroRAT/).

Figure 2: Device fingerprinting and Recon

In `SEITTING`, and yes its SEITTING(typo :)) I found the C2 configurations including web url `https[:]//itcstore.org/blog/ghazwa_news[.]php`, server IP `93.127.136.237` and they somewhat tried to encode it with `_` and then replacing it with `""` when executed and server port `18525`, version of `S.M.0.3` didn't know what's this version number. And it stores notifications and logs in different paths `_DERTDFI, _DERTOG_`.

Figure 3: C2 Config and settings

`SMLIST` module sweeps through the android system SMS database and extracts all the messages and stores them with certain column `"_id", "thread_id", "address", "person", "date", "read", "body", "type"` it also tries to steal the contact photo and sends these messages in batch of `10 messages` but there is a flaw while it extracts the photo of contact it has to use the `Contact ID` for that but its using `ID` of messages so mostly times the next block `input` will be null and its rare that it will find the photo.

Figure 4: SMS Exfiltration module

`WEBVIEW` module loads a url in app which we found earlier in C2 config, and it loads a web page of `Ghazwa-e-hind` propoganda, and they tried to use a legitimate name of `ITC` for publishing it.

Figure 5: Loads a WEB url for their propoganda

`CONTLIST` exfiltrates victims contact list from starred contacts to whom he/she talked recently which can be further used for phising attempts and tries to attack other users of contact list, it even logs timestamp of call logs and sends these logs in batch of `10 contacts` back to C2 server.

Figure 6: Exfiltrates Victim's contact list

`GPSSERV` modules gets the location of victim including GPS as well as network location, and in case the location of user gets changed it logs it too and sends the new location back to the attacker.

Figure 7: Exfiltrates Victim's Location GPS and Network

`ADSFEAM` is the mic recording module, now victim's device acts as a bug that captures real time audio and sends to attacker. It continously reads audio chunks from mic to a buffer and add those raw bytes to a queue.

Figure 8: Records audio using mic

`DIRLIST` module is responsible for all operation related to directories from read, writing to viewing, it can add files to storage, gets the information of a file, recursively view all the directories and files and sends those logs back to C2.

Figure 9: All operations regarding directory and file

Now the main module which combines all above independent modules together is `MEATIER` which handles everything I found above with additional getting commands from C2 server, it exfiltrates notifications and can even send a custom notification, can capture screen, captures video from both camera using `PHOSERV` modules.

Figure 10: Combines all modules together

### IOCs * **Web URL**: `https[:]//itcstore.org/blog/ghazwa_news[.]php` * **C2 IP**: `93.127.136.237` * **C2 PORT**: `18585` * **Package**: com.ghazwa.updates ### Rule I used this rule against `classes3.dex`. ``` rule APT36_RAT_Ghazwa { meta: description = "Detects APT36 RAT for Android (Ghazwa)" author = "0xSec" date = "2026-02-11" threat_actor = "Transparent Tribe (APT36)" strings: $class1 = "Lcom/ghazwa/updates/MEATIER;" ascii $class2 = "Lcom/ghazwa/updates/SEITING;" ascii $class3 = "Lcom/ghazwa/updates/ADSFEAM;" ascii $class4 = "Lcom/ghazwa/updates/SMLISTS;" ascii $class5 = "Lcom/ghazwa/updates/GPSSERV;" ascii $class6 = "Lcom/ghazwa/updates/PHOSERV;" ascii $class7 = "Lcom/ghazwa/updates/SYSINFO;" ascii $tag1 = "smxslg=" ascii $tag2 = "coxnta=" ascii $tag3 = "exxcep=" ascii $tag4 = "anxotifi=" ascii $tag5 = "chxkperm=" ascii $tag6 = "lgxps=" ascii $tag7 = "lnxtwok=" ascii $tag8 = "fixle=" ascii $config1 = "9_3.12_7.13_6._237" ascii $config2 = "https://itcstore.org/blog/ghazwa_news.php" ascii $config3 = "S.M.0.3" ascii condition: 1 of ($class*) and (1 of ($tag*) or 1 of ($config*)) } ``` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://0xsec.gitbook.io/0xsec/malware-analysis/2026-02-14-apt36.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.