We believe that an industry-wide collaboration and information-sharing is important in defending customers against this complex piece of malware .


TUESDAY , APRIL 9 , 2019 Gustuff banking botnet targets Australia EXECUTIVE SUMMARY Cisco Talos has uncovered a new Android-based campaign targeting Australian financial institutions .


Although this malware 's credential-harvest mechanism is not particularly sophisticated , it does have an advanced self-preservation mechanism .


Aside from the credential stealing , this malware also includes features like the theft of users ' contact list , collecting phone numbers associated names , and files and photos on the device .


But that does n't mean companies and organizations are out of the woods .


They should still be on the lookout for these kinds of trojans , as the attackers could target corporate accounts that contain large amounts of money .


A motivated attacker can use this trojan to harvest usernames and passwords and then reuse them to login into the organization 's system where the victim works .


Corporations can protect themselves from these side-channel attacks by deploying client-based two-factor authentication , such as Duo Security .


One of the most impressive features of this malware is its resilience .


If the command and control ( C2 ) server is taken down , the malicious operator can still recover the malware control by sending SMS messages directly to the infected devices .


This makes the taking down and recovery of the network much harder and poses a considerable challenge for defenders .


THE CAMPAIGN The malware 's primary infection vector is SMS .


Just like the old-school mail worms that used the victim 's address book to select the next victims , this banking trojan 's activation cycle includes the exfiltration of the victim 's address book .


The trojan will receive instructions from the C2 to spread .


Usually , this message targets four or five people at a time .


The body contains a message and URL .


Again , the concept is that new victims are more likely to install the malware if the SMS comes from someone they know .


When a victim tries to access the URL in the SMS body , the C2 will check if the mobile device meets the criteria to receive the malware ( see infrastructure section ) .


However , Talos has identified that was used at least since November 2018 .


During the investigation , Talos was also able to determine that the same infrastructure has been used to deploy similar campaigns using different versions of the malware .


Distribution of victims .


Talos assess with high confidence that this campaign is targeting Australian financial institutions based on several factors .


Our Umbrella telemetry shows that the majority of the request comes from Australia and the majority of the phone numbers infected have the international indicative for Australia .


Finally , the specific overlays are designed for Australian financial institutions , and Australia is one of the geographic regions that is accepted by the C2 .


Our data shows , on average , about three requests per hour to the drop host .


This data , when analyzed with the number of commands to send SMSs that Talos received during the investigation , lead us to conclude that the malicious operator is aggressively spreading the malware , but that does n't seem to result in the same number of new infections .


While doing our investigation we were able to identify other malware packages with different names .


Some of these might have been used on old campaigns or were already prepared for new campaigns .


MALWARE TECHNICAL DETAILS During our investigation , researchers uncovered a malware known as " Gustuff. '' .


Given the lack of indicators of compromise , we decided to check to see if this was the same malware we had been researching .


Our Threat Intelligence and Interdiction team found the Gustuff malware being advertised in the Exploit.in forum as a botnet for rent .


The seller , known as " bestoffer , '' was , at some point , expelled from the forum .


Gustuff advertising screenshot The companies advertised in the image above were from Australia , which matches up with the campaign we researched .


The screenshots provided by the author align with the advertised features and the features that we discovered while doing our analysis .


Admin panel The administration panel shows the application configuration , which matches the commands from the C2 .


Country selection The administration console screenshots also show the ability to filter the results by country .


In this case , " AU '' is the code shown , which is Australia .


Design In the manifest , the malware requests a large number of permissions .


However , it does n't request permissions like BIND_ADMIN .


Permissions in the manifest This malware is designed to avoid detection and analysis .


The code is not only obfuscated but also packed .


The packer , besides making the static analysis more complex , will break the standard debugger .


Manifest activity declaration Class list inside the dex file The main malware classes are packed , to a point where the class defined in the manifest has a handler for the MAIN category that does not exist in the DEX file .


Error when trying to debug the malware using the Android Studio IDE .


One of the side effects of this packer is the inability of Android Studio IDE to debug the code .


Since the class does not exist at startup , the application does not run on the debugger .


Check code for emulators As part of its defense , the malware payload first checks for emulators to prevent analysis on sandboxes .


It checks for different kinds of emulators , including QEMU , Genymotion , BlueStacks and Bignox .


If the malware determines that is not running on an emulator , it then performs additional checks to ensure that it wo n't be detected .


Code to check the existence of SafetyNet Google API It also checks if the Android SafetyNet is active and reporting back to the C2 .


This helps the C2 define what actions it can do before being detected on the mobile device .


The trojan uses the Android Accessibility API to intercept all interactions between the user and the mobile device .


For example , when a button is clicked , a view is focused , etc .


'' For each interaction , the malware will check if the generator is a package that belongs to the anti-virus list , the malware will abuse another feature of the Accessibility API .


There is a function called " performGlobalAction '' with the description below .


Android documentation describes that function as " a global action .


For example , going back , going home , opening recents , etc .


'' The trojan calls this function with the action GLOBAL_ACTION_BACK , which equals the pressing of the back button on the device , thus canceling the opening of the anti-virus application .


The same event interception is used to place the webview overlay when the user tries to access the targeted applications , allowing it to display its overlay , thus intercepting the credentials .


The beaconing only starts after the application is installed and removed from the running tasks .


Beaconing information The ID is generated for each installation of the malware , while the token remains unique .


The beaconing is sent to the URL http : // /api/v2/get.php with an interval of 60 seconds .


Answer from the C2 The C2 will check the country field , if it 's empty or if the country is not targeted , it will reply with a " Unauthorized '' answer .


List of available commands The command names are self-explanatory .


It is a custom obfuscation partly based on base85 encoding , which is in itself unusual , in malware .


Activation cycle As we have explained above , the malware has several defence mechanisms .


Beside the obfuscation and the environment checks , the malware also has some interesting anti-sandbox mechanisms .


The user needs to press the " close '' button to finish the installation .


However , this wo n't close the application , it will send it to the background , instead .


The beaconing will only start after the application is removed from the background , ultimately stopping it .


This will be the trigger for the service to start the beaconing .


As mentioned previously , the beaconing is done every 60 seconds .


However , no command is received from the C2 until the inactiveTime field ( see beaconing information image above ) has at least the value of 2000000 .


This time resets every time the user performs some activity .


After the checks , the malware becomes active , but first , it goes through seven steps , each one calling a different command : uploadPhoneNumbers : Exfiltrates all phone numbers that are in the contact list .


Aside from the natural value of phone numbers associated with the names of their owners .


Using the SMS has an initial infection vector is another possibility for the exfiltration .


One of the purposes of the exfiltration of the contact list is to use them to attack other victims using SMS as an initial vector .


checkApps : Asks the malware to see if the packages sent as parameters are installed .


The malware contains a list of 209 packages hardcoded in its source code .


List of packages received from the C2 adminNumber : Setup of the admin phone number .


In our case , the administrator phone number belongs to a mobile network in Australia .


Phone number for administration changeServer : At this point , the malware changes the C2 to a new host , even though the API and communication protocol continues to be the same .


Change server request The URL 's for the new server is obfuscated , preventing easy network identification .


changeActivity : This command will set up the webview to overlay any of the target activities .


params : This command allows the malicious operator to change configuration parameters in the malware .


Command to change the beaconing changeArchive : The final command of the activation cycle is the download of an archive .


This archive is stored in the same host has the webviews .


The archive is a ZIP containing several files , which is protected with a password .


These activities depend on the device configuration .


These are adapted to the information the malicious operator wants to retrieve .


The first webview overlay is created on step 6 of the activation cycle .


This file contains all HTML , CSS and PNG files necessary to create overlays .


Talos found 189 logos from banks to cryptocurrency exchanges inside the archive , all of which could be targeted .


The archive also contained all the necessary codes to target Australian financial institutions .


The overlays are activated by the malicious operator using the command changeActivity , as seen on step 5 of the activation cycle .


In this case , we can see that the HTML code of the overlay is stored in the C2 infrastructure .


However , since the archive that is downloaded into the device has all the necessary information and the malicious actor has access to the device via SMS , the malicious operator can keep its activity even without the C2 infrastructure .


Infrastructure The infrastructure supporting this malware is rather complex .


It is clear that on all stages there are at least two layers .


