This lead us to estimate there to be over 2.8 billion infections in total , on around 25 Million unique devices , meaning that on average , each victim would have suffered roughly 112 swaps of innocent applications .


As an initial attack vector , “ Agent Smith ” abuses the 9Apps market – with over 360 different dropper variants .


To maximize profit , variants with “ MinSDK ” or “ OTA ” SDK are present to further infect victims with other adware families .


The majority of droppers in 9Apps are games , while the rest fall into categories of adult entertainment , media player , photo utilities , and system utilities .


Figure 20 : dropper app category distribution Among the vast number of variants , the top 5 most infectious droppers alone have been downloaded more than 7.8 million times of the infection operations against innocent applications : Figure 21 : Top 5 most infectious droppers The “ Agent Smith ” campaign is primarily targeted at Indian users , who represent 59 % of the impacted population .


Unlike previously seen non-GP ( Google Play ) centric malware campaigns , “ Agent Smith ” has a significant impact upon not only developing countries but also some developed countries where GP is readily available .


Figure 22 : world infection heat map Considering that India is by far the most infected county by “ Agent Smith ” , overall compromised device brand distribution is heavily influenced by brand popularity among Indian Android users : Figure 23 : infected brand distribution While most infections occurred on devices running Android 5 and 6 , we also see a considerable number of successful attacks against newer Android versions .


AOSP patched the Janus vulnerability since version 7 by introducing APK Signature Scheme V2 .


However , in order to block Janus abuse , app developers need to sign their apps with the new scheme so that Android framework security component could conduct integrity checks with enhanced features .


Figure 25 : infected Android version distribution To further analyze “ Agent Smith ” ’ s infection landscape , we dived into the top 10 infected countries : Country Total Devices Total Infection Event Count Avg .


App Swap Per Device Avg .


Months Device Remained Infected India 15,230,123 2,017,873,249 2.6 1.7 2.1 Bangladesh 2,539,913 208,026,886 2.4 1.5 2.2 Pakistan 1,686,216 94,296,907 2.4 1.6 2 Indonesia 572,025 67,685,983 2 1.5 2.2 Nepal 469,274 44,961,341 2.4 1.6 2.4 US 302,852 19,327,093 1.7 1.4 1.8 Nigeria 287,167 21,278,498 2.4 1.3 2.3 Hungary 282,826 7,856,064 1.7 1.3 1.7 Saudi Arabia 245,698 18,616,259 2.3


1.6 1.9 Myanmar 234,338 9,729,572 1.5 1.4 1.9 “ Agent Smith ” Timeline Early signs of activity from the actor behind “ Agent Smith ” can be traced back to January 2016 .


We classify this 40-month period into three main stages .


During this period , malware samples display some typical adware characteristics such as unnecessary permission requirements and pop-up windows .


However , samples don ’ t have key capabilities to infect innocent apps on victim devices yet .


May 2018 to April 2019 : This is the actual mature stage of “ Agent Smith ” campaign .


From early 2018 prior to May , “ Agent Smith ” hackers started to experiment with Bundle Feng Shui , the key tool which gives “ Agent Smith ” malware family capabilities to infect innocent apps on the device .


A series of pilot runs were executed .


Its dropper family finished integration with Bundle Feng Shui and campaign C & C infrastructure was shifted to AWS cloud .


Post-April 2019 : Starting from early 2019 , the new infection rate of “ Agent Smith ” dropped significantly .


From early April , hackers started to build a new major update to the “ Agent Smith ” campaign under the name “ leechsdk ” .


The actor also built solid backend infrastructures which can handle high volume concurrent requests .


During our extended threat hunting , we uncovered 11 apps on the Google Play store that contain a malicious yet dormant SDK related to “ Agent Smith ” actor .


Instead of embedding core malware payload in droppers , the actor switches to a more low-key SDK approach .


Hence , we name this new spin-off campaign as Jaguar Kill Switch .


The below code snippet is currently isolated and dormant .


In the future , it will be invoked by malicious SDK during banner ads display .


Check Point Research reported these dangerous apps to Google upon discovery .


Interestingly , we uncovered several expired job posting of Android reverse engineer from the actor ’ s front business published in 2018 and 2019 .


It seems that the people who filled these roles are key to “ Agent Smith ’ s success , yet not quite necessary for actor ’ s legitimate side of business .


With a better understanding of the “ Agent Smith ” actor than we had in the initial phase of campaign hunting , we examined the list of target innocent apps once again and discovered the actor ’ s unusual practices in choosing targets .


It seems , “ Agent Smith ” prey list does not only have popular yet Janus vulnerable apps to ensure high proliferation , but also contain competitor apps of actor ’ s legitimate business arm to suppress competition .


Conclusion Although the actor behind “ Agent Smith ” decided to make their illegally acquired profit by exploiting the use of ads , another actor could easily take a more intrusive and harmful route .


With the ability to hide its icon from the launcher and hijack popular existing apps on a device , there are endless possibilities to harm a user ’ s digital even physical security .


Today this malware shows unwanted ads , tomorrow it could steal sensitive information ; from private messages to banking credentials and much more .


It requires attention and action from system developers , device manufacturers , app developers , and users , so that vulnerability fixes are patched , distributed , adopted and installed in time .


Dvmap : the first Android malware with code injection 08 JUN 2017 In April 2017 we started observing new rooting malware being distributed through the Google Play Store .


Kaspersky Lab products detect it as Trojan.AndroidOS.Dvmap.a .


The distribution of rooting malware through Google Play is not a new thing .


For example , the Ztorg Trojan has been uploaded to Google Play almost 100 times since September 2016 .


But Dvmap is very special rooting malware .


It uses a variety of new techniques , but the most interesting thing is that it injects malicious code into the system libraries – libdmv.so or libandroid_runtime.so .


This makes Dvmap the first Android malware that injects malicious code into the system libraries in runtime , and it has been downloaded from the Google Play Store more than 50,000 times .


Kaspersky Lab reported the Trojan to Google , and it has now been removed from the store .


To bypass Google Play Store security checks , the malware creators used a very interesting method : they uploaded a clean app to the store at the end of March , 2017 , and would then update it with a malicious version for short period of time .


Usually they would upload a clean version back on Google Play the very same day .


All the malicious Dvmap apps had the same functionality .


They decrypt several archive files from the assets folder of the installation package , and launch an executable file from them with the name “ start. ” The interesting thing is that the Trojan supports even the 64-bit version of Android , which is very rare .


All encrypted archives can be divided into two groups : the first comprises Game321.res , Game322.res , Game323.res and Game642.res – and these are used in the initial phase of infection , while the second group : Game324.res and Game644.res , are used in the main phase .


All archives from this phase contain the same files except for one called “ common ” .


This is a local root exploit pack , and the Trojan uses 4 different exploit pack files , 3 for 32-bit systems and 1 for 64-bit-systems .


If these files successfully gain root rights , the Trojan will install several tools into the system .


It will check the version of Android installed and decide which library should be patched .


For Android 4.4.4 and older , the Trojan will patch method _Z30dvmHeapSourceStartupBeforeForkv from libdvm.so , and for Android 5 and newer it will patch method nativeForkAndSpecialize from libandroid_runtime.so .


Both of these libraries are runtime libraries related to Dalvik and ART runtime environments .


Before patching , the Trojan will backup the original library with a name bak_ { original name } .


During patching , the Trojan will overwrite the existing code with malicious code so that all it can do is execute /system/bin/ip .


This could be very dangerous and cause some devices to crash following the overwrite .


Then the Trojan will put the patched library back into the system directory .


This means that all apps that were using this file will lose some functionality or even start crashing .


Malicious module “ ip ” This file will be executed by the patched system library .


It can turn off “ VerifyApps ” and enable the installation of apps from 3rd party stores by changing system settings .


It is a very unusual way to get Device Administrator rights .


Malicious app com.qualcmm.timeservices As I mentioned before , in the “ initial phase ” , the Trojan will install the “ com.qualcmm.timeservices ” app .


Its main purpose is to download archives and execute the “ start ” binary from them .


During the investigation , this app was able to successfully connect to the command and control server , but it received no commands .


Conclusions This Trojan was distributed through the Google Play Store and uses a number of very dangerous techniques , including patching system libraries .


It installs malicious modules with different functionality into the system .


It looks like its main purpose is to get into the system and execute downloaded files with root rights .


But I never received such files from their command and control server .


These malicious modules report to the attackers about every step they are going to make .


So I think that the authors are still testing this malware , because they use some techniques which can break the infected devices .


I hope that by uncovering this malware at such an early stage , we will be able to prevent a massive and dangerous attack when the attackers are ready to actively use their methods .


MD5 43680D1914F28E14C90436E1D42984E2 20D4B9EB9377C499917C4D69BF4CCEBE First widely distributed Android bootkit Malware infects more than 350,000 Devices January 29 , 2014 In the last quarter of 2013 , sale of a Smartphone with ANDROID operating system has increased and every second person you see is a DROID user .


A Russian security firm 'Doctor Web ' identified the first mass distributed Android bootkit malware called 'Android.Oldboot ' , a piece of malware that 's designed to re-infect devices after reboot , even if you delete all working components of it .


The bootkit Android.Oldboot has infected more than 350,000 android users in China , Spain , Italy , Germany , Russia , Brazil , the USA and some Southeast Asian countries .


China seems to a mass victim of this kind of malware having a 92 % share .


A Bootkit is a rootkit malware variant which infects the device at start-up and may encrypt disk or steal data , remove the application , open connection for Command and controller .


A very unique technique is being used to inject this Trojan into an Android system where an attacker places a component of it into the boot partition of the file system and modify the 'init ' script ( initialize the operating system ) to re-load the malware as you switch on your android .


When you start your device , this script loads the Trojan 'imei_chk ' ( detects it as Android.Oldboot.1 ) which extract two files libgooglekernel.so ( Android.Oldboot.2 ) and GoogleKernel.apk ( Android.Oldboot.1.origin ) , copy them respectively in /system/lib and /system/app .


Android.Oldboot acts as a system service and connects to the command-and-controller server using libgooglekernel.so library and receives commands to download , remove installed apps , and install malicious apps .


Since it becomes a part of the boot partition , formatting the device will not solve the problem .


So , users should beware of certain modified Android firmware .


