test.txt

Why	O
Did	O
Chinese	O
Spyware	O
Linger	O
in	O
U.S	O
.	O

Phones	O
?	O

November	O
16	O
,	O
2016	O
In	O
what	O
's	O
being	O
chalked	O
up	O
as	O
an	O
apparent	O
mistake	O
,	O
more	O
than	O
120,000	O
Android	B-System
phones	O
sold	O
in	O
the	O
U.S.	O
were	O
shipped	O
with	O
spying	O
code	O
that	O
sent	O
text	O
messages	O
,	O
call	O
logs	O
and	O
other	O
sensitive	O
data	O
to	O
a	O
server	O
in	O
Shanghai	O
.	O

The	O
New	B-Organization
York	I-Organization
Times	I-Organization
reported	O
on	O
Nov.	O
15	O
that	O
Kryptowire	B-Organization
,	O
a	O
mobile	O
enterprise	O
security	O
company	O
,	O
discovered	O
the	O
code	O
on	O
a	O
lower-end	O
smartphone	O
made	O
by	O
BLU	B-Organization
Products	O
of	O
Doral	O
,	O
Fla	O
.	O

The	O
phones	O
are	O
sold	O
at	O
Best	B-Organization
Buy	I-Organization
and	O
Amazon.com	B-Organization
,	O
among	O
other	O
retail	O
outlets	O
.	O

Kryptowire	B-Organization
says	O
the	O
code	O
,	O
which	O
it	O
found	O
on	O
a	O
BLU	B-Organization
R1	O
HD	O
devices	O
,	O
transmitted	O
fine-grained	O
location	O
information	O
and	O
allowed	O
for	O
the	O
remote	O
installation	O
of	O
other	O
apps	O
.	O

Text	O
message	O
and	O
call	O
logs	O
were	O
transmitted	O
every	O
72	O
hours	O
to	O
the	O
Shanghai	O
server	O
,	O
and	O
once	O
a	O
day	O
for	O
other	O
personally	O
identifiable	O
data	O
,	O
the	O
company	O
says	O
.	O

It	O
turns	O
out	O
,	O
however	O
,	O
that	O
other	O
security	O
researchers	O
noticed	O
suspicious	O
and	O
faulty	O
code	O
on	O
BLU	B-Organization
devices	O
as	O
early	O
as	O
March	O
2015	O
,	O
and	O
it	O
has	O
taken	O
nearly	O
that	O
long	O
to	O
remove	O
it	O
from	O
the	O
company	O
's	O
devices	O
.	O

The	O
finding	O
,	O
in	O
part	O
,	O
shows	O
the	O
risk	O
that	O
can	O
come	O
in	O
opting	O
for	O
less	O
expensive	O
smartphones	O
,	O
whose	O
manufacturers	O
may	O
not	O
diligently	O
fix	O
security	B-Vulnerability
vulnerabilities	I-Vulnerability
.	O

It	O
's	O
also	O
raising	O
eyebrows	O
because	O
of	O
the	O
connection	O
with	O
China	O
,	O
which	O
has	O
frequently	O
sparred	O
with	O
the	O
U.S.	O
over	O
cyber	O
espionage	O
.	O

BLU	B-Organization
Products	O
has	O
now	O
updated	O
its	O
phones	O
to	O
remove	O
the	O
spying	O
code	O
,	O
which	O
most	O
likely	O
would	O
have	O
never	O
been	O
detected	O
by	O
regular	O
users	O
.	O

The	O
code	O
never	O
informed	O
phone	O
users	O
that	O
it	O
was	O
collecting	O
that	O
data	O
,	O
a	O
behavior	O
uniformly	O
viewed	O
by	O
many	O
as	O
a	O
serious	O
security	O
concern	O
.	O

The	O
developer	O
of	O
the	O
code	O
,	O
Shanghai	B-Organization
Adups	I-Organization
Technology	I-Organization
Co.	I-Organization
,	O
has	O
apologized	O
,	O
contending	O
that	O
the	O
code	O
was	O
intended	O
for	O
another	O
one	O
of	O
its	O
clients	O
who	O
requested	O
better	O
blocking	O
of	O
junk	O
text	O
messages	O
and	O
marketing	O
calls	O
.	O

Vulnerabilities	O
Reported	O
BLU	O
Products	O
,	O
founded	O
in	O
2009	O
,	O
makes	O
lower-end	O
Android-powered	B-System
smartphones	O
that	O
sell	O
for	O
as	O
little	O
as	O
$	O
50	O
on	O
Amazon	B-Organization
.	O

Like	O
many	O
original	O
equipment	O
manufacturers	O
,	O
it	O
uses	O
software	O
components	O
from	O
other	O
developers	O
.	O

The	O
company	O
uses	O
a	O
type	O
of	O
software	O
from	O
Adups	B-Organization
that	O
's	O
nicknamed	O
FOTA	B-System
,	O
short	O
for	O
firmware	O
over-the-air	O
.	O

The	O
software	O
manages	O
the	O
delivery	O
of	O
firmware	O
updates	O
over-the-air	O
,	O
the	O
term	O
used	O
for	O
transmission	O
via	O
a	O
mobile	O
network	O
.	O

Firmware	O
is	O
low-level	O
code	O
deep	O
in	O
an	O
operating	O
system	O
that	O
often	O
has	O
high	O
access	O
privileges	O
,	O
so	O
it	O
's	O
critical	O
that	O
it	O
's	O
verified	O
and	O
contains	O
no	O
software	O
vulnerabilities	O
.	O

Long	O
before	O
Kryptowire	B-Organization
's	O
announcement	O
,	O
Tim	O
Strazzere	O
,	O
a	O
mobile	O
security	O
researcher	O
with	O
RedNaga	B-Organization
Security	I-Organization
,	O
contacted	O
BLU	O
Products	O
in	O
March	O
2015	O
after	O
he	O
found	O
two	O
vulnerabilities	O
that	O
could	O
be	O
traced	O
to	O
Adup	B-Organization
's	O
code	O
.	O

Those	O
vulnerabilities	O
could	O
have	O
enabled	O
someone	O
to	O
gain	O
broad	O
access	O
to	O
an	O
Android	B-System
device	O
.	O

Strazzere	O
's	O
colleague	O
,	O
Jon	O
Sawyer	O
,	O
suggested	O
on	O
Twitter	B-Organization
that	O
the	O
vulnerabilities	O
might	O
have	O
not	O
been	O
there	O
by	O
mistake	O
,	O
but	O
rather	O
included	O
as	O
intentionally	O
coded	O
backdoors	O
.	O

He	O
posted	O
a	O
tweet	O
to	O
The	O
New	B-Organization
York	I-Organization
Times	I-Organization
report	O
,	O
sarcastically	O
writing	O
,	O
"	O
If	O
only	O
two	O
people	O
had	O
called	O
this	O
company	O
out	O
for	O
their	O
backdoors	O
several	O
times	O
over	O
the	O
last	O
few	O
years	O
.	O

''	O
Strazzere	O
's	O
experience	O
in	O
trying	O
to	O
contact	O
both	O
vendors	O
last	O
year	O
is	O
typical	O
of	O
the	O
frustrations	O
frequently	O
faced	O
by	O
security	O
researchers	O
.	O

"	O
I	O
tried	O
reaching	O
out	O
to	O
Adups	B-Organization
and	O
never	O
heard	O
back	O
,	O
''	O
Strazzere	O
tells	O
Information	B-Organization
Security	I-Organization
Media	I-Organization
Group	I-Organization
.	O

"	O
BLU	B-Organization
said	O
they	O
had	O
no	O
security	O
department	O
when	O
I	O
emailed	O
them	O
.	O

''	O
Strazzere	O
says	O
he	O
also	O
failed	O
to	O
reach	O
MediaTek	B-Organization
,	O
a	O
Taiwanese	O
fabless	O
semiconductor	O
manufacturer	O
whose	O
chipsets	O
that	O
powered	O
BLU	B-Organization
phones	O
also	O
contained	O
Adups	B-Organization
software	O
.	O

To	O
their	O
credit	O
,	O
both	O
Google	B-Organization
and	O
Amazon	B-Organization
appear	O
to	O
have	O
put	O
pressure	O
on	O
device	O
manufacturers	O
to	O
fix	O
their	O
devices	O
when	O
flaws	O
are	O
found	O
,	O
Strazzere	O
says	O
.	O

For	O
Google	B-Organization
,	O
Android	O
security	O
issues	O
-	O
even	O
if	O
not	O
in	O
the	O
core	O
operating	O
code	O
-	O
are	O
a	O
reputation	O
threat	O
,	O
and	O
for	O
Amazon	B-Organization
,	O
a	O
product	O
quality	O
issue	O
.	O

But	O
devices	O
sold	O
outside	O
of	O
Amazon	B-Organization
"	O
might	O
not	O
have	O
ever	O
seen	O
fixes	O
,	O
''	O
he	O
says	O
.	O

Officials	O
at	O
BLU	B-Organization
could	O
n't	O
be	O
immediately	O
reached	O
for	O
comment	O
.	O

Attitude	O
Change	O
The	O
disinterest	O
in	O
the	O
issues	O
appears	O
to	O
have	O
changed	O
with	O
The	O
New	B-Organization
York	I-Organization
Times	I-Organization
report	O
,	O
which	O
lit	O
a	O
fire	O
underneath	O
Adups	B-Organization
and	O
BLU	B-Organization
.	O

Adups	B-Organization
addressed	O
the	O
issue	O
in	O
a	O
Nov.	O
16	O
news	O
release	O
,	O
writing	O
that	O
some	O
products	O
made	O
by	O
BLU	B-Organization
were	O
updated	O
in	O
June	O
with	O
a	O
version	O
of	O
its	O
FOTA	B-System
that	O
had	O
actually	O
been	O
intended	O
for	O
other	O
clients	O
who	O
had	O
requested	O
an	O
ability	O
to	O
stop	O
text	O
spam	O
.	O

That	O
version	O
flags	O
messages	O
"	O
containing	O
certain	O
language	O
associated	O
with	O
junk	O
texts	O
and	O
flags	O
numbers	O
associated	O
with	O
junk	O
calls	O
and	O
not	O
in	O
a	O
user	O
's	O
contacts	O
,	O
''	O
the	O
company	O
says	O
.	O

Manufacturers	O
should	O
be	O
keeping	O
close	O
tabs	O
on	O
what	O
software	O
ends	O
up	O
on	O
their	O
devices	O
.	O

But	O
it	O
would	O
appear	O
that	O
BLU	B-Organization
only	O
took	O
action	O
after	O
Kryptowire	B-Organization
notified	O
it	O
along	O
with	O
Google	B-Organization
,	O
Adups	B-Organization
and	O
Amazon	B-Organization
.	O

"	O
When	O
BLU	B-Organization
raised	O
objections	O
,	O
Adups	B-Organization
took	O
immediate	O
measures	O
to	O
disable	O
that	O
functionality	O
on	O
BLU	B-Organization
phones	O
,	O
''	O
Adups	I-Organization
says	O
.	O

The	O
greater	O
worry	O
is	O
that	O
these	O
situations	O
may	O
sometimes	O
not	O
be	O
simple	O
mistakes	O
.	O

Security	O
experts	O
have	O
long	O
warned	O
of	O
the	O
ability	O
of	O
advanced	O
adversaries	O
to	O
subvert	O
hardware	O
and	O
software	O
supply	O
chains	O
.	O

Also	O
,	O
the	O
software	B-Vulnerability
vulnerabilities	I-Vulnerability
pointed	O
out	O
in	O
the	O
FOTA	B-System
software	O
by	O
Strazzere	O
in	O
2015	O
could	O
have	O
been	O
taken	O
advantage	O
of	O
by	O
cybercriminals	O
looking	O
to	O
steal	O
bank	O
account	O
details	O
or	O
execute	O
other	O
frauds	O
.	O

Strazzere	O
advises	O
that	O
consumers	O
should	O
look	O
at	O
the	O
pedigree	O
of	O
mobile	O
manufacturers	O
and	O
take	O
a	O
close	O
look	O
at	O
their	O
security	O
track	O
record	O
before	O
making	O
a	O
decision	O
on	O
what	O
device	O
to	O
buy	O
.	O

"	O
In	O
the	O
end	O
,	O
the	O
consumer	O
needs	O
to	O
vote	O
with	O
their	O
wallet	O
,	O
''	O
he	O
says	O
.	O

Skygofree	B-Malware
:	O
Following	O
in	O
the	O
footsteps	O
of	O
HackingTeam	B-Organization
16	O
JAN	O
2018	O
At	O
the	O
beginning	O
of	O
October	O
2017	O
,	O
we	O
discovered	O
new	O
Android	B-System
spyware	O
with	O
several	O
features	O
previously	O
unseen	O
in	O
the	O
wild	O
.	O

In	O
the	O
course	O
of	O
further	O
research	O
,	O
we	O
found	O
a	O
number	O
of	O
related	O
samples	O
that	O
point	O
to	O
a	O
long-term	O
development	O
process	O
.	O

We	O
believe	O
the	O
initial	O
versions	O
of	O
this	O
malware	O
were	O
created	O
at	O
least	O
three	O
years	O
ago	O
–	O
at	O
the	O
end	O
of	O
2014	O
.	O

Since	O
then	O
,	O
the	O
implant	O
’	O
s	O
functionality	O
has	O
been	O
improving	O
and	O
remarkable	O
new	O
features	O
implemented	O
,	O
such	O
as	O
the	O
ability	O
to	O
record	O
audio	O
surroundings	O
via	O
the	O
microphone	O
when	O
an	O
infected	O
device	O
is	O
in	O
a	O
specified	O
location	O
;	O
the	O
stealing	O
of	O
WhatsApp	B-System
messages	O
via	O
Accessibility	O
Services	O
;	O
and	O
the	O
ability	O
to	O
connect	O
an	O
infected	O
device	O
to	O
Wi-Fi	O
networks	O
controlled	O
by	O
cybercriminals	O
.	O

We	O
observed	O
many	O
web	O
landing	O
pages	O
that	O
mimic	O
the	O
sites	O
of	O
mobile	O
operators	O
and	O
which	O
are	O
used	O
to	O
spread	O
the	O
Android	B-System
implants	O
.	O

These	O
domains	O
have	O
been	O
registered	O
by	O
the	O
attackers	O
since	O
2015	O
.	O

According	O
to	O
our	O
telemetry	O
,	O
that	O
was	O
the	O
year	O
the	O
distribution	O
campaign	O
was	O
at	O
its	O
most	O
active	O
.	O

The	O
activities	O
continue	O
:	O
the	O
most	O
recently	O
observed	O
domain	O
was	O
registered	O
on	O
October	O
31	O
,	O
2017	O
.	O

Based	O
on	O
our	O
KSN	O
statistics	O
,	O
there	O
are	O
several	O
infected	O
individuals	O
,	O
exclusively	O
in	O
Italy	O
.	O

Moreover	O
,	O
as	O
we	O
dived	O
deeper	O
into	O
the	O
investigation	O
,	O
we	O
discovered	O
several	O
spyware	O
tools	O
for	O
Windows	B-System
that	O
form	O
an	O
implant	O
for	O
exfiltrating	O
sensitive	O
data	O
on	O
a	O
targeted	O
machine	O
.	O

The	O
version	O
we	O
found	O
was	O
built	O
at	O
the	O
beginning	O
of	O
2017	O
,	O
and	O
at	O
the	O
moment	O
we	O
are	O
not	O
sure	O
whether	O
this	O
implant	O
has	O
been	O
used	O
in	O
the	O
wild	O
.	O

We	O
named	O
the	O
malware	O
Skygofree	B-Malware
,	O
because	O
we	O
found	O
the	O
word	O
in	O
one	O
of	O
the	O
domains	O
*	O
.	O

Malware	O
Features	O
Android	B-System
According	O
to	O
the	O
observed	O
samples	O
and	O
their	O
signatures	O
,	O
early	O
versions	O
of	O
this	O
Android	B-System
malware	O
were	O
developed	O
by	O
the	O
end	O
of	O
2014	O
and	O
the	O
campaign	O
has	O
remained	O
active	O
ever	O
since	O
.	O

The	O
code	O
and	O
functionality	O
have	O
changed	O
numerous	O
times	O
;	O
from	O
simple	O
unobfuscated	O
malware	O
at	O
the	O
beginning	O
to	O
sophisticated	O
multi-stage	O
spyware	O
that	O
gives	O
attackers	O
full	O
remote	O
control	O
of	O
the	O
infected	O
device	O
.	O

We	O
have	O
examined	O
all	O
the	O
detected	O
versions	O
,	O
including	O
the	O
latest	O
one	O
that	O
is	O
signed	O
by	O
a	O
certificate	O
valid	O
from	O
September	O
14	O
,	O
2017	O
.	O

The	O
implant	O
provides	O
the	O
ability	O
to	O
grab	O
a	O
lot	O
of	O
exfiltrated	O
data	O
,	O
like	O
call	O
records	O
,	O
text	O
messages	O
,	O
geolocation	O
,	O
surrounding	O
audio	O
,	O
calendar	O
events	O
,	O
and	O
other	O
memory	O
information	O
stored	O
on	O
the	O
device	O
.	O

After	O
manual	O
launch	O
,	O
it	O
shows	O
a	O
fake	O
welcome	O
notification	O
to	O
the	O
user	O
:	O
Dear	O
Customer	O
,	O
we	O
’	O
re	O
updating	O
your	O
configuration	O
and	O
it	O
will	O
be	O
ready	O
as	O
soon	O
as	O
possible	O
.	O

At	O
the	O
same	O
time	O
,	O
it	O
hides	O
an	O
icon	O
and	O
starts	O
background	O
services	O
to	O
hide	O
further	O
actions	O
from	O
the	O
user	O
.	O

Service	O
Name	O
Purpose	O
AndroidAlarmManager	O
Uploading	O
last	O
recorded	O
.amr	O
audio	O
AndroidSystemService	O
Audio	O
recording	O
AndroidSystemQueues	O
Location	O
tracking	O
with	O
movement	O
detection	O
ClearSystems	O
GSM	B-System
tracking	O
(	O
CID	O
,	O
LAC	O
,	O
PSC	O
)	O
ClipService	O
Clipboard	O
stealing	O
AndroidFileManager	O
Uploading	O
all	O
exfiltrated	O
data	O
AndroidPush	O
XMPP	O
С	O
&	O
C	O
protocol	O
(	O
url.plus:5223	B-Indicator
)	O
RegistrationService	O
Registration	O
on	O
C	O
&	O
C	O
via	O
HTTP	O
(	O
url.plus/app/pro/	B-Indicator
)	O
Interestingly	O
,	O
a	O
self-protection	O
feature	O
was	O
implemented	O
in	O
almost	O
every	O
service	O

.	O

Since	O
in	O
Android	B-System
8.0	I-System
(	O
SDK	O
API	O
26	O
)	O
the	O
system	O
is	O
able	O
to	O
kill	O
idle	O
services	O
,	O
this	O
code	O
raises	O
a	O
fake	O
update	O
notification	O
to	O
prevent	O
it	O
:	O
Cybercriminals	O
have	O
the	O
ability	O
to	O
control	O
the	O
implant	O
via	O
HTTP	O
,	O
XMPP	O
,	O
binary	O
SMS	O
and	O
FirebaseCloudMessaging	O
(	O
or	O
GoogleCloudMessaging	O
in	O
older	O
versions	O
)	O
protocols	O
.	O

Such	O
a	O
diversity	O
of	O
protocols	O
gives	O
the	O
attackers	O
more	O
flexible	O
control	O
.	O

In	O
the	O
latest	O
implant	O
versions	O
there	O
are	O
48	O
different	O
commands	O
.	O

You	O
can	O
find	O
a	O
full	O
list	O
with	O
short	O
descriptions	O
in	O
the	O
Appendix	O
.	O

Here	O
are	O
some	O
of	O
the	O
most	O
notable	O
:	O
‘	O
geofence	O
’	O
–	O
this	O
command	O
adds	O
a	O
specified	O
location	O
to	O
the	O
implant	O
’	O
s	O
internal	O
database	O
and	O
when	O
it	O
matches	O
a	O
device	O
’	O
s	O
current	O
location	O
the	O
malware	O
triggers	O
and	O
begins	O
to	O
record	O
surrounding	O
audio	O
.	O

”	O
social	O
”	O
–	O
this	O
command	O
that	O
starts	O
the	O
‘	O
AndroidMDMSupport	O
’	O
service	O
–	O
this	O
allows	O
the	O
files	O
of	O
any	O
other	O
installed	O
application	O
to	O
be	O
grabbed	O
.	O

The	O
service	O
name	O
makes	O
it	O
clear	O
that	O
by	O
applications	O
the	O
attackers	O
mean	O
MDM	O
solutions	O
that	O
are	O
business-specific	O
tools	O
.	O

The	O
operator	O
can	O
specify	O
a	O
path	O
with	O
the	O
database	O
of	O
any	O
targeted	O
application	O
and	O
server-side	O
PHP	O
script	O
name	O
for	O
uploading	O
.	O

Several	O
hardcoded	O
applications	O
targeted	O
by	O
the	O
MDM-grabbing	O
command	O
‘	O
wifi	O
’	O
–	O
this	O
command	O
creates	O
a	O
new	O
Wi-Fi	O
connection	O
with	O
specified	O
configurations	O
from	O
the	O
command	O
and	O
enable	O
Wi-Fi	O
if	O
it	O
is	O
disabled	O
.	O

So	O
,	O
when	O
a	O
device	O
connects	O
to	O
the	O
established	O
network	O
,	O
this	O
process	O
will	O
be	O
in	O
silent	O
and	O
automatic	O
mode	O
.	O

This	O
command	O
is	O
used	O
to	O
connect	O
the	O
victim	O
to	O
a	O
Wi-Fi	O
network	O
controlled	O
by	O
the	O
cybercriminals	O
to	O
perform	O
traffic	O
sniffing	O
and	O
man-in-the-middle	O
(	O
MitM	O
)	O
attacks	O
.	O

addWifiConfig	O
method	O
code	O
fragments	O
‘	O
camera	O
’	O
–	O
this	O
command	O
records	O
a	O
video/capture	O
a	O
photo	O
using	O
the	O
front-facing	O
camera	O
when	O
someone	O
next	O
unlocks	O
the	O
device	O
.	O

Some	O
versions	O
of	O
the	O
Skygofree	B-Malware
feature	O
the	O
self-protection	O
ability	O
exclusively	O
for	O
Huawei	B-Organization
devices	O
.	O

There	O
is	O
a	O
‘	O
protected	O
apps	O
’	O
list	O
in	O
this	O
brand	O
’	O
s	O
smartphones	O
,	O
related	O
to	O
a	O
battery-saving	O
concept	O
.	O

Apps	O
not	O
selected	O
as	O
protected	O
apps	O
stop	O
working	O
once	O
the	O
screen	O
is	O
off	O
and	O
await	O
re-activation	O
,	O
so	O
the	O
implant	O
is	O
able	O
to	O
determine	O
that	O
it	O
is	O
running	O
on	O
a	O
Huawei	B-Organization
device	O
and	O
add	O
itself	O
to	O
this	O
list	O
.	O

Due	O
to	O
this	O
feature	O
,	O
it	O
is	O
clear	O
that	O
the	O
developers	O
paid	O
special	O
attention	O
to	O
the	O
work	O
of	O
the	O
implant	O
on	O
Huawei	B-Organization
devices	O
.	O

Also	O
,	O
we	O
found	O
a	O
debug	O
version	O
of	O
the	O
implant	O
(	O
70a937b2504b3ad6c623581424c7e53d	B-Indicator
)	O
that	O
contains	O
interesting	O
constants	O
,	O
including	O
the	O
version	O
of	O
the	O
spyware	O
.	O

Debug	O
BuildConfig	O
with	O
the	O
version	O
After	O
a	O
deep	O
analysis	O
of	O
all	O
discovered	O
versions	O
of	O
Skygofree	B-Malware
,	O
we	O
made	O
an	O
approximate	O
timeline	O
of	O
the	O
implant	O
’	O
s	O
evolution	O
.	O

Mobile	O
implant	O
evolution	O
timeline	O
However	O
,	O
some	O
facts	O
indicate	O
that	O
the	O
APK	O
samples	O
from	O
stage	O
two	O
can	O
also	O
be	O
used	O
separately	O
as	O
the	O
first	O
step	O
of	O
the	O
infection	O
.	O

Below	O
is	O
a	O
list	O
of	O
the	O
payloads	O
used	O
by	O
the	O
Skygofree	B-Malware
implant	O
in	O
the	O
second	O
and	O
third	O
stages	O
.	O

Reverse	O
shell	O
payload	O
The	O
reverse	O
shell	O
module	O
is	O
an	O
external	O
ELF	O
file	O
compiled	O
by	O
the	O
attackers	O
to	O
run	O
on	O
Android	B-System
.	O

The	O
choice	O
of	O
a	O
particular	O
payload	O
is	O
determined	O
by	O
the	O
implant	O
’	O
s	O
version	O
,	O
and	O
it	O
can	O
be	O
downloaded	O
from	O
the	O
command	O
and	O
control	O
(	O
C	O
&	O
C	O
)	O
server	O
soon	O
after	O
the	O
implant	O
starts	O
,	O
or	O
after	O
a	O
specific	O
command	O
.	O

In	O
the	O
most	O
recent	O
case	O
,	O
the	O
choice	O
of	O
the	O
payload	O
zip	O
file	O
depends	O
on	O
the	O
device	O
process	O
architecture	O
.	O

For	O
now	O
,	O
we	O
observe	O
only	O
one	O
payload	O
version	O
for	O
following	O
the	O
ARM	B-System
CPUs	O
:	O
arm64-v8a	B-System
,	O
armeabi	B-System
,	O
armeabi-v7a	B-System
.	O

Note	O
that	O
in	O
almost	O
all	O
cases	O
,	O
this	O
payload	O
file	O
,	O
contained	O
in	O
zip	O
archives	O
,	O
is	O
named	O
‘	O
setting	B-Indicator
’	O
or	O
‘	O
setting.o	B-Indicator
’	O
.	O

The	O
main	O
purpose	O
of	O
this	O
module	O
is	O
providing	O
reverse	O
shell	O
features	O
on	O
the	O
device	O
by	O
connecting	O
with	O
the	O
C	O
&	O
C	O
server	O
’	O
s	O
socket	O
.	O

Reverse	O
shell	O
payload	O
The	O
payload	O
is	O
started	O
by	O
the	O
main	O
module	O
with	O
a	O
specified	O
host	O
and	O
port	O
as	O
a	O
parameter	O
that	O
is	O
hardcoded	O
to	O
‘	O
54.67.109.199	B-Indicator
’	O
and	O
‘	O
30010	B-Indicator
’	O
in	O
some	O
versions	O
:	O
Alternatively	O
,	O
they	O
could	O
be	O
hardcoded	O
directly	O
into	O
the	O
payload	O
code	O
:	O
We	O
also	O
observed	O
variants	O
that	O
were	O
equipped	O
with	O
similar	O
reverse	O
shell	O
payloads	O
directly	O
in	O
the	O
main	O
APK	O
/lib/	O
path	O
.	O

Equipped	O
reverse	O
shell	O
payload	O
with	O
specific	O
string	O
After	O
an	O
in-depth	O
look	O
,	O
we	O
found	O
that	O
some	O
versions	O
of	O
the	O
reverse	O
shell	O
payload	O
code	O
share	O
similarities	O
with	O
PRISM	B-Malware
–	O
a	O
stealth	O
reverse	O
shell	O
backdoor	O
that	O
is	O
available	O
on	O
Github	B-Organization
.	O

Reverse	O
shell	O
payload	O
from	O
update_dev.zip	B-Indicator
Exploit	O
payload	O
At	O
the	O
same	O
time	O
,	O
we	O
found	O
an	O
important	O
payload	O
binary	O
that	O
is	O
trying	O
to	O
exploit	O
several	O
known	O
vulnerabilities	O
and	O
escalate	O
privileges	O
.	O

According	O
to	O
several	O
timestamps	O
,	O
this	O
payload	O
is	O
used	O
by	O
implant	O
versions	O
created	O
since	O
2016	O
.	O

It	O
can	O
also	O
be	O
downloaded	O
by	O
a	O
specific	O
command	O
.	O

The	O
exploit	O
payload	O
contains	O
following	O
file	O
components	O
:	O
Component	O
name	O
Description	O
run_root_shell/arrs_put_user.o/arrs_put_user/poc	B-Indicator
Exploit	O
ELF	O
db	O
Sqlite3	O
tool	O
ELF	O
device.db	B-Indicator
Sqlite3	O
database	O
with	O
supported	O
devices	O
and	O
their	O
constants	O
needed	O
for	O
privilege	O
escalation	O
‘	O
device.db	B-Indicator
’	O
is	O
a	O
database	O
used	O
by	O
the	O
exploit	O
.	O

It	O
contains	O
two	O
tables	O
–	O
‘	O
supported_devices	O
’	O
and	O
‘	O
device_address	O
’	O
.	O

The	O
first	O
table	O
contains	O
205	O
devices	O
with	O
some	O
Linux	B-System
properties	O
;	O
the	O
second	O
contains	O
the	O
specific	O
memory	O
addresses	O
associated	O
with	O
them	O
that	O
are	O
needed	O
for	O
successful	O
exploitation	O
.	O

You	O
can	O
find	O
a	O
full	O
list	O
of	O
targeted	O
models	O
in	O
the	O
Appendix	O
.	O

Fragment	O
of	O
the	O
database	O
with	O
targeted	O
devices	O
and	O
specific	O
memory	O
addresses	O
If	O
the	O
infected	O
device	O
is	O
not	O
listed	O
in	O
this	O
database	O
,	O
the	O
exploit	O
tries	O
to	O
discover	O
these	O
addresses	O
programmatically	O
.	O