The infrastructure has several layers , although not being very dynamic , still has several layers each one providing some level of protection .


All the IP addresses belong to the same company Hetzner , an IP-hosting firm in Germany .


COVERAGE Cisco Cloud Web Security ( CWS ) or Web Security Appliance ( WSA ) web scanning prevents access to malicious websites and detects malware used in these attacks .


Open Source SNORTⓇ Subscriber Rule Set customers can stay up to date by downloading the latest rule pack available for purchase on Snort.org .


INDICATORS OF COMPROMISE ( IOCS ) Domains Facebook-photos-au.su Homevideo2-12l.ml videohosting1-5j.gq URLs hxxp : //88.99.227 [ .


] 26/html2/2018/GrafKey/new-inj-135-3-dark.html hxxp : //88.99.227 [ .


] 26/html2/arc92/au483x.zip hxxp : //94.130.106 [ .


] 117:8080/api/v1/report/records.php hxxp : //88.99.227 [ .


] 26/html2/new-inj-135-3-white.html hxxp : //facebook-photos-au [ .


] ml/mms3/download_3.php IP addresses 78.46.201.36 88.99.170.84 88.99.227.26 94.130.106.117 88.99.174.200 88.99.189.31 Hash 369fcf48c1eb982088c22f86672add10cae967af82613bee6fb8a3669603dc48 b2d4fcf03c7a8bf135fbd3073bea450e2e6661ad8ef2ab2058a3c04f81fc3f3e


8f5d5d8419a4832d175a6028c9e7d445f1e99fdc12170db257df79831c69ae4e a5ebcdaf5fd10ec9de85d62e48cc97a4e08c699a7ebdeab0351b86ab1370557d 84578b9b2c3cc1c7bbfcf4038a6c76ae91dfc82eef5e4c6815627eaf6b4ae6f6


6bdfb79f813448b7f1b4f4dbe6a45d1938f3039c93ecf80318cedd1090f7e341 ADDITIONAL INFORMATION Packages monitored pin.secret.access com.chase.sig.android com.morganstanley.clientmobile.prod com.wf.wellsfargomobile com.citi.citimobile com.konylabs.capitalone com.infonow.bofa com.htsu.hsbcpersonalbanking com.usaa.mobile.android.usaa


com.schwab.mobile com.americanexpress.android.acctsvcs.us com.pnc.ecommerce.mobile com.regions.mobbanking com.clairmail.fth com.grppl.android.shell.BOS com.tdbank com.huntington.m com.citizensbank.androidapp com.usbank.mobilebanking com.ally.MobileBanking com.key.android com.unionbank.ecommerce.mobile.android com.mfoundry.mb.android.mb_BMOH071025661


com.bbt.cmol com.sovereign.santander com.mtb.mbanking.sc.retail.prod com.fi9293.godough com.commbank.netbank org.westpac.bank org.stgeorge.bank au.com.nab.mobile au.com.bankwest.mobile au.com.ingdirect.android org.banksa.bank com.anz.android com.anz.android.gomoney com.citibank.mobile.au org.bom.bank com.latuabancaperandroid


com.comarch.mobile com.jpm.sig.android com.konylabs.cbplpat by.belinvestbank no.apps.dnbnor com.arkea.phonegap com.alseda.bpssberbank com.belveb.belvebmobile com.finanteq.finance.ca pl.eurobank pl.eurobank2 pl.noblebank.mobile com.getingroup.mobilebanking hr.asseco.android.mtoken.getin pl.getinleasing.mobile com.icp.ikasa.getinon


eu.eleader.mobilebanking.pekao softax.pekao.powerpay softax.pekao.mpos dk.jyskebank.mobilbank com.starfinanz.smob.android.bwmobilbanking eu.newfrontier.iBanking.mobile.SOG.Retail com.accessbank.accessbankapp com.sbi.SBIFreedomPlus com.zenithBank.eazymoney net.cts.android.centralbank com.f1soft.nmbmobilebanking.activities.main com.lb.smartpay com.mbmobile


com.db.mobilebanking com.botw.mobilebanking com.fg.wallet com.sbi.SBISecure com.icsfs.safwa com.interswitchng.www com.dhanlaxmi.dhansmart.mtc com.icomvision.bsc.tbc hr.asseco.android.jimba.cecro com.vanso.gtbankapp com.fss.pnbpsp com.mfino.sterling cy.com.netinfo.netteller.boc ge.mobility.basisbank com.snapwork.IDBI


com.lcode.apgvb com.fact.jib mn.egolomt.bank com.pnbrewardz com.firstbank.firstmobile wit.android.bcpBankingApp.millenniumPL com.grppl.android.shell.halifax com.revolut.revolut de.commerzbanking.mobil uk.co.santander.santanderUK se.nordea.mobilebank com.snapwork.hdfc com.csam.icici.bank.imobile com.msf.kbank.mobile


com.bmm.mobilebankingapp net.bnpparibas.mescomptes fr.banquepopulaire.cyberplus com.caisseepargne.android.mobilebanking com.palatine.android.mobilebanking.prod com.ocito.cdn.activity.creditdunord com.fullsix.android.labanquepostale.accountaccess mobi.societegenerale.mobile.lappli com.db.businessline.cardapp com.skh.android.mbanking com.ifs.banking.fiid1491


de.dkb.portalapp pl.pkobp.ipkobiznes pl.com.suntech.mobileconnect eu.eleader.mobilebanking.pekao.firm pl.mbank pl.upaid.nfcwallet.mbank eu.eleader.mobilebanking.bre pl.asseco.mpromak.android.app.bre pl.asseco.mpromak.android.app.bre.hd pl.mbank.mnews eu.eleader.mobilebanking.raiffeisen pl.raiffeisen.nfc hr.asseco.android.jimba.rmb


com.advantage.RaiffeisenBank pl.bzwbk.ibiznes24 pl.bzwbk.bzwbk24 pl.bzwbk.mobile.tab.bzwbk24 com.comarch.mobile.investment com.android.vending com.snapchat.android jp.naver.line.android com.viber.voip com.gettaxi.android com.whatsapp com.tencent.mm com.skype.raider com.ubercab com.paypal.android.p2pmobile


com.circle.android com.coinbase.android com.walmart.android com.bestbuy.android com.ebay.gumtree.au com.ebay.mobile com.westernunion.android.mtapp com.moneybookers.skrillpayments com.gyft.android com.amazon.mShop.android.shopping com.comarch.mobile.banking.bgzbnpparibas.biznes pl.bnpbgzparibas.firmapp com.finanteq.finance.bgz pl.upaid.bgzbnpp


de.postbank.finanzassistent pl.bph de.comdirect.android com.starfinanz.smob.android.sfinanzstatus de.sdvrz.ihb.mobile.app pl.ing.mojeing com.ing.mobile pl.ing.ingksiegowosc com.comarch.security.mobilebanking com.comarch.mobile.investment.ing com.ingcb.mobile.cbportal de.buhl.finanzblick pl.pkobp.iko pl.ipko.mobile pl.inteligo.mobile de.number26.android


pl.millennium.corpApp eu.transfer24.app pl.aliorbank.aib pl.corelogic.mtoken alior.bankingapp.android com.ferratumbank.mobilebank com.swmind.vcc.android.bzwbk_mobile.app de.schildbach.wallet piuk.blockchain.android com.bitcoin.mwallet com.btcontract.wallet com.bitpay.wallet com.bitpay.copay btc.org.freewallet.app org.electrum.electrum


com.xapo com.airbitz com.kibou.bitcoin com.qcan.mobile.bitcoin.wallet me.cryptopay.android com.bitcoin.wallet lt.spectrofinance.spectrocoin.android.wallet com.kryptokit.jaxx com.wirex bcn.org.freewallet.app com.hashengineering.bitcoincash.wallet bcc.org.freewallet.app com.coinspace.app btg.org.freewallet.app net.bither


co.edgesecure.app com.arcbit.arcbit distributedlab.wallet de.schildbach.wallet_test com.aegiswallet com.plutus.wallet com.coincorner.app.crypt eth.org.freewallet.app secret.access secret.pattern RuMMS : The Latest Family of Android Malware Attacking Users in Russia Via SMS Phishing April 26 , 2016 Introduction Recently we observed an Android malware family being used to attack users in Russia .