" Due to the special RAM disk feature of Android devices ' boot partition , all current mobile antivirus products in the world ca n't completely remove this Trojan or effectively repair the system .


The Android malware Android.Oldboot is almost impossible to remove , not even with formatting your device .


But if your device is not from a Chinese manufacturer , then chances that you are a victim of it , are very less .


This bootkit is not the first of this kind .


But Android.Oldboot malware is a bit more dangerous because even if you remove all working components of it from your android successfully , the component imei_chk will persist in a protected boot memory area and hence will reinstall itself on next boot and continuously infect the Smartphone .


Users are recommended to install apps from authorized stores such as Google Play , disable installation of apps from 'Unknown Sources ' and for a better security install a reputed security application .


You can also try to re-flash your device with its original ROM .


After flashing , the bootkit will be removed .


FrozenCell : Multi-Platform Surveillance Campaign Against Palestinians October 5 , 2017 FrozenCell has been seen masquerading as various well known social media and chat applications as well as an app likely only used by Palestinian or Jordanian students sitting their 2016 general exams .


Lookout researchers have discovered a new mobile surveillanceware family , FrozenCell .


FrozenCell is the mobile component of a multi-platform attack we 've seen a threat actor known as " Two-tailed Scorpion/APT-C-23 , '' use to spy on victims through compromised mobile devices and desktops .


The desktop components of this attack , previously discovered by Palo Alto Network , are known as KasperAgent and Micropsia .


More data is appearing daily , leading us to believe the actors are still highly active .


We are continuing to watch it closely .


Government agencies and enterprises should look at this threat as an example of the kind of spying that is now possible given how ubiquitous mobile devices are in the workplace .


What it does FrozenCell masquerades as fake updates to chat applications like Facebook , WhatsApp , Messenger , LINE , and LoveChat .


Once installed on a device FrozenCell is capable of : Recording calls Retrieving generic phone metadata ( e.g. , cell location , mobile country code , mobile network code ) Geolocating a device Extracting SMS messages Retrieving a victim 's accounts Exfiltrating images Downloading and installing additional applications Searching for and exfiltrating pdf , doc , docx , ppt , pptx , xls , and xlsx file types Retrieving contacts The graph below represents a split of the types of data


from only one misconfigured command and control server ( out of over 37 servers ) .


Split of exfiltrated data Some noteworthy files identified in content taken from compromised devices include passport photos , audio recordings of calls , other images , and a PDF document with data on 484 individuals .


The PDF lists dates of birth , gender , passport numbers , and names .


Potential targets The actors behind FrozenCell used an online service that geolocates mobile devices based on nearby cell towers to track targets .


This data shows a distinct concentration of infected devices beaconing from Gaza , Palestine .


It has not been confirmed whether these are from test devices or the devices of victims .


We were also able to link the FrozenCell 's Android infrastructure to numerous desktop samples that are part of the larger multi-platform attack .


It appears the attackers sent malicious executables though phishing campaigns impersonating individuals associated with the Palestinian Security Services , the General Directorate of Civil Defence - Ministry of the Interior , and the 7th Fateh Conference of the Palestinian National Liberation Front ( held in late 2016 ) .


Some malicious files associated with these samples were titled the following : Council_of_ministres_decision Minutes of the Geneva Meeting on Troops Summary of today 's meetings.doc.exe The most important points of meeting the memory of the late President Abu Omar may Allah have mercy on him - Paper No .


1 Fadi Alsalamin scandal with an Israeli officer - exclusive - watched before the deletion - Fadi Elsalameen The details of the assassination of President Arafat_06-12-2016_docx Quds.rar Many of these executables are associated with various short links created using Bit.ly , a URL shortening service .


Infrastructure At the time of writing the following domains have either been used by this family or are currently active .


We expect this list to grow given that this actor has changed its infrastructure numerous times in 2017 .


] orgmary-crawley [ .


] comrose-sturat [ .


] xyzdebra-morgan [ .


] infoacount-manager [ .


] infogooogel-drive [ .


] commediauploader [ .


] comgo-mail-accounts [ .


] netsybil-parks [ .


] infodavos-seaworth [ .


] orgacount-manager [ .


] comlila-tournai [ .


] comaccount-manager [ .


] orgmediauploader [ .


] infomavis-dracula [ .


] infogoogle-support-team [ .


] comuseraccount [ .


] comfeteh-asefa [ .


] comlagertha-lothbrok [ .


This mistake in operational security allowed us to gain visibility into exfiltrated content for a number of devices .


Continued mirroring suggests it is likely a regularly cleaned staging server .


We sourced the over 561MB of exfiltrated data from this domain alone , all of which we found to be 7z compressed and password protected .


Password generation for compressed files takes place client-side with each device using a unique key in most scenarios .


Visually , this can be represented as follows : Android ID When combined with our analysis of indexed directories on C2 infrastructure , we were able to easily automate the generation of the password used by each device and , in turn , successfully decompress all exfiltrated content from compromised devices .


FrozenCell is part of a very successful , multi-platform surveillance campaign .


Attackers are growing smarter , targeting individuals through the devices and the services they use most .


TUESDAY , MAY 19 , 2020 The wolf is back ... NEWS SUMMARY Thai Android devices and users are being targeted by a modified version of DenDroid we are calling " WolfRAT , '' now targeting messaging apps like WhatsApp , Facebook Messenger and Line .


We assess with high confidence that this modified version is operated by the infamous Wolf Research .


This actor has shown a surprising level of amateur actions , including code overlaps , open-source project copy/paste , classes never being instanced , unstable packages and unsecured panels .


EXECUTIVE SUMMARY Cisco Talos has discovered a new Android malware based on a leak of the DenDroid malware family .


We named this malware " WolfRAT '' due to strong links between this malware ( and the command and control ( C2 ) infrastructure ) and Wolf Research , an infamous organization that developed interception and espionage-based malware and was publicly described by CSIS during Virus Bulletin 2018 .


Some of the C2 servers are located in Thailand .


The panels also contain Thai JavaScript comments and the domain names also contain references to Thai food , a tactic commonly employed to entice users to click/visit these C2 panels without much disruption .


We identified a notable lack of sophistication in this investigation such as copy/paste , unstable code , dead code and panels that are freely open .


WolfRAT is based on a previously leaked malware named DenDroid .


The new malware appears to be linked to the infamous Wolf Research organization and targets Android devices located in Thailand .


The malware mimics legit services such as Google service , GooglePlay or Flash update .


The malware is not really advanced and is based on a lot of copy/paste from public sources available on the Internet .


The C2 infrastructure contains a lack of sophistication such as open panels , reuse of old servers publicly tagged as malicious… So what ?


After being publicly denounced by CSIS Group — a threat intelligence company in Denmark — Wolf Research was closed and a new organization named LokD was created .


This new organization seems to work on securing Android devices .


However , thanks to the infrastructure sharing and forgotten panel names , we assess with high confidence that this actor is still active , it is still developing malware and has been using it from mid-June to today .


On the C2 panel , we found a potential link between Wolf Research and another Cyprus organization named Coralco Tech .


This organization is also working on interception technology .


LINKS TO WOLF INTELLIGENCE During the Virus Bulletin conference in 2018 , CSIS researchers Benoît Ancel and Aleksejs Kuprins did a presentation on Wolf Research and the offensive arsenal developed by the organization .


They mentioned an Android , iOS and Windows remote access tool ( RAT ) .


Their findings showed that Wolf is headquartered in Germany with offices in Cyprus , Bulgaria , Romania , India and ( possibly ) the U.S .


However , the director created a new organization in Cyprus named LokD .


Based on infrastructure overlaps and leaked information , we assess with high confidence that the malware we identified and present in this paper is linked to Wolf Research .


One of the samples ( e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 ) uses the C2 server svcws [ .


The new one with the title " Coralco Archimedes , '' and an older version with the title " Wolf Intelligence : '' New panel Old panel The new panel name contains " Coralco '' in its name .


Coralco Tech is an organization located in Cyprus and providing interception tools .


We can not say for sure if Wolf Research and Coralco Tech are linked , but this panel name , their offerings and the panel layout would suggest it should be considered suspiciously linked .


Coralco Tech 's services description .


VICTIMOLOGY ON THE IDENTIFIED CAMPAIGNS The campaigns we analyzed targeted Android devices in Thailand .


The C2 server domain is linked to Thai food : Nampriknum [ .


] net : Nam Phrik Num Somtum [ .


] today : Som Tum We also identified comments in Thai on the C2 infrastructure mentioned in the previous chapter : MALWARE DenDroid The Android malware is based on the DenDroid Android malware .


Several analysis reports were published on this malware in 2014 and , finally , the source code was leaked in 2015 .


The original leak is no longer available on github.com , but a copy can be found here .


The table below shows the commands available to the operator for tasking on infected devices .


This malware is simplistic in comparison to some modern-day Android malware .


The commands are self-explanatory and show the features included in the malware .


Some of them like takephoto , takevideo , recordaudio , getsentsms and uploadpictures are focused on espionage activities .


Others like transferbot , promptupdate and promptuninstall are meant to help the operator manage the malware .


Version # 1 : June 2019 — Domain : databit [ .


] today During our investigation , we identified at least four major releases of the RAT .


The code is obfuscated but not packed .


This malware also contains a screen recorder .


During our analysis of this sample , we did notice that the class itself is never called or used by the malware .


It remains available within the source code but no method of use takes place .


Version # 2 : June - Aug. 2019 — Domain : somtum [ .


] today This is the first version that shows the code organization evolution that will continue to be used on all other functions throughout this malware .


One of the first changes that stands out is that the screen recording feature mentioned in the previous sample has been removed .


This class is based on public code belonging to the package praeda.muzikmekan , which can be found here among other places .


Just like in previous examples , the malware author does not use this package .


Missing permissions The lack of the READ_FRAME_BUFFER permission can be justified by the removal of the screen record feature .


The ACCESS_SUPERUSER may have been removed because it was deprecated upon the release of Android 5.0 Lollipop which happened in 2014 .


Version # 3 : Sept. - Dec. 2019 — Domain : ponethus [ .


] com Given that there is some overlap in the previous two versions , it came as no surprise to us that we finally identified a sample which is an evolution based on both previous versions .


This sample is clearly a mix between the two .


However , this time , the permission is actually used .


WhatsApp message capture The service com.serenegiant.service.ScreenRecorderService , is invoked by the ScreenRecorderActivity .