After	O
downloading	O
and	O
unpacking	O
,	O
the	O
main	O
module	O
executes	O
the	O
exploit	O
binary	O
file	O
.	O

Once	O
executed	O
,	O
the	O
module	O
attempts	O
to	O
get	O
root	O
privileges	O
on	O
the	O
device	O
by	O
exploiting	O
the	O
following	O
vulnerabilities	O
:	O
CVE-2013-2094	B-Vulnerability
CVE-2013-2595	B-Vulnerability
CVE-2013-6282	B-Vulnerability
CVE-2014-3153	B-Vulnerability
(	O
futex	B-Vulnerability
aka	O
TowelRoot	B-Vulnerability
)	O
CVE-2015-3636	B-Vulnerability
Exploitation	O
process	O
After	O
an	O
in-depth	O
look	O
,	O
we	O
found	O
that	O
the	O
exploit	O
payload	O
code	O
shares	O
several	O
similarities	O
with	O
the	O
public	O
project	O
android-rooting-tools	O
.	O

Decompiled	O
exploit	O
function	O
code	O
fragment	O
run_with_mmap	O
function	O
from	O
the	O
android-rooting-tools	B-System
project	O
As	O
can	O
be	O
seen	O
from	O
the	O
comparison	O
,	O
there	O
are	O
similar	O
strings	O
and	O
also	O
a	O
unique	O
comment	O
in	O
Italian	O
,	O
so	O
it	O
looks	O
like	O
the	O
attackers	O
created	O
this	O
exploit	O
payload	O
based	O
on	O
android-rooting-tools	B-System
project	O
source	O
code	O
.	O

Busybox	O
payload	O
Busybox	O
is	O
public	O
software	O
that	O
provides	O
several	O
Linux	O
tools	O
in	O
a	O
single	O
ELF	O
file	O
.	O

In	O
earlier	O
versions	O
,	O
it	O
operated	O
with	O
shell	O
commands	O
like	O
this	O
:	O
Stealing	O
WhatsApp	O
encryption	O
key	O
with	O
Busybox	B-Malware
Social	I-Malware
payload	I-Malware
Actually	O
,	O
this	O
is	O
not	O
a	O
standalone	O
payload	O
file	O
–	O
in	O
all	O
the	O
observed	O
versions	O
its	O
code	O
was	O
compiled	O
with	O
exploit	O
payload	O
in	O
one	O
file	O
(	O
‘	O
poc_perm	O
’	O
,	O
‘	O
arrs_put_user	O
’	O
,	O
‘	O
arrs_put_user.o	O
’	O
)	O
.	O

This	O
is	O
due	O
to	O
the	O
fact	O
that	O
the	O
implant	O
needs	O
to	O
escalate	O
privileges	O
before	O
performing	O
social	O
payload	O
actions	O
.	O

This	O
payload	O
is	O
also	O
used	O
by	O
the	O
earlier	O
versions	O
of	O
the	O
implant	O
.	O

It	O
has	O
similar	O
functionality	O
to	O
the	O
‘	O
AndroidMDMSupport	O
’	O
command	O
from	O
the	O
current	O
versions	O
–	O
stealing	O
data	O
belonging	O
to	O
other	O
installed	O
applications	O
.	O

The	O
payload	O
will	O
execute	O
shell	O
code	O
to	O
steal	O
data	O
from	O
various	O
applications	O
.	O

The	O
example	O
below	O
steals	O
Facebook	B-System
data	O
:	O
All	O
the	O
other	O
hardcoded	O
applications	O
targeted	O
by	O
the	O
payload	O
:	O
Package	O
name	O
Name	O
jp.naver.line.android	B-Indicator
LINE	B-System
:	I-System
Free	I-System
Calls	I-System
&	I-System
Messages	I-System
com.facebook.orca	B-Indicator
Facebook	B-System
messenger	I-System
com.facebook.katana	B-Indicator
Facebook	B-System
com.whatsapp	B-Indicator
WhatsApp	B-System
com.viber.voip	B-Indicator
Viber	B-System
Parser	O
payload	O
Upon	O
receiving	O
a	O
specific	O
command	O
,	O
the	O
implant	O
can	O
download	O
a	O
special	O
payload	O
to	O
grab	O
sensitive	O
information	O
from	O
external	O
applications	O
.	O

The	O
case	O
where	O
we	O
observed	O
this	O
involved	O
WhatsApp	B-System
.	O

In	O
the	O
examined	O
version	O
,	O
it	O
was	O
downloaded	O
from	O
:	O
hxxp	B-Indicator
:	I-Indicator
//url	I-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
plus/Updates/tt/parser.apk	I-Indicator
The	O
payload	O
can	O
be	O
a	O
.dex	O
or	O
.apk	O
file	O
which	O
is	O
a	O
Java-compiled	O
Android	B-System
executable	O
.	O

After	O
downloading	O
,	O
it	O
will	O
be	O
loaded	O
by	O
the	O
main	O
module	O
via	O
DexClassLoader	O
api	O
:	O
As	O
mentioned	O
,	O
we	O
observed	O
a	O
payload	O
that	O
exclusively	O
targets	O
the	O
WhatsApp	B-System
messenger	I-System
and	O
it	O
does	O
so	O
in	O
an	O
original	O
way	O
.	O

The	O
payload	O
uses	O
the	O
Android	B-System
Accessibility	O
Service	O
to	O
get	O
information	O
directly	O
from	O
the	O
displayed	O
elements	O
on	O
the	O
screen	O
,	O
so	O
it	O
waits	O
for	O
the	O
targeted	O
application	O
to	O
be	O
launched	O
and	O
then	O
parses	O
all	O
nodes	O
to	O
find	O
text	O
messages	O
:	O
Note	O
that	O
the	O
implant	O
needs	O
special	O
permission	O
to	O
use	O
the	O
Accessibility	O
Service	O
API	O
,	O
but	O
there	O
is	O
a	O
command	O
that	O
performs	O
a	O
request	O
with	O
a	O
phishing	O
text	O
displayed	O
to	O
the	O
user	O
to	O
obtain	O
such	O
permission	O
.	O

Windows	B-System
We	O
have	O
found	O
multiple	O
components	O
that	O
form	O
an	O
entire	O
spyware	O
system	O
for	O
the	O
Windows	B-System
platform	O
.	O

Name	O
MD5	O
Purpose	O
msconf.exe	B-Indicator
55fb01048b6287eadcbd9a0f86d21adf	B-Indicator
Main	O
module	O
,	O
reverse	O
shell	O
network.exe	B-Indicator
f673bb1d519138ced7659484c0b66c5b	B-Indicator
Sending	O
exfiltrated	O
data	O
system.exe	B-Indicator
d3baa45ed342fbc5a56d974d36d5f73f	B-Indicator
Surrounding	O
sound	O
recording	O
by	O
mic	O
update.exe	B-Indicator
395f9f87df728134b5e3c1ca4d48e9fa	B-Indicator
Keylogging	O
wow.exe	B-Indicator

16311b16fd48c1c87c6476a455093e7a	B-Indicator
Screenshot	O
capturing	O
skype_sync2.exe	B-Indicator
6bcc3559d7405f25ea403317353d905f	B-Indicator
Skype	B-System
call	O
recording	O
to	O
MP3	O
All	O
modules	O
,	O
except	O
skype_sync2.exe	B-Indicator
,	O
are	O
written	O
in	O
Python	B-System
and	O
packed	O
to	O
binary	O
files	O
via	O
the	O
Py2exe	B-System
tool	O
.	O

This	O
sort	O
of	O
conversion	O
allows	O
Python	B-System
code	O
to	O
be	O
run	O
in	O
a	O
Windows	B-System
environment	O
without	O
pre-installed	O
Python	B-System
binaries	O
.	O

msconf.exe	B-Indicator
is	O
the	O
main	O
module	O
that	O
provides	O
control	O
of	O
the	O
implant	O
and	O
reverse	O
shell	O
feature	O
.	O

It	O
opens	O
a	O
socket	O
on	O
the	O
victim	O
’	O
s	O
machine	O
and	O
connects	O
with	O
a	O
server-side	O
component	O
of	O
the	O
implant	O
located	O
at	O
54.67.109.199:6500	B-Indicator
.	O

Before	O
connecting	O
with	O
the	O
socket	O
,	O
it	O
creates	O
a	O
malware	O
environment	O
in	O
‘	O
APPDATA/myupd	B-Indicator
’	O
and	O
creates	O
a	O
sqlite3	O
database	O
there	O
–	O
‘	O
myupd_tmp\\mng.db	B-Indicator
’	O
:	O
CREATE	O
TABLE	O
MANAGE	O
(	O
ID	O
INT	O
PRIMARY	O
KEY	O
NOT	O
NULL	O
,	O
Send	O
INT	O
NOT	O
NULL	O
,	O
Keylogg	O
INT	O
NOT	O
NULL	O
,	O
Screenshot	O
INT	O
NOT	O
NULL	O
,	O
Audio	O
INT	O
NOT	O
NULL	O
)	O
;	O
INSERT	O
INTO	O
MANAGE	O
(	O
ID	O
,	O
Send	O
,	O
Keylogg	O
,	O
Screenshot	O
,	O
Audio	O

)	O
VALUES	O
(	O
1	O
,	O
1	O
,	O
1	O
,	O
1	O
,	O
0	O
)	O
Finally	O
,	O
the	O
malware	O
modifies	O
the	O
‘	O
Software\Microsoft\Windows\CurrentVersion\Run	B-Indicator
’	O
registry	O
key	O
to	O
enable	O
autostart	O
of	O
the	O
main	O
module	O
.	O

The	O
code	O
contains	O
multiple	O
comments	O
in	O
Italian	O
,	O
here	O
is	O
the	O
most	O
noteworthy	O
example	O
:	O
“	O
Receive	O
commands	O
from	O
the	O
remote	O
server	O
,	O
here	O
you	O
can	O
set	O
the	O
key	O
commands	O
to	O
command	O
the	O
virus	O
”	O
Here	O
are	O
the	O
available	O
commands	O
:	O
Name	O
Description	O
cd	O
Change	O
current	O
directory	O
to	O
specified	O
quit	O
Close	O
the	O
socket	O
nggexe	O
Execute	O
received	O
command	O
via	O
Python	B-System
’	O
s	O
subprocess.Popen	O
(	O
)	O
without	O
outputs	O
ngguploads	O
Upload	O
specified	O
file	O
to	O
the	O
specified	O
URL	O
nggdownloads	O
Download	O
content	O
from	O
the	O
specified	O
URLs	O
and	O
save	O
to	O
specified	O
file	O
nggfilesystem	O
Dump	O
file	O
structure	O
of	O

the	O
C	O
:	O
path	O
,	O
save	O
it	O
to	O
the	O
file	O
in	O
json	O
format	O
and	O
zip	O
it	O
nggstart_screen	O
nggstop_screen	O
Enable/disable	O
screenshot	O
module	O
.	O

When	O
enabled	O
,	O
it	O
makes	O
a	O
screenshot	O
every	O
25	O
seconds	O
nggstart_key	O
nggstop_key	O
Enable/disable	O
keylogging	O
module	O
nggstart_rec	O
nggstop_rec	O
Enable/disable	O
surrounding	O
sounds	O
recording	O
module	O
ngg_status	O
Send	O
components	O
status	O
to	O
the	O
C	O
&	O
C	O
socket	O
*	O
any	O
other	O
*	O
Execute	O
received	O
command	O
via	O
Python	B-System
’	O
s	O
subprocess.Popen	O
(	O
)	O
,	O
output	O
result	O
will	O
be	O
sent	O
to	O
the	O
C	O
&	O
C	O
socket	O
.	O

All	O
modules	O
set	O
hidden	O
attributes	O
to	O
their	O
files	O
:	O
Module	O
Paths	O
Exfiltrated	O
data	O
format	O
msconf.exe	B-Indicator
%	B-Indicator
APPDATA	I-Indicator
%	I-Indicator
/myupd/gen/	I-Indicator
%	I-Indicator
Y	I-Indicator
%	I-Indicator
m	I-Indicator
%	I-Indicator
d-	I-Indicator
%	I-Indicator
H	I-Indicator
%	I-Indicator
M	I-Indicator
%	I-Indicator
S_filesystem.zip	I-Indicator
(	I-Indicator
file	I-Indicator
structure	I-Indicator
dump	I-Indicator
)	I-Indicator
system.exe	I-Indicator
%	I-Indicator
APPDATA	I-Indicator
%	I-Indicator
/myupd/aud/	I-Indicator
%	I-Indicator
d	I-Indicator
%	I-Indicator
m	I-Indicator
%	I-Indicator
Y	I-Indicator
%	I-Indicator
H	I-Indicator
%	I-Indicator
M	I-Indicator
%	I-Indicator
S.wav	I-Indicator
(	I-Indicator
surrounding	I-Indicator
sounds	I-Indicator
)	I-Indicator
update.exe	I-Indicator
%	I-Indicator
APPDATA	I-Indicator
%	I-Indicator
/myupd_tmp/txt/	I-Indicator
%	I-Indicator
APPDATA	I-Indicator
%	I-Indicator
/myupd/txt/	I-Indicator
%	I-Indicator
Y	I-Indicator
%	I-Indicator
m	I-Indicator

%	I-Indicator
d-	I-Indicator
%	I-Indicator
H	I-Indicator
%	I-Indicator
M	I-Indicator
%	I-Indicator
S.txt	I-Indicator
(	I-Indicator
keylogging	I-Indicator
)	I-Indicator
wow.exe	I-Indicator
%	I-Indicator
APPDATA	I-Indicator
%	I-Indicator
/myupd/scr/	I-Indicator
%	I-Indicator
Y	I-Indicator
%	I-Indicator
m	I-Indicator
%	I-Indicator
d-	I-Indicator
%	I-Indicator
H	I-Indicator
%	I-Indicator
M	I-Indicator
%	I-Indicator
S.jpg	I-Indicator
(	I-Indicator
screenshots	I-Indicator
)	I-Indicator
skype_sync2.exe	I-Indicator
%	I-Indicator
APPDATA	I-Indicator
%	I-Indicator
/myupd_tmp/skype/	I-Indicator
%	I-Indicator
APPDATA	I-Indicator
%	I-Indicator
/myupd/skype/	I-Indicator
yyyyMMddHHmmss_in.mp3	I-Indicator
yyyyMMddHHmmss_out.mp3	B-Indicator
(	O
skype	O
calls	O
records	O
)	O
Moreover	O
,	O
we	O
found	O
one	O
module	O
written	O

in	O
.Net	B-System
–	O
skype_sync2.exe	B-Indicator
.	O

The	O
main	O
purpose	O
of	O
this	O
module	O
is	O
to	O
exfiltrate	O
Skype	B-System
call	O
recordings	O
.	O

Just	O
like	O
the	O
previous	O
modules	O
,	O
it	O
contains	O
multiple	O
strings	O
in	O
Italian	O
.	O

After	O
launch	O
,	O
it	O
downloads	O
a	O
codec	O
for	O
MP3	O
encoding	O
directly	O
from	O
the	O
C	O
&	O
C	O
server	O
:	O
http	B-Indicator
:	I-Indicator
//54.67.109.199/skype_resource/libmp3lame.dll	I-Indicator
The	O
skype_sync2.exe	B-Indicator
module	O
has	O
a	O
compilation	O
timestamp	O
–	O
Feb	O
06	O
2017	O
and	O
the	O
following	O
PDB	O
string	O
:	O
\\vmware-host\Shared	B-Indicator
Folders\dati\Backup\Projects\REcodin_2\REcodin_2\obj\x86\Release\REcodin_2.pdb	B-Indicator
network.exe	B-Indicator
is	O
a	O

module	O
for	O
submitting	O
all	O
exfiltrated	O
data	O
to	O
the	O
server	O
.	O

In	O
the	O
observed	O
version	O
of	O
the	O
implant	O
it	O
doesn	O
’	O
t	O
have	O
an	O
interface	O
to	O
work	O
with	O
the	O
skype_sync2.exe	B-Indicator
module	O
.	O

network.exe	B-Indicator
submitting	O
to	O
the	O
server	O
code	O
snippet	O
Code	O
similarities	O
We	O
found	O
some	O
code	O
similarities	O
between	O
the	O
implant	O
for	O
Windows	B-System
and	O
other	O
public	O
accessible	O
projects	O
.	O

https	B-Indicator
:	I-Indicator
//github.com/El3ct71k/Keylogger/	I-Indicator
It	O
appears	O
the	O
developers	O
have	O
copied	O
the	O
functional	O
part	O
of	O
the	O
keylogger	O
module	O
from	O
this	O
project	O
.	O

update.exe	B-Indicator
module	O
and	O
Keylogger	O
by	O
‘	O
El3ct71k	O
’	O
code	O
comparison	O
Xenotix	B-System
Python	I-System
Keylogger	I-System
including	O
specified	O
mutex	O
‘	O
mutex_var_xboz	O
’	O
.	O

update.exe	B-Indicator
module	O
and	O
Xenotix	B-System
Python	I-System
Keylogger	I-System
code	O
comparison	O
‘	O
addStartup	O
’	O
method	O
from	O
msconf.exe	B-Indicator
module	O
‘	O
addStartup	O
’	O
method	O
from	O
Xenotix	B-System
Python	I-System
Keylogger	I-System
Distribution	O
We	O
found	O
several	O
landing	O
pages	O
that	O
spread	O
the	O
Android	B-System
implants	O
.	O

Malicious	O
URL	O
Referrer	O
Dates	O
http	B-Indicator
:	I-Indicator
//217.194.13.133/tre/internet/Configuratore_3.apk	I-Indicator
http	B-Indicator
:	I-Indicator
//217.194.13.133/tre/internet/	I-Indicator
2015-02-04	O
to	O
present	O
time	O
http	B-Indicator
:	I-Indicator
//217.194.13.133/appPro_AC.apk	I-Indicator
–	O
2015-07-01	O
http	B-Indicator
:	I-Indicator
//217.194.13.133/190/configurazione/vodafone/smartphone/VODAFONE	I-Indicator
%	I-Indicator
20Configuratore	I-Indicator
%	I-Indicator
20v5_4_2.apk	I-Indicator
http	B-Indicator
:	I-Indicator
//217.194.13.133/190/configurazione/vodafone/smartphone/index.html	I-Indicator

2015-01-20	O
to	O
present	O
time	O
http	B-Indicator
:	I-Indicator
//217.194.13.133/190/configurazione/vodafone/smartphone/Vodafone	I-Indicator
%	I-Indicator
20Configuratore.apk	I-Indicator
http	B-Indicator
:	I-Indicator
//217.194.13.133/190/configurazione/vodafone/smartphone/index.html	I-Indicator
currently	O
active	O
http	B-Indicator
:	I-Indicator
//vodafoneinfinity.sytes.net/tim/internet/Configuratore_TIM.apk	I-Indicator
http	B-Indicator
:	I-Indicator
//vodafoneinfinity.sytes.net/tim/internet/	I-Indicator
2015-03-04	O
http	B-Indicator
:	I-Indicator
//vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/VODAFONE	I-Indicator

%	I-Indicator
20Configuratore	I-Indicator
%	I-Indicator
20v5_4_2.apk	I-Indicator
http	B-Indicator
:	I-Indicator
//vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/	I-Indicator
2015-01-14	O
http	B-Indicator
:	I-Indicator
//windupdate.serveftp.com/wind/LTE/WIND	I-Indicator
%	I-Indicator
20Configuratore	I-Indicator
%	I-Indicator
20v5_4_2.apk	I-Indicator
http	B-Indicator
:	I-Indicator
//windupdate.serveftp.com/wind/LTE/	I-Indicator
2015-03-31	O
http	B-Indicator
:	I-Indicator
//119.network/lte/Internet-TIM-4G-LTE.apk	I-Indicator
http	B-Indicator
:	I-Indicator
//119.network/lte/download.html	I-Indicator

2015-02-04	O
2015-07-20	O
http	B-Indicator
:	I-Indicator
//119.network/lte/Configuratore_TIM.apk	I-Indicator
2015-07-08	O
Many	O
of	O
these	O
domains	O
are	O
outdated	O
,	O
but	O
almost	O
all	O
(	O
except	O
one	O
–	O
appPro_AC.apk	B-Indicator
)	O
samples	O
located	O
on	O
the	O
217.194.13.133	B-Indicator
server	O
are	O
still	O
accessible	O
.	O

All	O
the	O
observed	O
landing	O
pages	O
mimic	O
the	O
mobile	O
operators	O
’	O
web	O
pages	O
through	O
their	O
domain	O
name	O
and	O
web	O
page	O
content	O
as	O
well	O
.	O

Further	O
research	O
of	O
the	O
attacker	O
’	O
s	O
infrastructure	O
revealed	O
more	O
related	O
mimicking	O
domains	O
.	O

Unfortunately	O
,	O
for	O
now	O
we	O
can	O
’	O
t	O
say	O
in	O
what	O
environment	O
these	O
landing	O
pages	O
were	O
used	O
in	O
the	O
wild	O
,	O
but	O
according	O
to	O
all	O
the	O
information	O
at	O
our	O
dsiposal	O
,	O
we	O
can	O
assume	O
that	O
they	O
are	O
perfect	O
for	O
exploitation	O
using	O
malicious	O
redirects	O
or	O
man-in-the-middle	O
attacks	O
.	O

For	O
example	O
,	O
this	O
could	O
be	O
when	O
the	O
victim	O
’	O
s	O
device	O
connects	O
to	O
a	O
Wi-Fi	O
access	O
point	O
that	O
is	O
infected	O
or	O
controlled	O
by	O
the	O
attackers	O
.	O

Artifacts	O
During	O
the	O
research	O
,	O
we	O
found	O
plenty	O
of	O
traces	O
of	O
the	O
developers	O
and	O
those	O
doing	O
the	O
maintaining	O
.	O

As	O
already	O
stated	O
in	O
the	O
‘	O
malware	O
features	O
’	O
part	O
,	O
there	O
are	O
multiple	O
giveaways	O
in	O
the	O
code	O
.	O

Here	O
are	O
just	O
some	O
of	O
them	O
:	O
ngglobal	O
–	O
FirebaseCloudMessaging	O
topic	O
name	O
Issuer	O
:	O
CN	O
=	O
negg	O
–	O
from	O
several	O
certificates	O
negg.ddns	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
,	O
negg1.ddns	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
,	O
negg2.ddns	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
–	O
C	O
&	O
C	O
servers	O
NG	O
SuperShell	O
–	O
string	O
from	O
the	O
reverse	O
shell	O
payload	O
ngg	O
–	O
prefix	O
in	O
commands	O
names	O
of	O
the	O
implant	O
for	O
Windows	B-System
Signature	O
with	O
specific	O
issuer	O
Whois	O
records	O
and	O
IP	O
relationships	O
provide	O
many	O
interesting	O
insights	O
as	O
well	O
.	O

There	O
are	O
a	O
lot	O
of	O
other	O
‘	O
Negg	O
’	O
mentions	O
in	O
Whois	O
records	O
and	O
references	O
to	O
it	O
.	O

For	O
example	O
:	O
Conclusions	O
The	O
Skygofree	B-Malware
Android	B-System
implant	O
is	O
one	O
of	O
the	O
most	O
powerful	O
spyware	O
tools	O
that	O
we	O
have	O
ever	O
seen	O
for	O
this	O
platform	O
.	O

As	O
a	O
result	O
of	O
the	O
long-term	O
development	O
process	O
,	O
there	O
are	O
multiple	O
,	O
exceptional	O
capabilities	O
:	O
usage	O
of	O
multiple	O
exploits	O
for	O
gaining	O
root	O
privileges	O
,	O
a	O
complex	O
payload	O
structure	O
,	O
never-before-seen	O
surveillance	O
features	O
such	O
as	O
recording	O
surrounding	O
audio	O
in	O
specified	O
locations	O
.	O

Given	O
the	O
many	O
artifacts	O
we	O
discovered	O
in	O
the	O
malware	O
code	O
,	O
as	O
well	O
as	O
infrastructure	O
analysis	O
,	O
we	O
are	O
pretty	O
confident	O
that	O
the	O
developer	O
of	O
the	O
Skygofree	B-Malware
implants	O
is	O
an	O
Italian	O
IT	O
company	O
that	O
works	O
on	O
surveillance	O
solutions	O
,	O
just	O
like	O
HackingTeam	B-Organization
.	O

HenBox	B-Malware
:	O
The	O
Chickens	O
Come	O
Home	O
to	O
Roost	O
March	O
13	O
,	O
2018	O
at	O
5:00	O
AM	O
Unit	O
42	O
recently	O
discovered	O
a	O
new	O
Android	B-System
malware	O
family	O
we	O
named	O
“	O
HenBox	B-Malware
”	O
masquerading	O
as	O
a	O
variety	O
of	O
legitimate	O
Android	B-System
apps	O
.	O

We	O
chose	O
the	O
name	O
“	O
HenBox	B-Malware
”	O
based	O
on	O
metadata	O
found	O
in	O
most	O
of	O
the	O
malicious	O
apps	O
such	O
as	O
package	O
names	O
and	O
signer	O
detail	O
.	O

HenBox	B-Malware
masquerades	O
as	O
apps	O
such	O
as	O
VPN	O
and	O
Android	B-System
system	O
apps	O
and	O
often	O
installs	O
legitimate	O
versions	O
of	O
these	O
apps	O
along	O
with	O
HenBox	B-Malware
to	O
trick	O
users	O
into	O
thinking	O
they	O
downloaded	O
the	O
legitimate	O
app	O
.	O

While	O
some	O
of	O
the	O
legitimate	O
apps	O
HenBox	B-Malware
use	O
as	O
decoys	O
can	O
be	O
found	O
on	O
Google	B-System
Play	I-System
,	O
HenBox	B-Malware
apps	O
themselves	O
have	O
only	O
been	O
found	O
on	O
third-party	O
(	O
non-Google	O
Play	B-System
)	O
app	O
stores	O
.	O

HenBox	B-Malware
appears	O
to	O
primarily	O
target	O
the	O
Uyghurs	O
–	O
a	O
minority	O
Turkic	O
ethnic	O
group	O
that	O
is	O
primarily	O
Muslim	O
and	O
lives	O
mainly	O
in	O
the	O
Xinjiang	O
Uyghur	O
Autonomous	O
Region	O
in	O
North	O
West	O
China	O
.	O

It	O
also	O
targets	O
devices	O
made	O
by	O
Chinese	O
manufacturer	O
Xiaomi	B-Organization
and	O
those	O
running	O
MIUI	B-System
,	O
an	O
operating	O
system	O
based	O
on	O
Google	B-System
Android	I-System
made	O
by	O
Xiaomi	B-Organization
.	O

Smartphones	O
are	O
the	O
dominant	O
form	O
of	O
internet	O
access	O
in	O
the	O
region	O
and	O
Xinjiang	O
was	O
recently	O
above	O
the	O
national	O
average	O
of	O
internet	O
users	O
in	O
China	O
.	O

The	O
result	O
is	O
a	O
large	O
online	O
population	O
who	O
have	O
been	O
the	O
subject	O
of	O
numerous	O
cyber-attacks	O
in	O
the	O
past	O
.	O

Once	O
installed	O
,	O
HenBox	B-Malware
steals	O
information	O
from	O
the	O
devices	O
from	O
a	O
myriad	O
of	O
sources	O
,	O
including	O
many	O
mainstream	O
chat	O
,	O
communication	O
,	O
and	O
social	O
media	O
apps	O
.	O

The	O
stolen	O
information	O
includes	O
personal	O
and	O
device	O
information	O
.	O

Of	O
note	O
,	O
in	O
addition	O
to	O
tracking	O
the	O
compromised	O
device	O
’	O
s	O
location	O
,	O
HenBox	B-Malware
also	O
harvests	O
all	O
outgoing	O
phone	O
numbers	O
with	O
an	O
“	O
86	O
”	O
prefix	O
,	O
which	O
is	O
the	O
country	O
code	O
for	O
the	O
People	O
’	O
s	O
Republic	O
of	O
China	O
(	O
PRC	O
)	O
.	O

It	O
can	O
also	O
access	O
the	O
phone	O
’	O
s	O
cameras	O
and	O
microphone	O
.	O

HenBox	B-Malware
has	O
ties	O
to	O
infrastructure	O
used	O
in	O
targeted	O
attacks	O
with	O
a	O
focus	O
on	O
politics	O
in	O
South	O
East	O
Asia	O
.	O

These	O
attackers	O
have	O
used	O
additional	O
malware	O
families	O
in	O
previous	O
activity	O
dating	O
to	O
at	O
least	O
2015	O
that	O
include	O
PlugX	B-Malware
,	O
Zupdax	B-Malware
,	O
9002	B-Malware
,	O
and	O
Poison	B-Malware
Ivy	I-Malware
.	O

This	O
also	O
aligns	O
with	O
HenBox	B-Malware
’	O
s	O
timeline	O
,	O
as	O
in	O
total	O
we	O
have	O
identified	O
almost	O
200	O
HenBox	B-Malware
samples	O
,	O
with	O
the	O
oldest	O
dating	O
to	O
2015	O
.	O

Most	O
of	O
the	O
samples	O
we	O
found	O
date	O
from	O
the	O
last	O
half	O
of	O
2017	O
,	O
fewer	O
samples	O
date	O
from	O
2016	O
,	O
and	O
a	O
handful	O
date	O
back	O
to	O
2015	O
.	O

In	O
2018	O
,	O
we	O
have	O
already	O
observed	O
a	O
small	O
but	O
consistent	O
number	O
of	O
samples	O
.	O