The malware samples were mainly distributed through a series of malicious subdomains registered under a legitimate domain belonging to a well-known shared hosting service provider in Russia .


Because all the URLs used in this campaign have the form of hxxp : //yyyyyyyy [ .


] XXXX.ru/mms.apk ( where XXXX.ru represents the hosting provider ’ s domain ) , we named this malware family RuMMS .


To lure the victims to download the malware , threat actors use SMS phishing – sending a short SMS message containing a malicious URL to the potential victims .


Unwary users who click the seemingly innocuous link will have their device infected with RuMMS malware .


Figure 1 describes this infection process and the main behaviors of RuMMS .


On April 3 , 2016 , we still observed new RuMMS samples emerging in the wild .


Within this time period , we identified close to 300 samples belonging to this family ( all sample hashes are listed in the Appendix ) .


After landing on the victim ’ s phone , the RuMMS apps will request device administrator privileges , remove their icons to hide themselves from users , and remain running in the background to perform a series of malicious behaviors .


So far we have identified the following behaviors : Sending device information to a remote command and control ( C2 ) server .


Contacting the C2 server for instructions .


Sending SMS messages to financial institutions to query account balances .


Uploading any incoming SMS messages ( including the balance inquiry results ) to the remote C2 server .


Each of these behaviors is under the control of the remote C2 server .


In other words , the C2 server can specify the message contents to be sent , the time period in which to forward the voice call , and the recipients of outgoing messages .


As part of our investigation into this malware , we emulated an infected Android device in order to communicate with the RuMMS C2 server .


During one session , the C2 server commanded our emulated device to send four different SMS messages to four different phone numbers , all of which were associated with Russian financial institutions .


At least three of the messages were intended to check a user ’ s account balance at the institution ( we could not confirm the purpose of the fourth ) .Through additional research , we identified several forum posts where victims complained of funds ( up to 600 rubles ) were transferred out of their accounts after RuMMS infected their phones .


We do not know exactly how many people have been infected with RuMMS malware .


However , our data suggests that there have been at least 2,729 infections between January 2016 and early April 2016 , with a peak in March of more than 1,100 infections .


Smishing ( SMS phishing ) is currently the primary way threat actors are distributing the malware .


An example SMS message is shown in Figure 1 .


All of the URLs reference the file “ mms.apk ” and all use the domain “ XXXX.ru ” , which belongs to a top five shared hosting platform in Russia ( the domain itself has been obfuscated to anonymize the provider ) .


The threat actors registered at least seven subdomains through the hosting provider , each consisting of eight random-looking characters ( asdfgjcr , cacama18 , cacamadf , konkonq2 , mmsmtsh5 , riveroer , and sdfkjhl2 .


) As of this writing , no files were hosted at any of the links .


Use of a shared hosting service to distribute malware is highly flexible and low cost for the threat actors .


It is also much harder for network defenders or researchers to track a campaign where the infrastructure is a moving target .


Many top providers in Russia offer cheap prices for their shared hosting services , and some even provide free 30-day trial periods .


Threat actors can register subdomains through the hosting provider and use the provider ’ s services for a short-period campaign .


In addition , these out-of-the-box hosting services usually provide better infrastructure than the attackers could manage to construct ( or compromise ) themselves .


RuMMS Code Analysis All RuMMS samples share the same behaviors , major parts of which are shown in Figure 1 .


We used a sample app named “ org.starsizew ” with an MD5 of d8caad151e07025fdbf5f3c26e3ceaff to analyze RuMMS ’ s code .


Several of the main components of RuMMS are shown in Figure 2 .


The activity class “ org.starsizew.MainActivity ” executes when the app is started .


It first starts another activity defined in “ org.starsizew.Aa ” to request device administrator privileges , and then calls the following API of “ android.content.pm.PackageManager ” ( the Android package manager to remove its own icon on the home screen in order to conceal the existence of RuMMS from the user : At the same time , ” org.starsizew.MainActivity ” will start the main service as defined in “ org.starsizew.Tb ” , and use a few mechanisms to keep the main service running continuously


The class “ org.starsizew.Tb ” also has a self-monitoring mechanism to restart itself when its own onDestroy API is triggered .


All those functions are implemented in asynchronous tasks by “ org.starsizew.i ” .


Its major functionality is also implemented through the call of the asynchronous task ( “ org.starsizew.i ” ) , including uploading the incoming SMS messages to the remote C2 server and executing any commands as instructed by the remote attacker .


C2 Communication The C2 communication includes two parts : sending information to the remote HTTP server and parsing the server ’ s response to execute any commands as instructed by the remote attackers .


Method doInBackground : to send information to remote C2 server As seen from the major code body of method doInBackground shown in Figure 3 ( some of the original classes and methods are renamed for easier understanding ) , there are three calls to HttpPost with different contents as parameters .


At line 5 , local variable v4 specifies the first parameter url , which can be changed by the remote C2 server later .


These URLs are all in the form of “ http : // $ C2. $ SERVER. $ IP/api/ ?


The second parameter is a constant string “ POST ” , and the third parameter is a series of key-value pairs to be sent , assembled at runtime .


It only has two parts , the method indicated by word “ info ” and the victim identifier .


sms_send : to send C2-specified SMS messages to C2-specified recipients .


sms_grab : to upload periodically the SMS messages in the inbox to C2 server .


delivery : to deliver specified text to all victim ’ s contacts ( SMS worming ) .


call_number : to forward phone calls to intercept voice based two-factor authentication .


new_url : to change the URL of the C2 server in the app preference .


ussd : to call a C2-specified phone number .


Method onPostExecute : to handle instructions from remote C2 Figure 6 shows an example response sent back from one C2 server .


Note that inside this single response , there is one “ install_true ” command , one “ sms_grab ” command and four “ sms_send ” commands .


With the four “ sms_send ” commands , the messages as specified in the key “ text ” will be sent immediately to the specified short numbers .


Example Response in JSON format In particular , short number “ +7494 ” is associated with a payment service provider in Russia .


For example , sending text “ Balance ” will trigger a response with the victim ’ s wallet balance .


Sending text “ confirm 1 ” will include proof of payment .


Sending text “ call on ” will activate the USSD payment confirmation service .


During our investigation , we observed the C2 server sending multiple “ balance ” commands to different institutions , presumably to query the victim ’ s financial account balances .


These could include resetting the user ’ s PIN , enabling or disabling various alerts and confirmations , and confirming the user ’ s identity .


Figure 7 lists the IP addresses of these C2 servers , the number of RuMMS apps that connect to each of them , and the example URL used as the first parameter of the HttpPost operation ( used in the code of Figure 3 ) .


This indicates that multiple C2 servers were used in this campaign , but one ( 37.1.207.31 ) was the most heavily used .


In the quadrant , the smaller boxes in blue-gray represent particular apps in the RuMMS family , while the bigger boxes in deep-blue represent C2 servers used by some RuMMS apps .


In this figure we have 11 RuMMS samples , all of which were hosted on the website as shown in the “ y ” axis .


The dates on the “ x ” axis show the dates when we first saw these apps in the wild .


Threat actors used different websites to host different payloads at different times .


This kind of “ moving target ” behavior made it harder to track their actions .


C2 servers are shared by multiple samples .


RuMMS samples , hosting sites , C2 servers from Jan. 2016 to Mar .


Figure 9 shows the number of RuMMS infections recorded in the last four months .


In February , we recorded 767 infections .


In March , it peaked at 1,169 infections .


In April , at the time of writing this post , we recorded 413 RuMMS infections .


Although the propagation trend seems to be slowing down a bit , the figure tells us that RuMMS malware is still alive in the wild .


We continue to monitor its progress .


The recent RuMMS campaign shows that Smishing is still a popular means for threat actors to distribute their malware .


In addition , the use of shared-hosting providers adds flexibility to the threat actor ’ s campaign and makes it harder for defending parties to track these moving targets .


Fortunately , FireEye Mobile Threat Prevention platform can recognize the malicious SMS and networking behaviors used by these RuMMS samples , and help us quickly identify the threat .


All of the victims are located in Italy .


All of these Google Play Store pages have been taken down by Google .


We believe this spyware platform is developed by an Italian company called eSurv , which primarily operates in the business of video surveillance .


According to public records it appears that eSurv began to also develop intrusion software in 2016 .