Upon creation , this activity launches a thread that will loop on a 50-second interval .


In the first iteration , the screen recording is started and will only stop when the RAT determines that WhatsApp is not running .


It 's restarted in the next cycle independently based on if WhatsApp is running .


Even though we could not find indications of being in use , two stand out .


Bluetooth — which allows the interaction with the Bluetooth interface , and net/deacon — which implements a beaconing system based on UDP .


Again , this package source code is publicly available and can be found here .


One of the uses the malware gives to this package is the execution of the command " dumpsys '' to determine if certain activities are running .


Check if chat apps are running In the above example , the malware is searching for Line , Facebook Messenger and WhatsApp activities .


This is part of a class called CaptureService , which already existed in the previous version but it was not duly implemented .


Previous version The capture service class implements the chat applications interception .


Another novelty is a VPN-related package , which is based on OrbotVPN .


Once again , it does n't seem to actually be in use .


The same happens with the package squareup.otto , which is an open-source bus implementation focused on Android implementation .


Both sources can be found here and here .


Version # 4 : April 2020 — Domain : nampriknum.net Following the same pattern , this version has some added features and others , which were not in use , removed .


First of all the new package name is com.google.services , which can easily be confused with a legitimate Google service .


The VPN package is no longer present , further reinforcing our conclusion that it was not in use .


WolfRAT application screen The Google GMS and Firebase service has been added , however , no configuration has been found , even though services seem to be referenced in the of a new class .


This would allow the RAT to receive system notifications .


Notification handling method The class is only implemented in debug mode , pushing all captured information into the log .


This service , along with the API , was fully decommissioned in March 2019 .


This version adds one significant class — it requests DEVICE_ADMIN privileges .


Device admin policies Looking at the policy 's definition , we can see that it lists all the available policies even if most of them are deprecated on Android 10.0 and their usage results in a security exception .


The code implementation again seems that it has been added for testing purposes only .


Versions overview The DenDroid code base was kept to such an extent that even the original base64-encoded password was kept .


Original password The main service follows the same structure as the first version , the anti-analysis features are primitive , only checking the emulator environment without any kind of packing or obfuscation .


The malware will start the main service if all the requested permissions and the device admin privileges are granted .


Otherwise , it will launch an ACTION_APPLICATION_SETTINGS intent trying to trick the user to grant the permissions .


It seems , however , if the same victim has more than one device the malware can be reused since the IMEI is sent along with each data exfiltration .


CONCLUSION We witness actors continually using open-source platforms , code and packages to create their own software .


Some are carried out well , others , like WolfRAT , are designed with an overload of functionality in mind as opposed to factoring any sensible approach to the development aspect .


throughout the Android package .


This can be packaged and " sold '' in many different ways to customers .


A " Tracking tool '' or an " Admin tool '' are often cited for these kinds of tools for " commercial '' or " enterprise '' usage .


Wolf Research claimed to shut down their operations but we clearly see that their previous work continues under another guise .


The ability to carry out these types of intelligence-gathering activities on phones represents a huge score for the operator .


The chat details , WhatsApp records , messengers and SMSs of the world carry some sensitive information which people often forget when communicating with their devices .


We see WolfRAT specifically targeting a highly popular encrypted chat app in Asia , Line , which suggests that even a careful user with some awareness around end-to-end encryption chats would still be at the mercy of WolfRAT and it 's prying eyes .


IOCS Hashes 139edb1bc033725539b117f50786f3d3362ed45845c57fe1f82e7ed72b044367 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e5f346d8f312cc1f93c2c6af611e2f50805c528934786ea173cabc6a39b14cda


ac5abaebd9f516b8b389450f7d27649801d746fb14963b848f9d6dad0a505e66 3a45d7a16937d4108b5b48f44d72bb319be645cbe15f003dc9e77fd52f45c065 Domains cvcws [ .


] com nampriknum [ .


] today admin [ .databit [ .today cendata [ .


'' in a variety of ways , such as static analysis , dynamic analysis , and machine learning .


While our systems are great at automatically detecting and protecting against PHAs , we believe the best security comes from the combination of automated scanning and skilled human review .


Zen uses root permissions on a device to automatically enable a service that creates fake Google accounts .


Zen apps gain access to root permissions from a rooting trojan in its infection chain .


In this blog post , we do not differentiate between the rooting component and the component that abuses root : we refer to them interchangeably as Zen .


PHA authors usually try to hide their tracks , so attribution is difficult .


Sometimes , we can attribute different apps to the same author based on a small , unique pieces of evidence that suggest similarity , such as a repetition of an exceptionally rare code snippet , asset , or a particular string in the debug logs .


Every once in a while , authors leave behind a trace that allows us to attribute not only similar apps , but also multiple different PHA families to the same group or person .


Dynamic code loading makes it impossible to state what kind of PHA it was .


This sample displayed ads from various sources .


More recent variants blend rooting capabilities and click fraud .


This post does n't follow the chronological evolution of Zen , but instead covers relevant samples from least to most complex .


By proxying all requests through a custom server , the real source of ads is opaque .


This example shows one possible implementation of this technique .


This approach allows the authors to combine ads from third-party advertising networks with ads they created for their own apps .


It may even allow them to sell ad space directly to application developers .


Selling the ad traffic directly or displaying ads from other sources in a very large volume can provide direct profit to the app author from the advertisers .


The first are games of very low quality that mimic the experience of popular mobile games .


Instead of implementing very basic gameplay , the authors pirated and repackaged the original game in their app and bundled with it their advertisement SDK .


In all cases , the ads are used to convince users to install other apps from different developer accounts , but written by the same group .


Click fraud apps The authors ' tactics evolved from advertisement spam to real PHA ( Click Fraud ) .


Click fraud PHAs simulate user clicks on ads instead of simply displaying ads and waiting for users to click them .


This behavior negatively impacts advertisement networks and their clients because advertising budget is spent without acquiring real customers , and impacts user experience by consuming their data plan resources .


The click fraud PHA requests a URL to the advertising network directly instead of proxying it through an additional SDK .


The command & control server ( C & C server ) returns the URL to click along with a very long list of additional parameters in JSON format .


After rendering the ad on the screen , the app tries to identify the part of the advertisement website to click .


If that part is found , the app loads Javascript snippets from the JSON parameters to click a button or other HTML element , simulating a real user click .


Because a user interacting with an ad often leads to a higher chance of the user purchasing something , ad networks often " pay per click '' to developers who host their ads .


Therefore , by simulating fraudulent clicks , these developers are making money without requiring a user to click on an advertisement .


It has been shortened for brevity .


Using a publicly available rooting framework , the PHA attempts to root devices and gain persistence on them by reinstalling itself on the system partition of rooted device .


Installing apps on the system partition makes it harder for the user to remove the app .


This technique only works for unpatched devices running Android 4.3 or lower .


Devices running Android 4.4 and higher are protected by Verified Boot .


Zen 's rooting trojan apps target a specific device model with a very specific system image .


Replicating framework.jar allows the app to intercept and modify the behavior of the Android standard API .


In particular , these apps try to add an additional method called statistics ( ) into the Activity class .


The only purpose of this method is to connect to the C & C server .


The Zen trojan After achieving persistence , the trojan downloads additional payloads , including another trojan called Zen .


Zen requires root to work correctly on the Android operating system .


The Zen trojan uses its root privileges to turn on accessibility service ( a service used to allow Android users with disabilities to use their devices ) for itself by writing to a system-wide setting value enabled_accessibility_services .


The trojan implements three accessibility services directed at different Android API levels and uses these accessibility services , chosen by checking the operating system version , to create new Google accounts .


This is done by opening the Google account creation process and parsing the current view .


The app then clicks the appropriate buttons , scrollbars , and other UI elements to go through account sign-up without user intervention .


During the account sign-up process , Google may flag the account creation attempt as suspicious and prompt the app to solve a CAPTCHA .


It is unclear if the remote server is capable of solving the CAPTCHA image automatically or if this is done manually by a human in the background .


The Zen trojan does not implement any kind of obfuscation except for one string that is encoded using Base64 encoding .


It 's one of the strings - " How you 'll sign in '' - that it looks for during the account creation process .


The code snippet below shows part of the screen parsing process .


Apart from injecting code to read the CAPTCHA , the app also injects its own code into the system_server process , which requires root privileges .


This indicates that the app tries to hide itself from any anti-PHA systems that look for a specific app process name or does not have the ability to scan the memory of the system_server process .


The app also creates hooks to prevent the phone from rebooting , going to sleep or allowing the user from pressing hardware buttons during the account creation process .


These hooks are created using the root access and a custom native code called Lmt_INJECT , although the algorithm for this is well known .


Then the app finds a process id value for the process it wants to inject with code .


This is done using a series of syscalls as outlined below .


The " source process '' refers to the Zen trojan running as root , while the " target process '' refers to the process to which the code is injected and [ pid ] refers to the target process pid value .


The source process checks the mapping between a process id and a process name .


This is done by reading the /proc/ [ pid ] /cmdline file .


This very first step fails in Android 7.0 and higher , even with a root permission .


The /proc filesystem is now mounted with a hidepid=2 parameter , which means that the process can not access other process /proc/ [ pid ] directory .


A ptrace_attach syscall is called .


This allows the source process to trace the target .


The source process looks at its own memory to calculate the offset between the beginning of the libc library and the mmap address .


The source process tries to determine the location of dlopen , dlsym , and dlclose functions in the target process .


The source process writes the native shellcode into the memory region allocated by mmap .


The source process changes the registers in the target process so that PC register points directly to the shellcode .


This is done using the ptrace syscall .


This diagram illustrates the whole process .


Summary PHA authors go to great lengths to come up with increasingly clever ways to monetize their apps .


The app that resulted in the largest number of affected users was the click fraud version , which was installed over 170,000 times at its peak in February 2018 .


The most affected countries were India , Brazil , and Indonesia .


In most cases , these click fraud apps were uninstalled by the users , probably due to the low quality of the apps .


If Google Play Protect detects one of these apps , Google Play Protect will show a warning to users .


We are constantly on the lookout for new threats and we are expanding our protections .


You can check the status of Google Play Protect on your device : Open your Android device 's Google Play Store app .


Tap Menu > Play Protect .


Look for information about the status of your device .