We	O
believe	O
this	O
indicates	O
a	O
fairly	O
sustained	O
campaign	O
that	O
has	O
gained	O
momentum	O
over	O
recent	O
months	O
.	O

HenBox	B-Malware
Enters	O
the	O
Uyghur	B-System
App	I-System
Store	I-System
In	O
May	O
2016	O
,	O
a	O
HenBox	B-Malware
app	O
was	O
downloaded	O
from	O
uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
.	O

Specifically	O
,	O
the	O
app	O
was	O
an	O
Android	B-System
Package	I-System
(	O
APK	O
)	O
file	O
that	O
will	O
be	O
discussed	O
in	O
more	O
detail	O
shortly	O
.	O

The	O
domain	O
name	O
,	O
language	O
of	O
the	O
site	O
and	O
app	O
content	O
hosted	O
suggest	O
this	O
site	O
is	O
a	O
third-party	O
app	O
store	O
for	O
whom	O
the	O
intended	O
users	O
are	O
the	O
Uyghurs	O
.	O

Such	O
app	O
stores	O
are	O
so-called	O
because	O
they	O
are	O
not	O
officially	O
supported	O
by	O
Android	B-System
,	O
nor	O
are	O
they	O
provided	O
by	O
Google	B-Organization
,	O
unlike	O
the	O
Play	B-System
Store	I-System
.	O

Third-party	O
app	O
stores	O
are	O
ubiquitous	O
in	O
China	O
for	O
a	O
number	O
of	O
reasons	O
including	O
:	O
evermore	O
powerful	O
Chinese	B-Organization
Original	I-Organization
Equipment	I-Organization
Manufacturers	I-Organization
(	I-Organization
OEM	I-Organization
)	I-Organization
,	O
a	O
lack	O
of	O
an	O
official	O
Chinese	O
Google	B-System
Play	I-System
app	O
store	O
,	O
and	O
a	O
growing	O
smartphone	O
market	O
.	O

The	O
HenBox	B-Malware
app	O
downloaded	O
in	O
May	O
2016	O
was	O
masquerading	O
as	O
the	O
DroidVPN	B-Indicator
app	O
.	O

At	O
the	O
time	O
of	O
writing	O
,	O
the	O
content	O
served	O
at	O
the	O
given	O
URL	O
on	O
uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
,	O
is	O
now	O
a	O
legitimate	O
version	O
of	O
the	O
DroidVPN	B-Indicator
app	O
,	O
and	O
looks	O
as	O
shown	O
in	O
Figure	O
1	O
below	O
.	O

henbox_2	O
Figure	O
1	O
Uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
app	O
store	O
showing	O
the	O
current	O
DroidVPN	B-Indicator
app	O
Virtual	O
Private	O
Network	O
(	O
VPN	O
)	O
tools	O
allow	O
connections	O
to	O
remote	O
private	O
networks	O
,	O
increasing	O
the	O
security	O
and	O
privacy	O
of	O
the	O
user	O
’	O
s	O
communications	O
.	O

According	O
to	O
the	O
DroidVPN	B-Indicator
app	O
description	O
,	O
it	O
“	O
helps	O
bypass	O
regional	O
internet	O
restrictions	O
,	O
web	O
filtering	O
and	O
firewalls	O
by	O
tunneling	O
traffic	O
over	O
ICMP.	O
”	O
Some	O
features	O
may	O
require	O
devices	O
to	O
be	O
rooted	O
to	O
function	O
and	O
according	O
to	O
some	O
3rd	O
party	O
app	O
stores	O
,	O
unconditional	O
rooting	O
is	O
required	O
,	O
which	O
has	O
additional	O
security	O
implications	O
for	O
the	O
device	O
.	O

We	O
have	O
not	O
been	O
able	O
to	O
ascertain	O
how	O
the	O
DroidVPN	B-Indicator
app	O
on	O
the	O
uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
app	O
store	O
was	O
replaced	O
with	O
the	O
malicious	O
HenBox	B-Malware
app	O
;	O
however	O
,	O
some	O
indicators	O
point	O
to	O
the	O
server	O
running	O
an	O
outdated	O
version	O
of	O
Apache	O
Web	O
Server	O
on	O
a	O
Windows	B-System
32-Bit	O
operating	O
system	O
.	O

In	O
light	O
of	O
this	O
,	O
we	O
believe	O
an	O
attack	O
against	O
unpatched	B-Vulnerability
vulnerabilities	I-Vulnerability
is	O
a	O
reasonable	O
conjecture	O
for	O
how	O
the	O
server	O
was	O
compromised	O
.	O

The	O
HenBox	O
app	O
downloaded	O
in	O
May	O
2016	O
,	O
as	O
described	O
in	O
Table	O
1	O
below	O
,	O
masquerades	O
as	O
a	O
legitimate	O
version	O
of	O
the	O
DroidVPN	B-Indicator
app	O
by	O
using	O
the	O
same	O
app	O
name	O
“	O
DroidVPN	B-System
”	O
and	O
the	O
same	O
iconography	O
used	O
when	O
displaying	O
the	O
app	O
in	O
Android	B-System
’	O
s	O
launcher	O
view	O
,	O
as	O
highlighted	O
in	O
Figure	O
2	O
below	O
Table	O
1	O
.	O

APK	O
SHA256	O
Size	O
(	O
bytes	O
)	O
First	O
Seen	O
App	O
Package	O
name	O
App	O
name	O
0589bed1e3b3d6234c30061be3be1cc6685d786ab3a892a8d4dae8e2d7ed92f7	B-Indicator
2,740,860	O
May	O
2016	O
com.android.henbox	B-Indicator
DroidVPN	B-System
Table	O
1	O
Details	O
of	O
the	O
HenBox	B-Malware
DroidVPN	B-System
app	O
on	O
the	O
uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
app	O
store	O
henbox_3	O
Figure	O
2	O
HenBox	B-Malware
app	O
installed	O
,	O
purporting	O
to	O
be	O
DroidVPN	B-Indicator
Depending	O
on	O
the	O
language	O
setting	O
on	O
the	O
device	O
,	O
and	O
for	O
this	O
particular	O
variant	O
of	O
HenBox	B-Malware
,	O
the	O
installed	O
HenBox	B-Malware
app	O
may	O
have	O
the	O
name	O
“	O
Backup	O
”	O
but	O
uses	O
the	O
same	O
DroidVPN	B-Indicator
logo	O
.	O

Other	O
variants	O
use	O
other	O
names	O
and	O
logos	O
,	O
as	O
described	O
later	O
.	O

Given	O
the	O
DroidVPN	B-Indicator
look	O
and	O
feel	O
being	O
used	O
by	O
this	O
variant	O
of	O
HenBox	B-Malware
,	O
it	O
’	O
s	O
highly	O
likely	O
the	O
uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
page	O
for	O
DroidVPN	B-Indicator
remained	O
identical	O
when	O
serving	O
either	O
HenBox	B-Malware
or	O
DroidVPN	B-Indicator
apps	O
,	O
just	O
that	O
the	O
legitimate	O
APK	O
file	O
had	O
been	O
replaced	O
with	O
HenBox	O
for	O
an	O
unknown	O
period	O
of	O
time	O
.	O

In	O
addition	O
to	O
the	O
look	O
and	O
feel	O
of	O
DroidVPN	B-Indicator
,	O
this	O
HenBox	B-Malware
variant	O
also	O
contained	O
a	O
legitimate	O
DroidVPN	B-Indicator
app	O
within	O
its	O
APK	O
package	O
as	O
an	O
asset	O
,	O
which	O
could	O
be	O
compared	O
to	O
a	O
resource	O
item	O
within	O
a	O
Windows	B-System
Portable	I-System
Executable	I-System
(	O
PE	O
)	O
file	O
.	O

Once	O
the	O
HenBox	B-Malware
app	O
is	O
installed	O
and	O
launched	O
,	O
it	O
launches	O
an	O
install	O
process	O
for	O
the	O
embedded	O
app	O
as	O
a	O
decoy	O
to	O
other	O
malicious	O
behaviors	O
occurring	O
in	O
the	O
background	O
,	O
and	O
to	O
satisfy	O
the	O
victim	O
with	O
the	O
app	O
they	O
were	O
requesting	O
,	O
assuming	O
they	O
requested	O
to	O
download	O
a	O
particular	O
app	O
,	O
such	O
as	O
DroidVPN	B-System
.	O

The	O
version	O
of	O
the	O
legitimate	O
DroidVPN	B-Indicator
embedded	O
inside	O
this	O
HenBox	B-Malware
variant	O
is	O
the	O
same	O
version	O
of	O
DroidVPN	B-Indicator
available	O
for	O
download	O
from	O
uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
,	O
at	O
the	O
time	O
of	O
writing	O
.	O

It	O
’	O
s	O
worth	O
noting	O
,	O
newer	O
versions	O
of	O
the	O
DroidVPN	B-System
app	O
are	O
available	O
on	O
Google	B-System
Play	I-System
,	O
as	O
well	O
as	O
in	O
some	O
other	O
third-party	O
app	O
stores	O
,	O
which	O
could	O
indicate	O
uyghurapps	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
is	O
not	O
awfully	O
well	O
maintained	O
or	O
updated	O
to	O
the	O
latest	O
apps	O
available	O
.	O

At	O
the	O
time	O
of	O
writing	O
,	O
to	O
our	O
knowledge	O
no	O
other	O
third-party	O
app	O
stores	O
,	O
nor	O
the	O
official	O
Google	B-System
Play	I-System
store	O
,	O
were	O
or	O
are	O
hosting	O
this	O
malicious	O
HenBox	B-Malware
variant	O
masquerading	O
as	O
DroidVPN	B-Indicator
.	O

The	O
Right	O
App	O
at	O
the	O
Right	O
Time	O
The	O
malicious	O
HenBox	B-Malware
and	O
embedded	O
DroidVPN	B-Indicator
app	O
combination	O
is	O
one	O
instance	O
of	O
the	O
type	O
of	O
legitimate	O
apps	O
the	O
attackers	O
choose	O
to	O
mimic	O
to	O
compromise	O
their	O
victims	O
.	O

These	O
threat	O
actors	O
frequently	O
offer	O
malicious	O
apps	O
purporting	O
to	O
be	O
legitimate	O
apps	O
that	O
are	O
broadly	O
used	O
or	O
important	O
to	O
a	O
targeted	O
population	O
.	O

It	O
’	O
s	O
worth	O
noting	O
however	O
,	O
about	O
one-third	O
of	O
the	O
HenBox	B-Malware
apps	O
contained	O
embedded	O
APK	O
objects	O
that	O
did	O
not	O
refer	O
to	O
legitimate	O
apps	O
.	O

Some	O
were	O
only	O
3	O
bytes	O
long	O
,	O
containing	O
strings	O
such	O
as	O
“	O
ddd	O
”	O
and	O
“	O
333	O
”	O
,	O
or	O
were	O
otherwise	O
corrupted	O
.	O

Beyond	O
the	O
previously	O
mentioned	O
DroidVPN	B-Indicator
example	O
,	O
other	O
viable	O
embedded	O
apps	O
we	O
found	O
include	O
apps	O
currently	O
available	O
on	O
Google	B-System
Play	I-System
,	O
as	O
well	O
as	O
many	O
third-party	O
app	O
stores	O
.	O

Table	O
2	O
below	O
lists	O
some	O
of	O
these	O
apps	O
with	O
their	O
respective	O
metadata	O
.	O

Sample	O
1	O
marks	O
the	O
first	O
HenBox	B-Malware
sample	O
we	O
saw	O
embedding	O
a	O
legitimate	O
app	O
within	O
its	O
assets	O
to	O
be	O
dropped	O
and	O
installed	O
on	O
the	O
victim	O
device	O
as	O
a	O
decoy	O
.	O

The	O
legitimate	O
app	O
in	O
question	O
was	O
a	O
Uyghur	O
language	O
keyboard	O
app	O
targeted	O
at	O
native	O
speakers	O
of	O
the	O
Uyghur	O
language	O
and	O
their	O
smartphones	O
.	O

Sample	O
2	O
,	O
has	O
the	O
package	O
name	O
cn.android.setting	B-Indicator
masquerading	O
as	O
Android	O
’	O
s	O
Settings	B-System
app	I-System
,	O
which	O
has	O
a	O
similar	O
package	O
name	O
(	O
com.android.settings	B-Indicator
)	O
.	O

This	O
variant	O
of	O
HenBox	B-Malware
also	O
used	O
the	O
common	O
green	O
Android	B-System
figure	O
as	O
the	O
app	O
logo	O
and	O
was	O
named	O
设置	O
(	O
“	O
Backup	O
”	O
in	O
English	O
)	O
.	O

This	O
variant	O
’	O
s	O
app	O
name	O
,	O
along	O
with	O
many	O
others	O
,	O
is	O
written	O
in	O
Chinese	O
and	O
describes	O
the	O
app	O
as	O
a	O
backup	O
tool	O
.	O

Please	O
see	O
the	O
IOCs	O
section	O
for	O
all	O
app	O
and	O
package	O
name	O
combinations	O
.	O

Interestingly	O
,	O
the	O
embedded	O
app	O
in	O
sample	O
2	O
is	O
not	O
a	O
version	O
of	O
the	O
Android	B-System
Settings	I-System
app	O
but	O
instead	O
the	O
“	O
Amaq	B-System
Agency	I-System
”	O
app	O
,	O
which	O
reports	O
on	O
ISIS	O
related	O
news	O
.	O

Reports	O
indicate	O
fake	O
versions	O
of	O
the	O
Amaq	B-System
app	O
exist	O
,	O
likely	O
in	O
order	O
to	O
spy	O
on	O
those	O
that	O
use	O
it	O
.	O

A	O
month	O
after	O
observing	O
sample	O
2	O
,	O
we	O
obtained	O
another	O
which	O
used	O
the	O
same	O
package	O
name	O
as	O
sample	O
2	O
(	O
cn.android.setting	B-Indicator
)	O
.	O

However	O
,	O
this	O
time	O
the	O
app	O
name	O
for	O
both	O
HenBox	B-Malware
and	O
the	O
embedded	O
app	O
were	O
identical	O
:	O
Islamawazi	B-System
.	O

Islamawazi	B-System
is	O
also	O
known	O
as	O
the	O
Turkistan	B-Organization
Islamic	I-Organization
Party	I-Organization
or	O
“	O
TIP	O
”	O
.	O

This	O
organization	O
was	O
formerly	O
known	O
as	O
the	O
East	B-Organization
Turkestan	I-Organization
Islamic	I-Organization
Party	I-Organization
and	O
is	O
purported	O
to	O
be	O
an	O
Islamic	O
extremist	O
separatist	O
organization	O
founded	O
by	O
Uyghur	O
jihadists	O
.	O

The	O
embedded	O
app	O
appears	O
to	O
be	O
a	O
media	O
player	O
.	O

These	O
examples	O
,	O
together	O
with	O
the	O
HenBox	B-Malware
app	O
placed	O
on	O
a	O
very	O
specific	O
third-party	O
app	O
store	O
,	O
point	O
clearly	O
to	O
at	O
least	O
some	O
of	O
the	O
intended	O
targets	O
of	O
these	O
malicious	O
apps	O
being	O
Uyghurs	O
,	O
specifically	O
those	O
with	O
interest	O
in	O
or	O
association	O
with	O
terrorist	O
groups	O
.	O

These	O
threat	O
actors	O
appear	O
to	O
be	O
choosing	O
the	O
right	O
apps	O
–	O
those	O
that	O
could	O
be	O
popular	O
with	O
locals	O
in	O
the	O
region	O
,	O
at	O
the	O
right	O
time	O
–	O
while	O
tensions	O
grow	O
in	O
this	O
region	O
of	O
China	O
,	O
to	O
ensure	O
a	O
good	O
victim	O
install-base	O
.	O

HenBox	B-Malware
Roosts	O
HenBox	B-Malware
has	O
evolved	O
over	O
the	O
past	O
three	O
years	O
,	O
and	O
of	O
the	O
almost	O
two	O
hundred	O
HenBox	B-Malware
apps	O
in	O
AutoFocus	O
,	O
the	O
vast	O
majority	O
contain	O
several	O
native	O
libraries	O
as	O
well	O
as	O
other	O
components	O
in	O
order	O
to	O
achieve	O
their	O
objective	O
.	O

Most	O
components	O
are	O
obfuscated	O
in	O
some	O
way	O
,	O
whether	O
it	O
be	O
simple	O
XOR	O
with	O
a	O
single-byte	O
key	O
,	O
or	O
through	O
the	O
use	O
of	O
ZIP	B-System
or	O
Zlib	B-System
compression	O
wrapped	O
with	O
RC4	O
encryption	O
.	O

These	O
components	O
are	O
responsible	O
for	O
a	O
myriad	O
of	O
functions	O
including	O
handling	O
decryption	O
,	O
network	O
communications	O
,	O
gaining	O
super-user	O
privileges	O
,	O
monitoring	O
system	O
logs	O
,	O
loading	O
additional	O
Dalvik	O
code	O
files	O
,	O
tracking	O
the	O
device	O
location	O
and	O
more	O
.	O

The	O
remainder	O
of	O
this	O
section	O
describes	O
at	O
a	O
high-level	O
what	O
HenBox	O
is	O
capable	O
of	O
,	O
and	O
how	O
it	O
operates	O
.	O

The	O
description	O
is	O
based	O
on	O
analysis	O
of	O
the	O
sample	O
described	O
in	O
Table	O
3	O
below	O
,	O
which	O
was	O
of	O
interest	O
given	O
its	O
C2	O
domain	B-Indicator
mefound	I-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
overlaps	O
with	O
PlugX	B-Malware
,	O
Zupdax	B-Malware
,	O
and	O
Poison	B-Malware
Ivy	I-Malware
malware	O
families	O
discussed	O
in	O
more	O
detail	O
later	O
.	O

SHA256	O
Package	O
Name	O
App	O
Name	O
a6c7351b09a733a1b3ff8a0901c5bde	B-Indicator
fdc3b566bfcedcdf5a338c3a97c9f249b	O
com.android.henbox	B-Indicator
备份	O
(	O
Backup	O
)	O
Table	O
3	O
HenBox	B-Malware
variant	O
used	O
in	O
description	O
Once	O
this	O
variant	O
of	O
HenBox	B-Malware
is	O
installed	O
on	O
the	O
victim	O
’	O
s	O
device	O
,	O
the	O
app	O
can	O
be	O
executed	O
in	O
two	O
different	O
ways	O
:	O
One	O
method	O
for	O
executing	O
HenBox	B-Malware
is	O
for	O
the	O
victim	O
to	O
launch	O
the	O
malicious	O
app	O
(	O
named	O
“	O
Backup	O
”	O
,	O
in	O

this	O
instance	O
)	O
from	O
the	O
launcher	O
view	O
on	O
their	O
device	O
,	O
as	O
shown	O
in	O
Figure	O
3	O
below	O
.	O

This	O
runs	O
code	O
in	O
the	O
onCreate	O
(	O
)	O
method	O
of	O
the	O
app	O
’	O
s	O
MainActivity	O
class	O
,	O
which	O
in	O
effect	O
is	O
the	O
program	O
’	O
s	O
entry	O
point	O
.	O

This	O
process	O
is	O
defined	O
in	O
the	O
app	O
’	O
s	O
AndroidManifest.xml	O
config	O
file	O
,	O
as	O
shown	O
in	O
the	O
following	O
snippet	O
.	O

Doing	O
so	O
executes	O
code	O
checking	O
if	O
the	O
device	O
is	O
manufactured	O
by	O
Xiaomi	B-Organization
,	O
or	O
if	O
Xiaomi	B-Organization
’	I-Organization
s	I-Organization
fork	O
of	O
Android	B-System
is	O
running	O
on	O
the	O
device	O
.	O

Under	O
these	O
conditions	O
,	O
the	O
app	O
continues	O
executing	O
and	O
the	O
intent	O
of	O
targeting	O
Xiaomi	B-Organization
devices	O
and	O
users	O
could	O
be	O
inferred	O
,	O
however	O
poorly	O
written	O
code	O
results	O
in	O
execution	O
in	O
more	O
environments	O
than	O
perhaps	O
intended	O
;	O
further	O
checks	O
are	O
made	O
to	O
ascertain	O
whether	O
the	O
app	O
is	O
running	O
on	O
an	O
emulator	O
,	O
perhaps	O
to	O
evade	O
researcher	O
analysis	O
environments	O
.	O

Assuming	O
these	O
checks	O
pass	O
,	O
one	O
of	O
the	O
main	O
ELF	O
libraries	O
is	O
loaded	O
that	O
orchestrates	O
other	O
components	O
and	O
provides	O
functionality	O
to	O
the	O
app	O
’	O
s	O
Dalvik	O
code	O
through	O
the	O
Java	O
Native	O
Interface	O
(	O
JNI	O
)	O
.	O

HenBox	B-Malware
checks	O
whether	O
this	O
execution	O
is	O
its	O
first	O
by	O
using	O
Android	B-System
’	O
s	O
shared	O
preferences	O
feature	O
to	O
persist	O
XML	O
key-value	O
pair	O
data	O
.	O

If	O
it	O
is	O
the	O
first	O
execution	O
,	O
and	O
if	O
the	O
app	O
’	O
s	O
path	O
does	O
not	O
contain	O
“	O
/system/app	B-Indicator
”	O
(	O
i.e	O
.	O

HenBox	B-Malware
is	O
not	O
running	O
as	O
a	O
system	O
app	O
)	O
,	O
another	O
ELF	O
library	O
is	O
loaded	O
to	O
aid	O
with	O
executing	O
super-user	O
commands	O
.	O

The	O
second	O
method	O
uses	O
intents	O
,	O
broadcasts	O
,	O
and	O
receivers	O
to	O
execute	O
HenBox	O
code	O
.	O

Providing	O
the	O
app	O
has	O
registered	O
an	O
intent	O
to	O
process	O
particular	O
events	O
from	O
the	O
system	O
,	O
and	O
one	O
of	O
said	O
events	O
occurs	O
,	O
HenBox	O
is	O
effectively	O
brought	O
to	O
life	O
through	O
external	O
stimulus	O
from	O
another	O
app	O
on	O
the	O
system	O
broadcasting	O
a	O
request	O
,	O
or	O
the	O
system	O
itself	O
broadcasting	O
a	O
particular	O
event	O
has	O
occurred	O
.	O

These	O
intents	O
are	O
typically	O
defined	O
statically	O
in	O
the	O
app	O
’	O
s	O
AndroidManifest.xml	O
config	O
file	O
;	O
some	O
HenBox	B-Malware
variants	O
register	O
further	O
intents	O
from	O
their	O
code	O
at	O
run-time	O
.	O

Once	O
a	O
matching	O
intent	O
is	O
triggered	O
,	O
the	O
respective	O
Receiver	O
code	O
will	O
be	O
executed	O
,	O
leading	O
to	O
other	O
HenBox	O
behaviors	O
being	O
launched	O
,	O
which	O
are	O
described	O
later	O
.	O

Table	O
4	O
below	O
lists	O
the	O
intents	O
that	O
are	O
statically	O
registered	O
in	O
this	O
HenBox	B-Malware
variant	O
’	O
s	O
AndroidManifest.xml	O
config	O
file	O
,	O
together	O
with	O
a	O
description	O
of	O
what	O
that	O
intent	O
does	O
,	O
and	O
when	O
it	O
would	O
be	O
used	O
.	O

Depending	O
on	O
the	O
intent	O
triggered	O
,	O
one	O
of	O
two	O
Receivers	O
would	O
be	O
called	O
,	O
in	O
this	O
instance	O
they	O
are	O
called	O
Boot	O
or	O
Time	O
but	O
the	O
name	O
is	O
somewhat	O
immaterial	O
.	O

Receiver	O
Intent	O
Name	O
Description	O
BootReceiver	O
android.intent.action.BOOT_COMPLETED	B-Indicator
System	O
notification	O
that	O
the	O
device	O
has	O
finished	O
booting	O
.	O

android.intent.action.restart	B-Indicator
A	O
legacy	O
intent	O
used	O
to	O
indicate	O
a	O
system	O
restart	O
.	O

android.intent.action.SIM_STATE_CHANGED	B-Indicator
System	O
notification	O
that	O
the	O
SIM	O
card	O
has	O
changed	O
or	O
been	O
removed	O
.	O

android.intent.action.PACKAGE_INSTALL	B-Indicator
System	O
notification	O
that	O
the	O
download	O
and	O
eventual	O
installation	O
of	O
an	O
app	O
package	O
is	O
happening	O
(	O
this	O
is	O
deprecated	O
)	O
android.intent.action.PACKAGE_ADDED	B-Indicator
System	O
notification	O
that	O
a	O
new	O
app	O
package	O
has	O
been	O
installed	O
on	O
the	O
device	O
,	O
including	O
the	O
name	O
of	O
said	O
package	O
.	O

com.xiaomi.smarthome.receive_alarm	B-Indicator
Received	O
notifications	O
from	O
Xiaomi	B-Organization
’	O
s	O
smart	O
home	O
IoT	O
devices	O
.	O

TimeReceiver	O
android.intent.action.ACTION_TIME_CHANGED	B-Indicator
System	O
notification	O
that	O
the	O
time	O
was	O
set	O
.	O

android.intent.action.CONNECTIVITY_CHANGE	B-Indicator
System	O
notification	O
that	O
a	O
change	O
in	O
network	O
connectivity	O
has	O
occurred	O
,	O
either	O
lost	O
or	O
established	O
.	O

Since	O
Android	B-System
version	O
7	O
(	O
Nougat	B-System
)	O
this	O
information	O
is	O
gathered	O
using	O
other	O
means	O
,	O
perhaps	O
inferring	O
the	O
devices	O
used	O
by	O
potential	O
victim	O
run	O
older	O
versions	O
of	O
Android	B-System
.	O

Table	O
4	O
HenBox	B-Malware
variant	O
's	O
Intents	O
and	O
Receivers	O
Most	O
of	O
the	O
intents	O
registered	O
in	O
the	O
AndroidManifest.xml	O
file	O
,	O
or	O
loaded	O
during	O
run-time	O
,	O
are	O
commonly	O
found	O
in	O
malicious	O
Android	B-System
apps	O
.	O

What	O
’	O
s	O
more	O
interesting	O
,	O
and	O
much	O
less	O
common	O
,	O
is	O
the	O
inclusion	O
of	O
the	O
com.xiaomi.smarthome.receive_alarm	B-Indicator
intent	O
filter	O
.	O

Xiaomi	B-Organization
,	O
a	O
privately	O
owned	O
Chinese	O
electronics	O
and	O
software	O
company	O
,	O
is	O
the	O
5th	O
largest	O
smart	O
phone	O
manufacturer	O
in	O
the	O
world	O
and	O
also	O
manufactures	O
IoT	O
devices	O
for	O
the	O
home	O
.	O

Most	O
devices	O
can	O
be	O
controlled	O
by	O
Xiaomi	B-Organization
’	O
s	O
“	O
MiHome	B-System
”	O
Android	B-System
app	O
,	O
which	O
is	O
available	O
on	O
Google	B-System
Play	I-System
with	O
between	O
1,000,000	O
and	O
5,000,000	O
downloads	O
.	O

Given	O
the	O
nature	O
of	O
connected	O
devices	O
in	O
smart	O
homes	O
,	O
it	O
’	O
s	O
highly	O
likely	O
many	O
of	O
these	O
devices	O
,	O
and	O
indeed	O
the	O
controller	O
app	O
itself	O
,	O
communicate	O
with	O
one	O
another	O
sending	O
status	O
notifications	O
,	O
alerts	O
and	O
so	O
on	O
.	O

Such	O
notifications	O
would	O
be	O
received	O
by	O
the	O
MiHome	B-System
app	O
or	O
any	O
other	O
,	O
such	O
as	O
HenBox	B-Malware
,	O
so	O
long	O
as	O
they	O
register	O
their	O
intent	O
to	O
do	O
so	O
.	O

This	O
could	O
essentially	O
allow	O
for	O
external	O
devices	O
to	O
act	O
as	O
a	O
trigger	O
to	O
execute	O
the	O
malicious	O
HenBox	B-Malware
code	O
,	O
or	O
perhaps	O
afford	O
additional	O
data	O
HenBox	B-Malware
can	O
collect	O
and	O
exfiltrate	O
.	O

Either	O
method	O
to	O
load	O
HenBox	B-Malware
ultimately	O
results	O
in	O
an	O
instance	O
of	O
a	O
service	O
being	O
launched	O
.	O

This	O
service	O
hides	O
the	O
app	O
from	O
plain	O
sight	O
and	O
loads	O
another	O
ELF	O
library	O
to	O
gather	O
environmental	O
information	O
about	O
the	O
device	O
,	O
such	O
as	O
running	O
processes	O
and	O
apps	O
,	O
and	O
details	O
about	O
device	O
hardware	O
,	O
primarily	O
through	O
parsing	O
system	O
logs	O
and	O
querying	O
running	O
processes	O
.	O

The	O
service	O
continues	O
by	O
loading	O
an	O
ELF	O
,	O
created	O
by	O
Baidu	B-Organization
,	O
which	O
is	O
capable	O
of	O
tracking	O
the	O
device	O
location	O
before	O
setting	O
up	O
a	O
monitor	O
to	O
harvest	O
phone	O
numbers	O
associated	O
with	O
outgoing	O
calls	O
for	O
those	O
numbers	O
with	O
a	O
country	O
code	O
“	O
+86	O
”	O
prefix	O
,	O
which	O
relates	O
to	O
the	O
People	O
’	O
s	O
Republic	O
of	O
China	O
.	O