Worryingly , some of the modifications enforced by the spyware might expose the infected devices to further compromise or data tampering .


Disguised Spyware Uploaded on Google Play Store We identified previously unknown spyware apps being successfully uploaded on Google Play Store multiple times over the course of over two years .


While details would vary , all of the identified copies of this spyware shared a similar disguise .


Often the app description on the Play Store would reference some SMS messages the targets would supposedly receive leading them to the Play Store page .


All of the Play Store pages we identified and all of the decoys of the apps themselves are written in Italian .


According to Google , whom we have contacted to alert about our discoveries , nearly 25 variants of this spyware were uploaded on Google Play Store .


While Google did not share with us the total number of infected devices , they confirmed that one of these malicious apps collected over 350 installations through the Play Store , while other variants collected few dozens each , and that all infections were located in Italy .


We have directly observed multiple copies of Exodus with more than 50 installs and we can estimate the total number of infections to amount in the several hundreds , if not a thousand or more .


Stage 1 : Exodus One The first stage installed by downloading the malicious apps uploaded on Google Play Store only acts as a dropper .


Following are some examples of the decoys used by these droppers : The purpose of Exodus One seems to be to collect some basic identifying information about the device ( namely the IMEI code and the phone number ) and send it to the Command & Control server .


This is usually done in order to validate the target of a new infection .


This is further corroborated by some older and unobfuscated samples from 2016 , whose primary classes are named CheckValidTarget .


During our tests the spyware was upgraded to the second stage on our test device immediately after the first check-ins .


This suggests that the operators of the Command & Control are not enforcing a validation of the targets .


Additionally , during a period of several days , our infected test device was never remotely disinfected by the operators .


For the purpose of this report we analyze here the Exodus One sample with hash 8453ce501fee1ca8a321f16b09969c517f92a24b058ac5b54549eabd58bf1884 which communicated with the Command & Control server at 54.71.249.137 .


Other samples communicated with other servers listed at the bottom of this report .


Exodus One checks-in by sending a POST request containing the app package name , the device IMEI and an encrypted body containing additional device information .


The encrypted body is composed of various identifiers which are joined together : doFinal ( ) is called to encrypt the device information string : The user agent string is built from the package name and IMEI number : Finally the HTTP request is sent to the server at https : //54.71.249.137/eddd0317-2bdc-4140-86cb-0e8d7047b874 .


Many of the strings in the application are XOR 'd with the key Kjk1MmphFG : After some additional requests , the dropper made a POST request to https : //54.71.249.137/56e087c9-fc56-49bb-bbd0-4fafc4acd6e1 which returned a zip file containing the second stage binaries .


At least in most recent versions , as of January 2019 , the Zip archive would actually contain the i686 , arm and arm64 versions of all deployed binaries .


File Name Modified Date SHA256 null_arm 2018-02-27 06:44:00 48a7dd672931e408662d2b5e1abcd6ef00097b8ffe3814f0d2799dd6fd74bd88 null_i686 2018-02-27 06:44:00 c228a534535b22a316a97908595a2d793d0fecabadc32846c6d1bfb08ca9a658 null_arm64 2018-02-27 06:43:00 48a7dd672931e408662d2b5e1abcd6ef00097b8ffe3814f0d2799dd6fd74bd88


sepolicy-inject_arm 2019-01-08 04:55:00 47449a612697ad99a6fbd6e02a84e957557371151f2b034a411ebb10496648c8 sepolicy-inject_arm64 2019-01-08 04:55:00 824ad333320cbb7873dc49e61c14f749b0e0d88723635524463f2e6f56ea133a sepolicy-inject_i686 2019-01-08 04:55:00 13ec6cec511297ac3137cf7d6e4a7c4f5dd2b24478a06262a44f13a3d61070b6


rootdaemon_arm 2019-01-08 04:55:00 00c787c0c0bc26caf623e66373a5aaa1b913b9caee1f34580bdfdd21954b7cc4 rootdaemon_arm64 2019-01-08 04:55:00 3ee3a973c62ba5bd9eab595a7c94b7a26827c5fa5b21964d511ab58903929ec5 mike.jar 2018-12-06 05:50:00 a42a05bf9b412cd84ea92b166d790e8e72f1d01764f93b05ace62237fbabe40e


rootdaemon_i686 2019-01-08 04:55:00 b46f282f9a1bce3798faee3212e28924730a657eb93cda3824c449868b6ee2e7 zygotedaemonarm 2019-01-08 04:55:00 e3f65f84dd6c2c3a5a653a3788d78920c0321526062a6b53daaf23fa57778a5f zygotedaemonarm64 2019-01-08 04:55:00 11499ff2418f4523344de81a447f6786fdba4982057d4114f64db929990b4b59


zygotedaemoni686 2019-01-08 04:55:00 3c9f08b3280851f54414dfa5a57f40d3b7be7b73736fa0ba21b078e75ce54d33 sapp.apk 2019-01-08 04:53:00 4bf1446c412dd5c552539490d03e999a6ceb96ae60a9e7846427612bec316619 placeholder 2018-03-29 16:31:00 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855


After download , Exodus One would dynamically load and execute the primary stage 2 payload mike.jar using the Android API DexClassLoader ( ) .


Similarly to another Android spyware made in Italy , originally discovered by Lukas Stefanko and later named Skygofree and analyzed in depth by Kaspersky Labs , Exodus also takes advantage of " protectedapps '' , a feature in Huawei phones that allows to configure power-saving options for running applications .


Additionally , rootdaemon attempts to remove its own power usage statistics from Huawei phones ' SystemManager : Similarly , the malicious application probably attempts to minimize traces on Samsung phones by adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/apm_sp_status_of_apps.xml the following lines : And adding to the file /data/data/com.samsung.android.securitylogagent/shared_prefs/com.samsung.android.securitylogagent_preferences.xml


these lines instead : Data Collection and Exfiltration As mentioned , mike.jar equips the spyware with extensive collection capabilities , including : Retrieve a list of installed applications .


Record surroundings using the built-in microphone in 3gp format .


Retrieve the browsing history and bookmarks from Chrome and SBrowser ( the browser shipped with Samsung phones ) .


Extract the calls log .


Extract the address book .


Extract the contacts list from the Facebook app .


Take a screenshot of any app in foreground .


Extract information from th GMail app .


Dump data from the IMO messenger app .


Extract call logs , contacts and messages from the Skype app .


Extract messages and the encryption key from the Telegram app .


Dump data from the Viber messenger app .


Extract logs from WhatsApp .


Retrieve media exchanged through WhatsApp .


Extract the Wi-Fi network 's password .


Extract data from WeChat app .


Extract current GPS coordinates of the phone .


While some of these acquisition are performed purely through code in mike.jar , some others that require access to , for example , SQLite databases or other files in the application 's storage are performed through rootdaemon instead , which should be running with root privileges .


Ports 6203 and 6204 : Facebook extraction service .


Port 6205 : Gmail extraction service .


Port 6207 : Viber extraction service .


Port 6209 : Telegram extraction service .


Port 6210 : SBrowser extraction service .


Port 6212 : Chrome extraction service .


These services appear to be running on all network interfaces and are therefore accessible to anyone sharing a local network with an infected device .


Following we can see an example of a connection to port 6209 which is used to extract data from the Telegram app .


We are able to send commands to the service such as dumpmsgdb or getkey ( which dumps the tgnet.dat file ) .


Data is eventually exfiltrated over a TLS connection to the Command & Control server ws.my-local-weather [ .


As mentioned before , our test device was automatically from stage one to stage two , which started collecting data .


For example , the password of the WiFi network used by the phone was stored in the folder /storage/emulated/0/.lost+found/0BBDA068-9D27-4B55-B226-299FCF2B4242/ using the following file name format DD_MM_2019_HH_mm_ss_XXXXXXXXXXXXX.txt.crypt ( the datetime followed by the IMEI ) .


This payload will then attempt to instantiate a remote reverse /system/bin/sh shell to the Command & Control ws.my-local-weather [ .


It is worth noticing that this remote reverse shell does not employ any transport cryptography .


This local port is used by Exodus Two to execute various commands on the Android device , such as enabling or disabling certain services , or parsing app databases .


For example , if an infected device is connected to a public Wi-Fi network any other host will be able to obtain a terminal on the device without any form of authentication or verification by simply connecting to the port .