Hashes of samples Type Package name SHA256 digest Custom ads com.targetshoot.zombieapocalypse.sniper.zombieshootinggame 5d98d8a7a012a858f0fa4cf8d2ed3d5a82937b1a98ea2703d440307c63c6c928 Click fraud com.counterterrorist.cs.elite.combat.shootinggame 84672fb2f228ec749d3c3c1cb168a1c31f544970fd29136bea2a5b2cefac6d04


Rooting trojan com.android.world.news bd233c1f5c477b0cc15d7f84392dab3a7a598243efa3154304327ff4580ae213 Zen trojan com.lmt.register eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d Mobile Campaign ‘ Bouncing Golf ’ Affects Middle East We uncovered a cyberespionage campaign targeting Middle


Malicious codes are embedded in apps that the operators repackaged from legitimate applications .


Monitoring the command and control ( C & C ) servers used by Bouncing Golf , we ’ ve so far observed more than 660 Android devices infected with GolfSpy .


The campaign ’ s attack vector is also interesting .


Also of note is Bouncing Golf ’ s possible connection to a previously reported mobile cyberespionage campaign that researchers named Domestic Kitten .


The strings of code , for one , are similarly structured .


The data targeted for theft also have similar formats .


GolfSpy ’ s infection chain GolfSpy 's Potential Impact Given GolfSpy ’ s information-stealing capabilities , this malware can effectively hijack an infected Android device .


Here is a list of information that GolfSpy steals : Device accounts List of applications installed in the device Device ’ s current running processes Battery status Bookmarks/Histories of the device ’ s default browser Call logs and records Clipboard contents Contacts , including those in VCard format Mobile operator information Files stored on SDcard Device location List of image , audio , and video files stored on the device Storage and memory information Connection information Sensor information SMS messages Pictures GolfSpy also has a function that lets it connect to a remote server to fetch and perform commands


, including : searching for , listing , deleting , and renaming files as well as downloading a file into and retrieving a file from the device ; taking screenshots ; installing other application packages ( APK ) ; recording audio and video ; and updating the malware .


Technical Analysis The repackaged applications are embedded with malicious code , which can be found in the com.golf package .


These repackaged apps pose as communication , news , lifestyle , book , and reference apps popularly used in the Middle East .


The GolfSpy malware embedded in the apps is hardcoded with an internal name used by the attacker .


Icons of the apps that Bouncing Golf ’ s operators repackaged ( top ) and a comparison of packages between the original legitimate app ( bottom left ) and GolfSpy ( bottom right ) Figure 3 .


GolfSpy ’ s configurations encoded by a custom algorithm ( right ) and its decoded version ( left ) As shown in Figure 3 , GolfSpy ’ s configurations ( e.g. , C & C server , secret keys ) are encoded by a customized algorithm .


The information is written into a file on the device .


Code snippet showing GolfSpy generating UUID The value of % is in the range of 1-9 or a-j .


Each value represents a different type of data to steal from the device : Value Data Type 1 Accounts 2 Installed APP list 3 Running processes list 4 Battery status 5 Browser bookmarks and histories 6 Call logs 7 Clipboard 8 Contacts 9 Mobile operator information a File list on SD card b Location c Image list d Audio list e Video list f Storage and memory information g Connection information h Sensors information i SMS messages j VCard format contacts Table 1 .


The type of data corresponding to the value coded in GolfSpy Figure 5 shows the code snippets that are involved in monitoring and recording the device ’ s phone call .


It will also take a photo using the device ’ s front camera when the user wakes the device .


GolfSpy encrypts all the stolen data using a simple XOR operation with a pre-configured key before sending it to the C & C server using the HTTP POST method .


Code snippets showing how GolfSpy monitors phone calls via register receiver ( top left ) , its actions when the device is woken up ( top right ) , and how it encrypts the stolen data ( bottom ) The malware retrieves commands from the C & C server via HTTP , and attackers can steal specific files on the infected device .


The command is a constructed string split into three parts using " " as a separator .


The first part is the target directory , the second is a regular expression used to match specific files , while the last part is an ID .


The small or limited number is understandable given the nature of this campaign , but we also expect it to increase or even diversify in terms of distribution .


Bouncing Golf ’ s operators also try to cover their tracks .


The C & C server IP addresses used also appear to be disparate , as they were located in many European countries like Russia , France , Holland , and Germany .


It ’ s not a definite correlation , but Bouncing Golf also seems to have a connection with Domestic Kitten due to similarities we found in their code .


For example , the Android malware that both deploy share the same strings of code for their decoding algorithm .


The data that Domestic Kitten steals follows a similar format with Bouncing Golf ’ s , with each type of data having a unique identifying character .


It ’ s also worth noting that both campaigns repackage apps that are commonly used in their target ’ s countries , such as Telegram , Kik , and Plus messaging apps .


Code snippets showing : the decoding algorithm shared by both Bouncing Golf and Domestic Kitten ( top ) , the format of data that Domestic Kitten ’ s malware targets to steal ( center ) , and how both Bouncing Golf ( bottom left ) and Domestic Kitten ( bottom right ) use " " as a separator in their command strings .


As we ’ ve seen in last year ’ s mobile threat landscape , we expect more cyberespionage campaigns targeting the mobile platform given its ubiquity , employing tried-and-tested techniques to lure unwitting users .


The extent of information that these kinds of threats can steal is also significant , as it lets attackers virtually take over a compromised device .


Users should adopt best practices , while organizations should ensure that they balance the need for mobility and the importance of security .


Several weeks ago , Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “ Charger. ” This incident demonstrates how malware can be a dangerous threat to your business , and how advanced behavioral detection fills mobile security gaps attackers use to penetrate entire networks .


Charger was found embedded in an app called EnergyRescue .


If granted , the ransomware locks the device and displays a message demanding payment : You need to pay for us , otherwise we will sell portion of your personal information on black market every 30 minutes .


WE GIVE 100 % GUARANTEE THAT ALL FILES WILL RESTORE AFTER WE RECEIVE PAYMENT .


WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER !


TURNING OFF YOUR PHONE IS MEANINGLESS , ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS !


WE STILL CAN SELLING IT FOR SPAM , FAKE , BANK CRIME etc… We collect and download all of your personal data .


All information about your social networks , Bank accounts , Credit Cards .


We collect all data about your friends and family .


The ransom demand for 0.2 Bitcoins ( roughly $ 180 ) is a much higher ransom demand than has been seen in mobile ransomware so far .


By comparison , the DataLust ransomware demanded merely $ 15 .


Payments are made to a specific Bitcoin account , but we haven ’ t identified any payments so far .


Adware commonly found on Play collects profits from ad networks , but mobile ransomware inflicts direct harm to users .


Similar to other malware seen in the past , Charger checks the local settings of the device and does not run its malicious logic if the device is located in Ukraine , Russia , or Belarus .


Charger , however , uses a heavy packing approach which it harder for the malware to stay hidden , so it must compensate with other means .


The developers of Charger gave it everything they had to boost its evasion capabilities and so it could stay hidden on Google Play for as long as possible .


The malware uses several advanced techniques to hide its real intentions and makes it harder to detect .


It encodes strings into binary arrays , making it hard to inspect them .


It loads code from encrypted resources dynamically , which most detection engines can not penetrate and inspect .


It checks whether it is being run in an emulator before it starts its malicious activity .


Emulator and location conditions for the malware ’ s activity Check Point Mobile Threat Prevention customers are protected from Charger and similar malware .


Check Point ’ s Analysis and Response Team ( ART ) disclosed the finding to Android ’ s Security team who took the appropriate security steps to remove the infected app and added the malware to Android ’ s built-in protection mechanisms .


With mobile devices increasingly used in the corporate environment , thanks to the popularity of BYOD policies , this malware has the potential to cause serious harm , mostly to consumers , and businesses that allow the installation of unsigned applications .


Let ’ s take a closer look at the suspicious file .


Figure 1 – Phishing Email When the email link is opened from an Android device , an APK file ( Fattura002873.apk ) , is downloaded .


Upon opening the file , the user is asked to enable “ Google Play Protect ” as shown in Figure 2 .


However , this is not a genuine “ Google Play Protect ” screen ; instead it gives the app all the permissions it needs while simultaneously disabling the actual Google Play Protect .


The malware mainly targets banking and financial applications , but also looks for popular shopping apps such as eBay or Amazon .


A full list of targeted applications is included in the IOC section at the end of this post .


Figure 4 – Checking for installed apps Based on a thorough analysis of the code , the most interesting technical capabilities include : Capturing screenshots Enabling or changing administration settings Opening and visiting any URL Disabling Play Protect Recording audio Making phone calls Stealing the contact list Controlling the device via VNC Sending , receiving and deleting SMS Locking the device Encrypting files on the device and external drives Searching for files Retrieving the GPS location Capturing remote control commands from Twitter and Telegram Pushing overlays Reading the device ID The malware includes


a keylogger that works in every app installed on the Android device .


However , the keylogger needs to be specifically enabled by a command sent from the C2 server .


The keylogger can track three different events ( Figure 5 ) : TYPE_VIEW_CLICKED Represents the event of clicking on a View-like Button , CompoundButton , etc .


TYPE_VIEW_FOCUSED Represents the event of setting input focus of a View .


Figure 5 – Keylogger component Figure 6 shows one of the most noteworthy functions of Anubis : its ransomware module .


It adds the file extension .AnubisCrypt to each encrypted file and sends it to the C2 .


Figure 7 – C2 As seen in Figure 8 , this version of Anubis is built to run on several iterations of the Android operating system , dating back to version 4.0.3 , which was released in 2012 .


Figure 8 – Android requirements Android malware has been around for many years and will be with us for the foreseeable future .


APK files will not natively open in an environment other than an Android device .


With the increased use of Android phones in business environments , it is important to defend against these threats by ensuring devices are kept current with the latest updates .


Limiting app installations on corporate devices , as well as ensuring that applications are created by trusted developers on official marketplaces , can help in reducing the risk of infection as well .


Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims ; and a hash of the APK involved ( Android application ) was tagged in our sample feed for inspection .


Once we looked into the file , we quickly found out that the inner-workings of the APK included a malicious payload , embedded in the original code of the application .


This was an original spyware program , designed to exfiltrate almost all accessible information .


Researchers from Bitdefender also released an analysis of one of the samples in a blogpost .