Further	O
assets	O
are	O
decrypted	O
and	O
deployed	O
,	O
including	O
another	O
Dalvik	O
DEX	O
code	O
file	O
,	O
which	O
has	O
various	O
capabilities	O
including	O
registering	O
itself	O
as	O
the	O
incoming	O
SMS	O
handler	O
for	O
the	O
device	O
to	O
intercept	O
SMS	O
messages	O
,	O
loading	O
another	O
ELF	O
library	O
that	O
includes	O
a	O
version	O
of	O
BusyBox	B-System
-	O
a	O
package	O
containing	O
various	O
stripped-down	O
Unix	O
tools	O
useful	O
for	O
administering	O
such	O
systems	O
–	O
and	O
,	O
interestingly	O
,	O
is	O
capable	O
of	O
turning	O
off	O
the	O
sound	O
played	O
when	O
the	O
device	O
’	O
s	O
cameras	O
take	O
pictures	O
.	O

The	O
Android	B-System
permissions	O
requested	O
by	O
HenBox	B-Malware
,	O
as	O
defined	O
in	O
the	O
apps	O
’	O
AndroidManifest.xml	O
files	O
,	O
range	O
from	O
accessing	O
location	O
and	O
network	O
settings	O
to	O
messages	O
,	O
call	O
,	O
and	O
contact	O
data	O
.	O

HenBox	B-Malware
can	O
also	O
access	O
sensors	O
such	O
as	O
the	O
device	O
camera	O
(	O
s	O
)	O
and	O
the	O
microphone	O
.	O

Beyond	O
the	O
Android	B-System
app	O
itself	O
,	O
other	O
components	O
such	O
as	O
the	O
aforementioned	O
ELF	O
libraries	O
have	O
additional	O
data-stealing	O
capabilities	O
.	O

One	O
ELF	O
library	O
,	O
libloc4d.so	B-Indicator
,	O
handles	O
amongst	O
other	O
things	O
the	O
loading	O
of	O
the	O
app-decoded	O
ELF	O
library	O
file	O
“	O
sux	O
”	O
,	O
as	O
well	O
as	O
handling	O
connectivity	O
to	O
the	O
C2	O
.	O

The	O
sux	O
library	O
appears	O
to	O
be	O
a	O
customized	O
super	O
user	O
(	O
su	O
)	O
tool	O
that	O
includes	O
code	O
from	O
the	O
com.koushikdutta.superuser	B-Indicator
app	O
and	O
carries	O
the	O
equivalent	O
of	O
a	O
super	O
user	O
(	O
su	O
)	O
binary	O
in	O
order	O
to	O
run	O
privileged	O
commands	O
on	O
the	O
system	O
.	O

The	O
primary	O
goal	O
of	O
sux	O
appears	O
to	O
be	O
steal	O
messages	O
and	O
other	O
data	O
from	O
popular	O
messaging	O
and	O
social	O
media	O
apps	O
specified	O
within	O
the	O
HenBox	B-Malware
sample	O
.	O

A	O
similar	O
tool	O
,	O
with	O
the	O
same	O
filename	O
,	O
has	O
been	O
discussed	O
in	O
previous	O
research	O
but	O
the	O
SpyDealer	B-Malware
malware	O
appears	O
unrelated	O
to	O
HenBox	B-Malware
.	O

More	O
likely	O
,	O
this	O
is	O
a	O
case	O
of	O
common	O
attack	O
tools	O
being	O
re-used	O
between	O
different	O
threat	O
actor	O
groups	O
.	O

This	O
particular	O
HenBox	B-Malware
variant	O
,	O
as	O
listed	O
in	O
Table	O
3	O
above	O
,	O
harvests	O
data	O
from	O
two	O
popular	O
messaging	O
and	O
social	O
media	O
apps	O
:	O
Voxer	B-System
Walkie	B-System
Talkie	I-System
Messenger	B-System
(	O
com.rebelvox.voxer	B-Indicator
)	O
and	O
Tencent	B-Organization
’	O
s	O
WeChat	B-System
(	O
com.tencent.mm	B-Indicator
)	O
.	O

These	O
types	O
of	O
apps	O
tend	O
to	O
store	O
their	O
data	O
in	O
databases	O
and	O
,	O
as	O
an	O
example	O
,	O
HenBox	B-Malware
accesses	O
Voxer	O
’	O
s	O
database	O
from	O
the	O
file	O
“	O
/data/data/com.rebelvox.voxer/databases/rv.db	B-Indicator
”	O
.	O

Once	O
opened	O
,	O
HenBox	B-Malware
runs	O
the	O
following	O
query	O
to	O
gather	O
message	O
information	O
.	O

Not	O
long	O
after	O
this	O
variant	O
was	O
public	O
,	O
newer	O
variants	O
of	O
HenBox	B-Malware
were	O
seen	O
,	O
and	O
some	O
had	O
significant	O
increases	O
in	O
the	O
number	O
of	O
targeted	O
apps	O
.	O

Table	O
5	O
describes	O
the	O
latest	O
variant	O
seen	O
in	O
AutoFocus	O
.	O

SHA256	O
Package	O
Name	O
App	O
Name	O
First	O
Seen	O
07994c9f2eeeede199dd6b4e760fce3	B-Indicator
71f03f3cc4307e6551c18d2fbd024a24f	B-Indicator
com.android.henbox	B-Indicator
备份	O
(	O
Backup	O
)	O
January	O
3rd	O
2018	O
Table	O
6	O
contains	O
an	O
updated	O
list	O
of	O
targeted	O
apps	O
from	O
which	O
this	O
newer	O
variant	O
of	O
HenBox	B-Malware
is	O
capable	O
of	O
harvesting	O
data	O
.	O

Interestingly	O
,	O
the	O
two	O
communication	O
apps	O
described	O
above	O
as	O
being	O
targeted	O
by	O
the	O
HenBox	O
variant	O
listed	O
in	O
Table	O
3	O
do	O
not	O
appear	O
in	O
this	O
updated	O
list	O
.	O

Package	O
Name	O
App	O
Name	O
com.whatsapp	B-Indicator
WhatsApp	B-System
Messenger	B-System
com.pugna.magiccall	B-Indicator
n/a	O
org.telegram.messenger	B-Indicator
Telegram	B-System
com.facebook.katana	B-Indicator
Facebook	B-System
com.twitter.android	B-Indicator
Twitter	B-System
jp.naver.line.android	B-Indicator
LINE	B-System
:	O
Free	O
Calls	O
&	O
Messages	O
com.instanza.cocovoice	B-Indicator
Coco	O
com.beetalk	B-Indicator
BeeTalk	B-System
com.gtomato.talkbox	B-Indicator
TalkBox	B-System
Voice	O
Messenger	B-System
-	O
PTT	O
com.viber.voip	B-Indicator
Viber	B-System
Messenger	B-System
com.immomo.momo	B-Indicator
MOMO陌陌	B-System
com.facebook.orca	B-Indicator
Messenger	B-System
–	O
Text	O
and	O
Video	O
Chat	O
for	O
Free	O
com.skype.rover	B-Indicator

Skype	B-System
;	O
3rd	O
party	O
stores	O
only	O
Most	O
of	O
these	O
apps	O
are	O
well	O
established	O
and	O
available	O
on	O
Google	B-System
Play	I-System
,	O
however	O
,	O
com.skype.rover	B-Indicator
appears	O
to	O
be	O
available	O
only	O
on	O
third-party	O
app	O
stores	O
.	O

The	O
same	O
is	O
likely	O
to	O
be	O
the	O
case	O
for	O
com.pugna.magiccall	B-Indicator
but	O
this	O
is	O
unknown	O
currently	O
.	O

It	O
’	O
s	O
clear	O
to	O
see	O
that	O
the	O
capabilities	O
of	O
HenBox	B-Malware
are	O
very	O
comprehensive	O
,	O
both	O
in	O
terms	O
of	O
an	O
Android	B-System
app	O
with	O
its	O
native	O
libraries	O
and	O
given	O
the	O
amount	O
of	O
data	O
it	O
can	O
glean	O
from	O
a	O
victim	O
.	O

Such	O
data	O
includes	O
contact	O
and	O
location	O
information	O
,	O
phone	O
and	O
message	O
activity	O
,	O
the	O
ability	O
to	O
record	O
from	O
the	O
microphone	O
,	O
camera	O
,	O
and	O
other	O
sensors	O
as	O
well	O
as	O
the	O
capability	O
to	O
access	O
data	O
from	O
many	O
popular	O
messaging	O
and	O
social	O
media	O
apps	O
.	O

Infrastructure	O
While	O
investigating	O
HenBox	B-Malware
we	O
discovered	O
infrastructure	O
ties	O
to	O
other	O
malware	O
families	O
associated	O
with	O
targeted	O
attacks	O
against	O
Windows	B-System
users	O
–	O
notable	O
overlaps	O
included	O
PlugX	B-Malware
,	O
Zupdax	B-Malware
,	O
9002	B-Malware
,	O
and	O
Poison	B-Malware
Ivy	I-Malware
.	O

The	O
overall	O
image	O
of	O
these	O
ties	O
is	O
below	O
in	O
Figure	O
5	O
and	O
paints	O
a	O
picture	O
of	O
an	O
adversary	O
with	O
at	O
least	O
5	O
malware	O
families	O
in	O
their	O
toolbox	O
dating	O
back	O
to	O
at	O
least	O
2015	O
.	O

The	O
overlap	O
between	O
the	O
HenBox	B-Malware
and	O
9002	B-Malware
malware	O
families	O
Unit	O
42	O
has	O
seen	O
involves	O
three	O
shared	O
C2s	O
between	O
several	O
samples	O
;	O
the	O
first	O
IP	O
below	O
is	O
used	O
for	O
more	O
than	O
half	O
of	O
the	O
HenBox	B-Malware
samples	O
we	O
have	O
seen	O
to	O
date	O
:	O
47.90.81	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
23	I-Indicator
222.139.212	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
16	I-Indicator
lala513.gicp	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
The	O
overlaps	O
between	O
the	O
Henbox	B-Malware
,	O
PlugX	B-Malware
,	O
Zupdax	B-Malware
,	O
and	O
Poison	B-Malware
Ivy	I-Malware
malware	O
families	O
involves	O
a	O
web	O
of	O
shared	O
C2s	O
and	O
IP	O
resolutions	O
centered	O
around	O
the	O
below	O
:	O
59.188.196	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
172	I-Indicator
cdncool	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
(	O
and	O
third-levels	O
of	O
this	O
domain	O
)	O
www3.mefound	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
www5.zyns	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
w3.changeip	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
org	I-Indicator
Ties	O
to	O
previous	O
activity	O
The	O
registrant	O
of	O
cdncool	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
also	O
registered	O
six	O
other	O
domains	O
.	O

To	O
date	O
,	O
Unit	O
42	O
has	O
seen	O
four	O
of	O
the	O
seven	O
(	O
the	O
first	O
three	O
in	O
the	O
list	O
below	O
,	O
along	O
with	O
cdncool	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
)	O
used	O
in	O
malicious	O
activity	O
and	O
it	O
is	O
reasonable	O
to	O
assume	O
the	O
remaining	O
three	O
are	O
or	O
were	O
intended	O
to	O
serve	O
the	O
same	O
purpose	B-Indicator
.	I-Indicator

tcpdo	I-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
adminsysteminfo	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
md5c	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
linkdatax	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
csip6	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
biz	I-Indicator
adminloader	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
Unit	O
42	O
published	O
a	O
blog	O
in	O
July	O
2016	O
about	O
9002	B-Malware
malware	O
being	O
delivered	O
using	O
a	O
combination	O
of	O
shortened	O
links	O
and	O
a	O
file	O
hosted	O
on	O
Google	O
Drive	O
.	O

The	O
spear	O
phishing	O
emails	O
had	O
Myanmar	O
political-themed	O
lures	O
and	O
,	O
if	O
the	O
9002	B-Malware
C2	O
server	O
responded	O
,	O
the	O
Trojan	O
sent	O
system	O
specific	O
information	O
along	O
with	O
the	O
string	O
“	O
jackhex	O
”	O
.	O

“	O
jackhex	O
”	O
has	O
also	O
been	O
part	O
of	O
a	O
C2	O
for	O
what	O
is	O
likely	O
related	O
Poison	B-Malware
Ivy	I-Malware
activity	O
detailed	O
below	O
,	O
along	O
with	O
additional	O
infrastructure	O
ties	O
.	O

The	O
C2	O
for	O
the	O
aforementioned	O
9002	B-Malware
sample	O
was	O
logitechwkgame	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
,	O
which	O
resolved	O
to	O
the	O
IP	O
address	O
222.239.91	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
30	I-Indicator
.	O

At	O
the	O
same	O
time	O
,	O
the	O
domain	B-Indicator
admin.nslookupdns	I-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
also	O
resolved	O
to	O
the	O
same	O
IP	O
address	O
,	O
suggesting	O
that	O
these	O
two	O
domains	O
are	O
associated	O
with	O
the	O
same	O
threat	O
actors	O
.	O

In	O
addition	O
,	O
admin.nslookupdns	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
was	O
a	O
C2	O
for	O
Poison	B-Malware
Ivy	I-Malware
samples	O
associated	O
with	O
attacks	O
on	O
Myanmar	O
and	O
other	O
Asian	O
countries	O
discussed	O
in	O
a	O
blog	O
published	O
by	O
Arbor	B-Organization
Networks	I-Organization
in	O
April	O
2016	O
.	O

Another	O
tie	O
between	O
the	O
activity	O
is	O
the	O
C2	O
jackhex.md5c	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
net	I-Indicator
,	O
which	O
was	O
also	O
used	O
as	O
a	O
Poison	B-Malware
Ivy	I-Malware
C2	O
in	O
the	O
Arbor	B-Organization
Networks	I-Organization
blog	O
.	O

“	O
jackhex	O
”	O
is	O
not	O
a	O
common	O
word	O
or	O
phrase	O
and	O
,	O
as	O
noted	O
above	O
,	O
was	O
also	O
seen	O
in	O
the	O
beacon	O
activity	O
with	O
the	O
previously	O
discussed	O
9002	B-Malware
sample	O
.	O

Finally	O
,	O
since	O
publishing	O
the	O
9002	B-Malware
blog	O
,	O
Unit	O
42	O
has	O
also	O
seen	O
the	O
aforementioned	O
9002	B-Malware
C2	O
used	O
as	O
a	O
Poison	B-Malware
Ivy	I-Malware
C2	O
with	O
a	O
Myanmar	O
political-themed	O
lure	O
.	O

In	O
our	O
9002	B-Malware
blog	O
we	O
noted	O
some	O
additional	O
infrastructure	O
used	O
either	O
as	O
C2s	O
for	O
related	O
Poison	B-Malware
Ivy	I-Malware
samples	O
,	O
or	O
domain	O
registrant	O
overlap	O
with	O
those	O
C2	O
domains	O
.	O

When	O
we	O
published	O
that	O
blog	O
Unit	O
42	O
hadn	O
’	O
t	O
seen	O
any	O
of	O
the	O
three	O
registrants	O
overlap	O
domains	O
used	O
in	O
malicious	O
activity	O
.	O

Since	O
then	O
,	O
we	O
have	O
seen	O
Poison	B-Malware
Ivy	I-Malware
samples	O
using	O
third-levels	O
of	O
querlyurl	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
,	O
lending	O
further	O
credence	O
the	O
remaining	O
two	O
domains	O
,	O
gooledriveservice	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
and	O
appupdatemoremagic	B-Indicator
[	I-Indicator
.	I-Indicator

]	I-Indicator
com	I-Indicator
are	O
or	O
were	O
intended	O
for	O
malicious	O
use	O
.	O

While	O
we	O
do	O
not	O
have	O
complete	O
targeting	O
,	O
information	O
associated	O
with	O
these	O
Poison	B-Malware
Ivy	I-Malware
samples	O
,	O
several	O
of	O
the	O
decoy	O
files	O
were	O
in	O
Chinese	O
and	O
appear	O
to	O
be	O
part	O
of	O
a	O
2016	O
campaign	O
targeting	O
organizations	O
in	O
Taiwan	O
with	O
political-themed	O
lures	O
.	O

Conclusion	O
Typically	O
masquerading	O
as	O
legitimate	O
Android	B-Malware
system	O
apps	O
,	O
and	O
sometimes	O
embedding	O
legitimate	O
apps	O
within	O
them	O
,	O
the	O
primary	O
goal	O
of	O
the	O
malicious	O
HenBox	B-Malware
appears	O
to	O
be	O
to	O
spy	O
on	O
those	O
who	O
install	O
them	O
.	O

Using	O
similar	O
traits	O
,	O
such	O
as	O
copycat	O
iconography	O
and	O
app	O
or	O
package	O
names	O
,	O
victims	O
are	O
likely	O
socially	O
engineered	O
into	O
installing	O
the	O
malicious	O
apps	O
,	O
especially	O
when	O
available	O
on	O
so-called	O
third-party	O
(	O
i.e	O
.	O

non-Google	O
Play	B-System
)	O
app	O
stores	O
which	O
often	O
have	O
fewer	O
security	O
and	O
vetting	O
procedures	O
for	O
the	O
apps	O
they	O
host	O
.	O

It	O
’	O
s	O
possible	O
,	O
as	O
with	O
other	O
Android	B-System
malware	O
,	O
that	O
some	O
apps	O
may	O
also	O
be	O
available	O
on	O
forums	O
,	O
file-sharing	O
sites	O
or	O
even	O
sent	O
to	O
victims	O
as	O
email	O
attachments	O
,	O
and	O
we	O
were	O
only	O
able	O
to	O
determine	O
the	O
delivery	O
mechanism	O
for	O
a	O
handful	O
of	O
the	O
apps	O
we	O
have	O
been	O
able	O
to	O
find	O
.	O

The	O
hosting	O
locations	O
seen	O
for	O
some	O
HenBox	B-Malware
samples	O
,	O
together	O
with	O
the	O
nature	O
of	O
some	O
embedded	O
apps	O
including	O
:	O
those	O
targeted	O
at	O
extremist	O
groups	O
,	O
those	O
who	O
use	O
VPN	O
or	O
other	O
privacy-enabling	O
apps	O
,	O
and	O
those	O
who	O
speak	O
the	O
Uyghur	O
language	O
,	O
highlights	O
the	O
victim	O
profile	O
the	O
threat	O
actors	O
were	O
seeking	O
to	O
attack	O
.	O

The	O
targets	O
and	O
capabilities	O
of	O
HenBox	B-Malware
,	O
in	O
addition	O
to	O
the	O
ties	O
to	O
previous	O
activity	O
using	O
four	O
different	O
Windows	O
malware	O
families	O
with	O
political-themed	O
lures	O
against	O
several	O
different	O
South	O
East	O
Asian	O
countries	O
,	O
indicates	O
this	O
activity	O
likely	O
represents	O
an	O
at	O
least	O
three-year-old	O
espionage	O
campaign	O
.	O

THURSDAY	O
,	O
OCTOBER	O
11	O
,	O
2018	O
GPlayed	B-Malware
Trojan	O
-	O
.Net	O
playing	O
with	O
Google	B-Organization
Market	O
Introduction	O
In	O
a	O
world	O
where	O
everything	O
is	O
always	O
connected	O
,	O
and	O
mobile	O
devices	O
are	O
involved	O
in	O
individuals	O
'	O
day-to-day	O
lives	O
more	O
and	O
more	O
often	O
,	O
malicious	O
actors	O
are	O
seeing	O
increased	O
opportunities	O
to	O
attack	O
these	O
devices	O
.	O

Cisco	B-Organization
Talos	I-Organization
has	O
identified	O
the	O
latest	O
attempt	O
to	O
penetrate	O
mobile	O
devices	O
—	O
a	O
new	O
Android	B-System
trojan	O
that	O
we	O
have	O
dubbed	O
"	O
GPlayed	B-Malware
.	O

''	O
This	O
is	O
a	O
trojan	O
with	O
many	O
built-in	O
capabilities	O
.	O

At	O
the	O
same	O
time	O
,	O
it	O
's	O
extremely	O
flexible	O
,	O
making	O
it	O
a	O
very	O
effective	O
tool	O
for	O
malicious	O
actors	O
.	O

The	O
sample	O
we	O
analyzed	O
uses	O
an	O
icon	O
very	O
similar	O
to	O
Google	B-System
Apps	I-System
,	O
with	O
the	O
label	O
"	O
Google	B-System
Play	I-System
Marketplace	I-System
''	O
to	O
disguise	O
itself	O
.	O

The	O
malicious	O
application	O
is	O
on	O
the	O
left-hand	O
side	O
.	O

What	O
makes	O
this	O
malware	O
extremely	O
powerful	O
is	O
the	O
capability	O
to	O
adapt	O
after	O
it	O
's	O
deployed	O
.	O

In	O
order	O
to	O
achieve	O
this	O
adaptability	O
,	O
the	O
operator	O
has	O
the	O
capability	O
to	O
remotely	O
load	O
plugins	O
,	O
inject	O
scripts	O
and	O
even	O
compile	O
new	O
.NET	B-System
code	O
that	O
can	O
be	O
executed	O
.	O

Our	O
analysis	O
indicates	O
that	O
this	O
trojan	O
is	O
in	O
its	O
testing	O
stage	O
but	O
given	O
its	O
potential	O
,	O
every	O
mobile	O
user	O
should	O
be	O
aware	O
of	O
GPlayed	B-Malware
.	O

Mobile	O
developers	O
have	O
recently	O
begun	O
eschewing	O
traditional	O
app	O
stores	O
and	O
instead	O
want	O
to	O
deliver	O
their	O
software	O
directly	O
through	O
their	O
own	O
means	O
.	O

But	O
GPlayed	B-Malware
is	O
an	O
example	O
of	O
where	O
this	O
can	O
go	O
wrong	O
,	O
especially	O
if	O
a	O
mobile	O
user	O
is	O
not	O
aware	O
of	O
how	O
to	O
distinguish	O
a	O
fake	O
app	O
versus	O
a	O
real	O
one	O
.	O

Trojan	O
architecture	O
and	O
capabilities	O
This	O
malware	O
is	O
written	O
in	O
.NET	B-System
using	O
the	O
Xamarin	B-System
environment	O
for	O
mobile	O
applications	O
.	O

The	O
main	O
DLL	O
is	O
called	O
"	O
Reznov.DLL	B-Indicator
.	O

''	O
This	O
DLL	O
contains	O
one	O
root	O
class	O
called	O
"	O
eClient	O
,	O
''	O
which	O
is	O
the	O
core	O
of	O
the	O
trojan	O
.	O

The	O
imports	O
reveal	O
the	O
use	O
of	O
a	O
second	O
DLL	O
called	O
"	O
eCommon.dll	B-Indicator
.	O

''	O
We	O
determined	O
that	O
the	O
"	O
eCommon	O
''	O
file	O
contains	O
support	O
code	O
and	O
structures	O
that	O
are	O
platform	O
independent	O
.	O

The	O
main	O
DLL	O
also	O
contains	O
eClient	O
subclasses	O
that	O
implement	O
some	O
of	O
the	O
native	O
capabilities	O
.	O

The	O
package	O
certificate	O
is	O
issued	O
under	O
the	O
package	O
name	O
,	O
which	O
also	O
resembles	O
the	O
name	O
of	O
the	O
main	O
DLL	O
name	O
.	O

Certificate	O
information	O
The	O
Android	B-System
package	O
is	O
named	O
"	O
verReznov.Coampany	B-Indicator
.	O

''	O
The	O
application	O
uses	O
the	O
label	O
"	O
Installer	B-Indicator
''	O
and	O
its	O
name	O
is	O
"	O
android.app.Application	B-Indicator
.	O

''	O
Package	O
permissions	O
The	O
trojan	O
declares	O
numerous	O
permissions	O
in	O
the	O
manifest	O
,	O
from	O
which	O
we	O
should	O
highlight	O
the	O
BIND_DEVICE_ADMIN	O
,	O
which	O
provides	O
nearly	O
full	O
control	O
of	O
the	O
device	O
to	O
the	O
trojan	O
.	O

This	O
trojan	O
is	O
highly	O
evolved	O
in	O
its	O
design	O
.	O

It	O
has	O
modular	O
architecture	O
implemented	O
in	O
the	O
form	O
of	O
plugins	O
,	O
or	O
it	O
can	O
receive	O
new	O
.NET	B-System
source	O
code	O
,	O
which	O
will	O
be	O
compiled	O
on	O
the	O
device	O
in	O
runtime	O
.	O

Initialization	O
of	O
the	O
compiler	O
object	O
The	O
plugins	O
can	O
be	O
added	O
in	O
runtime	O
,	O
or	O
they	O
can	O
be	O
added	O
as	O
a	O
package	O
resource	O
at	O
packaging	O
time	O
.	O

This	O
means	O
that	O
the	O
authors	O
or	O
the	O
operators	O
can	O
add	O
capabilities	O
without	O
the	O
need	O
to	O
recompile	O
and	O
upgrade	O
the	O
trojan	O
package	O
on	O
the	O
device	O
.	O

Trojan	O
native	O
capabilities	O
This	O
is	O
a	O
full-fledged	O
trojan	O
with	O
capabilities	O
ranging	O
from	O
those	O
of	O
a	O
banking	O
trojan	O
to	O
a	O
full	O
spying	O
trojan	O
.	O

This	O
means	O
that	O
the	O
malware	O
can	O
do	O
anything	O
from	O
harvest	O
the	O
user	O
's	O
banking	O
credentials	O
,	O
to	O
monitoring	O
the	O
device	O
's	O
location	O
.	O

There	O
are	O
several	O
indicators	O
(	O
see	O
section	O
"	O
trojan	O
activity	O
''	O
below	O
)	O
that	O
it	O
is	O
in	O
its	O
last	O
stages	O
of	O
development	O
,	O
but	O
it	O
has	O
the	O
potential	O
to	O
be	O
a	O
serious	O
threat	O
.	O

Trojan	O
details	O
Upon	O
boot	O
,	O
the	O
trojan	O
will	O
start	O
by	O
populating	O
a	O
shared	O
preferences	O
file	O
with	O
the	O
configuration	O
it	O
has	O
on	O
its	O
internal	O
structures	O
.	O

Afterward	O
,	O
it	O
will	O
start	O
several	O
timers	O
to	O
execute	O
different	O
tasks	O
.	O

The	O
first	O
timer	O
will	O
be	O
fired	O
on	O
the	O
configured	O
interval	O
(	O
20	O
seconds	O
in	O
this	O
case	O
)	O
,	O
pinging	O
the	O
command	O
and	O
control	O
(	O
C2	O
)	O
server	O
.	O

The	O
response	O
can	O
either	O
be	O
a	O
simple	O
"	O
OK	O
,	O
''	O
or	O
can	O
be	O
a	O
request	O
to	O
perform	O
some	O
action	O
on	O
the	O
device	O
.	O

The	O
second	O
timer	O
will	O
run	O
every	O
five	O
seconds	O
and	O
it	O
will	O
try	O
to	O
enable	O
the	O
WiFi	O
if	O
it	O
's	O
disabled	O
.	O

The	O
third	O
timer	O
will	O
fire	O
every	O
10	O
seconds	O
and	O
will	O
attempt	O
to	O
register	O
the	O
device	O
into	O
the	O
C2	O
and	O
register	O
wake-up	O
locks	O
on	O
the	O
system	O
to	O
control	O
the	O
device	O
's	O
status	O
.	O

During	O
the	O
trojan	O
registration	O
stage	O
,	O
the	O
trojan	O
exfiltrates	O
private	O
information	O
such	O
as	O
the	O
phone	O
's	O
model	O
,	O
IMEI	O
,	O
phone	O
number	O
and	O
country	O
.	O

It	O
will	O
also	O
report	O
the	O
version	O
of	O
Android	B-System
that	O
the	O
phone	O
is	O
running	O
and	O
any	O
additional	O
capabilities	O
.	O

Device	O
registration	O
This	O
is	O
the	O
last	O
of	O
the	O
three	O
main	O
timers	O
that	O
are	O
created	O
.	O

The	O
trojan	O
will	O
register	O
the	O
SMS	O
handler	O
,	O
which	O
will	O
forward	O
the	O
contents	O
and	O
the	O
sender	O
of	O
all	O
of	O
the	O
SMS	O
messages	O
on	O
the	O
phone	O
to	O
the	O
C2	O
.	O

The	O
final	O
step	O
in	O
the	O
trojan	O
's	O
initialization	O
is	O
the	O
escalation	O
and	O
maintenance	O
of	O
privileges	O
in	O
the	O
device	O
.	O

This	O
is	O
done	O
both	O
by	O
requesting	O
admin	O
privileges	O
on	O
the	O
device	O
and	O
asking	O
the	O
user	O
to	O
allow	O
the	O
application	O
to	O
access	O
the	O
device	O
's	O
settings	O
.	O

Privilege	O
escalation	O
requests	O
The	O
screens	O
asking	O
for	O
the	O
user	O
's	O
approval	O
wo	O
n't	O
close	O
unless	O
the	O
user	O
approves	O
the	O
privilege	O
escalation	O
.	O

If	O
the	O
user	O
closes	O
the	O
windows	O
,	O
they	O
will	O
appear	O
again	O
due	O
to	O
the	O
timer	O
configuration	O
.	O

After	O
the	O
installation	O
of	O
the	O
trojan	O
,	O
it	O
will	O
wait	O
randomly	O
between	O
three	O
and	O
five	O
minutes	O
to	O
activate	O
one	O
of	O
the	O
native	O
capabilities	O
—	O
these	O
are	O
implemented	O
on	O
the	O
eClient	O
subclass	O
called	O
"	O
GoogleCC	O
.	O

''	O
This	O
class	O
will	O
open	O
a	O
WebView	O
with	O
a	O
Google-themed	B-Organization
page	O
asking	O
for	O
payment	O
in	O
order	O
to	O
use	O
the	O
Google	B-Organization
services	O
.	O