If the mobile operator does n't enforce proper client isolation , it is possible that the infected devices are also exposed to the rest of the cellular network .


Obviously , this inevitably leaves the device open not only to further compromise but to data tampering as well .


null is not the only payload opening a shell on the phone .


Sending the command sh to TCP port 6200 results in a full terminal being dropped : Sending the command cmd followed by a proper terminal command will execute it and print the output ( in the example we use id which displays the identity of the system user running the issued commands ) : Doing the same as above but with command sucmd will run the terminal command as root : Other commands supported by rootdaemon on TCP port 6200 are su ( which in our tests did n't properly work ) , loadsocketpolicy , loadfilepolicy , remount and removeroot


However , the persistent presence of Italian language both on the Google Play Store pages as well as inside the spyware code was a clear sign that an Italian actor was behind the creation of this platform .


" Mundizza '' is a dialectal word , a derivative of the proper Italian word " immondizia '' that translates to " trash '' or " garbage '' in English .


Interestingly , " mundizza '' is typical of Calabria , a region in the south of Italy , and more specifically it appears to be language native of the city of Catanzaro .


While not too seriously , these elements made us restrict our research into surveillance companies from the region .


Overlapping Infrastructure with eSurv Surveillance Cameras The Command & Control domain configured in several of the malicious applications found on Google Play Store , ws.my-local-weather [ .


] com , points to the IP address 54.69.156.31 which serves a self-signed TLS certificate with the certificate common name MyCert and fingerprint 11:41:45:2F : A7:07:23:54 : AE:9A : CE : F4 : FE:56 : AE : AC : B1 : C2:15:9F:6A : FC:1E : CC:7D : F8:61 : E3:25:26:73:6A .


A search for this certificate fingerprint on the Internet scanning service Censys returns 8 additional servers : IP address 34.208.71.9 34.212.92.0 34.216.43.114 52.34.144.229 54.69.156.31 54.71.249.137 54.189.5.198 78.5.0.195 207.180.245.74 Opening the Command & Control web page in a browser presents a Basic Authentication prompt : Closing this prompt causes the server to send a " 401 Unauthorized Response '' with an " Access Denied '' message in Italian


All of the other IP address we discovered sharing the same TLS certificate behave in the same way .


The Command & Control server also displays a favicon image which looks like a small orange ball .


Many of these servers are control panels for video surveillance systems developed by the Italian company eSurv , based in Catanzaro , in Calabria , Italy .


eSurv 's logo is identical to the Command & Control server favicon .


Older samples connecting to eSurv Finally , Google shared with us some older samples of Exodus One ( with hashes 2055584625d24687bd027a63bc0b8faa7d1a854a535de74afba24840a52b1d2f and a37f5d2418c5f2f64d06ba28fe62edee1293a56158ddfa9f04020e316054363f ) which are not obfuscated and use the following disguise : The configuration of these older samples


is very similar to newer ones , but it provides additional insights being not obfuscated : Firstly we can notice that , instead of generic domain names or IP addresses , these samples communicated with a Command & Control server located at attiva.exodus.esurv [ .


] it ( " attiva '' is the Italian for " activate '' ) .


( We named the spyware " Exodus '' after this Command & Control domain name .


) Following is the snippet of code in these older Exodus One samples showing the connection to the Command & Control : Below is the almost identical composition of the request to the Command & Control server in mike.jar ( also containing the path 7e661733-e332-429a-a7e2-23649f27690f ) : To further corroborate the connection of the Exodus spyware with eSurv , the domain attiva.exodus.esurv.it resolves to the IP 212.47.242.236 which , according to


public passive DNS data , in 2017 was used to host the domain server1cs.exodus.connexxa.it .


Connexxa was a company also from Catanzaro .


According to publicly available information , the founder of Connexxa seems to also be the CEO of eSurv .


Interestingly , we found other DNS records mostly from 2017 that follow a similar pattern and appear to contain two-letters codes for districts in Italy : Server City server1bo.exodus.connexxa [ .


] it Bologna server1bs.exodus.connexxa [ .


] it Brescia server1cs.exodus.connexxa [ .


] it Cosenza server1ct.exodus.connexxa [ .


] it Catania server1fermo.exodus.connexxa [ .


] it server1fi.exodus.connexxa [ .


] it Firenze server1gioiat.exodus.connexxa [ .


] it Napoli server1rc.exodus.connexxa [ .


] it Reggio Calabria server2ct.exodus.connexxa [ .


] it Catania server2cz.exodus.connexxa [ .


] it Catanzaro server2fi.exodus.connexxa [ .


] it Milano server2rc.exodus.connexxa [ .


] it Reggio Calabria server3bo.exodus.connexxa [ .


] it Catania server3.exodus.connexxa [ .


] it Firenze server4fi.exodus.connexxa [ .


] it Firenze serverrt.exodus.connexxa [ .


Further details in it reflect characteristics of Exodus ( such as the bypass of power managers we described from Exodus One , and more ) : Indicators of Compromise Exodus One 011b6bcebd543d4eb227e840f04e188fb01f2335b0b81684b60e6b45388d3820 0f5f1409b1ebbee4aa837d20479732e11399d37f05b47b5359dc53a4001314e5 2055584625d24687bd027a63bc0b8faa7d1a854a535de74afba24840a52b1d2f


a37f5d2418c5f2f64d06ba28fe62edee1293a56158ddfa9f04020e316054363f db59407f72666526fca23d31e3b4c5df86f25eff178e17221219216c6975c63f e0acbb0d7e55fb67e550a6bf5cf5c499a9960eaf5f037b785f9004585202593b Exodus One Package Names com.phonecarrier.linecheck


rm.rf operatore.italia it.offertetelefonicheperte it.servizipremium assistenza.sim assistenza.linea.riattiva assistenza.linea it.promofferte Exodus Two 64c11fdb317d6b7c9930e639f55863df592f23f3c7c861ddd97048891a90c64b a42a05bf9b412cd84ea92b166d790e8e72f1d01764f93b05ace62237fbabe40e Exodus Two


ELF Utilities 00c787c0c0bc26caf623e66373a5aaa1b913b9caee1f34580bdfdd21954b7cc4 11499ff2418f4523344de81a447f6786fdba4982057d4114f64db929990b4b59 13ec6cec511297ac3137cf7d6e4a7c4f5dd2b24478a06262a44f13a3d61070b6 3c9f08b3280851f54414dfa5a57f40d3b7be7b73736fa0ba21b078e75ce54d33


Command & Controls ad1.fbsba [ .


] com ws.my-local-weather [ .


] 31 162.243.172 [ .


] 208 attiva.exodus.esurv [ .


] it The rise of mobile banker Asacub 28 AUG 2018 We encountered the Trojan-Banker.AndroidOS.Asacub family for the first time in 2015 , when the first versions of the malware were detected , analyzed , and found to be more adept at spying than stealing funds .


The Trojan has evolved since then , aided by a large-scale distribution campaign by its creators ( in spring-summer 2017 ) , helping Asacub to claim top spots in last year ’ s ranking by number of attacks among mobile banking Trojans , outperforming other families such as Svpeng and Faketoken .


Our eyes fell on the latest version of the Trojan , which is designed to steal money from owners of Android devices connected to the mobile banking service of one of Russia ’ s largest banks .


The numbering seems to have started anew after the version 9 .


Versions 5.X.X-8.X.X were active in 2016 , and versions 9.X.X-1.X.X in 2017 .


In 2018 , the most actively distributed versions were 5.0.0 and 5.0.3 .


Communication with C & C Although Asacub ’ s capabilities gradually evolved , its network behavior and method of communication with the command-and-control ( C & C ) server changed little .


This strongly suggested that the banking Trojans , despite differing in terms of capability , belong to the same family .


Data was always sent to the C & C server via HTTP in the body of a POST request in encrypted form to the relative address /something/index.php .


In earlier versions , the something part of the relative path was a partially intelligible , yet random mix of words and short combinations of letters and numbers separated by an underscore , for example , “ bee_bomb ” or “ my_te2_mms ” .


Example of traffic from an early version of Asacub ( 2015 ) The data transmitted and received is encrypted with the RC4 algorithm and encoded using the base64 standard .