Although something had already been published , we decided to do something different with the data we acquired .


We decided to call the operation “ ViceLeaker ” , because of strings and variables in its code .


Mobile ViceLeaker The following table shows meta information on the observed samples , including compiler timestamps : MD5 Package Compiler C2 51df2597faa3fce38a4c5ae024f97b1c com.xapps.SexGameForAdults dexlib 2.x 188.165.28 [ .


] 251 2d108ff3a735dea1d1fdfa430f37fab2 com.psiphon3 dexlib 2.x 188.165.49 [ .


] 205 7ed754a802f0b6a1740a99683173db73 com.psiphon3 dexlib 2.x 188.165.49 [ .


] 205 3b89e5cd49c05ce6dc681589e6c368d9 ir.abed.dastan dexlib 2.x 185.141.60 [ .


Original code of the APK on the left , versus injected APK on the right The analysis of the APK was rather interesting , because some of the actions were very common spyware features , such as the exfiltration of SMS messages , call logs and other data .


The malware uses HTTP for communication with the C2 server for command handling and data exfiltration .


Here is a command and control protocol fragment : Commands from C2 server parsing In total , the malicious APK handles 16 different commands : Command Endpoint Description 1 reqsmscal.php Send specified SMS message 2 reqsmscal.php Call specified number 3 reqsmscal.php Exfiltrate device info , such as phone model and OS version 4 reqsmscal.php Exfiltrate a list of all installed applications 5 reqsmscal.php Exfiltrate default browser history ( limited to a given date ) 6 reqsmscal.php


Exfiltrate Chrome browser history ( limited to a given date ) 7 reqsmscal.php Exfiltrate memory card file structure 8 reqsmscal.php Record surrounding sound for 80 seconds 1 reqcalllog.php Exfiltrate all call logs 2 reqcalllog.php Exfiltrate all SMS messages 3 reqcalllog.php Upload specified file from the device to the C2 4 reqcalllog.php Download file from specified URL and save on device 5 reqcalllog.php Delete specified file 6,7,8 reqcalllog.php Commands not yet


implemented 9 reqcalllog.php Take photo ( muted audio ) with rear camera , send to C2 10 reqcalllog.php Take photo ( muted audio ) with front camera , send to C2 All observed samples with Smali injections were signed by the same debug certificate ( 0x936eacbe07f201df ) .


As we know from our investigation , traces of the first development activities were found at the end of 2016 , but the main distribution campaign began in 2018 ( end of 2017 ) .


Based on our detection statistics , the main infection vector is the spread of Trojanized applications directly to victims via Telegram and WhatsApp messengers .


There are the following relevant detection paths ( the last one is an alternative Telegram client – “ Telegram X “ ) : Name Detection path Sex Game For Adults 18.apk /storage/emulated/0/WhatsApp/Media/WhatsApp Documents/ 4_6032967490689041387.apk /storage/emulated/0/Telegram/Telegram Documents/ Psiphon-v91.apk /storage/emulated/0/Android/data/org.thunderdog.challegram/files/documents/ Backdoored Open Source During the course


of our analysis , we also found samples sharing code with the ViceLeaker malware , in particular they shared a delimiter that was used in both cases to parse commands from the C2 server .


This would be a very unusual coincidence .


Even when a false flag might also be a possibility , we consider this to be unlikely .


The samples sharing this overlap are modified versions of an open source Jabber/XMPP client called “ Conversations ” with some code additions .


The legitimate version of this app is also available on Google Play .


The Conversations modified samples differ from the original one in the getKnownHosts method that was modified to replace the main XMPP host with the attackers ’ C2 server : It appears that the attackers were using a specific C2 for the use of that app .


Another important modification is in the message transfer process : With this modification , an application sends device location coordinates with every message .


In addition , we did not see traces of the Smali injection .


In this case we found traces of dx/dexmerge compilers , which means that , this time , the attackers just imported the original source code into an Android IDE ( such as Android Studio , for instance ) and compiled it with their own modifications .


We do not know why , but we suspect that it was an attempt to hide the origin of the application .


This brought to us the hypothesis that this might be a version used by the group behind ViceLeaker for internal communication or for other , unclear purposes .


All the detections of this backdoored app were geolocated in Iran .


Backdoored Conversations C2 server analysis During the analysis of the Smali injected apps and their C2 server infrastructure we hadn ’ t found any interesting clues , but things changed when we looked at the C2 server of the linked Conversations messenger .


It uses “ 185.51.201 [ .


] 133 ” as a main C2 address , and there is only one domain that is hosted on this dedicated server – iliageram [ .


Note that we later found versions that used the domain as a C2 directly instead of the IP address .


The record contains a personal email address : WHOIS records of C2 server exposing the attacker ’ s email address We were aware of the possibility that the attackers might be using a compromised email account , so we dug deeper to find more information related to this email address .


A quick search produced results about a personal page and , what is more interesting , a GitHub account that contains a forked Conversation repository .


Related Github account contains forked Conversations repository Summarizing all the found clues , we have the following attribution flow : Conclusion The operation of ViceLeaker is still ongoing , as is our research .


Trend Micro detects these as ANDROIDOS_XLOADER.HRX .


By : Trend Micro April 20 , 2018 We have been detecting a new wave of network attacks since early March , which , for now , are targeting Japan , Korea , China , Taiwan , and Hong Kong .


The attacks use Domain Name System ( DNS ) cache poisoning/DNS spoofing , possibly through infringement techniques such as brute-force or dictionary attacks , to distribute and install malicious Android apps .


These malware pose as legitimate Facebook or Chrome applications .


They are distributed from polluted DNS domains that send a notification to an unknowing victim ’ s device .


XLoader can also hijack the infected device ( i.e. , send SMSs ) and sports self-protection/persistence mechanisms through device administrator privileges .


Infection Chain As with our earlier reports in late March , the attack chain involves diverting internet traffic to attacker-specified domains by compromising and overwriting the router ’ s DNS settings .


A fake alert will notify and urge the user to access the malicious domain and download XLoader .


Technical Analysis XLoader first loads the encrypted payload from Assets/db as test.dex to drop the necessary modules then requests for device administrator privileges .


Once granted permission , it hides its icon from the launcher application list then starts a service that it keeps running in the background .


Here is a list of broadcast actions : android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.intent.action.PHONE_STATE android.net.wifi.SCAN_RESULTS android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.SCREEN_OFF android.intent.action.SCREEN_ON


android.media.RINGER_MODE_CHANGED android.sms.msg.action.SMS_SEND android.sms.msg.action.SMS_DELIVERED Creating a Web Server to Phish XLoader creates a provisional web server to receive the broadcast events .


It can also create a simple HTTP server on the infected device to deceive victims .


It shows a web phishing page whenever the affected device receives a broadcast event ( i.e. , if a new package is installed or if the device ’ s screen is on ) to steal personal data , such as those keyed in for banking apps .


The phishing page is translated in Korean , Japanese , Chinese , and English , which are hardcoded in the payload .


Its data-stealing capabilities include collecting SMSs after receiving an SMS-related broadcast event and covertly recording phone calls .


XLoader can also hijack accounts linked to financial or game-related apps installed on the affected device .


XLoader can also start other attacker-specified packages .


By monitoring the package installation broadcast event , XLoader can start their packages .


This enables it to launch malicious apps without the user ’ s awareness and explicit consent .


We reverse engineered XLoader and found that it appears to target South Korea-based banks and game development companies .


XLoader also prevents victims from accessing the device ’ s settings or using a known antivirus ( AV ) app in the country .


XLoader can also load multiple malicious modules to receive and execute commands from its remote command-and-control ( C & C ) server , as shown below : Here ’ s a list of the modules and their functions : sendSms — send SMS/MMS to a specified address setWifi — enable or disable Wi-Fi connection gcont — collect all the device ’ s contacts lock — currently just an input lock status in the settings ( pref ) file , but may be used as a screenlocking ransomware bc — collect all contacts


from the Android device and SIM card setForward — currently not implemented , but can be used to hijack the infected device getForward — currently not implemented , but can be used to hijack the infected device hasPkg — check the device whether a specified app is installed or not setRingerMode — set the device ’ s ringer mode setRecEnable — set the device ’ s ringer mode as silent reqState — get a detailed phone connection status , which includes activated network and Wi-Fi ( with or without password ) showHome —


force the device ’ s back to the home screen getnpki : get files/content from the folder named NPKI ( contains certificates related to financial transactions ) http — access a specified network using HttpURLConnection onRecordAction — simulate a number-dialed tone call — call a specified number get_apps — get all the apps installed on the device show_fs_float_window — show a full-screen window for phishing Of note is XLoader ’ s abuse of the WebSocket protocol ( supported in many browsers


and web applications ) via ws ( WebSockets ) or wss ( WebSockets over SSL/TLS ) to communicate with its C & C servers .


The abuse of the WebSocket protocol provides XLoader with a persistent connection between clients and servers where data can be transported any time .


Mitigations XLoader will not download malicious apps if the Android device uses a mobile data connection .


Nevertheless , users should practice proper security hygiene to mitigate threats that may take advantage of a home or business router ’ s security gaps .


Employ stronger credentials , for instance , to make them less susceptible to unauthorized access .


Regularly update and patch the router ’ s software and firmware to prevent exploits , and enable its built-in firewall .


For system administrators and information security professionals , configuring the router to be more resistant to attacks like DNS cache poisoning can help mitigate similar threats .


Everyday users can do the same by checking the router ’ s DNS settings if they ’ ve been modified .


Even threats like DNS cache poisoning employ social engineering , so users should also be more prudent against suspicious or unknown messages that have telltale signs of malware .


We have worked with Google and they ensure that Google Play Protect proactively catches apps of this nature .


No instances of these apps were found in Google Play .


September 08 , 2020 TikTok Spyware A detailed analysis of spyware masquerading as TikTok A recent threat to ban TikTok in the United States has taken the internet by storm and received mixed reactions from social media and internet users .


U.S. President Donald Trump has ordered ByteDance , the parent company of TikTok , to sell its U.S. TikTok assets and also issued executive orders that would ban the social media apps TikTok and WeChat from operating in the U.S. if the sale doesn ’ t happen in the next few weeks .


On the other side , ByteDance has filed a lawsuit suing the Trump administration .


When popular applications come under fire and are featured prominently in the news , hackers get excited as these newsworthy apps can become their latest target .