This	O
will	O
take	O
the	O
user	O
through	O
several	O
steps	O
until	O
it	O
collects	O
all	O
the	O
necessary	O
credit	O
card	O
information	O
,	O
which	O
will	O
be	O
checked	O
online	O
and	O
exfiltrated	O
to	O
the	O
C2	O
.	O

During	O
this	O
process	O
,	O
an	O
amount	O
of	O
money	O
,	O
configured	O
by	O
the	O
malicious	O
operator	O
,	O
is	O
requested	O
to	O
the	O
user	O
.	O

Steps	O
to	O
request	O
the	O
user	O
's	O
credit	O
card	O
information	O
In	O
our	O
sample	O
configuration	O
,	O
the	O
request	O
for	O
the	O
views	O
above	O
can	O
not	O
be	O
canceled	O
or	O
removed	O
from	O
the	O
screen	O
—	O
behaving	O
just	O
like	O
a	O
screen	O
lock	O
that	O
wo	O
n't	O
be	O
disabled	O
without	O
providing	O
credit	O
card	O
information	O
.	O

All	O
communication	O
with	O
the	O
C2	O
is	O
done	O
over	O
HTTP	O
.	O

It	O
will	O
use	O
either	O
a	O
standard	O
web	O
request	O
or	O
it	O
will	O
write	O
data	O
into	O
a	O
web	O
socket	O
if	O
the	O
first	O
method	O
fails	O
.	O

The	O
C2	O
can	O
also	O
use	O
WebSocket	O
as	O
a	O
backup	O
communication	O
channel	O
.	O

Before	O
sending	O
any	O
data	O
to	O
the	O
C2	O
using	O
the	O
trojan	O
attempts	O
to	O
disguise	O
its	O
data	O
,	O
the	O
data	O
is	O
serialized	O
using	O
JSON	O
,	O
which	O
is	O
then	O
encoded	O
in	O
Base64	O
.	O

However	O
,	O
the	O
trojan	O
replaces	O
the	O
'=	O
'	O
by	O
'AAAZZZXXX	O
'	O
,	O
the	O
'+	O
'	O
by	O
'|	O
'	O
and	O
the	O
'/	O
'	O
by	O
'	O
.	O

'	O
to	O
disguise	O
the	O
Base64	O
.	O

Request	O
encoding	O
process	O
The	O
HTTP	O
requests	O
follow	O
the	O
format	O
below	O
,	O
while	O
on	O
the	O
WebSocket	O
only	O
the	O
query	O
data	O
is	O
written	O
.	O

?	O

q=	O
-	O
:	O
As	O
is	O
common	O
with	O
trojans	O
,	O
the	O
communication	O
is	O
always	O
initiated	O
by	O
the	O
trojan	O
on	O
the	O
device	O
to	O
the	O
C2	O
.	O

The	O
request	O
codes	O
are	O
actually	O
replies	O
to	O
the	O
C2	O
action	O
requests	O
,	O
which	O
are	O
actually	O
called	O
"	O
responses	O
.	O

''	O
There	O
are	O
27	O
response	O
codes	O
that	O
the	O
C2	O
can	O
use	O
to	O
make	O
requests	O
to	O
the	O
trojan	O
,	O
which	O
pretty	O
much	O
match	O
what	O
's	O
listed	O
in	O
the	O
capabilities	O
section	O
.	O

Error	O
Registration	O
Ok	O
Empty	O
SendSMS	O
RequestGoogleCC	O
Wipe	O
OpenBrowser	O
SendUSSD	O
RequestSMSList	O
RequestAppList	O
RequestLocation	O
ShowNotification	O
SetLockPassword	O
LockNow	O
MuteSound	O
LoadScript	O
LoadPlugin	O
ServerChange	O
StartApp	O
CallPhone	O
SetPingTimer	O
SMSBroadcast	O
RequestContacts	O
AddInject	O
RemoveInject	O
Evaluate	O
Another	O
feature	O
of	O
this	O
trojan	O
is	O
the	O
ability	O
to	O
register	O
injects	O
,	O
which	O
are	O
JavaScript	O
snippets	O
of	O
code	O
.	O

These	O
will	O
be	O
executed	O
in	O
a	O
WebView	O
object	O
created	O
by	O
the	O
trojan	O
.	O

This	O
gives	O
the	O
operators	O
the	O
capability	O
to	O
trick	O
the	O
user	O
into	O
accessing	O
any	O
site	O
while	O
stealing	O
the	O
user	O
's	O
cookies	O
or	O
forging	O
form	O
fields	O
,	O
like	O
account	O
numbers	O
or	O
phone	O
numbers	O
.	O

Trojan	O
activity	O
At	O
the	O
time	O
of	O
the	O
writing	O
of	O
this	O
post	O
,	O
all	O
URLs	O
(	O
see	O
IOC	O
section	O
)	O
found	O
on	O
the	O
sample	O
were	O
inactive	O
,	O
and	O
it	O
does	O
not	O
seem	O
to	O
be	O
widespread	O
.	O

There	O
are	O
some	O
indicators	O
that	O
this	O
sample	O
is	O
just	O
a	O
test	O
sample	O
on	O
its	O
final	O
stages	O
of	O
development	O
.	O

There	O
are	O
several	O
strings	O
and	O
labels	O
still	O
mentioning	O
'test	O
'	O
or	O
'testcc	O
'	O
—	O
even	O
the	O
URL	O
used	O
for	O
the	O
credit	O
card	O
data	O
exfiltration	O
is	O
named	O
"	O
testcc.php	B-Indicator
.	O

''	O
Debug	O
information	O
on	O
logcat	O
Another	O
indicator	O
is	O
the	O
amount	O
of	O
debugging	O
information	O
the	O
trojan	O
is	O
still	O
generating	O
—	O
a	O
production-level	O
trojan	O
would	O
keep	O
its	O
logging	O
to	O
a	O
minimum	O
.	O

The	O
only	O
sample	O
was	O
found	O
on	O
public	O
repositories	O
and	O
almost	O
seemed	O
to	O
indicate	O
a	O
test	O
run	O
to	O
determine	O
the	O
detection	O
ratio	O
of	O
the	O
sample	O
.	O

We	O
have	O
observed	O
this	O
trojan	O
being	O
submitted	O
to	O
public	O
antivirus	O
testing	O
platforms	O
,	O
once	O
as	O
a	O
package	O
and	O
once	O
for	O
each	O
DLL	O
to	O
determine	O
the	O
detection	O
ratio	O
.	O

The	O
sample	O
analyzed	O
was	O
targeted	O
at	O
Russian-speaking	O
users	O
,	O
as	O
most	O
of	O
the	O
user	O
interaction	O
pages	O
are	O
written	O
in	O
Russian	O
.	O

However	O
,	O
given	O
the	O
way	O
the	O
trojan	O
is	O
built	O
,	O
it	O
is	O
highly	O
customizable	O
,	O
meaning	O
that	O
adapting	O
it	O
to	O
a	O
different	O
language	O
would	O
be	O
extremely	O
easy	O
.	O

The	O
wide	O
range	O
of	O
capabilities	O
does	O
n't	O
limit	O
this	O
trojan	O
to	O
a	O
specific	O
malicious	O
activity	O
like	O
a	O
banking	O
trojan	O
or	O
a	O
ransomware	O
.	O

This	O
makes	O
it	O
impossible	O
to	O
create	O
a	O
target	O
profile	O
.	O

Conclusion	O
This	O
trojan	O
shows	O
a	O
new	O
path	O
for	O
threats	O
to	O
evolve	O
.	O

Having	O
the	O
ability	O
to	O
move	O
code	O
from	O
desktops	O
to	O
mobile	O
platforms	O
with	O
no	O
effort	O
,	O
like	O
the	O
eCommon.DLL	B-Indicator
demonstrates	O
that	O
malicious	O
actors	O
can	O
create	O
hybrid	O
threats	O
faster	O
and	O
with	O
fewer	O
resources	O
involved	O
than	O
ever	O
before	O
.	O

This	O
trojan	O
's	O
design	O
and	O
implementation	O
is	O
of	O
an	O
uncommonly	O
high	O
level	O
,	O
making	O
it	O
a	O
dangerous	O
threat	O
.	O

These	O
kinds	O
of	O
threats	O
will	O
become	O
more	O
common	O
,	O
as	O
more	O
and	O
more	O
companies	O
decide	O
to	O
publish	O
their	O
software	O
directly	O
to	O
consumers	O
.	O

There	O
have	O
been	O
several	O
recent	O
examples	O
of	O
companies	O
choosing	O
to	O
release	O
their	O
software	O
directly	O
to	O
consumers	O
,	O
bypassing	O
traditional	O
storefronts	O
.	O

The	O
average	O
user	O
might	O
not	O
have	O
the	O
necessary	O
skills	O
to	O
distinguish	O
legitimate	O
sites	O
from	O
malicious	O
ones	O
.	O

We	O
've	O
seen	O
that	O
this	O
has	O
been	O
the	O
case	O
for	O
many	O
years	O
with	O
spear-phishing	O
campaigns	O
on	O
desktop	O
and	O
mobile	O
platforms	O
,	O
so	O
,	O
unfortunately	O
,	O
it	O
does	O
n't	O
seem	O
that	O
this	O
will	O
change	O
any	O
time	O
soon	O
.	O

And	O
this	O
just	O
means	O
attackers	O
will	O
continue	O
to	O
be	O
successful	O
.	O

Coverage	O
Additional	O
ways	O
our	O
customers	O
can	O
detect	O
and	O
block	O
this	O
threat	O
are	O
listed	O
below	O
.	O

Advanced	B-System
Malware	I-System
Protection	I-System
(	I-System
AMP	I-System
)	I-System
is	O
ideally	O
suited	O
to	O
prevent	O
the	O
execution	O
of	O
the	O
malware	O
used	O
by	O
these	O
threat	O
actors	O
.	O

Cisco	B-System
Cloud	I-System
Web	I-System
Security	I-System
(	I-System
CWS	I-System
)	I-System
or	O
Web	B-System
Security	I-System
Appliance	I-System
(	I-System
WSA	I-System
)	I-System
web	O
scanning	O
prevents	O
access	O
to	O
malicious	O
websites	O
and	O
detects	O
malware	O
used	O
in	O
these	O
attacks	O
.	O

Email	O
Security	O
can	O
block	O
malicious	O
emails	O
sent	O
by	O
threat	O
actors	O
as	O
part	O
of	O
their	O
campaign	O
.	O

Network	O
Security	O
appliances	O
such	O
as	O
Next-Generation	B-System
Firewall	I-System
(	I-System
NGFW	I-System
)	I-System
,	O
Next-Generation	B-System
Intrusion	I-System
Prevention	I-System
System	I-System
(	I-System
NGIPS	I-System
)	I-System
,	O
and	O
Meraki	B-System
MX	I-System
can	O
detect	O
malicious	O
activity	O
associated	O
with	O
this	O
threat	O
.	O

AMP	O
Threat	O
Grid	O
helps	O
identify	O
malicious	O
binaries	O
and	O
build	O
protection	O
into	O
all	O
Cisco	B-Organization
Security	O
products	O
.	O

Umbrella	B-System
,	O
our	O
secure	O
internet	O
gateway	O
(	O
SIG	O
)	O
,	O
blocks	O
users	O
from	O
connecting	O
to	O
malicious	O
domains	O
,	O
IPs	O
,	O
and	O
URLs	O
,	O
whether	O
users	O
are	O
on	O
or	O
off	O
the	O
corporate	O
network	O
.	O

Open	O
Source	O
Snort	O
Subscriber	O
Rule	O
Set	O
customers	O
can	O
stay	O
up	O
to	O
date	O
by	O
downloading	O
the	O
latest	O
rule	O
pack	O
available	O
for	O
purchase	O
on	O
Snort.org	O
.	O

Indicators	O
of	O
compromise	O
(	O
IOC	O
)	O
URLs	O
hxxp	B-Indicator
:	I-Indicator
//5.9.33.226:5416	I-Indicator
hxxp	B-Indicator
:	I-Indicator
//172.110.10.171:85/testcc.php	I-Indicator
hxxp	B-Indicator
:	I-Indicator
//sub1.tdsworker.ru:5555/3ds/	I-Indicator
Hash	O
values	O
Package.apk	B-Indicator
-	O
A342a16082ea53d101f556b50532651cd3e3fdc7d9e0be3aa136680ad9c6a69f	B-Indicator
eCommon.dl	B-Indicator
-	O
604deb75eedf439766896f05799752de268baf437bf89a7185540627ab4a4bd1	B-Indicator

Reznov.dll	B-Indicator
-	O
17b8665cdbbb94482ca970a754d11d6e29c46af6390a2d8e8193d8d6a527dec3	B-Indicator
Custom	O
activity	O
prefix	O
com.cact.CAct	B-Indicator
Cerberus	B-Malware
-	O
A	O
new	O
banking	O
Trojan	O
from	O
the	O
underworld	O
August	O
2019	O
In	O
June	O
2019	O
,	O
ThreatFabric	B-Organization
analysts	O
found	O
a	O
new	O
Android	B-System
malware	O
,	O
dubbed	O
“	O
Cerberus	B-Malware
”	O
,	O
being	O
rented	O
out	O
on	O
underground	O
forums	O
.	O

Its	O
authors	O
claim	O
that	O
it	O
was	O
used	O
for	O
private	O
operations	O
for	O
two	O
years	O
preceding	O
the	O
start	O
of	O
the	O
rental	O
.	O

They	O
also	O
state	O
that	O
the	O
code	O
is	O
written	O
from	O
scratch	O
and	O
is	O
not	O
using	O
parts	O
of	O
other	O
existing	O
banking	O
Trojans	O
unlike	O
many	O
other	O
Trojans	O
that	O
are	O
either	O
based	O
completely	O
on	O
the	O
source	O
of	O
another	O
Trojan	O
(	O
such	O
as	O
the	O
leaked	O
Anubis	B-Malware
source	O
code	O
that	O
is	O
now	O
being	O
resold	O
)	O
or	O
at	O
least	O
borrow	O
parts	O
of	O
other	O
Trojans	O
.	O

After	O
thorough	O
analysis	O
we	O
can	O
confirm	O
that	O
Cerberus	B-Malware
was	O
indeed	O
not	O
based	O
on	O
the	O
Anubis	B-Malware
source	O
code	O
.	O

One	O
peculiar	O
thing	O
about	O
the	O
actor	O
group	O
behind	O
this	O
banking	O
malware	O
is	O
that	O
they	O
have	O
an	O
“	O
official	O
”	O
twitter	B-Organization
account	O
that	O
they	O
use	O
to	O
post	O
promotional	O
content	O
(	O
even	O
videos	O
)	O
about	O
the	O
malware	O
.	O

Oddly	O
enough	O
they	O
also	O
use	O
it	O
to	O
make	O
fun	O
of	O
the	O
AV	O
community	O
,	O
sharing	O
detection	O
screenshots	O
from	O
VirusTotal	B-Organization
(	O
thus	O
leaking	O
IoC	O
)	O
and	O
even	O
engaging	O
in	O
discussions	O
with	O
malware	O
researchers	O
directly	O
The	O
following	O
screenshot	O
shows	O
tweets	O
from	O
their	O
advertisement	O
campaign	O
:	O
That	O
unusual	O
behavior	O
could	O
be	O
explained	O
by	O
the	O
combination	O
of	O
the	O
need	O
for	O
attention	O
and	O
a	O
probable	O
lack	O
of	O
experience	O
.	O

What	O
is	O
sure	O
is	O
that	O
the	O
gap	O
in	O
the	O
Android	B-System
banking	O
malware	O
rental	O
business	O
left	O
open	O
after	O
the	O
rental	O
of	O
the	O
Anubis	B-Malware
2	I-Malware
and	O
RedAlert	B-Malware
2	I-Malware
Trojans	O
ended	O
provides	O
a	O
good	O
opportunity	O
for	O
the	O
actors	O
behind	O
Cerberus	B-Malware
to	O
grow	O
their	O
business	O
quickly	O
.	O

The	O
Android	B-System
banking	O
Trojan	O
rental	O
business	O
Rental	O
of	O
banking	O
Trojans	O
is	O
not	O
new	O
.	O

It	O
was	O
an	O
existing	O
business	O
model	O
when	O
computer-based	O
banking	O
malware	O
was	O
the	O
only	O
form	O
of	O
banking	O
malware	O
and	O
has	O
shifted	O
to	O
the	O
Android	B-System
equivalent	O
a	O
few	O
years	O
later	O
.	O

The	O
life	O
span	O
of	O
Android	B-System
banking	O
malware	O
is	O
limited	O
to	O
either	O
the	O
will	O
of	O
its	O
author	O
(	O
s	O
)	O
to	O
support	O
it	O
or	O
the	O
arrest	O
of	O
those	O
actors	O
.	O

This	O
malware-life-cycle	O
has	O
been	O
observed	O
to	O
reoccur	O
every	O
few	O
years	O
,	O
bringing	O
new	O
malware	O
families	O
into	O
light	O
.	O

Each	O
time	O
a	O
rented	O
malware	O
reaches	O
the	O
end	O
of	O
its	O
life	O
it	O
provides	O
the	O
opportunity	O
for	O
other	O
actors	O
a	O
to	O
take	O
over	O
the	O
malware	O
rental	O
market-share	O
.	O

As	O
visible	O
on	O
following	O
chart	O
,	O
the	O
lifespan	O
of	O
many	O
well-known	O
rented	O
Android	B-System
bankers	O
is	O
usually	O
no	O
more	O
than	O
one	O
or	O
two	O
years	O
.	O

When	O
the	O
family	O
ceases	O
to	O
exist	O
a	O
new	O
one	O
is	O
already	O
available	O
to	O
fill	O
the	O
void	O
,	O
proving	O
that	O
the	O
demand	O
for	O
such	O
malware	O
is	O
always	O
present	O
and	O
that	O
therefore	O
Cerberus	B-Malware
has	O
a	O
good	O
chance	O
to	O
survive	O
.	O

After	O
the	O
actor	O
behind	O
RedAlert	B-Malware
2	I-Malware
decided	O
to	O
quit	O
the	O
rental	O
business	O
,	O
we	O
observed	O
a	O
surge	O
in	O
Anubis	B-Malware
samples	O
in	O
the	O
wild	O
.	O

After	O
the	O
Anubis	B-Malware
actor	O
was	O
allegedly	O
arrested	O
and	O
the	O
source	O
code	O
was	O
leaked	O
there	O
was	O
also	O
huge	O
increase	O
in	O
the	O
number	O
of	O
Anubis	B-Malware
samples	O
found	O
in	O
the	O
wild	O
,	O
but	O
the	O
new	O
actors	O
using	O
Anubis	B-Malware
have	O
no	O
support	O
or	O
updates	O
.	O

Due	O
to	O
this	O
Cerberus	B-Malware
will	O
come	O
in	O
handy	O
for	O
actors	O
that	O
want	O
to	O
focus	O
on	O
performing	O
fraud	O
without	O
having	O
to	O
develop	O
and	O
maintain	O
a	O
botnet	O
and	O
C2	O
infrastructure	O
.	O

Analysis	O
of	O
evasion	O
techniques	O
Along	O
with	O
the	O
standard	O
payload	O
and	O
string	O
obfuscation	O
,	O
Cerberus	B-Malware
uses	O
a	O
rather	O
interesting	O
technique	O
to	O
prevent	O
analysis	O
of	O
the	O
Trojan	O
.	O

Using	O
the	O
device	O
accelerometer	O
sensor	O
it	O
implements	O
a	O
simple	O
pedometer	O
that	O
is	O
used	O
to	O
measure	O
movements	O
of	O
the	O
victim	O
.	O

The	O
idea	O
is	O
simple	O
-	O
if	O
the	O
infected	O
device	O
belongs	O
to	O
a	O
real	O
person	O
,	O
sooner	O
or	O
later	O
this	O
person	O
will	O
move	O
around	O
,	O
increasing	O
the	O
step	O
counter	O
.	O

The	O
Trojan	O
uses	O
this	O
counter	O
to	O
activate	O
the	O
bot	O
-	O
if	O
aforementioned	O
step	O
counter	O
hits	O
the	O
pre-configured	O
threshold	O
it	O
considers	O
running	O
on	O
the	O
device	O
to	O
be	O
safe	O
.	O

This	O
simple	O
measure	O
prevents	O
the	O
Trojan	O
from	O
running	O
and	O
being	O
analyzed	O
in	O
dynamic	O
analysis	O
environments	O
(	O
sandboxes	O
)	O
and	O
on	O
the	O
test	O
devices	O
of	O
malware	O
analysts	O
.	O

The	O
code	O
responsible	O
for	O
this	O
verification	O
is	O
shown	O
in	O
the	O
following	O
snippet	O
:	O
How	O
it	O
works	O
When	O
the	O
malware	O
is	O
first	O
started	O
on	O
the	O
device	O
it	O
will	O
begin	O
by	O
hiding	O
its	O
icon	O
from	O
the	O
application	O
drawer	O
.	O

Then	O
it	O
will	O
ask	O
for	O
the	O
accessibility	O
service	O
privilege	O
as	O
visible	O
in	O
the	O
following	O
screenshot	O
:	O
After	O
the	O
user	O
grants	O
the	O
requested	O
privilege	O
,	O
Cerberus	B-Malware
starts	O
to	O
abuse	O
it	O
by	O
granting	O
itself	O
additional	O
permissions	O
,	O
such	O
as	O
permissions	O
needed	O
to	O
send	O
messages	O
and	O
make	O
calls	O
,	O
without	O
requiring	O
any	O
user	O
interaction	O
.	O

It	O
also	O
disables	O
Play	B-System
Protect	I-System
(	O
Google	B-Organization
’	O
s	O
preinstalled	O
antivirus	O
solution	O
)	O
to	O
prevent	O
its	O
discovery	O
and	O
deletion	O
in	O
the	O
future	O
.	O

After	O
conveniently	O
granting	O
itself	O
additional	O
privileges	O
and	O
securing	O
its	O
persistence	O
on	O
the	O
device	O
,	O
Cerberus	B-Malware
registers	O
the	O
infected	O
device	O
in	O
the	O
botnet	O
and	O
waits	O
for	O
commands	O
from	O
the	O
C2	O
server	O
while	O
also	O
being	O
ready	O
to	O
perform	O
overlay	O
attacks	O
.	O

The	O
commands	O
supported	O
by	O
the	O
analyzed	O
version	O
of	O
the	O
Cerberus	B-Malware
bot	O
are	O
listed	O
below	O
.	O

As	O
can	O
be	O
seen	O
,	O
the	O
possibilities	O
offered	O
by	O
the	O
bot	O
are	O
pretty	O
common	O
.	O

Command	O
Description	O
push	O
Shows	O
a	O
push	O
notification	O
.	O

Clicking	O
on	O
thenotification	O
will	O
result	O
in	O
launching	O
a	O
specified	O
app	O
startApp	O
Starts	O
the	O
specified	O
application	O
getInstallApps	O
Gets	O
the	O
list	O
of	O
installedapplications	O
on	O
the	O
infected	O
device	O
getContacts	O
Gets	O
the	O
contact	O
names	O
and	O
phone	O
numbers	O
from	O
the	O
addressbook	O
on	O
the	O
infected	O
device	O
deleteApplication	O
Triggers	O
the	O
deletion	O
of	O
the	O
specified	O
application	O
forwardCall	O
Enables	O
call	O
forwarding	O
to	O
the	O
specified	O
number	O
sendSms	O
Sends	O
a	O
text	O
message	O
with	O
specified	O
text	O
from	O
the	O
infecteddevice	O
to	O
the	O
specified	O
phone	O
number	O
startInject	O
Triggers	O
the	O
overlay	O
attack	O
against	O
the	O
specified	O
application	O
startUssd	O

Calls	O
the	O
specified	O
USSD	O
code	O
openUrl	O
Opens	O
the	O
specified	O
URL	O
in	O
the	O
WebView	O
getSMS	O
Gets	O
all	O
text	O
messages	O
from	O
the	O
infected	O
device	O
killMe	O
Triggers	O
the	O
kill	O
switch	O
for	O
the	O
bot	O
updateModule	O
Updates	O
the	O
payload	O
module	O
Cerberus	B-Malware
features	O
Cerberus	B-Malware
malware	O
has	O
the	O
same	O
capabilities	O
as	O
most	O
other	O
Android	B-System
banking	O
Trojans	O
such	O
as	O
the	O
use	O
of	O
overlay	O
attacks	O
,	O
SMS	O
control	O
and	O
contact	O
list	O
harvesting	O
.	O

The	O
Trojan	O
can	O
also	O
leverage	O
keylogging	O
to	O
broaden	O
the	O
attack	O
scope	O
.	O

Overall	O
,	O
Cerberus	B-Malware
has	O
a	O
pretty	O
common	O
feature	O
list	O
and	O
although	O
the	O
malware	O
seems	O
to	O
have	O
been	O
written	O
from	O
scratch	O
there	O
does	O
not	O
seem	O
to	O
be	O
any	O
innovative	O
functionality	O
at	O
this	O
time	O
.	O

For	O
example	O
,	O
some	O
of	O
the	O
more	O
advanced	O
banking	O
Trojans	O
now	O
offer	O
features	O
such	O
as	O
a	O
back-connect	O
proxy	O
,	O
screen-streaming	O
and	O
even	O
remote	O
control	O
.	O

Cerberus	B-Malware
embeds	O
the	O
following	O
set	O
of	O
features	O
that	O
allows	O
itself	O
to	O
remain	O
under	O
the	O
radar	O
and	O
successfully	O
perform	O
attacks	O
:	O
Overlaying	O
:	O
Dynamic	O
(	O
Local	O
injects	O
obtained	O
from	O
C2	O
)	O
Keylogging	O
SMS	O
harvesting	O
:	O
SMS	O
listing	O
SMS	O
harvesting	O
:	O
SMS	O
forwarding	O
Device	O
info	O
collection	O
Contact	O
list	O
collection	O
Application	O
listing	O
Location	O
collection	O
Overlaying	O
:	O
Targets	O
list	O
update	O
SMS	O
:	O
Sending	O
Calls	O
:	O
USSD	O
request	O
making	O
Calls	O
:	O
Call	O
forwarding	O
Remote	O
actions	O
:	O
App	O
installing	O
Remote	O
actions	O
:	O
App	O
starting	O
Remote	O
actions	O
:	O
App	O
removal	O
Remote	O
actions	O
:	O
Showing	O
arbitrary	O
web	O
pages	O
Remote	O
actions	O
:	O
Screen-locking	O

Notifications	O
:	O
Push	O
notifications	O
C2	O
Resilience	O
:	O
Auxiliary	O
C2	O
list	O
Self-protection	O
:	O
Hiding	O
the	O
App	O
icon	O
Self-protection	O
:	O
Preventing	O
removal	O
Self-protection	O
:	O
Emulation-detection	O
Architecture	O
:	O
Modular	O
Overlay	O
attack	O
Most	O
Android	O
banking	O
Trojans	O
use	O
overlay	O
attacks	O
to	O
trick	O
the	O
victim	O
into	O
providing	O
their	O
personal	O
information	O
(	O
such	O
as	O
but	O
not	O
limited	O
to	O
:	O
credit	O
card	O
information	O
,	O
banking	O
credentials	O
,	O
mail	O
credentials	O
)	O
and	O
Cerberus	B-Malware
is	O
no	O
exception	O
.	O

In	O
this	O
particular	O
case	O
,	O
the	O
bot	O
abuses	O
the	O
accessibility	O
service	O
privilege	O
to	O
obtain	O
the	O
package	O
name	O
of	O
the	O
foreground	O
application	O
and	O
determine	O
whether	O
or	O
not	O
to	O
show	O
a	O
phishing	O
overlay	O
window	O
,	O
as	O
shown	O
in	O
the	O
following	O
code	O
snippet	O
:	O
Targets	O
Some	O
examples	O
of	O
phishing	O
overlays	O
are	O
shown	O
below	O
.	O

They	O
exist	O
in	O
two	O
types	O
:	O
the	O
credentials	O
stealers	O
(	O
first	O
2	O
screenshots	O
)	O
and	O
the	O
credit	O
card	O
grabbers	O
(	O
last	O
screenshot	O
)	O
.	O

The	O
only	O
active	O
target	O
list	O
observed	O
in	O
the	O
wild	O
is	O
available	O
in	O
the	O
appendix	O
and	O
contains	O
a	O
total	O
of	O
30	O
unique	O
targets	O
.	O

It	O
is	O
interesting	O
to	O
observe	O
that	O
the	O
actual	O
target	O
list	O
contains	O
:	O
7	O
French	O
banking	O
apps	O
7	O
U.S.	O
banking	O
apps	O
1	O
Japanese	O
banking	O
app	O
15	O
non-banking	O
apps	O
This	O
uncommon	O
target	O
list	O
might	O
either	O
be	O
the	O
result	O
of	O
specific	O
customer	O
demand	O
,	O
or	O
due	O
to	O
some	O
actors	O
having	O
partially	O
reused	O
an	O
existing	O
target	O
list	O
.	O

Conclusion	O
Although	O
not	O
yet	O
mature	O
enough	O
to	O
provide	O
the	O
equivalent	O
of	O
a	O
full-blown	O
set	O
of	O
Android	B-System
banking	O
malware	O
features	O
(	O
such	O
as	O
RAT	O
,	O
RAT	O
with	O
ATS	O
(	O
Automated	O
Transaction	O
Script	O
)	O
,	O
back-connect	O
proxy	O
,	O
media	O
streaming	O
)	O
,	O
or	O
providing	O
an	O
exhaustive	O
target	O
list	O
,	O
Cerberus	B-Malware
should	O
not	O
be	O
taken	O
lightly	O
.	O