The C & C address and the encryption key ( one for different modifications in versions 4.x and 5.x , and distinct for different C & Cs in later versions ) are stitched into the body of the Trojan .


In early versions of Asacub , .com , .biz , .info , .in , .pw were used as top-level domains .


In the 2016 version , the value of the User-Agent header changed , as did the method of generating the relative path in the URL : now the part before /index.php is a mix of a pronounceable ( if not entirely meaningful ) word and random letters and numbers , for example , “ muromec280j9tqeyjy5sm1qy71 ” or “ parabbelumf8jgybdd6w0qa0 ” .


Moreover , incoming traffic from the C & C server began to use gzip compression , and the top-level domain for all C & Cs was .com : Since December 2016 , the changes in C & C communication methods have affected only how the relative path in the URL is generated : the pronounceable word was replaced by a rather long random combination of letters and numbers , for example , “ ozvi4malen7dwdh ” or “ f29u8oi77024clufhw1u5ws62 ” .


At the time of writing this article , no other significant changes in Asacub ’ s network behavior had been observed : The origin of Asacub It is fairly safe to say that the Asacub family evolved from Trojan-SMS.AndroidOS.Smaps .


Communication between both Trojans and their C & C servers is based on the same principle , the relative addresses to which Trojans send network requests are generated in a similar manner , and the set of possible commands that the two Trojans can perform also overlaps .


The main difference is that Smaps transmits data as plain text , while Asacub encrypts data with the RC4 algorithm and then encodes it into base64 format .


Let ’ s compare examples of traffic from Smaps and Asacub — an initializing request to the C & C server with information about the infected device and a response from the server with a command for execution : Smaps request Asacub request Decrypted data from Asacub traffic : { “ id ” : ” 532bf15a-b784-47e5-92fa-72198a2929f5″ , ” type ” : ” get ” , ” info ” : ” imei:365548770159066 , country : PL , cell : Tele2


, android:4.2.2 , model : GT-N5100 , phonenumber : +486679225120 , sim:6337076348906359089f , app : null , ver:5.0.2″ } Data sent to the server [ { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” \u0410\u0412\u0422\u041e\u041f\u041b\u0410\u0422\u0415\u0416


1000 50″ , ” timestamp ” : ” 1452272572″ } } , { “ command ” : ” sent & & & ” , ” params ” : { “ to ” : ” +79262000900″ , ” body ” : ” BALANCE ” , ” timestamp ” : ” 1452272573″ } } ] Instructions received from the server A comparison can also be made of the format in which Asacub and Smaps forward incoming SMS ( encoded with the base64 algorithm ) from the device to the C & C server : Smaps


format Asacub format Decrypted data from Asacub traffic : { “ data ” : ” 2015:10:14_02:41:15″ , ” id ” : ” 532bf15a-b784-47e5-92fa-72198a2929f5″ , ” text ” : ” SSB0aG91Z2h0IHdlIGdvdCBwYXN0IHRoaXMhISBJJ20gbm90IGh1bmdyeSBhbmQgbmU= ” , ” number ” : ” 1790″ , ” type


” : ” load ” } Propagation The banking Trojan is propagated via phishing SMS containing a link and an offer to view a photo or MMS .


The link points to a web page with a similar sentence and a button for downloading the APK file of the Trojan to the device .


App icons under which Asacub masks itself The APK files of the Trojan are downloaded from sites such as mmsprivate [ .


] site , and mms4you [ .


For the Trojan to install , the user must allow installation of apps from unknown sources in the device settings .


Infection During installation , depending on the version of the Trojan , Asacub prompts the user either for Device Administrator rights or for permission to use AccessibilityService .


After receiving the rights , it sets itself as the default SMS app and disappears from the device screen .


If the user ignores or rejects the request , the window reopens every few seconds .


The Trojan requests Device Administrator rights The Trojan requests permission to use AccessibilityService After installation , the Trojan starts communicating with the cybercriminals ’ C & C server .


All data is transmitted in JSON format ( after decryption ) .


It includes information about the smartphone model , the OS version , the mobile operator , and the Trojan version .


Structure of data sent to the server : To begin with , the Trojan sends information about the device to the server : In response , the server sends the code of the command for execution ( “ command ” ) , its parameters ( “ params ” ) , and the time delay before execution ( “ waitrun ” in milliseconds ) .


List of commands sewn into the body of the Trojan : Command code Parameters Actions 2 – Sending a list of contacts from the address book of the infected device to the C & C server 7 “ to ” : int Calling the specified number 11 “ to ” : int , “ body ” : string Sending an SMS with the specified text to the specified number 19 “ text ” : string , “ n ” : string Sending SMS with the specified text to numbers from the address book of the infected device , with the name of the addressee from the


address book substituted into the message text 40 “ text ” : string Shutting down applications with specific names ( antivirus and banking applications ) The set of possible commands is the most significant difference between the various flavors of Asacub .


In later versions , instead of the name of the command , its numerical code was transmitted .


The same numerical code corresponded to one command in different versions , but the set of supported commands varied .


For example , version 9.0.7 ( 2017 ) featured the following set of commands : 2 , 4 , 8 , 11 , 12 , 15 , 16 , 17 , 18 , 19 , 20 .


After receiving the command , the Trojan attempts to execute it , before informing C & C of the execution status and any data received .


Moreover , the Trojan intercepts SMS from the bank that contain one-time passwords and information about the balance of the linked bank card .


Some versions of the Trojan can autonomously retrieve confirmation codes from such SMS and send them to the required number .


What ’ s more , the user can not check the balance via mobile banking or change any settings there , because after receiving the command with code 40 , the Trojan prevents the banking app from running on the phone .


User messages created by the Trojan during installation typically contain grammatical and spelling errors , and use a mixture of Cyrillic and Latin characters .


The Trojan also employs various obfuscation methods : from the simplest , such as string concatenation and renaming of classes and methods , to implementing functions in native code and embedding SO libraries in C/C++ in the APK file , which requires the use of additional tools or dynamic analysis for deobfuscation , since most tools for static analysis of Android apps support only Dalvik bytecode .


In some versions of Asacub , strings in the app are encrypted using the same algorithm as data sent to C & C , but with different keys .


The Trojan also hit users from Ukraine , Turkey , Germany , Belarus , Poland , Armenia , Kazakhstan , the US , and other countries .


Conclusion The case of Asacub shows that mobile malware can function for several years with minimal changes to the distribution scheme .


That said , so as to hinder detection of new versions , the Trojan ’ s APK file and the C & C server domains are changed regularly , and the Trojan download links are often one-time-use .


IOCs C & C IP addresses : 155.133.82.181 155.133.82.240 155.133.82.244 185.234.218.59 195.22.126.160 195.22.126.163 195.22.126.80 195.22.126.81 5.45.73.24 5.45.74.130 IP addresses from which the Trojan was downloaded : 185.174.173.31 185.234.218.59 188.166.156.110 195.22.126.160 195.22.126.80 195.22.126.81


195.22.126.82 195.22.126.83 SHA256 : 158c7688877853ffedb572ccaa8aa9eff47fa379338151f486e46d8983ce1b67 3aedbe7057130cf359b9b57fa533c2b85bab9612c34697585497734530e7457d f3ae6762df3f2c56b3fe598a9e3ff96ddf878c553be95bacbd192bd14debd637 df61a75b7cfa128d4912e5cb648cfc504a8e7b25f6c83ed19194905fef8624c8


31edacd064debdae892ab0bc788091c58a03808997e11b6c46a6a5de493ed25d 87ffec0fe0e7a83e6433694d7f24cfde2f70fc45800aa2acb8e816ceba428951 eabc604fe6b5943187c12b8635755c303c450f718cc0c8e561df22a27264f101 Kernel Backdoor found in Gadgets Powered by Popular Chinese ARM


Maker May 12 , 2016 Mohit Kumar How to Hack an Android device ?


It is possibly one of the most frequently asked questions on the Internet .


Thanks to Allwinner , a Chinese ARM system-on-a-chip maker , which has recently been caught shipping a version of Linux Kernel with an incredibly simple and easy-to-use built-in backdoor .


Simple Backdoor Exploit to Hack Android Devices All you need to do to gain root access of an affected Android device is… Send the text " rootmydevice '' to any undocumented debugging process .