Generally , after an application gets banned from an official app store , such as Google Play , users try to find alternative ways to download the app .


In doing so , users can become victims to malicious apps portraying themselves as the original app .


Recently there was a huge wave of SMS messages , as well as Whatsapp messages , making the rounds asking users to download the latest version of TikTok at hxxp : //tiny [ .


In reality , this downloaded app is a fake app that asks for credentials and Android permissions ( including camera and phone permissions ) , resulting in the user being bombarded with advertisements .


Recently , we have come across another variant of this app portraying itself as TikTok Pro , but this is a full-fledged spyware with premium features to spy on victim with ease .


( Please note this is a different app and not the same as the one being spread by hxxp : //tiny [ .


) Technical Analysis App Name : TikTok Pro Hash : 9fed52ee7312e217bd10d6a156c8b988 Package Name : com.example.dat.a8andoserverx Upon installation , the spyware portrays itself as TikTok using the name TikTok Pro .


As soon as a user tries to open the app , it launches a fake notification and soon the notification as well as the app icon disappears .


This fake notification tactic is used to redirect the user 's attention , meanwhile the app hides itself , making the user believe the app to be faulty .


This functionality can be seen in Figure 1 .


First , an activity named MainActivity fires up , taking care of hiding the icon and showing the fake notification .


The spyware also appears to have an additional payload stored under the /res/raw/ directory .


The conditions to build an additional payload are never met .


Going one step further , we rebuilt the malware to execute the apparent functionality of generating a payload , but discovered that the APK stored in the /res/raw/ directory is empty .


The placement of the decoy functionality is likely designed to confuse the malware researchers .


It is also possible that this functionality is under development , making this placeholder code incomplete .


MainService is the brain of this spyware and controls almost everything—from stealing the victim 's data to deleting it .


All of its capabilities are discussed later in this blog .


Hide Icon Figure 3 : Code showing the hiding icon and starting service .


As MainService is the main controller , the developer has taken the appropriate actions to keep it functional and running at all times .


Broadcast receivers are components that allow you to register for various Android events .


In this case , it registers three broadcast receivers : MyReceiver - Triggers when the device is booted .


MyReceiver and AlarmReceiver start the MainService whenever appropriate events occur .


This tactic is very common among malware developers to ensure the malware is not killed by the Android OS or by any other means .


Figure 4 shows MyReceiver in action where it eventually calls the MainService service .


The InterceptCall receiver is triggered whenever there is an incoming or outgoing call .


It sets particular parameters in relation to call details and a further service named calls takes the control as seen in Figure 5 .


Call Service Figure 5 : Code for the calls service As seen above , the calls service stores incoming call details in .mp3 format in the /sdcard/DCIM/.dat/ directory with file name appended with " In_ '' for incoming calls and " Out_ '' for outgoing calls .


How these recorded calls are sent to the command and control server ( CnC ) is taken care of by MainService , which is discussed next .


This functionality can be seen in Figure 6 .


MainService has the following capabilities : Steal SMS messages Send SMS messages Steal the victim 's location Capture photos Execute commands Capture screenshots Call phone numbers Initiate other apps Steal Facebook credentials , etc All of the above functionalities take place on the basis of commands sent by the attacker .


Stolen data is stored in external storage under the /DCIM/ directory with a hidden sub-directory named " .dat '' .


Below is the list of all the commands catered by the C & C server .


Command Action Unistxcr Restart the app dowsizetr Send the file stored in the /sdcard/DCIM/.dat/ directory to the C & C server Caspylistx Get a list of all hidden files in the /DCIM/.dat/ directory spxcheck Check whether call details are collected by the spyware S8p8y0 Delete call details stored by the spyware screXmex Take screenshots of the device screen Batrxiops Check battery status L4oclOCMAWS Fetch the victim 's location GUIFXB Launch


the fake Facebook login page IODBSSUEEZ Send a file containing stolen Facebook credentials to the C & C server FdelSRRT Delete files containing stolen Facebook credentials chkstzeaw Launch Facebook LUNAPXER Launch apps according to the package name sent by the C & C server Gapxplister Get a list of all installed applications DOTRall8xxe Zip all the stolen files and store in the /DCIM/.dat/ directory Acouxacour Get a list of accounts on the victim 's device Fimxmiisx Open the camera


Scxreexcv4 Capture an image micmokmi8x Capture audio Yufsssp Get latitude and longitude GExCaalsss7 Get call logs PHOCAs7 Call phone numbers sent by the C & C server Gxextsxms Get a list of inbox SMS messages Msppossag Send SMS with message body sent by the C & C server Getconstactx Get a list of all contacts Rinxgosa Play a ringtone bithsssp64 Execute commands sent by the C & C server DOWdeletx Deletes


the file specified by the C & C server Deldatall8 Delete all files stored in the /sdcard/DCIM/.dat/ directory We do n't have the space to cover all of the commands , but let 's take a look at some of the major ones .


Upon receiving the command GUIFXB , the spyware launches a fake Facebook login page .


As soon as the victim tries to log in , it stores the victim 's credentials in /storage/0/DCIM/.fdat Facebook Login Figure 7 : Fake Facebook login The second command is IODBSSUEEZ , which further sends stolen credentials to the C & C server , as seen in Figure 8 .


This functionality can be easily further extended to steal other information , such as bank credentials , although we did not see any banks being targeted in this attack .


Calling functionality Command PHOCAs7 initiates calling functionality .


Call Command Figure 9 : The calling functionality .


The phone number is fetched from a response from the C & C server and is stored in str3 variable , which further is utilized using the tel : function .


Stealing SMS The Gxextsxms command is responsible for fetching all the SMS messages from the victim 's device and sending it over to the C & C server .


Stealing SMS Figure 10 : Stealing SMS messages .


Similarly , there are many crucial commands that further allow this spyware to perform additional functionality , such as executing commands sent by the C & C , clicking photos , capturing screenshots , stealing location information , and more .


Further analysis Upon further research , we found this spyware to be developed by a framework similar to Spynote and Spymax , meaning this could be an updated version of these Trojan builders , which allow anyone , even with limited knowledge , to develop full-fledged spyware .


Many of the functionalities seen in this spyware are similar to Spynote and Spymax based on the samples we analyzed with some modifications .


This spyware sample communicates over dynamic DNS .


Other common functionalities include executing commands received from the attacker , taking screenshots of the victim 's device , fetching locations , stealing SMS messages and most common features that every spyware may poses .


Stealing Facebook credentials using fake Facebook activity is something we did n't observe in Spynote/Spymax versions but was seen in this spyware .


This framework allows anyone to develop a malicious app with the desired icon and communication address .


Some of the icons used can be seen below .


We found 280 such apps in the past three months .


It is very easy to trick victims to fall for such attacks .


In doing so , users can mistakenly install malicious apps , such as the spyware mentioned in this blog .


The precautions you take online have been covered extensively in almost all of our blogs ; even so , we believe this information bears repeating .


Always keep the " Unknown Sources '' option disabled in the Android device .


This disallows apps to be installed on your device from unknown sources .


We would also like to mention that if you come across an app hiding it 's icon , always try to search for the app in your device settings ( by going to Settings - > Apps - > Search for icon that was hidden ) .


In the case of this spyware , search for app named TikTok Pro .


MITRE TAGS Action Tag ID App auto-start at device boot T1402 Input prompt T1411 Capture SMS messages T1412 Application discovery T1418 Capture audio T1429 Location tracking T1430 Access contact list T1432 Access call log T1433 Commonly used port T1436 Standard application layer protocol T1437 Masquerage as legitimate application T1444 Suppress application icon T1508 Capture camera T1512 Screen capture T1513 Foreground persistence T1541 DualToy : New Windows Trojan Sideloads Risky Apps to Android and iOS Devices


By Claud Xiao September 13 , 2016 at 5:00 AM Over the past two years , we ’ ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices .


This attack vector is increasingly popular with malicious actors as almost everyone on the planet carries at least one mobile device they interact with throughout any given day .


Thanks to a relative lack of security controls applied to mobile devices , these devices have become very attractive targets for a broad range of malicious actors .


When DualToy began to spread in January 2015 , it was only capable of infecting Android devices .


However , within six months the malicious actors added the capability to infect iOS devices .


It mainly targets Chinese users , but has also successfully affected people and organizations in the United States , United Kingdom , Thailand , Spain , and Ireland .


Credential phishing and an Android banking Trojan combine in Austrian mobile attacks NOVEMBER 03 , 2017 Overview Credential phishing , banking Trojans , and credit card phishing schemes are common threats that we regularly observe both at scale and in more targeted attacks .


However , Proofpoint researchers have recently observed phishing attacks that incorporate all of these elements in a single , multistep scheme involving the Marcher Android banking Trojan targeting customers of large Austrian banks .


Attacks involving Marcher have become increasingly sophisticated , with documented cases involving multiple attack vectors and a variety of targeted financial services and communication platforms [ 1 ] [ 2 ] .


In this case , a threat actor has been targeting customers of Bank Austria , Raiffeisen Meine Bank , and Sparkasse since at least January 2017 .


The attacks described here begin with a banking credential phishing scheme , followed by an attempt to trick the victim into installing Marcher , and finally with attempts to steal credit card information by the banking Trojan itself .


Analysis Marcher is frequently distributed via SMS , but in this case , victims are presented with a link in an email .


Oftentimes , the emailed link is a bit.ly shortened link , used to potentially evade detection .


Figure 1 : Landing page for phishing scheme asking for the victim ’ s signatory number and PIN using stolen branding from Bank Austria Because the actor delivered phishing links using the bit.ly URL shortener , we can access delivery statistics for this particular campaign .


The link resolves to a URL designed to appear legitimate , with a canonical domain of sicher97140 [ .


] info including the “ bankaustria ” brand .


Figure 2 : Bit.ly statistics for a phishing landing page targeting Bank Austria customers The actor appears to have recently begun using “ .top ” top-level domains ( TLDs ) for their phishing landing pages and have implemented a consistent naming structure as shown below .


Earlier this year , the actor used “ .pw ” TLDs while the Bank Austria scheme highlighted above used “ .info ” .


Some recent campaigns against other bank customers also used “ .gdn ” TLDs .


Other attacks on Bank Austria customers that we observed resolved to the following .top domains : Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817062 [ .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817461 [ .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817465 [ .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817469 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58712 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58717 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58729 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87721 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87726 [ .