Due	O
to	O
the	O
current	O
absence	O
of	O
maintained	O
and	O
supported	O
Android	B-Malware
banking	O
Malware-as-a-Service	O
in	O
the	O
underground	O
community	O
,	O
there	O
is	O
a	O
certainly	O
demand	O
for	O
a	O
new	O
service	O
.	O

Cerberus	B-Malware
is	O
already	O
capable	O
to	O
fulfill	O
this	O
demand	O
.	O

In	O
addition	O
to	O
the	O
feature	O
base	O
it	O
already	O
possesses	O
and	O
the	O
money	O
that	O
can	O
be	O
made	O
from	O
the	O
rental	O
,	O
it	O
could	O
evolve	O
to	O
compete	O
with	O
the	O
mightiest	O
Android	B-System
banking	O
Trojans	O
.	O

Next	O
to	O
the	O
features	O
,	O
we	O
expect	O
the	O
target	O
list	O
to	O
be	O
expanded	O
to	O
contain	O
additional	O
(	O
banking	O
)	O
apps	O
in	O
the	O
near	O
future	O
.	O

Knowledge	O
of	O
the	O
threat	O
landscape	O
and	O
implementation	O
of	O
the	O
right	O
detection	O
tools	O
remains	O
crucial	O
to	O
be	O
able	O
to	O
protect	O
yourself	O
from	O
fraud	O
;	O
Cerberus	B-Malware
is	O
yet	O
a	O
new	O
Trojan	O
active	O
in	O
the	O
wild	O
!	O

Appendix	O
Samples	O
Some	O
of	O
the	O
latest	O
Cerberus	B-Malware
samples	O
found	O
in	O
the	O
wild	O
:	O
App	O
name	O
Package	O
name	O
SHA	O
256	O
hash	O
Flash	B-System
Player	I-System
com.uxlgtsvfdc.zipvwntdy	B-Indicator
728a6ea44aab94a2d0ebbccbf0c1b4a93fbd9efa8813c19a88d368d6a46b4f4f	B-Indicator
Flash	B-System
Player	I-System
com.ognbsfhszj.hqpquokjdp	B-Indicator
fe28aba6a942b6713d7142117afdf70f5e731c56eff8956ecdb40cdc28c7c329	B-Indicator

Flash	B-System
Player	I-System
com.mwmnfwt.arhkrgajn	B-Indicator
ffa5ac3460998e7b9856fc136ebcd112196c3abf24816ccab1fbae11eae4954c	B-Indicator
Flash	B-System
Player	I-System
com.wogdjywtwq.oiofvpzpxyo	B-Indicator
6ac7e7ed83b4b57cc4d28f14308d69d062d29a544bbde0856d5697b0fc50cde4	B-Indicator
Flash	B-System
Player	I-System
com.hvdnaiujzwo.fovzeukzywfr	B-Indicator

cfd77ddc5c1ebb8498c899a68ea75d2616c1c92a0e618113d7c9e5fcc650094b	B-Indicator
Flash	B-System
Player	I-System
com.gzhlubw.pmevdiexmn	B-Indicator
3f2ed928789c200e21fd0c2095619a346f75d84f76f1e54a8b3153385850ea63	B-Indicator
Target	O
list	O
The	O
actual	O
observed	O
list	O
of	O
mobile	O
apps	O
targeted	O
by	O
Cerberus	B-Malware
contains	O
a	O
total	O
of	O
30	O
unique	O
applications	O
.	O

This	O
list	O
is	O
expected	O
to	O
expand	O
:	O
Package	O
name	O
Application	O
name	O
com.android.vending	B-Indicator
Play	B-System
Market	I-System
com.boursorama.android.clients	B-Indicator
Boursorama	I-Indicator
Banque	B-System
com.caisseepargne.android.mobilebanking	B-Indicator
Banque	B-System
com.chase.sig.android	B-Indicator
Chase	B-System
Mobile	I-System
com.clairmail.fth	B-Indicator
Fifth	B-System
Third	I-System
Mobile	I-System
Banking	I-System
com.connectivityapps.hotmail	B-Indicator
Connect	B-System
for	I-System
Hotmail	I-System
com.google.android.gm	B-Indicator
Gmail	B-System
com.imo.android.imoim	B-Indicator
imo	B-System
free	O
video	O
calls	O
and	O
chat	O
com.infonow.bofa	B-Indicator
Bank	B-System
of	I-System
America	I-System

Mobile	I-System
Banking	I-System
com.IngDirectAndroid	B-Indicator
ING	O
com.instagram.android	B-Indicator
Instagram	I-Indicator
com.konylabs.capitalone	B-Indicator
Capital	B-System
One®	I-System
Mobile	I-System
com.mail.mobile.android.mail	B-Indicator
mail.com	I-Indicator
mail	B-System
com.microsoft.office.outlook	B-Indicator
Microsoft	B-System
Outlook	I-System
com.snapchat.android	B-Indicator
Snapchat	B-System
com.tencent.mm	B-Indicator
WeChat	B-System
com.twitter.android	B-Indicator
Twitter	B-System
com.ubercab	B-Indicator
Uber	B-Organization
com.usaa.mobile.android.usaa	B-Indicator
USAA	B-System
Mobile	I-System
com.usbank.mobilebanking	B-Indicator
U.S.	I-Indicator
Bank	O
-	O
Inspired	O
by	O
customers	O
com.viber.voip	B-Indicator
Viber	B-System
com.wf.wellsfargomobile	B-Indicator

Wells	B-System
Fargo	I-System
Mobile	I-System
com.whatsapp	B-Indicator
WhatsApp	B-System
com.yahoo.mobile.client.android.mail	B-Indicator
Yahoo	B-System
Mail	I-System
–	O
Organized	O
Email	O
fr.banquepopulaire.cyberplus	B-Indicator
Banque	B-System
Populaire	O
fr.creditagricole.androidapp	B-Indicator
Ma	B-System
Banque	I-System
jp.co.rakuten_bank.rakutenbank	B-Indicator
楽天銀行	O
-個人のお客様向けアプリ	O
mobi.societegenerale.mobile.lappli	B-Indicator
L	O
’	O
Appli	O
Société	O
Générale	O
net.bnpparibas.mescomptes	B-Indicator
Mes	O
Comptes	O
BNP	O
Paribas	O
org.telegram.messenger	B-Indicator
Telegram	I-Indicator
Triout	B-Malware
-	O
Spyware	O
Framework	O

for	O
Android	B-System
with	O
Extensive	O
Surveillance	O
Capabilities	O
August	O
20	O
,	O
2018	O
No	O
operating	O
system	O
is	O
safe	O
from	O
malware	O
,	O
as	O
cyber	O
criminals	O
will	O
always	O
want	O
to	O
steal	O
,	O
spy	O
or	O
tamper	O
with	O
your	O
data	O
.	O

The	O
proliferation	O
of	O
Android	B-Malware
devices	O
–	O
from	O
smartphones	O
to	O
tablets	O
and	O
smart	O
TVs	O
–	O
has	O
opened	O
up	O
new	O
possibilities	O
for	O
malware	O
developers	O
,	O
as	O
all	O
these	O
devices	O
pack	O
microphones	O
,	O
cameras	O
and	O
location-tracking	O
hardware	O
they	O
can	O
turn	O
into	O
the	O
perfect	O
spy	O
tools	O
.	O

Bitdefender	B-Organization
researchers	O
have	O
identified	O
a	O
new	O
Android	B-System
spyware	O
,	O
dubbed	O
Triout	B-Malware
,	O
which	O
appears	O
to	O
act	O
as	O
a	O
framework	O
for	O
building	O
extensive	O
surveillance	O
capabilities	O
into	O
seemingly	O
benign	O
applications	O
.	O

Found	O
bundled	O
with	O
a	O
repackaged	O
app	O
,	O
the	O
spyware	O
’	O
s	O
surveillance	O
capabilities	O
involve	O
hiding	O
its	O
presence	O
on	O
the	O
device	O
,	O
recording	O
phone	O
calls	O
,	O
logging	O
incoming	O
text	O
messages	O
,	O
recoding	O
videos	O
,	O
taking	O
pictures	O
and	O
collecting	O
GPS	B-System
coordinates	O
,	O
then	O
broadcasting	O
all	O
of	O
that	O
to	O
an	O
attacker-controlled	O
C	O
&	O
C	O
(	O
command	O
and	O
control	O
)	O
server	O
.	O

It	O
’	O
s	O
interesting	O
that	O
Triout	B-Malware
,	O
which	O
is	O
detected	O
by	O
Bitdefender	B-Organization
’	O
s	O
machine	O
learning	O
algorithms	O
,	O
was	O
first	O
submitted	O
from	O
Russia	O
,	O
and	O
most	O
scans/reports	O
came	O
from	O
Israel	O
.	O

The	O
sample	O
’	O
s	O
first	O
appearance	O
seems	O
to	O
be	O
May	O
15	O
,	O
2018	O
,	O
when	O
it	O
was	O
uploaded	O
to	O
VirusTotal	B-Organization
,	O
but	O
it	O
’	O
s	O
unclear	O
how	O
the	O
tainted	O
sample	O
is	O
disseminated	O
.	O

Third-party	O
marketplaces	O
or	O
some	O
other	O
attacker-controlled	O
domains	O
are	O
likely	O
used	O
to	O
host	O
the	O
sample	O
.	O

A	O
subsequent	O
investigation	O
revealed	O
that	O
the	O
spyware	O
has	O
the	O
following	O
capabilities	O
:	O
Records	O
every	O
phone	O
call	O
(	O
literally	O
the	O
conversation	O
as	O
a	O
media	O
file	O
)	O
,	O
then	O
sends	O
it	O
together	O
with	O
the	O
caller	O
id	O
to	O
the	O
C	O
&	O
C	O
(	O
incall3.php	B-Indicator
and	O
outcall3.php	B-Indicator
)	O
Logs	O
every	O
incoming	O
SMS	O
message	O
(	O
SMS	O
body	O
and	O
SMS	O
sender	O
)	O
to	O
C	O
&	O
C	O
(	O
script3.php	B-Indicator
)	O
Has	O
capability	O
to	O
hide	O
self	O
Can	O
send	O
all	O
call	O
logs	O
(	O
“	O
content	B-Indicator
:	I-Indicator
//call_log/calls	I-Indicator
”	O
,	O
info	O
:	O
callname	O
,	O
callnum	O
,	O
calldate	O
,	O
calltype	O
,	O
callduration	O

)	O
to	O
C	O
&	O
C	O
(	O
calllog.php	B-Indicator
)	O
Whenever	O
the	O
user	O
snaps	O
a	O
picture	O
,	O
either	O
with	O
the	O
front	O
or	O
rear	O
camera	O
,	O
it	O
gets	O
sent	O
to	O
the	O
C	O
&	O
C	O
(	O
uppc.php	B-Indicator
,	O
fi	O
npic.php	B-Indicator
orreqpic.php	B-Indicator
)	O
Can	O
send	O
GPS	B-System
coordinates	O
to	O
C	O
&	O
C	O
(	O
gps3.php	B-Indicator
)	O
The	O
C	O
&	O
C	O
server	O
to	O
which	O
the	O
application	O
seems	O
to	O
be	O
sending	O
collected	O
data	O
appears	O
to	O
be	O
operational	O
,	O
as	O
of	O
this	O
writing	O
,	O
and	O
running	O
since	O
May	O
2018	O
.	O

January	O
23	O
,	O
2017	O
SpyNote	B-Malware
RAT	I-Malware
posing	O
as	O
Netflix	B-System
app	I-System
As	O
users	O
have	O
become	O
more	O
attached	O
to	O
their	O
mobile	O
devices	O
,	O
they	O
want	O
everything	O
on	O
those	O
devices	O
.	O

There	O
’	O
s	O
an	O
app	O
for	O
just	O
about	O
any	O
facet	O
of	O
one	O
’	O
s	O
personal	O
and	O
professional	O
life	O
,	O
from	O
booking	O
travel	O
and	O
managing	O
projects	O
,	O
to	O
buying	O
groceries	O
and	O
binge-watching	O
the	O
latest	O
Netflix	B-Organization
series	O
.	O

The	O
iOS	B-System
and	O
Android	B-System
apps	O
for	O
Netflix	B-Organization
are	O
enormously	O
popular	O
,	O
effectively	O
turning	O
a	O
mobile	O
device	O
into	O
a	O
television	O
with	O
which	O
users	O
can	O
stream	O
full	O
movies	O
and	O
TV	O
programs	O
anytime	O
,	O
anywhere	O
.	O

But	O
the	O
apps	O
,	O
with	O
their	O
many	O
millions	O
of	O
users	O
,	O
have	O
captured	O
the	O
attention	O
of	O
the	O
bad	O
actors	O
,	O
too	O
,	O
who	O
are	O
exploiting	O
the	O
popularity	O
of	O
Netflix	B-Organization
to	O
spread	O
malware	O
.	O

Recently	O
,	O
the	O
ThreatLabZ	B-Organization
research	O
team	O
came	O
across	O
a	O
fake	B-System
Netflix	I-System
app	I-System
,	O
which	O
turned	O
out	O
to	O
be	O
a	O
new	O
variant	O
of	O
SpyNote	B-Malware
RAT	I-Malware
(	O
Remote	O
Access	O
Trojan	O
)	O
.	O

SpyNote	B-Malware
RAT	I-Malware
is	O
capable	O
of	O
performing	O
a	O
variety	O
of	O
alarming	O
functions	O
that	O
includes	O
:	O
Activating	O
the	O
device	O
’	O
s	O
microphone	O
and	O
listening	O
to	O
live	O
conversations	O
Executing	O
commands	O
on	O
the	O
device	O
Copying	O
files	O
from	O
the	O
device	O
to	O
a	O
Command	O
&	O
Control	O
(	O
C	O
&	O
C	O
)	O
center	O
Recording	O
screen	O
captures	O
Viewing	O
contacts	O
Reading	O
SMS	O
messages	O
The	O
screenshot	O
below	O
shows	O
part	O
of	O
the	O
sandbox	O
’	O
s	O
report	O
on	O
the	O
SpyNote	B-Malware
RAT	I-Malware
’	O
s	O
signature	O
and	O
detected	O
functions	O
:	O
The	O
fake	O
Netflix	B-Organization
app	O
we	O
are	O
analyzing	O
in	O
this	O
blog	O
appears	O
to	O
be	O
built	O
using	O
an	O
updated	O
version	O
of	O
SpyNote	B-Malware
RAT	I-Malware
builder	O
,	O

which	O
was	O
leaked	O
last	O
year	O
.	O

Technical	O
details	O
Please	O
note	O
that	O
our	O
research	O
is	O
not	O
about	O
the	O
legitimate	O
Netflix	B-System
app	I-System
on	O
Google	B-System
Play	I-System
.	O

The	O
spyware	O
in	O
this	O
analysis	O
was	O
portraying	O
itself	O
as	O
the	O
Netflix	B-System
app	I-System
.	O

Once	O
installed	O
,	O
it	O
displayed	O
the	O
icon	O
found	O
in	O
the	O
actual	O
Netflix	B-System
app	I-System
on	O
Google	B-System
Play	I-System
.	O

As	O
soon	O
as	O
the	O
user	O
clicks	O
the	O
spyware	O
’	O
s	O
icon	O
for	O
the	O
first	O
time	O
,	O
nothing	O
seems	O
to	O
happen	O
and	O
the	O
icon	O
disappears	O
from	O
the	O
home	O
screen	O
.	O

This	O
is	O
a	O
common	O
trick	O
played	O
by	O
malware	O
developers	O
,	O
making	O
the	O
user	O
think	O
the	O
app	O
may	O
have	O
been	O
removed	O
.	O

But	O
,	O
behind	O
the	O
scenes	O
,	O
the	O
malware	O
has	O
not	O
been	O
removed	O
;	O
instead	O
it	O
starts	O
preparing	O
its	O
onslaught	O
of	O
attacks	O
.	O

For	O
contacting	O
C	O
&	O
C	O
,	O
the	O
spyware	O
was	O
found	O
to	O
be	O
using	O
free	O
DNS	B-Indicator
services	O
,	O
as	O
shown	O
in	O
the	O
screenshot	O
below	O
:	O
SpyNote	B-Malware
RAT	I-Malware
uses	O
an	O
unusual	O
trick	O
to	O
make	O
sure	O
that	O
it	O
remains	O
up	O
and	O
running	O
and	O
that	O
the	O
spying	O
does	O
not	O
stop	O
.	O

It	O
does	O
so	O
using	O
the	O
Services	O
,	O
Broadcast	O
Receivers	O
,	O
and	O
Activities	O
components	O
of	O
the	O
Android	B-System
platform	O
.	O

Services	O
can	O
perform	O
long-running	O
operations	O
in	O
the	O
background	O
and	O
does	O
not	O
need	O
a	O
user	O
interface	O
.	O

Broadcast	O
Receivers	O
are	O
Android	B-System
components	O
that	O
can	O
register	O
themselves	O
for	O
particular	O
events	O
.	O

Activities	O
are	O
key	O
building	O
blocks	O
,	O
central	O
to	O
an	O
app	O
’	O
s	O
navigation	O
,	O
for	O
example	O
.	O

The	O
SpyNote	B-Malware
RAT	I-Malware
registers	O
a	O
service	O
called	O
AutoStartup	O
and	O
a	O
broadcast	O
receiver	O
named	O
BootComplete	O
.	O

MainActivity	O
registers	O
BootComplete	O
with	O
a	O
boot	O
event	O
,	O
so	O
that	O
whenever	O
the	O
device	O
is	O
booted	O
,	O
BootComplete	O
gets	O
triggered	O
.	O

BootComplete	O
starts	O
the	O
AutoStartup	O
service	O
and	O
the	O
AutoStartup	O
service	O
makes	O
sure	O
that	O
MainActivity	O
is	O
always	O
running	O
.	O

What	O
follows	O
are	O
some	O
of	O
the	O
features	O
exhibited	O
by	O
SpyNote	B-Malware
RAT	I-Malware
.	O

Command	O
execution	O
Command	O
execution	O
can	O
create	O
havoc	O
for	O
victim	O
if	O
the	O
malware	O
developer	O
decides	O
to	O
execute	O
commands	O
in	O
the	O
victim	O
’	O
s	O
device	O
.	O

Leveraging	O
this	O
feature	O
,	O
the	O
malware	O
developer	O
can	O
root	O
the	O
device	O
using	O
a	O
range	O
of	O
vulnerabilities	O
,	O
well-known	O
or	O
zero-day	O
.	O

The	O
following	O
screenshot	O
shows	O
the	O
command	O
execution	O
functionality	O
in	O
action	O
:	O
The	O
paramString	O
parameter	O
shown	O
in	O
the	O
above	O
screenshot	O
can	O
be	O
any	O
command	O
received	O
from	O
C	O
&	O
C	O
.	O

Screen	O
capture	O
and	O
audio	O
recording	O
SpyNote	B-Malware
RAT	I-Malware
was	O
able	O
to	O
take	O
screen	O
captures	O
and	O
,	O
using	O
the	O
device	O
’	O
s	O
microphone	O
,	O
listen	O
to	O
audio	O
conversations	O
.	O

This	O
capability	O
was	O
confirmed	O
when	O
the	O
Android	B-System
permission	O
,	O
called	O
android.permission.RECORD_AUDIO	B-Indicator
,	O
was	O
being	O
requested	O
along	O
with	O
code	O
found	O
in	O
the	O
app	O
.	O

SpyNote	B-Malware
RAT	I-Malware
captured	O
the	O
device	O
’	O
s	O
screen	O
activities	O
along	O
with	O
audio	O
using	O
the	O
MediaProjectionCallback	O
functionality	O
(	O
available	O
with	O
Lollipop	B-System
,	O
the	O
Android	B-System
5.0	I-System
release	O
,	O
and	O
later	O
)	O
and	O
saved	O
the	O
output	O
in	O
a	O
file	O
named	O
"	O
video.mp4	B-Indicator
''	O
as	O
shown	O
in	O
the	O
following	O
screenshot	O
SMS	O
stealing	O
SpyNote	B-Malware
RAT	I-Malware
was	O
also	O
observed	O
stealing	O
SMS	O
messages	O
from	O
the	O
affected	O
devices	O
,	O
as	O
shown	O
in	O
screenshot	O
below	O
:	O
Stealing	O
contacts	O
The	O
ability	O
to	O
steal	O
contacts	O
is	O
a	O
favorite	O
feature	O
for	O
spyware	O
developers	O
,	O
as	O
the	O
stolen	O
contacts	O
can	O
be	O
used	O
to	O
further	O
spread	O
the	O
spyware	O

.	O

The	O
following	O
screenshot	O
shows	O
the	O
contacts	O
being	O
stolen	O
and	O
written	O
in	O
a	O
local	O
array	O
,	O
which	O
is	O
then	O
sent	O
to	O
C	O
&	O
C	O
:	O
Uninstalling	O
apps	O
Uninstalling	O
apps	O
is	O
another	O
function	O
favored	O
by	O
developers	O
of	O
Android	B-System
spyware	O
and	O
malware	O
.	O

They	O
tend	O
to	O
target	O
any	O
antivirus	O
protections	O
on	O
the	O
device	O
and	O
uninstall	O
them	O
,	O
which	O
increases	O
the	O
possibility	O
of	O
their	O
malware	O
persisting	O
on	O
the	O
device	O
.	O

Following	O
screenshot	O
shows	O
this	O
functionality	O
in	O
action	O
:	O
Other	O
functions	O
In	O
addition	O
to	O
the	O
functionalities	O
we	O
’	O
ve	O
described	O
,	O
the	O
SpyNote	B-Malware
RAT	I-Malware
was	O
exhibiting	O
many	O
other	O
behaviors	O
that	O
make	O
it	O
more	O
robust	O
than	O
most	O
off-the-shelf	O
malware	O
.	O

SpyNote	B-Malware
RAT	I-Malware
was	O
designed	O
to	O
function	O
only	O
over	O
Wi-Fi	O
,	O
which	O
is	O
the	O
preferable	O
mode	O
for	O
Android	B-System
malware	O
to	O
send	O
files	O
to	O
C	O
&	O
C	O
.	O

The	O
screenshot	O
below	O
shows	O
SpyNote	B-Malware
RAT	I-Malware
scanning	O
for	O
Wi-Fi	O
and	O
enabling	O
it	O
if	O
a	O
known	O
channel	O
is	O
found	O
:	O
Additional	O
features	O
-	O
SpyNote	B-Malware
RAT	I-Malware
could	O
click	O
photos	O
using	O
the	O
device	O
's	O
camera	O
,	O
based	O
on	O
commands	O
from	O
C	O
&	O
C	O
.	O

-	O
There	O
were	O
two	O
interesting	O
sub-classes	O
found	O
inside	O
Main	O
Activity	O
:	O
Receiver	O
and	O
Sender	O
.	O

Receiver	O
was	O
involved	O
in	O
receiving	O
commands	O
from	O
the	O
Server	O
and	O
the	O
main	O
functionality	O
of	O
Sender	O
was	O
to	O
send	O
all	O
the	O
data	O
collected	O
to	O
the	O
C	O
&	O
C	O
over	O
Wi-Fi	O
.	O

-	O
SpyNote	B-Malware
RAT	I-Malware
was	O
also	O
collecting	O
the	O
device	O
’	O
s	O
location	O
to	O
identify	O
the	O
exact	O
location	O
of	O
the	O
victim	O
.	O

SpyNote	B-Malware
RAT	I-Malware
builder	O
The	O
SpyNote	B-Malware
Remote	O
Access	O
Trojan	O
(	O
RAT	O
)	O
builder	O
is	O
gaining	O
popularity	O
in	O
the	O
hacking	O
community	O
,	O
so	O
we	O
decided	O
to	O
study	O
its	O
pervasiveness	O
.	O

What	O
we	O
found	O
were	O
several	O
other	O
fake	O
apps	O
developed	O
using	O
the	O
SpyNote	B-Malware
builder	O
,	O
which	O
should	O
come	O
as	O
a	O
warning	O
to	O
Android	B-System
users	O
.	O

Some	O
of	O
the	O
targeted	O
apps	O
were	O
:	O
Whatsapp	B-System
YouTube	B-System
Video	I-System
Downloader	I-System
Google	B-System
Update	I-System
Instagram	B-System
Hack	B-System
Wifi	I-System
AirDroid	B-System
WifiHacker	B-System
Facebook	B-System
Photoshop	B-System
SkyTV	B-System
Hotstar	B-System
Trump	B-System
Dash	I-System
PokemonGo	B-System
With	O
many	O
more	O
to	O
come	O
.	O

Furthermore	O
,	O
we	O
found	O
that	O
in	O
just	O
the	O
first	O
two	O
weeks	O
of	O
2017	O
,	O
there	O
have	O
been	O
more	O
than	O
120	O
such	O
spyware	O
variants	O
already	O
built	O
using	O
the	O
same	O
SpyNote	B-Malware
Trojan	O
builder	O
as	O
SpyNote	B-Malware
RAT	I-Malware
and	O
roaming	O
in	O
the	O
wild	O
.	O

A	O
complete	O
list	O
of	O
sample	O
hashes	O
is	O
available	O
here	O
.	O

Conclusion	O
The	O
days	O
when	O
one	O
needed	O
in-depth	O
coding	O
knowledge	O
to	O
develop	O
malware	O
are	O
long	O
gone	O
.	O

Nowadays	O
,	O
script	O
kiddies	O
can	O
build	O
a	O
piece	O
of	O
malware	O
that	O
can	O
create	O
real	O
havoc	O
.	O

Moreover	O
,	O
there	O
are	O
many	O
toolkits	O
like	O
the	O
SpyNote	B-Malware
Trojan	O
builder	O
that	O
enable	O
users	O
to	O
build	O
malware	O
with	O
ease	O
and	O
few	O
clicks	O
.	O

In	O
particular	O
,	O
avoid	O
side-loading	O
apps	O
from	O
third-party	O
app	O
stores	O
and	O
avoid	O
the	O
temptation	O
to	O
play	O
games	O
that	O
are	O
not	O
yet	O
available	O
on	O
Android	B-System
.	O

Yes	O
,	O
we	O
are	O
talking	O
about	O
SuperMarioRun	B-System
,	O
which	O
was	O
recently	O
launched	O
by	O
Nintendo	B-Organization
only	O
for	O
iOS	B-System
users	O
.	O

Recent	O
blogs	O
by	O
the	O
Zscaler	B-Organization
research	O
team	O
explain	O
how	O
some	O
variants	O
of	O
Android	B-Malware
malware	O
are	O
exploiting	O
the	O
popularity	O
of	O
this	O
game	O
and	O
tricking	O
Android	B-System
users	O
into	O
downloading	O
a	O
fake	O
version	O
.	O

(	O
Have	O
a	O
look	O
here	O
and	O
here	O
.	O

)	O
You	O
should	O
also	O
avoid	O
the	O
temptation	O
to	O
play	O
games	O
from	O
sources	O
other	O
than	O
legitimate	O
app	O
stores	O
;	O
such	O
games	O
are	O
not	O
safe	O
and	O
may	O
bring	O
harm	O
to	O
your	O
reputation	O
and	O
your	O
bank	O
account	O
.	O

FakeSpy	B-Malware
Masquerades	O
as	O
Postal	O
Service	O
Apps	O
Around	O
the	O
World	O
July	O
1	O
,	O
2020	O
KEY	O
FINDINGS	O
The	O
Cybereason	B-Organization
Nocturnus	I-Organization
team	O
is	O
investigating	O
a	O
new	O
campaign	O
involving	O
FakeSpy	B-Malware
,	O
an	O
Android	B-System
mobile	O
malware	O
that	O
emerged	O
around	O
October	O
2017	O
.	O

FakeSpy	B-Malware
is	O
an	O
information	O
stealer	O
used	O
to	O
steal	O
SMS	O
messages	O
,	O
send	O
SMS	O
messages	O
,	O
steal	O
financial	O
data	O
,	O
read	O
account	O
information	O
and	O
contact	O
lists	O
,	O
steal	O
application	O
data	O
,	O
and	O
do	O
much	O
more	O
.	O

FakeSpy	B-Malware
first	O
targeted	O
South	O
Korean	O
and	O
Japanese	O
speakers	O
.	O

However	O
,	O
it	O
has	O
begun	O
to	O
target	O
users	O
all	O
around	O
the	O
world	O
,	O
especially	O
users	O
in	O
countries	O
like	O
China	O
,	O
Taiwan	O
,	O
France	O
,	O
Switzerland	O
,	O
Germany	O
,	O
United	O
Kingdom	O
,	O
United	O
States	O
,	O
and	O
others	O
.	O

FakeSpy	B-Malware
masquerades	O
as	O
legitimate	O
postal	O
service	O
apps	O
and	O
transportation	O
services	O
in	O
order	O
to	O
gain	O
the	O
users	O
'	O
trust	O
.	O

Once	O
installed	O
,	O
the	O
application	O
requests	O
permissions	O
so	O
that	O
it	O
may	O
control	O
SMS	O
messages	O
and	O
steal	O
sensitive	O
data	O
on	O
the	O
device	O
,	O
as	O
well	O
as	O
proliferate	O
to	O
other	O
devices	O
in	O
the	O
target	O
device	O
’	O
s	O
contact	O
list	O
.	O

Cybereason	B-Organization
's	O
investigation	O
shows	O
that	O
the	O
threat	O
actor	O
behind	O
the	O
FakeSpy	B-Malware
campaign	O
is	O
a	O
Chinese-speaking	O
group	O
dubbed	O
"	O
Roaming	B-Organization
Mantis	I-Organization
''	O
,	O
a	I-Organization
group	O
that	O
has	O
led	O
similar	O
campaigns	O
.	O