The local privileges escalation backdoor code for debugging ARM-powered Android devices managed to make its way in shipped firmware after firmware makers wrote their own kernel code underneath a custom Android build for their devices , though the mainstream kernel source is unaffected .


The backdoor code is believed to have been left by mistake by the authors after completing the debugging process .


For exploiting this issue , any process running with any UID can be converted into root easily by simply using the following command : echo " rootmydevice '' > /proc/sunxi_debug/sunxi_debug The Linux 3.4-sunxi kernel was originally designed to support the Android operating system on Allwinner ARM for tablets , but later it was used to port Linux to many Allwinner processors on boards like Banana Pi micro-PCs , Orange Pi , and other devices .


At the forum of the Armbian operating system , a moderator who goes by the name Tkaiser noted that the backdoor code could remotely be exploitable " if combined with networked services that might allow access to /proc .


'' This security hole is currently present in every operating system image for A83T , H3 or H8 devices that rely on kernel 3.4 , he added .


This blunder made by the company has been frustrating to many developers .


David Manouchehri released the information about the backdoor through its own Github account ( Pastebin ) and then apparently deleted it .


It is safe to say that today ’ s cybercriminal is no longer a lone hacker but part of a serious business operation .


There are various types of actors involved in the mobile malware industry : virus writers , testers , interface designers of both the malicious apps and the web pages they are distributed from , owners of the partner programs that spread the malware , and mobile botnet owners .


This division of labor among the cybercriminals can also be seen in the behavior of their Trojans .


In 2013 , there was evidence of cooperation ( most probably on a commercial basis ) between different groups of virus writers .


For example , the botnet Trojan-SMS.AndroidOS.Opfake.a , in addition to its own activity , also spread Backdoor.AndroidOS.Obad.a by sending spam containing a link to the malware to the victim ’ s list of contacts .


2013 in figures A total of 143,211 new modifications of malicious programs targeting mobile devices were detected in all of 2013 ( as of January 1 , 2014 ) .


In 2013 , 3,905,502 installation packages were used by cybercriminals to distribute mobile malware .


Android remains a prime target for malicious attacks .


98.05 % of all malware detected in 2013 targeted this platform , confirming both the popularity of this mobile OS and the vulnerability of its architecture .


Most mobile malware is designed to steal users ’ money , including SMS-Trojans , and lots of backdoors and Trojans .


Over the year , the number of mobile malware modifications designed for phishing , the theft of credit card information and money increased by a factor of 19.7 .


In 2013 , Kaspersky Lab mobile products prevented 2,500 infections by banking Trojans .


Methods and techniques 2013 not only saw a radical increase in output from mobile virus writers but also saw them actively applying methods and technologies that allowed cybercriminals to use their malware more effectively .


Infecting legal web resources help spread mobile malware via popular websites .


The purely nominal control over the applications uploaded to these stores means attackers can conceal Trojans in apps made to look like innocent games or utilities .


Distribution via botnets .


We also registered one episode of mobile malware spreading via a third-party botnet .


Resistance to anti-malware protection The ability of malicious software to operate continuously on the victim ’ s mobile device is an important aspect of its development .


The longer a Trojan “ lives ” on a smartphone , the more money it will make for the owner .


The more complex the obfuscation , the longer it will take an antivirus solution to neutralize the malicious code .


Tellingly , current virus writers have mastered commercial obfuscators .


This implies they have made considerable investments .


For example , one commercial obfuscator , which cost €350 , was used for Trojans and Opfak.bo Obad.a Android vulnerabilities are used by criminals for three reasons : to bypass the code integrity check when installing an application ( vulnerability Master Key ) ; to enhance the rights of malicious applications , considerably extending their capabilities ; and to make it more difficult to remove malware .


For example , Svpeng uses a previously unknown vulnerability to protect itself from being removed manually or by the antivirus program .


Cybercriminals also exploit the Master Key vulnerability and have learned to embed unsigned executable files in Android installation packages .


Digital signature verification can be bypassed by giving the malicious file exactly the same name as a legitimate file and placing it on the same level in the archive .


However , many users are in no hurry to update the operating systems of their products .


If a smartphone or tablet was released more than a year ago , it is probably no longer supported by the manufacturer and patching of vulnerabilities is no longer provided .


Of course , this does not mean the digital signature of the software developer can be used .


However , due to the absence of certification centers verifying the digital signatures of Android programs , nothing prevents criminals from adding their own signature .


As a result , a copy of Angry Birds installed from an unofficial app store or downloaded from a forum could easily contain malicious functionality .


Capabilities and functionality In 2013 , we detected several technological innovations developed and used by criminals in their malicious software .


Below are descriptions of some of the most interesting .


Control of malware from a single center provides maximum flexibility .


Botnets can make considerably more money than autonomous Trojans .


It comes as no surprise then that many SMS-Trojans include bot functionality .


According to our estimates , about 60 % of mobile malware are elements of both large and small mobile botnets .


Google Cloud Messaging is designed to send short message ( up to 4 KB ) to mobile devices via Google services .


The commands received via GCM can not be blocked immediately on an infected device .


We have detected several malicious programs using GCM for command and control – the widespread Trojan-SMS.AndroidOS.FakeInst.a , Trojan-SMS.AndroidOS.Agent.ao , and Trojan-SMS.AndroidOS.OpFake.a among others .


Google is actively combating this use of the service , responding quickly to reports from antivirus companies and blocking the IDs of cybercriminals .


Attacks on Windows XP allows mobile malware to infect a PC after connecting a smartphone or tablet .


In early 2013 we detected two identical applications on Google Play that were allegedly designed for cleaning the operating system of Android-based devices from unnecessary processes .


In fact , the applications are designed to download the autorun.inf file , an icon file and the win32-Trojan file , which the mobile malicious program locates in the root directory of an SD card .


We would like to emphasize that this method of attack only works on Windows XP and Android versions prior to 2.2 .


The most advanced mobile malicious programs today are Trojans targeting users ’ bank accounts – the most attractive source of criminal earnings .


Trend of the year : mobile banking Trojans 2013 was marked by a rapid rise in the number of Android banking Trojans .


The cyber industry of mobile malware is becoming more focused on making profits more effectively , i.e. , mobile phishing , theft of credit card information , money transfers from bank cards to mobile phones and from phones to the criminalas ’ e-wallets .


Cybercriminals have become obsessed by this method of illegal earnings : at the beginning of the year we knew only 67 banking Trojans , but by the end of the year there were already 1321 unique samples .


Kaspersky Lab mobile products prevented 2,500 infections by banking Trojans .


However , in 2013 , autonomous mobile banking Trojans developed further .


mobile_treats_2013_05s Infections caused by mobile banking programs Today , the majority of banking Trojan attacks affect users in Russia and the CIS .


However , this situation will not last long : given the cybercriminals ’ interest in user bank accounts , the activity of mobile banking Trojans is expected to grow in other countries in 2014 .


It can not act independently and operates strictly in accordance with commands received from the C & C server .


There the user is prompted to download and install a Trojan imitating an Adobe Flash Player update .


Svpeng is capable of doing lots of things .


It collects information about the smartphone ( IMEI , country , service provider , operating system language ) and sends it to the host via the HTTP POST request .


This appears to be necessary to determine the number of banks the victim may use .


It steals SMS messages and information about voice calls .


It steals money from the victim ’ s bank account .


Svpeng sends the corresponding messages to the SMS services of two banks .


Svpeng does this to check if the cards from these banks are attached to the number of the infected phone and to find out the account balance .


If the phone is attached to a bank card , commands are sent from the C & C server with instructions to transfer money from the user ’ s bank account to his/her mobile account .


The cybercriminals then send this money to a digital wallet or to a premium number and cash it in .


It steals logins and passwords to online banking accounts by substituting he window displayed by the bank application .


Currently , this only affects Russian banks , but the technology behind Svpeng could easily be used to target other banking applications .


The data entered by the user is sent to the cybercriminals .


In actual fact , the Trojan does not block anything and the phone can be used without any problems .


It hides traces of its activity by masking the outgoing and incoming text messages and blocking calls and messages from numbers belonging to the bank .


It is impossible to deprive it of these rights without the use of specialized tools ( such as Kaspersky Internet Security for Android ) .


To protect itself from being removed , Svpeng uses a previously unknown vulnerability in Android .


But , as we have already mentioned , the criminals could easily turn their attention to users in other countries .