] top/ These permutations of TLDs and canonical domains incorporating the legitimate domain expected by the targeted banking customers exemplifies recent trends in social engineering by threat actors .


Just as threat actors may use stolen branding in their email lures to trick potential victims , they reproduce a legitimate domain name in a fraudulent domain that is not controlled by the bank .


Figure 3 : Step two of the credential phish asking for the victim ’ s email address and phone number Having stolen the victim ’ s account and personal information , the scammer introduces a social engineering scheme , informing users that they currently do not have the “ Bank Austria Security App ” installed on their smartphone and must download it to proceed .


Figure 4 shows the download prompt for this fake app ; an English translation follows .


Figure 4 : Alert prompting the victim to download an Android banking app ( English translation below ) , with stolen branding and fraudulent copy * * * Translation * * * Dear Customer , The system has detected that the Bank Austria Security App is not installed on your smartphone .


Due to new EU money laundering guidelines , the new Bank Austria security app is mandatory for all customers who have a mobile phone number in our system .


Please install the app immediately to avoid blocking your account .


Follow the instructions at the bottom of this page .


Why you need the Bank Austria Security App : Due to outdated technology of the mobile network important data such as mTan SMS and online banking connections are transmitted unencrypted .


Our security app allows us to transmit this sensitive data encrypted to you , thus increasing the security that you will not suffer any financial loss .


Step 1 : Download Bank Austria Security App Download the Bank Austria security app to your Android device .


* * * End translation * * * The phishing template then presents additional instructions for installing the fake security application ( Figure 5 ) : Figure 5 : Additional instructions telling the victim to give the app the requested permissions ( English translation below ) , with stolen branding and fraudulent copy * * * Translation * * * Step 2 : Allow installation Open your device 's settings , select Security or Applications ( depending on the device ) , and check Unknown sources .


After successful installation , tap Open and enable the device administrator .


* * * End translation * * * Referring again to bit.ly , we can see click statistics for this campaign ( Figure 6 ) .


Figure 6 : bit.ly statistics for the fake Bank Austria Android app download link From this small sample , we see that 7 % of visitors clicked through to download the application , which is actually a version of the Marcher banking Trojan named “ BankAustria.apk ” , continuing the fraudulent use of the bank ’ s branding to fool potential victims .


This sample is similar to those presented in other recent Marcher analyses [ 1 ] [ 2 ] .


This particular application is signed with a fake certificate : Owner : CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Issuer CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Serial : 1c9157d7 Validity : 11/02/2017 00:16:46 03/20/2045 00:16:46 MD5 Hash : A8:55:46:32:15


: A9 : D5:95 : A9:91 : C2:91:77:5D:30 : F6 SHA1 Hash : 32:17 : E9:7E:06 : FE:5D:84 : BE:7C:14:0C : C6:2B:12:85 : E7:03:9A:5F The app requests extensive permissions during installation that enable a range of activities supported by the malware .


Allows an application to read from external storage .


Allows an application to use SIP service .


Allows an application to send SMS messages .


Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call .


Allows applications to access information about networks .


Allows an application to read the user 's contacts data .


Allows an application to read or write the system settings .


Allows applications to change Wi-Fi connectivity state .


Allows applications to change network connectivity state .


Analysis of the malware shows that it uses the common string obfuscation of character replacement ( Figure 7 ) : Figure 7 : Encoded Marcher Strings Figure 8 : Decoded Marcher Strings As noted , the application requests extensive permissions during installation ; Figure 9 shows the request to act as device administrator , a particular permission that should very rarely be granted to an app .


Figure 9 : Prompt for application permissions upon installation Figures 10 and 11 show the other permission screens for the app : Figure 10 Figure 10 : Part 1 of the permission screen for the app Figure 11 : Part 2 of the permission screen for the app Once installed the app will place a legitimate looking icon on the phone ’ s home screen , again using branding stolen from the bank .


Figure 12 : Fake Bank Austria Security application icon In addition to operating as a banking Trojan , overlaying a legitimate banking app with an indistinguishable credential theft page , the malware also asks for credit card information from the user when they open applications such as the Google Play store .


Figure 13 : Popup asking for a credit card number The application also supports stealing credit card verification information ( Figures 14 and 15 ) .


A review of the bit.ly statistics for these campaigns shows that they were at least as effective in driving end-user clicks as the Bank Austria campaign analyzed above .


Conclusion As our computing increasingly crosses multiple screens , we should expect to see threats extending across mobile and desktop environments .


As on the desktop , mobile users need to be wary of installing applications from outside of legitimate app stores and sources and be on the lookout for bogus banking sites that ask for more information than users would normally provide on legitimate sites .


Unusual domains , the use of URL shorteners , and solicitations that do not come from verifiable sources are also red flags for potential phishing and malware .


It is still under active development , with at least 5 different versions of the Trojan released within the last 5 months ( June - November 2019 ) .


In addition , its original target list is extremely narrow and seems to be focused on Spanish banks .


At that time , Ginp was a simple SMS stealer whose purpose was only to send a copy of incoming and outgoing SMS messages to the C2 server .


A couple of months later , in August 2019 , a new version was released with additional banking-specific features .


This and following versions were masquerading as fake “ Adobe Flash Player ” apps .


Although early versions had some basic code and string obfuscation , protection of the third version of the malware was enhanced with the use of payload obfuscation .


The capabilities remained unchanged , but a new endpoint was added to the Trojan C2 allowing it to handle the generic card grabber overlay and specific target overlays ( banking apps ) separately .


In addition , the credit card grabber target list was expanded with Snapchat and Viber .


In the third version spotted in the wild , the author introduced parts of the source code of the infamous Anubis Trojan ( which was leaked earlier in 2019 ) .


This version has some small modifications which seems to be unused , as the malware behaviour is the same as the previous version .


Additionally new endpoint was added that seems related to downloading a module for the malware , probably with new features or configuration .


How it works When the malware is first started on the device it will begin by removing its icon from the app drawer , hiding from the end user .


In the second step it asks the victim for the Accessibility Service privilege as visible in following screenshot : Ginp Accessibility request Once the user grants the requested Accessibility Service privilege , Ginp starts by granting itself additional permissions , such as ( dynamic ) permissions required in order to be able to send messages and make calls , without requiring any further action from the victim .


When done , the bot is functional and ready to receive commands and perform overlay attacks .


The commands supported by the most recent version of the bot are listed below .


As can be observed , the possibilities offered by the bot are pretty common .


Command Description SEND_SMS Send an SMS from the bot to a specific number NEW_URL Update the C2 URL KILL Disable the bot PING_DELAY Update interval between each ping request CLEAN_IGNORE_PKG Empty list of overlayed apps WRITE_INJECTS Update target list READ_INJECTS Get current target list START_ADMIN Request Device Admin privileges ALL_SMS Get all SMS messages DISABLE_ACCESSIBILITY Stop preventing user from disabling the accessibility service ENABLE_ACCESSIBILITY Prevent user from disabling


the accessibility service ENABLE_HIDDEN_SMS Set malware as default SMS app DISABLE_HIDDEN_SMS Remove malware as default SMS app ENABLE_EXTENDED_INJECT Enable overlay attacks DISABLE_EXTENDED_INJECT Disable overlay attacks ENABLE_CC_GRABBER Enable the Google Play overlay DISABLE_CC_GRABBER Disable the Google Play overlay START_DEBUG Enable debugging GET_LOGCAT Get logs from the device STOP_DEBUG Disable debugging GET_APPS


Get installed applications GET_CONTACTS Get contacts SEND_BULK_SMS Send SMS to multiple numbers UPDATE_APK Not implemented INJECT_PACKAGE Add new overlay target CALL_FORWARD Enable/disable call forwarding START_PERMISSIONS Starts request for additional permissions ( Accessibility privileges , battery optimizations bypass , dynamic permissions ) Features The most recent version of Ginp has the same capabilities as most other Android banking Trojans , such as the use of overlay attacks , SMS control and contact


Overall , it has a fairly common feature list , but it is expected to expand in future updates .


Since Ginp is already using some code from the Anubis Trojan , it is quite likely that other , more advanced features from Anubis or other malware , such as a back-connect proxy , screen-streaming and RAT will also be added in the future .


Ginp embeds the following set of features , allowing it to remain under the radar and successfully perform attacks : Overlaying : Dynamic ( local overlays obtained from the C2 ) SMS harvesting : SMS listing SMS harvesting : SMS forwarding Contact list collection Application listing Overlaying : Targets list update SMS : Sending Calls : Call forwarding C2 Resilience : Auxiliary C2 list Self-protection : Hiding the App icon Self-protection : Preventing removal Self-protection : Emulation-detection Update


10/03/2020 At the end of February the actors behind Ginp added screen capture capabilities to their Trojan .


Like previously added functionality , the code is borrowed from the leaked Anubis Trojan source code .


It enables the bot to stream screenshots and send them to the C2 so that actors can see what is happening on the screen of the infected device .


Overlay attack Ginp uses the Accessibility Service to check which application runs is the foreground .


If the package name of the foreground app is included in the target list , an overlay is shown .


The WebView-based overlay is loading an HTML page provided by the C2 in response to the package name provided by the bot .


Something that makes Ginp special is that all of its overlay screens for banking apps are consist of multiple steps , first stealing the victim ’ s login credentials , then stealing the credit card details ( to “ validate ” the user identity ) , as shown in the screenshots hereafter : The following code snippet shows that after the second overlay is filled-in and validated , it disappears and the targeted application is added to the list of packages names to be ignored for future overlays attacks .


Still included in the last versions , this screen is only used to overlay the official Google Play Store app .


More apps could be added to the grabber target list in the future , such as the ones that were targeted in older versions : Facebook WhatsApp Skype Twitter Chrome Instagram Snapchat Viber The following screenshot shows the generic card grabber overlay screen : Ginp generic grabber The current active target list is available in the appendix , containing a total of 24 unique targets .


When analyzing the Ginp ’ s recent samples , ThreatFabric analysts found some similarities with the famous Android banking Trojan .


Based on the evolution of Ginp it is clear that it isn ’ t based on Anubis , but rather reuses some of its code .


Below are some of the elements showing the relation .