FakeSpy	B-Malware
has	O
been	O
in	O
the	O
wild	O
since	O
2017	O
;	O
this	O
latest	O
campaign	O
indicates	O
that	O
it	O
has	O
become	O
more	O
powerful	O
.	O

Code	O
improvements	O
,	O
new	O
capabilities	O
,	O
anti-emulation	O
techniques	O
,	O
and	O
new	O
,	O
global	O
targets	O
all	O
suggest	O
that	O
this	O
malware	O
is	O
well-maintained	O
by	O
its	O
authors	O
and	O
continues	O
to	O
evolve	O
.	O

TABLE	O
OF	O
CONTENTS	O
Key	O
Findings	O
Introduction	O
Threat	O
Analysis	O
Fakespy	B-Malware
Code	O
Analysis	O
Dynamic	O
Library	O
Loading	O
Stealing	O
Sensitive	O
Information	O
Anti-Emulator	O
Techniques	O
Under	O
Active	O
Development	O
Who	O
is	O
Behind	O
Fakespy	B-Malware
's	O
Smishing	O
Campaigns	O
?	O

Conclusions	O
Cybereason	B-Organization
Mobile	I-Organization
Detects	O
and	O
Stops	O
FakeSpy	B-Malware
Indicators	O
of	O
Compromise	O
INTRODUCTION	O
For	O
the	O
past	O
several	O
weeks	O
,	O
Cybereason	B-Organization
has	O
been	O
investigating	O
a	O
new	O
version	O
of	O
Android	B-System
malware	O
dubbed	O
FakeSpy	B-Malware
,	O
which	O
was	O
first	O
identified	O
in	O
October	O
2017	O
and	O
reported	O
again	O
in	O
October	O
2018	O
.	O

A	O
new	O
campaign	O
is	O
up	O
and	O
running	O
using	O
newly	O
improved	O
,	O
significantly	O
more	O
powerful	O
malware	O
as	O
compared	O
to	O
previous	O
versions	O
.	O

FakeSpy	B-Malware
is	O
under	O
active	O
development	O
and	O
is	O
evolving	O
rapidly	O
;	O
new	O
versions	O
are	O
released	O
every	O
week	O
with	O
additional	O
evasion	O
techniques	O
and	O
capabilities	O
.	O

Our	O
analysis	O
shows	O
that	O
the	O
threat	O
actor	O
behind	O
the	O
FakeSpy	B-Malware
malware	O
is	O
a	O
Chinese-speaking	O
group	O
,	O
commonly	O
referred	O
to	O
as	O
"	O
Roaming	B-Organization
Mantis	I-Organization
''	O
,	O
a	I-Organization
group	O
that	O
is	O
known	O
to	O
have	O
launched	O
similar	O
campaigns	O
in	O
the	O
past	O
.	O

FakeSpy	B-Malware
is	O
an	O
information	O
stealer	O
that	O
exfiltrates	O
and	O
sends	O
SMS	O
messages	O
,	O
steals	O
financial	O
and	O
application	O
data	O
,	O
reads	O
account	O
information	O
and	O
contact	O
lists	O
,	O
and	O
more	O
.	O

The	O
malware	O
uses	O
smishing	O
,	O
or	O
SMS	O
phishing	O
,	O
to	O
infiltrate	O
target	O
devices	O
,	O
which	O
is	O
a	O
technique	O
that	O
relies	O
on	O
social	O
engineering	O
.	O

The	O
attackers	O
send	O
fake	O
text	O
messages	O
to	O
lure	O
the	O
victims	O
to	O
click	O
on	O
a	O
malicious	O
link	O
.	O

The	O
link	O
directs	O
them	O
to	O
a	O
malicious	O
web	O
page	O
,	O
which	O
prompts	O
them	O
to	O
download	O
an	O
Android	O
application	O
package	O
(	O
APK	O
)	O
.	O

This	O
most	O
recent	O
FakeSpy	B-Malware
campaign	O
appears	O
to	O
target	O
users	O
of	O
postal	O
services	O
around	O
the	O
world	O
.	O

New	O
versions	O
of	O
FakeSpy	B-Malware
masquerade	O
as	O
government	O
post	O
office	O
apps	O
and	O
transportation	O
services	O
apps	O
.	O

Our	O
analysis	O
indicates	O
that	O
the	O
threat	O
actors	O
are	O
no	O
longer	O
limiting	O
their	O
campaigns	O
to	O
East	O
Asian	O
countries	O
,	O
but	O
are	O
targeting	O
additional	O
countries	O
around	O
the	O
world	O
.	O

THREAT	O
ANALYSIS	O
Infection	O
Vector	O
:	O
Smishing	O
Your	O
Device	O
Thus	O
far	O
,	O
FakeSpy	B-Malware
campaigns	O
are	O
characterized	O
by	O
SMS	O
phishing	O
(	O
a.k.a	O
.	O

smishing	O
)	O
.	O

These	O
SMS	O
messages	O
masquerade	O
as	O
a	O
message	O
from	O
the	O
local	O
post	O
office	O
and	O
link	O
to	O
the	O
FakeSpy	B-Malware
download	O
.	O

In	O
a	O
previous	O
campaign	O
reported	O
by	O
JPCERT	B-Organization
,	O
mobile	O
users	O
were	O
alerted	O
by	O
phishy	O
messages	O
containing	O
“	O
delivery	O
updates	O
”	O
purportedly	O
from	O
Sagawa	B-Organization
Express	I-Organization
.	O

Fake	O
SMS	O
message	O
luring	O
users	O
to	O
enter	O
a	O
fake	O
website	O
,	O
which	O
contains	O
the	O
malicious	O
APK	O
(	O
JPCERT	B-Organization
report	O
)	O
.	O

Clicking	O
the	O
SMS	O
link	O
brings	O
the	O
user	O
to	O
a	O
fake	O
website	O
that	O
prompts	O
them	O
to	O
download	O
and	O
install	O
the	O
FakeSpy	B-Malware
APK	O
,	O
which	O
is	O
masquerading	O
as	O
a	O
local	O
postal	O
service	O
app	O
.	O

Targeting	O
Postal	O
and	O
Transportation	O
Services	O
Companies	O
One	O
of	O
the	O
most	O
significant	O
findings	O
is	O
that	O
new	O
versions	O
of	O
FakeSpy	B-Malware
target	O
not	O
only	O
Korean	O
and	O
Japanese	O
speakers	O
,	O
but	O
also	O
almost	O
any	O
postal	O
service	O
company	O
around	O
the	O
world	O
.	O

Example	O
of	O
more	O
recent	O
FakeSpy	B-Malware
campaigns	O
targeting	O
France	O
.	O

New	O
FakeSpy	B-Malware
campaign	O
applications	O
leveraging	O
fake	O
postal	O
services	O
apps	O
.	O

All	O
recent	O
FakeSpy	B-Malware
versions	O
contain	O
the	O
same	O
code	O
with	O
minor	O
changes	O
.	O

The	O
FakeSpy	B-Malware
malware	O
has	O
been	O
found	O
to	O
masquerade	O
as	O
any	O
of	O
the	O
following	O
companies	O
:	O
United	B-Organization
States	I-Organization
Postal	I-Organization
Service	I-Organization
-	O
An	O
independent	O
agency	O
of	O
the	O
executive	O
branch	O
of	O
the	O
United	O
States	O
federal	O
government	O
.	O

USPS	B-Organization
is	O
the	O
most	O
well-known	O
branch	O
of	O
the	O
US	O
government	O
and	O
provides	O
a	O
publicly	O
funded	O
postal	O
service	O
.	O

Royal	B-Organization
Mail	I-Organization
-	O
British	O
postal	O
service	O
and	O
courier	O
company	O
.	O

For	O
most	O
of	O
its	O
history	O
it	O
operated	O
as	O
a	O
government	O
department	O
or	O
public	O
corporation	O
.	O

Deutsche	B-Organization
Post	I-Organization
-	O
Deutsche	O
Post	O
DHL	B-Organization
Group	I-Organization
,	O
a	O
German	O
multinational	O
package	O
delivery	O
and	O
supply	O
chain	O
management	O
company	O
headquartered	O
in	O
Bonn	O
.	O

La	B-Organization
Poste	I-Organization
-	O
La	O
Poste	O
is	O
a	O
public	O
limited	O
postal	O
service	O
company	O
in	O
France	O
.	O

Japan	B-Organization
Post	I-Organization
-	O
A	O
private	O
Japanese	O
post	O
,	O
logistics	O
and	O
courier	O
headquartered	O
in	O
Tokyo	O
.	O

Yamato	B-Organization
Transport	I-Organization
-	O
One	O
of	O
Japan	O
's	O
largest	O
door-to-door	O
delivery	O
service	O
companies	O
,	O
also	O
in	O
Tokyo	O
.	O

Chunghwa	B-Organization
Post	I-Organization
-	O
The	O
government-owned	O
corporation	O
Chunghwa	B-Organization
is	O
the	O
official	O
postal	O
service	O
of	O
Taiwan	O
.	O

Swiss	B-Organization
Post	I-Organization
-	O
The	O
national	O
postal	O
service	O
of	O
Switzerland	O
,	O
a	O
fully	O
state-owned	O
limited	O
company	O
(	O
AG	O
)	O
regulated	O
by	O
public	O
law	O
.	O

The	O
fake	O
applications	O
are	O
built	O
using	O
WebView	B-System
,	O
a	O
popular	O
extension	O
of	O
Android	B-System
’	O
s	O
View	O
class	O
that	O
lets	O
the	O
developer	O
show	O
a	O
webpage	O
.	O

FakeSpy	B-Malware
uses	O
this	O
view	O
to	O
redirect	O
users	O
to	O
the	O
original	O
post	O
office	O
carrier	O
webpage	O
on	O
launch	O
of	O
the	O
application	O
,	O
continuing	O
the	O
deception	O
.	O

This	O
allows	O
the	O
application	O
to	O
appear	O
legitimate	O
,	O
especially	O
given	O
these	O
applications	O
icons	O
and	O
user	O
interface	O
.	O

New	O
FakeSpy	B-Malware
applications	O
masquerading	O
as	O
post	O
office	O
apps	O
.	O

FAKESPY	B-Malware
CODE	O
ANALYSIS	O
Once	O
the	O
user	O
clicks	O
on	O
the	O
malicious	O
link	O
from	O
the	O
SMS	O
message	O
,	O
the	O
app	O
asks	O
them	O
to	O
approve	O
installation	O
from	O
unknown	O
resources	O
.	O

This	O
configuration	O
can	O
be	O
toggled	O
on	O
by	O
going	O
to	O
‘	O
Settings	O
’	O
-	O
>	O
‘	O
Security	O
’	O
-	O
>	O
‘	O
Unknown	O
Resources	O
’	O
.	O

PackageInstaller	O
shows	O
the	O
app	O
’	O
s	O
permission	O
access	O
and	O
asks	O
for	O
the	O
user	O
's	O
approval	O
,	O
which	O
then	O
installs	O
the	O
application	O
.	O

This	O
analysis	O
dissects	O
FakeSpy	B-Malware
’	O
s	O
Chunghwa	O
Post	O
app	O
version	O
,	O
which	O
emerged	O
in	O
April	O
2020	O
.	O

During	O
the	O
installation	O
,	O
the	O
malware	O
asks	O
for	O
the	O
following	O
permissions	O
:	O
READ_PHONE_STATE	O
-	O
Allows	O
read-only	O
access	O
to	O
the	O
phone	O
state	O
,	O
including	O
the	O
current	O
cellular	O
network	O
information	O
,	O
the	O
status	O
of	O
any	O
ongoing	O
calls	O
,	O
and	O
a	O
list	O
of	O
any	O
PhoneAccounts	O
registered	O
on	O
the	O
device	O
.	O

READ_SMS	O
-	O
Allows	O
the	O
application	O
to	O
read	O
text	O
messages	O
.	O

RECEIVE_SMS	O
-	O
Allows	O
the	O
application	O
to	O
receive	O
SMS	O
messages	O
.	O

WRITE_SMS	O
-	O
Allows	O
the	O
application	O
to	O
write	O
to	O
SMS	O
messages	O
stored	O
on	O
the	O
device	O
or	O
SIM	O
card	O
,	O
including	O
y	O
deleting	O
messages	O
.	O

SEND_SMS	O
-	O
Allows	O
the	O
application	O
to	O
send	O
SMS	O
messages	O
.	O

INTERNET	O
-	O
Allows	O
the	O
application	O
to	O
open	O
network	O
sockets	O
.	O

WRITE_EXTERNAL_STORAGE	O
-	O
Allows	O
the	O
application	O
to	O
write	O
to	O
external	O
storage	O
.	O

READ_EXTERNAL_STORAGE	O
-	O
Allows	O
the	O
application	O
to	O
read	O
from	O
external	O
storage	O
.	O

RECEIVE_BOOT_COMPLETED	O
-	O
Allows	O
the	O
application	O
to	O
receive	O
a	O
broadcast	O
after	O
the	O
system	O
finishes	O
booting	O
.	O

GET_TASKS	O
-	O
Allows	O
the	O
application	O
to	O
get	O
information	O
about	O
current	O
or	O
recently	O
run	O
tasks	O
.	O

(	O
deprecated	O
in	O
API	O
level	O
21	O
)	O
SYSTEM_ALERT_WINDOW	O
-	O
Allows	O
the	O
application	O
to	O
create	O
windows	O
shown	O
on	O
top	O
of	O
all	O
other	O
apps	O
.	O

WAKE_LOCK	O
-	O
Allows	O
the	O
application	O
to	O
use	O
PowerManager	O
WakeLocks	O
to	O
keep	O
the	O
processor	O
from	O
sleeping	O
or	O
the	O
screen	O
from	O
dimming	O
.	O

ACCESS_NETWORK_STATE	O
-	O
Allows	O
the	O
application	O
to	O
access	O
information	O
about	O
networks	O
.	O

REQUEST_IGNORE_BATTERY_OPTIMIZATIONS	O
-	O
Whitelists	O
the	O
application	O
to	O
allow	O
it	O
to	O
ignore	O
battery	O
optimizations	O
.	O

READ_CONTACTS	O
-	O
Allows	O
the	O
application	O
to	O
read	O
the	O
user	O
's	O
contacts	O
data	O
.	O

FakeSpy	B-Malware
package	O
permissions	O
.	O

On	O
opening	O
the	O
app	O
,	O
two	O
pop-up	O
messages	O
appear	O
on	O
screen	O
:	O
Change	O
SMS	O
App	O
:	O
This	O
sets	O
permissions	O
to	O
intercept	O
every	O
SMS	O
received	O
on	O
the	O
device	O
and	O
send	O
a	O
copy	O
of	O
these	O
messages	O
to	O
the	O
C2	O
server	O
.	O

Ignore	O
Battery	O
Optimization	O
:	O
This	O
sets	O
permissions	O
to	O
continue	O
to	O
operate	O
at	O
full	O
capacity	O
while	O
the	O
phone	O
's	O
screen	O
is	O
turned	O
off	O
and	O
the	O
phone	O
locked	O
.	O

These	O
requests	O
rely	O
on	O
the	O
end	O
user	O
accepting	O
the	O
permission	O
changes	O
and	O
points	O
to	O
the	O
importance	O
of	O
healthy	O
skepticism	O
when	O
giving	O
applications	O
permissions	O
.	O

FakeSpy	B-Malware
Chunghwa	B-Organization
Post	I-Organization
version	O
installation	O
process	O
and	O
application	O
UI	O
.	O

DYNAMIC	O
LIBRARY	O
LOADING	O
Once	O
the	O
application	O
has	O
finished	O
the	O
installation	O
process	O
,	O
the	O
malware	O
starts	O
its	O
real	O
malicious	O
activity	O
.	O

The	O
malicious	O
application	O
da.hao.pao.bin	B-Indicator
(	O
Chunghwa	B-Organization
Post	I-Organization
)	O
loads	O
a	O
library	O
file	O
libmsy.so	B-Indicator
used	O
to	O
execute	O
the	O
packed	O
mycode.jar	B-Indicator
file	I-Indicator
.	O

The	O
JAR	O
file	O
is	O
the	O
decrypted	O
version	O
of	O
the	O
file	O
tong.luo	B-Indicator
,	O
which	O
is	O
located	O
in	O
the	O
assets	O
folder	O
.	O

Decompiled	O
APK	O
resources	O
.	O

By	O
comparing	O
the	O
sizes	O
of	O
the	O
encrypted	O
asset	O
file	O
tong.luo	B-Indicator
vs	O
the	O
decrypted	O
JAR	O
file	O
mycode.jar	B-Indicator
,	O
it	O
is	O
interesting	O
to	O
note	O
that	O
it	O
is	O
the	O
same	O
file	O
(	O
almost	O
the	O
same	O
size	O
)	O
.	O

Comparing	O
encrypted	O
vs	O
decrypted	O
asset	O
file	O
.	O

After	O
libmsy.so	B-Indicator
decrypts	O
the	O
asset	O
file	O
tong.luo	B-Indicator
,	O
it	O
loads	O
mycode.jar	B-Indicator
dynamically	O
into	O
FakeSpy	B-Malware
’	O
s	O
process	O
,	O
as	O
is	O
shown	O
from	O
the	O
output	O
of	O
the	O
“	O
adb	O
logcat	O
”	O
command	O
.	O

Logcat	O
logs	O
show	O
FakeSpy	B-Malware
uses	O
libmsy.so	B-Indicator
to	O
execute	O
the	O
malicious	O
packed	O
mycode.jar	B-Indicator
file	I-Indicator
.	O

By	O
analyzing	O
running	O
processes	O
on	O
the	O
infected	O
device	O
,	O
it	O
shows	O
that	O
the	O
malware	O
creates	O
a	O
child	O
process	O
of	O
itself	O
to	O
perform	O
the	O
multi-process	O
ptrace	O
anti-debugging	O
technique	O
.	O

FakeSpy	B-Malware
uses	O
an	O
anti-debugging	O
technique	O
by	O
creating	O
another	O
child	O
process	O
of	O
itself	O
.	O

By	O
performing	O
a	O
deep	O
analysis	O
of	O
the	O
malware	O
,	O
we	O
were	O
able	O
to	O
extract	O
the	O
unpacked	O
JAR	O
file	O
mycode.jar	B-Indicator
and	O
reveal	O
some	O
very	O
interesting	O
code	O
.	O

STEALING	O
SENSITIVE	O
INFORMATION	O
FakeSpy	B-Malware
has	O
multiple	O
built	O
in	O
information	O
stealing	O
capabilities	O
.	O

The	O
first	O
function	O
is	O
used	O
for	O
contact	O
information	O
stealing	O
:	O
the	O
function	O
upCon	O
steals	O
all	O
contacts	O
in	O
the	O
contact	O
list	O
and	O
their	O
information	O
.	O

Then	O
,	O
it	O
sends	O
it	O
to	O
the	O
C2	O
server	O
using	O
the	O
URL	O
that	O
ends	O
with	O
/servlet/ContactUpload	B-Indicator
.	O

The	O
stolen	O
data	O
fields	O
are	O
:	O
Mobile	O
-	O
The	O
infected	O
device	O
phone	O
number	O
and	O
contact	O
’	O
s	O
phone	O
number	O
Contacts	O
-	O
A	O
headline	O
used	O
for	O
the	O
attacker	O
to	O
distinguish	O
between	O
the	O
type	O
of	O
stolen	O
information	O
he	O
gets	O
Name	O
-	O
Contact	O
’	O
s	O
full	O
name	O
(	O
Display	O
name	O
)	O
upCon	O
(	O
upload	O
contact	O
)	O
function	O
used	O
for	O
stealing	O
contact	O
list	O
information	O
.	O

For	O
testing	O
purposes	O
we	O
inserted	O
a	O
fake	O
contacts	O
list	O
to	O
our	O
Android	B-System
Emulator	O
and	O
observed	O
resultant	O
behavior	O
.	O

Exfiltrated	O
contact	O
list	O
data	O
sent	O
to	O
the	O
C2	O
server	O
.	O

The	O
second	O
stealing	O
function	O
is	O
the	O
onStartCommand	O
,	O
which	O
steals	O
infected	O
device	O
data	O
and	O
additional	O
information	O
.	O

The	O
stolen	O
data	O
is	O
sent	O
to	O
the	O
C2	O
server	O
using	O
the	O
URL	O
ending	O
with	O
/servlet/xx	B-Indicator
.	O

The	O
stolen	O
data	O
fields	O
are	O
:	O
Mobile	O
-	O
The	O
infected	O
device	O
phone	O
number	O
Machine	O
-	O
The	O
device	O
model	O
(	O
in	O
our	O
example	O
:	O
Google	B-System
Pixel	I-System
2	I-System
)	O
Sversion	O
-	O
The	O
OS	O
version	O
Bank	O
-	O
Checks	O
if	O
there	O
are	O
any	O
banking-related	O
or	O
cryptocurrency	O
trading	O
apps	O
Provider	O
-	O
The	O
telecommunication	O
provider	O
(	O
IMSI	O
value	O
in	O
device	O
settings	O
)	O
npki	O
-	O
Checks	O
if	O
the	O
folder	O
named	O
NPKI	O
(	O
National	O
Public	O
Key	O
Infrastructure	O
)	O
might	O
contain	O
authentication	O
certificates	O
related	O
to	O
financial	O
transactions	O
onStartCommand	O
function	O
for	O
stealing	O
device	O
information	O
and	O
additional	O
sensitive	O
data	O
.	O

Exfiltrated	O
device	O
information	O
and	O
additional	O
sensitive	O
data	O
sent	O
to	O
the	O
C2	O
server	O
.	O

FakeSpy	B-Malware
asks	O
to	O
be	O
the	O
default	O
SMS	O
app	O
because	O
it	O
uses	O
the	O
function	O
onReceive	O
to	O
intercept	O
incoming	O
SMS	O
messages	O
.	O

It	O
saves	O
the	O
messages	O
’	O
metadata	O
and	O
content	O
,	O
filters	O
the	O
information	O
by	O
fields	O
,	O
and	O
sends	O
them	O
to	O
the	O
C2	O
server	O
using	O
the	O
URL	O
/servlet/SendMassage2	B-Indicator
.	O

The	O
fields	O
it	O
collects	O
are	O
:	O
Mobile	O
-	O
The	O
phone	O
number	O
which	O
sent	O
the	O
SMS	O
Content	O
-	O
The	O
message	O
body	O
Sender	O
-	O
The	O
contact	O
name	O
who	O
sent	O
the	O
message	O
Time	O
-	O
The	O
time	O
the	O
message	O
was	O
received	O
onReceive	O
function	O
used	O
to	O
intercept	O
incoming	O
SMS	O
messages	O
.	O

The	O
malware	O
uses	O
the	O
function	O
sendAll	O
to	O
send	O
messages	O
that	O
spread	O
the	O
malware	O
to	O
other	O
devices	O
.	O

It	O
sends	O
a	O
smishing	O
message	O
to	O
the	O
entire	O
contact	O
list	O
of	O
the	O
infected	O
device	O
along	O
with	O
the	O
malicious	O
link	O
to	O
the	O
FakeSpy	B-Malware
installation	O
page	O
.	O

sendAll	O
function	O
used	O
to	O
spread	O
malicious	O
messages	O
to	O
the	O
contact	O
list	O
.	O

Another	O
interesting	O
feature	O
in	O
FakeSpy	B-Malware
’	O
s	O
code	O
is	O
the	O
collection	O
of	O
the	O
device	O
's	O
IMEI	O
(	O
International	O
Mobile	O
Station	O
Equipment	O
Identity	O
)	O
number	O
and	O
all	O
installed	O
applications	O
using	O
the	O
function	O
upAppinfos	O
.	O

It	O
sends	O
all	O
of	O
this	O
data	O
to	O
the	O
C2	O
server	O
using	O
the	O
URL	O
ending	O
with	O
/servlet/AppInfos	B-Indicator
.	O

upAppinfos	O
function	O
used	O
for	O
obtaining	O
the	O
device	O
IMEI	O
and	O
all	O
of	O
its	O
installed	O
applications	O
.	O

FakeSpy	B-Malware
is	O
able	O
to	O
check	O
the	O
network	O
connectivity	O
status	O
by	O
using	O
the	O
function	O
isNetworkAvailable	O
.	O

What	O
makes	O
this	O
function	O
more	O
suspicious	O
is	O
the	O
two	O
strings	O
written	O
in	O
Chinese	O
characters	O
:	O
===状态===	O
(	O
===Status===	O
)	O
-	O
Checks	O
whether	O
the	O
device	O
is	O
connected	O
to	O
a	O
network	O
===类型===	O
(	O
===Type===	O
)	O
-	O
Checks	O
whether	O
the	O
device	O
sees	O
available	O
nearby	O
Wifi	O
networks	O
isNetworkAvailable	O
function	O
used	O
for	O
monitoring	O
network	O
connectivity	O
status	O
.	O

ANTI-EMULATOR	O
TECHNIQUES	O
FakeSpy	B-Malware
appears	O
to	O
use	O
multiple	O
techniques	O
to	O
evade	O
detection	O
via	O
the	O
emulator	O
.	O

It	O
shows	O
that	O
the	O
malware	O
can	O
detect	O
whether	O
it	O
’	O
s	O
running	O
in	O
an	O
emulated	O
environment	O
or	O
a	O
real	O
mobile	O
device	O
,	O
and	O
can	O
change	O
its	O
code	O
pattern	O
accordingly	O
.	O

The	O
first	O
example	O
of	O
this	O
is	O
in	O
the	O
onStart	O
function	O
,	O
where	O
the	O
malware	O
looks	O
for	O
the	O
string	O
“	O
Emulator	O
”	O
and	O
a	O
x86	O
processor	O
model	O
.	O

Anti-emulator	O
code	O
.	O

In	O
order	O
to	O
simulate	O
this	O
technique	O
,	O
we	O
took	O
two	O
videos	O
side	O
by	O
side	O
of	O
how	O
FakeSpy	B-Malware
(	O
the	O
Royal	B-Organization
Mail	I-Organization
sample	O
)	O
behaves	O
differently	O
on	O
a	O
physical	O
device	O
versus	O
an	O
emulator	O
.	O

FakeSpy	B-Malware
behavior	O
on	O
physical	O
device	O
vs	O
emulator	O
(	O
anti-emulator	O
)	O
.	O

This	O
simulation	O
shows	O
that	O
FakeSpy	B-Malware
behaves	O
differently	O
on	O
a	O
physical	O
device	O
versus	O
an	O
emulator	O
.	O

When	O
executed	O
the	O
second	O
time	O
by	O
clicking	O
on	O
the	O
app	O
on	O
the	O
physical	O
device	O
,	O
FakeSpy	B-Malware
redirects	O
to	O
the	O
app	O
settings	O
.	O

In	O
contrast	O
,	O
on	O
the	O
emulator	O
,	O
a	O
toast	O
message	O
is	O
displayed	O
that	O
shows	O
“	O
Install	O
completed	O
”	O
,	O
at	O
which	O
point	O
FakeSpy	B-Malware
removes	O
its	O
shortcut	O
from	O
the	O
device	O
's	O
homescreen	O
.	O

Another	O
example	O
of	O
FakeSpy	B-Malware
’	O
s	O
anti-emulation	O
techniques	O
is	O
how	O
it	O
uses	O
the	O
getMachine	O
function	O
,	O
which	O
uses	O
the	O
TelephonyManager	O
class	O
to	O
check	O
for	O
the	O
deviceID	O
,	O
phone	O
number	O
,	O
IMEI	O
,	O
and	O
IMSI	O
.	O

Some	O
emulators	O
build	O
their	O
phone	O
number	O
out	O
of	O
the	O
default	O
number	O
created	O
in	O
the	O
emulator	O
software	O
and	O
the	O
port	B-Indicator
number	I-Indicator
:	I-Indicator
5554.	I-Indicator
getMachine	O
function	O
using	O
anti-emulator	O
technique	O
.	O

UNDER	O
ACTIVE	O
DEVELOPMENT	O
An	O
analysis	O
of	O
new	O
FakeSpy	B-Malware
samples	O
to	O
old	O
ones	O
showed	O
code	O
discrepancies	O
and	O
new	O
features	O
.	O

These	O
artifacts	O
indicate	O
that	O
FakeSpy	B-Malware
's	O
campaign	O
is	O
still	O
live	O
and	O
under	O
development	O
.	O

The	O
newer	O
version	O
of	O
FakeSpy	B-Malware
uses	O
new	O
URL	O
addresses	O
for	O
malicious	O
communication	O
with	O
FakeSpy	B-Malware
.	O

The	O
function	O
main	O
uses	O
a	O
DES	O
encryption	O
algorithm	O
to	O
encode	O
these	O
addresses	O
.	O

The	O
examples	O
below	O
show	O
the	O
plaintext	O
key	O
“	O
TEST	O
”	O
to	O
decrypt	O
encoded	O
hexadecimal	O
strings	O
(	O
jUtils.decrypt	O
(	O
)	O
)	O
.	O

These	O
encoded	O
strings	O
contain	O
the	O
new	O
URL	O
addresses	O
not	O
seen	O
in	O
older	O
versions	O
of	O
FakeSpy	B-Malware
.	O

Comparing	O
strings	O
from	O
an	O
old	O
FakeSpy	B-Malware
sample	O
to	O
a	O
new	O
one	O
.	O

WHO	O
IS	O
BEHIND	O
FAKESPY	B-Malware
’	O
S	O
SMISHING	O
CAMPAIGNS	O
?	O

The	O
Cybereason	B-Organization
Nocturnus	I-Organization
team	O
suspects	O
that	O
the	O
malware	O
operators	O
and	O
authors	O
are	O
Chinese	O
speakers	O
.	O