The names used for Android components are similar : Similarities with AnubisSimilarities with Anubis When analyzing these components , similarities were found in the code of both malware families : Similarities with Anubis Another major change that indicated that the actor copied code from the Anubis Trojan is the way of handling configuration values .


Previous versions were storing config values within the variables of a class , while the latest version is using SharedPreferences with some of the keys being identical to those used by Anubis : isAccessibility time_work time_start_permission url_inj Conclusion Ginp is a simple but rather efficient banking Trojan providing the basic functionality to be able to trick victims into delivering personal information .


In a 5-month timespan , actor managed to create a Trojan from scratch which will presumably continue evolving offering new features such as keylogging , back-connect proxy or RAT capabilities .


Ginp ’ s unusual target selection is not just about its focus on Spanish banks but also the wide selection of targeted apps per bank .


The fact that the overlay screens are almost identical to the legitimate banking apps suggests that the actors might be very familiar with the Spanish banking applications and might even be accustomed to the language .


Although the current target list is limited to Spanish apps , it seems that the actor is taking into account that the bot should also be able to target other countries , seeing that the path used in the inject requests contains the country code of the targeted institution .


This could indicate that actor already has plans in expanding the targets to applications from different countries and regions .


Appendix Samples Some of the latest Ginp samples found in the wild : App name Package name SHA-256 hash Google Play Verificator sing.guide.false 0ee075219a2dfde018f17561467272633821d19420c08cba14322cc3b93bb5d5 Google Play Verificator park.rather.dance 087a3beea46f3d45649b7506073ef51c784036629ca78601a4593759b253d1b7 Adobe Flash Player ethics.unknown.during


5ac6901b232c629bc246227b783867a0122f62f9e087ceb86d83d991e92dba2f Adobe Flash Player solution.rail.forward 7eb239cc86e80e6e1866e2b3a132b5af94a13d0d24f92068a6d2e66cfe5c2cea Adobe Flash Player com.pubhny.hekzhgjty 14a1b1dce69b742f7e258805594f07e0c5148b6963c12a8429d6e15ace3a503c


Adobe Flash Player sentence.fancy.humble 78557094dbabecdc17fb0edb4e3a94bae184e97b1b92801e4f8eb0f0626d6212 Target list The current list of apps observed to be targeted by Ginp contains a total of 24 unique applications as seen below .


This list is expected to grow in the future .


We believe the TelePort Crew Threat Actor is operating out of Russia or Eastern Europe with the groups major motivations appearing to be financial in nature through cybercrime and/or corporate espionage.


The group behind the OilRig campaign continues to leverage spear-phishing emails with malicious Microsoft Excel documents to compromise victims.


A backdoor also known as: Trojan.WebToos.A6 Trojan.Gadoopt.Win64.4 Trojan/Gadoopt.aa Win64.Backdoor.Gadoopt.b TROJ_WEBTOOS_EL150244.UVPM Win.Trojan.Win64-93 BackDoor.Gates.19 TROJ_WEBTOOS_EL150244.UVPM TR/Gadoopt.maz Trojan:Win32/WebToos.A Win64/Gadoopt.AA Trojan.Win32.WebToos


A backdoor also known as: W32.Clodc4c.Trojan.f31e Win32.Packed.VMProtect.a Trojan.Win32.Zapchast.ajbs Trojan.Win32.Black.elkboj Trojan.Win32.Z.Vmprotbad.242576[h] W32/Trojan.TYMW-2040 Trojan/Win32.PcClient.R191990 Trojan.VMProtect! Trojan.Win32.VMProtect Trj/CI.A Win32/Trojan.f26


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9952 PWS:MSIL/Bahmajip.A


A backdoor also known as: Worm.Win32.Radminer!O TrojanDropper.Small.PQ4 Worm.Radminer.Win32.8 Trojan/Radmin.b TROJ_SPNR.03EF12 Win32.Trojan.WisdomEyes.16070401.9500.9999 W32/Trojan.XJGC-7764 Remacc.Radmin TROJ_SPNR.03EF12 Dos.Trojan.RAdmin-17 Trojan-Dropper.RadmIns Worm.Win32.Radminer.d Trojan.Win32.Radminer.dxpafi Worm.Win32.A.Radminer.307200 Trojan.DownLoader9.15517 BehavesLike.Win32.Skintrim.fh W32/Trojan2.OCDS Trojan[RemoteAdmin]/Win32.RAdmin Backdoor:Win32/Radmin.B Worm.Win32.Radminer.d Trojan/Win32.RAdmin.R103271 Trj/CI.A Trojan.Radmin.B Win32/Radmin.B


A backdoor also known as: Trojan.Antavmu.Win32.50 Trojan/Antavmu.ejw Trojan.Heur2.RP.E5C8CC Win32.Trojan.WisdomEyes.16070401.9500.9564 W32/Trojan2.IKTO Downloader.Trojan Win.Trojan.Antavmu-74 Trojan-Downloader.Win32.Murlo.vqg Trojan.Win32.Antavmu.wseg Spyware.Antavmu.455005 TrojWare.Win32.Antavmu.~bar Trojan.1 Trojan.Win32.Antavmu W32/Trojan.ASFC-3590 Trojan.Antavmu.y Troj.W32.Antavmu.jf!c Trojan-Downloader.Win32.Murlo.vqg Trojan/Win32.Antavmu.R18411 Trojan.1 Trojan.Antavmu!m7hjC7OtKPY


A new online banking malware with the same technique used in Operation Emmental has been hitting users in Japan.


The name of this injector is based on its version information which is the same for both dotRunpeX versions, consistent across all samples we analyzed and containing ProductName – RunpeX.Stub.Framework.


A backdoor also known as: TROJ_DROPPER.FK Win32.Trojan.WisdomEyes.16070401.9500.9995 Infostealer.Gampass TROJ_DROPPER.FK Trojan.Win32.XDR.euxmtw Trojan.MulDrop.18385 BehavesLike.Win32.Virut.cc Win32.Infect.a.124448 Win32/Trojan.5f3


A backdoor also known as: Backdoor.Delfsnif W32/Backdoor2.GYBX Backdoor.Trojan Trojan.Win32.Delphi.bjxrjc BehavesLike.Win32.Rontokbro.dm W32/Backdoor.XFVH-7108 Backdoor.Delfsnif Trj/CI.A Win32.Trojan.Crypt.Alih Hoax.Win32.BadJoke.FakeKAV Win32/Trojan.160


However, we have also observed attacks against surrounding nations and beyond, including targets in India and the USA.


The documents were found to drop the following malware families: The previously discussed CONFUCIUS_B malware family A backdoor previously not discussed in the public domain, commonly detected by some antivirus solutions as BioData A previously unknown backdoor that we have named MY24


The spammed attachments are using a RTF trick or a feature of Windows OS that allows dropping an executable – but not running it – simply by opening the RTF document


Every sample we found was different in size and activity from the others but the internal name and other identifiers were disturbingly similar.


The malware disguises itself as a file helper app and then uses very advanced anti-debug and anti-hook techniques to prevent it from being reverse engineered.


A backdoor also known as: Trojan/W32.KillAV.60689 Packed.Win32.TDSS!O Trojan.KillAV.Win32.3036 Trojan/KillAV.caq W32/Trojan2.GLAK Infostealer.Onlinegame Trojan.Win32.KillAV.60689 TrojWare.Win32.Patched.KSU Trojan.Click.28899 Trojan.1 W32/Trojan.ANJW-2244 Trojan/KillAV.qx Worm:Win32/QQnof.A Trojan.Zusy.D1B0EC Troj.W32.KillAV.caq!c Trojan/Win32.KillAV.C155326 Trojan.1 Trojan.Win32.Jhee W32/KillAV.CAQ!tr Trj/KillAV.FJ


A backdoor also known as: Win32.Trojan.WisdomEyes.16070401.9500.9979 Backdoor.Trojan Win32/Cyreho.A Trojan.DownLoad2.18592 W32.Trojan.Trojan-Backdoor-Cele TR/Dldr.Ftp.E Trojan/Win32.Unknown Trojan.Heur.VP.E82FB1 Trojan:Win32/Cyreho.A Trojan.VBRA.02524 Win32.Trojan.Dldr.Oyeu Trojan.Win32.Darkddoser W32/VB.NZ!tr Win32/Trojan.9b7


Additionally, we have observed instances of the IsSpace and TidePool malware families being delivered via the same techniques.


A backdoor also known as: Backdoor.Pccontrol.2.1 Backdoor.Pccontrol.2.1 Backdoor.PcControl!Vqgcs0rOUEs PcControl.C Backdoor.Win32.PcControl.21 Backdoor.Pccontrol.2.1 Trojan.Win32.PcControl.cbiyio Backdoor.Pccontrol.2.1 Backdoor.Win32.PcControl.21 Backdoor.Pccontrol.2.1 BackDoor.Control.21 BKDR_PCCONTROL.A W32/Risk.SRBI-7988 BDS/PcControl.21.1 Trojan[Backdoor]/Win32.PcControl Backdoor:Win32/PCControl.2_1 Backdoor.Pccontrol.2.1 Backdoor.Pccontrol.2.1 Backdoor.PcControl Backdoor.Win32.PcControl.aa Win32/PcControl.21 W32/PcCont.21!tr.bdr BackDoor.Pccontrol.C Bck/PcControl.21


A backdoor also known as: Trojan.Bacterio61.A Trojan.Bacterio61.A Trojan.Bacterio61.r3 Trojan.Bacterio61.A Trojan.Bacterio61.A Trojan.Bacterio61!xosA0+L/cz0 Trojan.Dropper TROJ_BACTERIO.61 Trojan.Win32.Bacterio61 Trojan.Win32.Bacterio61.fdse Trojan.Win32.RenAll[h] PE:Trojan.Bacterio61!1073791980 Trojan.Bacterio61.A TrojWare.Win32.RenAll Trojan.Bacterio61.A Trojan.Bacterio61.Win32.1 TROJ_BACTERIO.61 W32/Virus.NFQE-4477 Trojan/Win32.Bacterio61 Win32.Troj.Bacterio61.kcloud Win-Trojan/RenAll.94208 Trojan.Bacterio61.A Win32.Trojan.Bacterio61.ddnb W32/Bacterio61.A!tr Trojan.Win32.Bacterio61.aW


A backdoor also known as: HW32.CDB.3cb9 Virus.Win32.Patched