Our	O
findings	O
,	O
along	O
with	O
previous	O
research	O
,	O
indicates	O
that	O
the	O
threat	O
actor	O
behind	O
these	O
recent	O
campaigns	O
is	O
likely	O
a	O
Chinese	O
group	O
dubbed	O
“	O
Roaming	B-Organization
Mantis	I-Organization
”	O
.	O

Roaming	B-Organization
Mantis	I-Organization
is	O
believed	O
to	O
be	O
a	O
Chinese	O
threat	O
actor	O
group	O
first	O
discovered	O
in	O
April	O
2018	O
that	O
has	O
continuously	O
evolved	O
.	O

In	O
the	O
beginning	O
,	O
this	O
threat	O
group	O
mainly	O
targeted	O
Asian	O
countries	O
.	O

Now	O
,	O
they	O
are	O
expanding	O
their	O
activity	O
to	O
audiences	O
all	O
around	O
the	O
world	O
.	O

As	O
part	O
of	O
their	O
activities	O
,	O
they	O
are	O
known	O
for	O
hijacking	O
DNS	O
settings	O
on	O
Japanese	O
routers	O
that	O
redirect	O
users	O
to	O
malicious	O
IP	O
addresses	O
,	O
creating	O
disguised	O
malicious	O
Android	B-System
apps	O
that	O
appear	O
as	O
popular	O
apps	O
,	O
stealing	O
Apple	B-Organization
ID	O
credentials	O
by	O
creating	O
Apple	B-Organization
phishing	O
pages	O
,	O
as	O
well	O
as	O
performing	O
web	O
crypto	O
mining	O
on	O
browsers	O
.	O

CONNECTION	O
TO	O
CHINA	O
Chinese	O
server	O
infrastructure	O
:	O
FakeSpy	B-Malware
applications	O
send	O
stolen	O
information	O
to	O
C2	O
domains	O
with	O
.club	B-Indicator
TLDs	I-Indicator
and	O
URLs	O
ending	O
with	O
/servlet/	B-Indicator
[	I-Indicator
C2	I-Indicator
Command	I-Indicator
]	I-Indicator
(	O
mentioned	O
above	O
in	O
the	O
“	O
Stealing	O
Sensitive	O
Information	O
”	O
section	O
)	O
.	O

All	O
of	O
these	O
domains	O
are	O
registered	O
to	O
‘	O
Li	O
Jun	O
Biao	O
’	O
on	O
Bizcn	B-Organization
,	I-Organization
Inc	I-Organization
,	O
a	O
Chinese	O
Internet	O
application	O
service	O
provider	O
.	O

Chinese	O
language	O
traces	O
in	O
the	O
code	O
:	O
During	O
the	O
investigation	O
,	O
the	O
Cybereason	B-Organization
Nocturnus	I-Organization
team	O
discovered	O
code	O
artifacts	O
that	O
may	O
indicate	O
Chinese	O
threat	O
actors	O
.	O

For	O
example	O
,	O
we	O
found	O
several	O
suspicious	O
strings	O
written	O
in	O
the	O
Chinese	O
language	O
in	O
a	O
function	O
called	O
isNetworkAvailable	O
,	O
previously	O
discussed	O
in	O
this	O
blog	O
:	O
An	O
almost	O
identical	O
function	O
is	O
mentioned	O
in	O
an	O
earlier	O
research	O
,	O
that	O
ties	O
FakeSpy	B-Malware
and	O
other	O
malware	O
to	O
the	O
Roaming	B-Organization
Mantis	I-Organization
group	O
.	O

Chinese	O
APK	O
names	O
:	O
Some	O
of	O
FakeSpy	B-Malware
’	O
s	O
APK	O
package	O
names	O
contain	O
anglicized	O
Chinese	O
(	O
Mandarin	O
)	O
words	O
that	O
might	O
be	O
related	O
to	O
Chinese	O
songs	O
and	O
lyrics	O
,	O
food	O
,	O
provinces	O
,	O
etc	O
.	O

CONCLUSIONS	O
FakeSpy	B-Malware
was	O
first	O
seen	O
in	O
October	O
2017	O
and	O
until	O
recently	O
mainly	O
targeted	O
East	O
Asian	O
countries	O
.	O

Our	O
research	O
shows	O
fresh	O
developments	O
in	O
the	O
malware	O
’	O
s	O
code	O
and	O
sophistication	O
,	O
as	O
well	O
as	O
an	O
expansion	O
to	O
target	O
Europe	O
and	O
North	O
America	O
.	O

This	O
mobile	O
malware	O
masquerades	O
as	O
legitimate	O
,	O
trusted	O
postal	O
service	O
applications	O
so	O
that	O
it	O
can	O
gain	O
the	O
users	O
trust	O
.	O

Once	O
it	O
has	O
been	O
installed	O
,	O
it	O
requests	O
permissions	O
from	O
the	O
user	O
so	O
that	O
it	O
can	O
steal	O
sensitive	O
data	O
,	O
manipulate	O
SMS	O
messages	O
,	O
and	O
potentially	O
infect	O
contacts	O
of	O
the	O
user	O
.	O

The	O
malware	O
now	O
targets	O
more	O
countries	O
all	O
over	O
the	O
world	O
by	O
masquerading	O
as	O
official	O
post	O
office	O
and	O
transportation	O
services	O
apps	O
.	O

These	O
apps	O
appear	O
legitimate	O
due	O
to	O
their	O
app	O
logo	O
,	O
UI	O
appearance	O
,	O
and	O
redirects	O
to	O
the	O
carrier	O
webpage	O
--	O
all	O
luring	O
end	O
users	O
to	O
believe	O
it	O
’	O
s	O
the	O
original	O
one	O
.	O

In	O
this	O
blog	O
,	O
we	O
showed	O
that	O
the	O
threat	O
actor	O
behind	O
the	O
recent	O
FakeSpy	B-Malware
campaign	O
is	O
a	O
Chinese-speaking	O
group	O
called	O
“	O
Roaming	B-Organization
Mantis	I-Organization
”	O
known	O
to	O
operate	O
mainly	O
in	O
Asia	O
.	O

It	O
is	O
interesting	O
to	O
see	O
that	O
the	O
group	O
has	O
expanded	O
their	O
operation	O
to	O
other	O
regions	O
,	O
such	O
as	O
the	O
United	O
States	O
and	O
Europe	O
.	O

The	O
malware	O
authors	O
seem	O
to	O
be	O
putting	O
a	O
lot	O
of	O
effort	O
into	O
improving	O
this	O
malware	O
,	O
bundling	O
it	O
with	O
numerous	O
new	O
upgrades	O
that	O
make	O
it	O
more	O
sophisticated	O
,	O
evasive	O
,	O
and	O
well-equipped	O
.	O

These	O
improvements	O
render	O
FakeSpy	B-Malware
one	O
of	O
the	O
most	O
powerful	O
information	O
stealers	O
on	O
the	O
market	O
.	O

We	O
anticipate	O
this	O
malware	O
to	O
continue	O
to	O
evolve	O
with	O
additional	O
new	O
features	O
;	O
the	O
only	O
question	O
now	O
is	O
when	O
we	O
will	O
see	O
the	O
next	O
wave	O
.	O

First	O
Twitter‑controlled	B-System
Android	B-System
botnet	O
discovered	O
Detected	O
by	O
ESET	B-Organization
as	O
Android/Twitoor	B-Malware
,	O
this	O
malware	O
is	O
unique	O
because	O
of	O
its	O
resilience	O
mechanism	O
.	O

Instead	O
of	O
being	O
controlled	O
by	O
a	O
traditional	O
command-and-control	O
server	O
,	O
it	O
receives	O
instructions	O
via	O
tweets	O
.	O

24	O
Aug	O
2016	O
-	O
02:05PM	O
Android/Twitoor	B-Malware
is	O
a	O
backdoor	O
capable	O
of	O
downloading	O
other	O
malware	O
onto	O
an	O
infected	O
device	O
.	O

It	O
has	O
been	O
active	O
for	O
around	O
one	O
month	O
.	O

This	O
malicious	O
app	O
,	O
detected	O
by	O
ESET	B-Organization
as	O
a	O
variant	O
of	O
Android/Twitoor.A	B-Malware
,	O
can	O
’	O
t	O
be	O
found	O
on	O
any	O
official	O
Android	B-System
app	I-System
store	I-System
–	O
it	O
probably	O
spreads	O
by	O
SMS	O
or	O
via	O
malicious	O
URLs	O
.	O

It	O
impersonates	O
a	O
porn	O
player	O
app	O
or	O
MMS	O
application	O
but	O
without	O
having	O
their	O
functionality	O
.	O

After	O
launching	O
,	O
it	O
hides	O
its	O
presence	O
on	O
the	O
system	O
and	O
checks	O
the	O
defined	O
Twitter	B-System
account	O
at	O
regular	O
intervals	O
for	O
commands	O
.	O

Based	O
on	O
received	O
commands	O
,	O
it	O
can	O
either	O
download	O
malicious	O
apps	O
or	O
switch	O
the	O
C	O
&	O
C	O
Twitter	B-System
account	O
to	O
another	O
one	O
.	O

“	O
Using	O
Twitter	B-System
instead	O
of	O
command-and-control	O
(	O
C	O
&	O
C	O
)	O
servers	O
is	O
pretty	O
innovative	O
for	O
an	O
Android	B-System
botnet.	O
”	O
“	O
Using	O
Twitter	B-Organization
instead	O
of	O
command-and-control	O
(	O
C	O
&	O
C	O
)	O
servers	O
is	O
pretty	O
innovative	O
for	O
an	O
Android	B-System
botnet	O
,	O
”	O
says	O
Lukáš	O
Štefanko	O
,	O
the	O
ESET	B-Organization
malware	O
researcher	O
who	O
discovered	O
the	O
malicious	O
app	O
.	O

Malware	O
that	O
enslaves	O
devices	O
to	O
form	O
botnets	O
needs	O
to	O
be	O
able	O
to	O
receive	O
updated	O
instructions	O
.	O

That	O
communication	O
is	O
an	O
Achilles	O
heel	O
for	O
any	O
botnet	O
–	O
it	O
may	O
raise	O
suspicion	O
and	O
,	O
cutting	O
the	O
bots	O
off	O
is	O
always	O
lethal	O
to	O
the	O
botnet	O
’	O
s	O
functioning	O
.	O

Additionally	O
,	O
should	O
the	O
command-and-control	O
(	O
C	O
&	O
C	O
)	O
servers	O
get	O
seized	O
by	O
the	O
authorities	O
,	O
it	O
would	O
ultimately	O
lead	O
to	O
disclosing	O
information	O
about	O
the	O
entire	O
botnet	O
.	O

To	O
make	O
the	O
Twitoor	B-Malware
botnet	O
’	O
s	O
communication	O
more	O
resilient	O
,	O
botnet	O
designers	O
took	O
various	O
steps	O
like	O
encrypting	O
their	O
messages	O
,	O
using	O
complex	O
topologies	O
of	O
the	O
C	O
&	O
C	O
network	O
–	O
or	O
using	O
innovative	O
means	O
for	O
communication	O
,	O
among	O
them	O
the	O
use	O
of	O
social	O
networks	O
.	O

“	O
These	O
communication	O
channels	O
are	O
hard	O
to	O
discover	O
and	O
even	O
harder	O
to	O
block	O
entirely	O
.	O

On	O
the	O
other	O
hand	O
,	O
it	O
’	O
s	O
extremely	O
easy	O
for	O
the	O
crooks	O
to	O
re-direct	O
communications	O
to	O
another	O
freshly	O
created	O
account	O
,	O
”	O
explains	O
Štefanko	O
.	O

In	O
the	O
Windows	B-System
space	O
,	O
Twitter	B-Organization
,	O
founded	O
in	O
2006	O
,	O
was	O
first	O
used	O
to	O
control	O
botnets	O
as	O
early	O
as	O
in	O
2009	O
.	O

Android	B-System
bots	O
have	O
also	O
already	O
been	O
found	O
being	O
controlled	O
via	O
other	O
non-traditional	O
means	O
–	O
blogs	O
or	O
some	O
of	O
the	O
many	O
cloud	O
messaging	O
systems	O
like	O
Google	B-Organization
’	O
s	O
or	O
Baidu	B-Organization
’	O
s	O
–	O
but	O
Twitoor	B-Malware
is	O
the	O
first	O
Twitter-based	B-System
bot	O
malware	O
,	O
according	O
to	O
Štefanko	O
.	O

“	O
In	O
the	O
future	O
,	O
we	O
can	O
expect	O
that	O
the	O
bad	O
guys	O
will	O
try	O
to	O
make	O
use	O
of	O
Facebook	B-System
statuses	O
or	O
deploy	O
LinkedIn	B-System
and	O
other	O
social	O
networks	O
”	O
,	O
states	O
ESET	B-Organization
’	O
s	O
researcher	O
.	O

Currently	O
,	O
the	O
Twitoor	B-Malware
trojan	O
has	O
been	O
downloading	O
several	O
versions	O
of	O
mobile	O
banking	O
malware	O
.	O

However	O
,	O
the	O
botnet	O
operators	O
can	O
start	O
distributing	O
other	O
malware	O
,	O
including	O
ransomware	O
,	O
at	O
any	O
time	O
warns	O
Štefanko	O
.	O

“	O
Twitoor	B-Malware
serves	O
as	O
another	O
example	O
of	O
how	O
cybercriminals	O
keep	O
on	O
innovating	O
their	O
business	O
,	O
”	O
Stefanko	O
continues	O
.	O

“	O
The	O
takeaway	O
?	O

Internet	O
users	O
should	O
keep	O
on	O
securing	O
their	O
activities	O
with	O
good	O
security	O
solutions	O
for	O
both	O
computers	O
and	O
mobile	O
devices.	O
”	O
Hashes	O
:	O
E5212D4416486AF42E7ED1F58A526AEF77BE89BE	B-Indicator
A9891222232145581FE8D0D483EDB4B18836BCFC	B-Indicator
AFF9F39A6CA5D68C599B30012D79DA29E2672C6E	B-Indicator
Insidious	O
Android	B-System
malware	O
gives	O
up	O
all	O
malicious	O
features	O
but	O
one	O
to	O
gain	O
stealth	O
ESET	B-Organization
researchers	O
detect	O
a	O
new	O
way	O
of	O
misusing	O
Accessibility	O

Service	O
,	O
the	O
Achilles	O
’	O
heel	O
of	O
Android	B-System
security	O
22	O
May	O
2020	O
-	O
03:00PM	O
ESET	B-Organization
researchers	O
have	O
analyzed	O
an	O
extremely	O
dangerous	O
Android	B-System
app	O
that	O
can	O
perform	O
a	O
host	O
of	O
nefarious	O
actions	O
,	O
notably	O
wiping	O
out	O
the	O
victim	O
’	O
s	O
bank	O
account	O
or	O
cryptocurrency	O
wallet	O
and	O
taking	O
over	O
their	O
email	O
or	O
social	O
media	O
accounts	O
.	O

Called	O
“	O
DEFENSOR	B-Malware
ID	I-Malware
”	O
,	O
the	O
banking	O
trojan	O
was	O
available	O
on	O
Google	B-System
Play	I-System
at	O
the	O
time	O
of	O
the	O
analysis	O
.	O

The	O
app	O
is	O
fitted	O
with	O
standard	O
information-stealing	O
capabilities	O
;	O
however	O
,	O
this	O
banker	O
is	O
exceptionally	O
insidious	O
in	O
that	O
after	O
installation	O
it	O
requires	O
a	O
single	O
action	O
from	O
the	O
victim	O
–	O
enable	O
Android	B-System
’	O
s	O
Accessibility	O
Service	O
–	O
to	O
fully	O
unleash	O
the	O
app	O
’	O
s	O
malicious	O
functionality	O
.	O

The	O
DEFENSOR	B-Malware
ID	I-Malware
app	O
made	O
it	O
onto	O
the	O
heavily	O
guarded	O
Google	B-System
Play	I-System
store	I-System
thanks	O
to	O
its	O
extreme	O
stealth	O
.	O

Its	O
creators	O
reduced	O
the	O
app	O
’	O
s	O
malicious	O
surface	O
to	O
the	O
bare	O
minimum	O
by	O
removing	O
all	O
potentially	O
malicious	O
functionalities	O
but	O
one	O
:	O
abusing	O
Accessibility	O
Service	O
.	O

Accessibility	O
Service	O
is	O
long	O
known	O
to	O
be	O
the	O
Achilles	O
’	O
heel	O
of	O
the	O
Android	B-System
operating	O
system	O
.	O

Security	O
solutions	O
can	O
detect	O
it	O
in	O
countless	O
combinations	O
with	O
other	O
suspicious	O
permissions	O
and	O
functions	O
,	O
or	O
malicious	O
functionalities	O
–	O
but	O
when	O
faced	O
with	O
no	O
additional	O
functionality	O
nor	O
permission	O
,	O
all	O
failed	O
to	O
trigger	O
any	O
alarm	O
on	O
DEFENSOR	B-Malware
ID	I-Malware
.	O

By	O
“	O
all	O
”	O
we	O
mean	O
all	O
security	O
mechanisms	O
guarding	O
the	O
official	O
Android	B-System
app	I-System
store	I-System
(	O
including	O
the	O
detection	O
engines	O
of	O
the	O
members	O
of	O
the	O
App	B-Organization
Defense	I-Organization
Alliance	I-Organization
)	O
and	O
all	O
security	O
vendors	O
participating	O
in	O
the	O
VirusTotal	B-Organization
program	O
(	O
see	O
Figure	O
1	O
)	O
.	O

DEFENSOR	B-Malware
ID	I-Malware
was	O
released	O
on	O
Feb	O
3	O
,	O
2020	O
and	O
last	O
updated	O
to	O
v1.4	O
on	O
May	O
6	O
,	O
2020	O
.	O

The	O
latest	O
version	O
is	O
analyzed	O
here	O
;	O
we	O
weren	O
’	O
t	O
able	O
to	O
determine	O
if	O
the	O
earlier	O
versions	O
were	O
also	O
malicious	O
.	O

According	O
to	O
its	O
profile	O
at	O
Google	B-System
Play	I-System
(	O
see	O
Figure	O
2	O
)	O
the	O
app	O
reached	O
a	O
mere	O
10+	O
downloads	O
.	O

We	O
reported	O
it	O
to	O
Google	B-Organization
on	O
May	O
16	O
,	O
2020	O
and	O
since	O
May	O
19	O
,	O
2020	O
the	O
app	O
has	O
no	O
longer	O
been	O
available	O
on	O
Google	B-System
Play	I-System
.	O

The	O
developer	O
name	O
used	O
,	O
GAS	O
Brazil	O
,	O
suggests	O
the	O
criminals	O
behind	O
the	O
app	O
targeted	O
Brazilian	O
users	O
.	O

Apart	O
from	O
including	O
the	O
country	O
’	O
s	O
name	O
,	O
the	O
app	O
’	O
s	O
name	O
is	O
probably	O
intended	O
to	O
imply	O
a	O
relationship	O
with	O
the	O
antifraud	O
solution	O
named	O
GAS	B-System
Tecnologia	I-System
.	O

That	O
security	O
software	O
is	O
commonly	O
installed	O
on	O
computers	O
in	O
Brazil	O
as	O
several	O
banks	O
require	O
it	O
to	O
log	O
into	O
their	O
online	O
banking	O
.	O

However	O
,	O
there	O
is	O
also	O
an	O
English	O
version	O
of	O
the	O
DEFENSOR	B-Malware
ID	I-Malware
app	O
(	O
see	O
Figure	O
3	O
)	O
besides	O
the	O
Portuguese	O
one	O
,	O
and	O
that	O
app	O
has	O
neither	O
geographical	O
nor	O
language	O
restrictions	O
.	O

Playing	O
further	O
off	O
the	O
suggested	O
GAS	B-System
Tecnologia	I-System
link	O
,	O
the	O
app	O
promises	O
better	O
security	O
for	O
its	O
users	O
.	O

The	O
description	O
in	O
Portuguese	O
promises	O
more	O
protection	O
for	O
the	O
user	O
’	O
s	O
applications	O
,	O
including	O
end-to-end	O
encryption	O
.	O

Deceptively	O
,	O
the	O
app	O
was	O
listed	O
in	O
the	O
Education	O
section	O
.	O

Functionality	O
After	O
starting	O
,	O
DEFENSOR	B-Malware
ID	I-Malware
requests	O
the	O
following	O
permissions	O
:	O
allow	O
modify	O
system	O
settings	O
permit	O
drawing	O
over	O
other	O
apps	O
,	O
and	O
activate	O
accessibility	O
services	O
.	O

If	O
an	O
unsuspecting	O
user	O
grants	O
these	O
permissions	O
(	O
see	O
Figure	O
4	O
)	O
,	O
the	O
trojan	O
can	O
read	O
any	O
text	O
displayed	O
in	O
any	O
app	O
the	O
user	O
may	O
launch	O
–	O
and	O
send	O
it	O
to	O
the	O
attackers	O
.	O

This	O
means	O
the	O
attackers	O
can	O
steal	O
the	O
victim	O
’	O
s	O
credentials	O
for	O
logging	O
into	O
apps	O
,	O
SMS	O
and	O
email	O
messages	O
,	O
displayed	O
cryptocurrency	O
private	O
keys	O
,	O
and	O
even	O
software-generated	O
2FA	O
codes	O
.	O

The	O
fact	O
the	O
trojan	O
can	O
steal	O
both	O
the	O
victim	O
’	O
s	O
credentials	O
and	O
also	O
can	O
control	O
their	O
SMS	O
messages	O
and	O
generated	O
2FA	O
codes	O
means	O
DEFENSOR	B-Malware
ID	I-Malware
’	O
s	O
operators	O
can	O
bypass	O
two-factor	O
authentication	O
.	O

This	O
opens	O
the	O
door	O
to	O
,	O
for	O
example	O
,	O
fully	O
controlling	O
the	O
victim	O
’	O
s	O
bank	O
account	O
.	O

To	O
make	O
sure	O
the	O
trojan	O
survives	O
a	O
device	O
restart	O
,	O
it	O
abuses	O
already	O
activated	O
accessibility	O
services	O
that	O
will	O
launch	O
the	O
trojan	O
right	O
after	O
start	O
.	O

Our	O
analysis	O
shows	O
the	O
DEFENSOR	B-Malware
ID	I-Malware
trojan	O
can	O
execute	O
17	O
commands	O
received	O
from	O
the	O
attacker-controlled	O
server	O
such	O
as	O
uninstalling	O
an	O
app	O
,	O
launching	O
an	O
app	O
and	O
then	O
performing	O
any	O
click/tap	O
action	O
controlled	O
remotely	O
by	O
the	O
attacker	O
(	O
see	O
Figure	O
5	O
)	O
.	O

In	O
2018	O
,	O
we	O
saw	O
similar	O
behavior	O
,	O
but	O
all	O
the	O
click	O
actions	O
were	O
hardcoded	O
and	O
suited	O
only	O
for	O
the	O
app	O
of	O
the	O
attacker	O
’	O
s	O
choice	O
.	O

In	O
this	O
case	O
,	O
the	O
attacker	O
can	O
get	O
the	O
list	O
of	O
all	O
installed	O
apps	O
and	O
then	O
remotely	O
launch	O
the	O
victim	O
’	O
s	O
app	O
of	O
their	O
choice	O
to	O
either	O
steal	O
credentials	O
or	O
perform	O
malicious	O
actions	O
(	O
e.g	O
.	O

send	O
funds	O
via	O
a	O
wire	O
transfer	O
)	O
.	O

We	O
believe	O
that	O
this	O
is	O
the	O
reason	O
the	O
DEFENSOR	B-Malware
ID	I-Malware
trojan	O
requests	O
the	O
user	O
to	O
allow	O
“	O
Modify	O
system	O
settings	O
”	O
.	O

Subsequently	O
,	O
the	O
malware	O
will	O
change	O
the	O
screen	O
off	O
time-out	O
to	O
10	O
minutes	O
.	O

This	O
means	O
that	O
,	O
unless	O
victims	O
lock	O
their	O
devices	O
via	O
the	O
hardware	O
button	O
,	O
the	O
timer	O
provides	O
plenty	O
of	O
time	O
for	O
the	O
malware	O
to	O
remotely	O
perform	O
malicious	O
,	O
in-app	O
operations	O
.	O

If	O
the	O
device	O
gets	O
locked	O
,	O
the	O
malware	O
can	O
’	O
t	O
unlock	O
it	O
.	O

Malware	O
data	O
leak	O
When	O
we	O
analyzed	O
the	O
sample	O
,	O
we	O
realized	O
that	O
the	O
malware	O
operators	O
left	O
the	O
remote	O
database	O
with	O
some	O
of	O
the	O
victims	O
’	O
data	O
freely	O
accessible	O
,	O
without	O
any	O
authentication	O
.	O

The	O
database	O
contained	O
the	O
last	O
activity	O
performed	O
on	O
around	O
60	O
compromised	O
devices	O
.	O

We	O
found	O
no	O
other	O
information	O
stolen	O
from	O
the	O
victims	O
to	O
be	O
accessible	O
.	O

Thanks	O
to	O
this	O
data	O
leak	O
,	O
we	O
were	O
able	O
to	O
confirm	O
that	O
the	O
malware	O
really	O
worked	O
as	O
designed	O
:	O
the	O
attacker	O
had	O
access	O
to	O
the	O
victims	O
’	O
entered	O
credentials	O
,	O
displayed	O
or	O
written	O
emails	O
and	O
messages	O
,	O
etc	O
.	O

Once	O
we	O
reached	O
the	O
non-secured	O
database	O
,	O
we	O
were	O
able	O
to	O
directly	O
observe	O
the	O
app	O
’	O
s	O
malicious	O
behavior	O
.	O

To	O
illustrate	O
the	O
level	O
of	O
threat	O
the	O
DEFENSOR	B-Malware
ID	I-Malware
app	O
posed	O
,	O
we	O
performed	O
three	O
tests	O
.	O

First	O
,	O
we	O
launched	O
a	O
banking	O
app	O
and	O
entered	O
the	O
credentials	O
there	O
.	O

The	O
credentials	O
were	O
immediately	O
available	O
in	O
the	O
leaky	O
database	O
–	O
see	O
Figure	O
6	O
.	O

Figure	O
6	O
.	O

The	O
banking	O
app	O
test	O
:	O
the	O
credentials	O
as	O
entered	O
(	O
left	O
)	O
and	O
as	O
available	O
in	O
the	O
database	O
(	O
right	O
)	O
Second	O
,	O
we	O
wrote	O
a	O
test	O
message	O
in	O
an	O
email	O
client	O
.	O

We	O
saw	O
the	O
message	O
uploaded	O
to	O
the	O
attackers	O
’	O
server	O
within	O
a	O
second	O
–	O
see	O
Figure	O
7	O
.	O

Figure	O
7	O
.	O

The	O
email	O
message	O
test	O
:	O
the	O
message	O
as	O
written	O
(	O
left	O
)	O
and	O
as	O
available	O
in	O
the	O
database	O
(	O
right	O
)	O
Third	O
,	O
we	O
documented	O
the	O
trojan	O
retrieving	O
the	O
Google	B-System
Authenticator	I-System
2FA	O
code	O
.	O

Figure	O
8	O
.	O

The	O
software	O
generated	O
2FA	O
code	O
as	O
it	O
appeared	O
on	O
the	O
device	O
’	O
s	O
display	O
(	O
left	O
)	O
and	O
as	O
available	O
in	O
the	O
database	O
(	O
right	O
)	O
Along	O
with	O
the	O
malicious	O
DEFENSOR	O
ID	O
app	O
,	O
another	O
malicious	O
app	O
named	O
Defensor	B-Malware
Digital	I-Malware
was	O
discovered	O
.	O

Both	O
apps	O
shared	O
the	O
same	O
C	O
&	O
C	O
server	O
,	O
but	O
we	O
couldn	O
’	O
t	O
investigate	O
the	O
latter	O
as	O
it	O
had	O
already	O
been	O
removed	O
from	O
the	O
Google	B-System
Play	I-System
store	I-System
.	O

Indicators	O
of	O
Compromise	O
(	O
IoCs	O
)	O
Package	O
Name	O
Hash	O
ESET	B-Organization
detection	O
name	O
com.secure.protect.world	B-Indicator
F17AEBC741957AA21CFE7C7D7BAEC0900E863F61	B-Indicator
Android/Spy.BanBra.A	B-Indicator
com.brazil.android.free	B-Indicator
EA069A5C96DC1DB0715923EB68192FD325F3D3CE	B-Indicator
Android/Spy.BanBra.A	B-Indicator
MITRE	B-Organization
ATT	O
&	O
CK	O
techniques	O
Tactic	O
ID	O
Name	O
Description	O
Initial	O
Access	O
T1475	O
Deliver	O
Malicious	O
App	O

via	O
Authorized	O
App	B-System
Store	I-System
Impersonates	O
security	O
app	O
on	O
Google	B-System
Play	I-System
.	O

T1444	O
Masquerade	O
as	O
Legitimate	O
Application	O
Impersonates	O
legitimate	O
GAS	B-System
Tecnologia	I-System
application	O
.	O

Discovery	O
T1418	O
Application	O
Discovery	O
Sends	O
list	O
of	O
installed	O
apps	O
on	O
device	O
.	O

Impact	O
T1516	O
Input	O
Injection	O
Can	O
enter	O
text	O
and	O
perform	O
clicks	O
on	O
behalf	O
of	O
user	O
.	O

Collection	O
T1417	O
Input	O
Capture	O
Records	O
user	O
input	O
data	O
.	O

Command	O
and	O
Control	O
T1437	O
Standard	O
Application	O
Layer	O
Protocol	O
Uses	O
Firebase	O
Cloud	O
Messaging	O
for	O
C	O
&	O
C	O
.	O