Perkele and Wroba Foreign users have also been on the receiving end of several malicious innovations targeting bank accounts .


It is of interest primarily because it operates in conjunction with various banking win32-Trojans .


Its main task is to bypass the two-factor authentication of the client in the online banking system .


Due to the specific nature of its activity , Perkele is distributed in a rather unusual way .


When a user enters an Internet banking site on a computer infected by banking malware ( ZeuS , Citadel ) , a request about the smartphone number and type of operating system is injected into the code of the authentication page .


After scanning the QR code and installing a component downloaded from the link , the user infects his smartphone with the Trojan program that boasts functionality that is of great interest to the attackers .


Perkele intercepts mTANs ( confirmation codes for banking operations ) sent by the bank via text message .


By using the login and password stolen from the browser , the Windows Trojan initiates a fake transaction while Perkele intercepts ( via the C & C server ) the mTAN sent by the bank to the user .


Money then disappears from the victim ’ s account and is cashed in without the owner ’ s knowledge .


The Korean malware Wroba , in addition to the traditional vector of infection via file-sharing services , spreads via alternative app stores .


However , they possess no banking functions , and merely steal the logins and passwords entered by users .


We also discovered and analyzed live , misconfigured malicious command and control servers ( C2 ) , from which we were able to identify how the attacker gets new , infected apps to secretly install and the types of activities they are monitoring .


In addition , we uncovered the IMEIs of the targeted individuals ( IMEIs will not be shared publicly for the privacy and safety of the victims ) as well as the types of exfiltrated content .


In aggregate , the type of information stolen could let an attacker know where a person is , with whom they are associated ( including contacts ’ profile photos ) , the messages they are sending , the websites they visit and search history , screenshots that reveal data from other apps on the device , the conversations they have in the presence of the device , and a myriad of images including anything at which device ’ s camera is pointed .


Lookout has determined ViperRAT is a very sophisticated threat that adds to the mounting evidence that targeted mobile attacks against governments and business is a real problem .


Given that this is an active threat , we ’ ve been working behind-the-scenes with our customers to ensure both personal and enterprise customers are protected from this threat and only decided to come forward with this information after the research team at Kaspersky released a report earlier today .


Additionally , we have determined that though original reports of this story attribute this surveillanceware tool to Hamas , this may not be the case , as we demonstrate below .


The increasing sophistication of surveillanceware The structure of the surveillanceware indicates it is very sophisticated .


Analysis indicates there are currently two distinct variants of ViperRAT .


The first variant involves social engineering the target into downloading a trojanized app .


After building an initial rapport with targets , the actors behind these social media accounts would instruct victims to install an additional app for easier communication .


We also uncovered ViperRAT in a billiards game , an Israeli Love Songs player , and a Move To iOS app .


The second stage The second stage apps contain the surveillanceware capabilities .


Lookout uncovered nine secondary payload applications : * These apps have not been previously reported and were discovered using data from the Lookout global sensor network , which collects app and device information from over 100 million sensors to provide researchers and customers with a holistic look at the mobile threat ecosystem today .


Naming additional payload applications as system updates is a clever technique used by malware authors to trick victims into believing a threat isn ’ t present on their device .


For example , if a victim has Viber on their device , it will choose to retrieve the Viber Update second stage .


What was taken The actors behind ViperRAT seem to be particularly interested in image data .


We were able to identify that 8,929 files had been exfiltrated from compromised devices and that the overwhelming majority of these , 97 percent , were highly likely encrypted images taken using the device camera .


We observed legitimate exfiltrated files of the following types of data : Contact information Compressed recorded audio in the Adaptive Multi-Rate ( amr ) file format Images captured from the device camera Images stored on both internal device and SDCard storage that are listed in the MediaStore Device geolocation information SMS content Chrome browser search history and bookmarks Call log information Cell tower information Device network metadata ; such as phone number , device software version , network country , network operator , SIM country , SIM operator , SIM serial , IMSI , voice mail number , phone


type , network type , data state , data activity , call state , SIM state , whether device is roaming , and if SMS is supported .


Standard browser search history Standard browser bookmarks Device handset metadata ; such as brand , display , hardware , manufacturer , product , serial , radio version , and SDK .


Below is a collection of API methods and a brief description around their purpose .


Israeli media published the first reports about the social networking and social engineering aspects of this campaign .


However it ’ s unclear whether organizations that later reported on ViperRAT performed their own independent research or simply based their content on the original Israeli report .


ViperRAT has been operational for quite some time , with what appears to be a test application that surfaced in late 2015 .


Many of the default strings in this application are in Arabic , including the name .


This leads us to believe this is another actor .


However , the existence of threats like ViperRAT and Pegasus , the most sophisticated piece of mobile surveillanceware we ’ ve seen to date , are evidence that attackers are targeting mobile devices .


Enterprise and government employees all use these devices in their day-to-day work , which means IT and security leaders within these organizations must prioritize mobile in their security strategies .


Check Point researchers discovered another widespread malware campaign on Google Play , Google ’ s official app store .


The malware uses infected devices to generate large amounts of fraudulent clicks on advertisements , generating revenues for the perpetrators behind it .


The malicious apps reached an astonishing spread between 4.5 million and 18.5 million downloads .


Some of the apps we discovered resided on Google Play for several years , but all were recently updated .


It is unclear how long the malicious code existed inside the apps , hence the actual spread of the malware remains unknown .


We also found several apps containing the malware , which were developed by other developers on Google Play .


The connection between the two campaigns remains unclear , and it is possible that one borrowed code from the other , knowingly or unknowingly .


Similar to previous malware which infiltrated Google Play , such as FalseGuide and Skinner , Judy relies on the communication with its Command and Control server ( C & C ) for its operation .


The server replies with the actual malicious payload , which includes JavaScript code , a user-agent string and URLs controlled by the malware author .


The malware opens the URLs using the user agent that imitates a PC browser in a hidden webpage and receives a redirection to another website .


Upon clicking the ads , the malware author receives payment from the website developer , which pays for the illegitimate clicks and traffic .


The JavaScript code locates the targeted ads by searching for iframes which contain ads from Google ads infrastructure , as shown in the image below : The fraudulent clicks generate a large revenue for the perpetrators , especially since the malware reached a presumably wide spread .


Who is behind Judy ?


The malicious apps are all developed by a Korean company named Kiniwini , registered on Google Play as ENISTUDIO corp .


The company develops mobile apps for both Android and iOS platforms .


It is quite unusual to find an actual organization behind mobile malware , as most of them are developed by purely malicious actors .


It is important to note that the activity conducted by the malware is not borderline advertising , but definitely an illegitimate use of the users ’ mobile devices for generating fraudulent clicks , benefiting the attackers .


Although most apps have positive ratings , some of the users have noticed and reported Judy ’ s suspicious activities , as seen in the images below : As seen in previous malware , such as DressCode , a high reputation does not necessarily indicate that the app is safe for use .


Hackers can hide their apps ’ real intentions or even manipulate users into leaving positive ratings , in some cases unknowingly .


Users can not rely on the official app stores for their safety , and should implement advanced security protections capable of detecting and blocking zero-day mobile malware .


We first started tracking Bread ( also known as Joker ) in early 2017 , identifying apps designed solely for SMS fraud .


As the Play Store has introduced new policies and Google Play Protect has scaled defenses , Bread apps were forced to continually iterate to search for gaps .


Many of these samples appear to be designed specifically to attempt to slip into the Play Store undetected and are not seen elsewhere .


In this post , we show how Google Play Protect has defended against a well organized , persistent attacker and share examples of their techniques .


Both of these types of fraud take advantage of mobile billing techniques involving the user ’ s carrier .


SMS Billing Carriers may partner with vendors to allow users to pay for services by SMS .


A charge is then added to the user ’ s bill with their mobile service provider .


Toll Billing Carriers may also provide payment endpoints over a web page .


The user visits the URL to complete the payment and enters their phone number .


Verification that the request is coming from the user ’ s device is completed using two possible methods : The user connects to the site over mobile data , not WiFi ( so the service provider directly handles the connection and can validate the phone number ) ; or The user must retrieve a code sent to them via SMS and enter it into the web page ( thereby proving access to the provided phone number ) .


Fraud Both of the billing methods detailed above provide device verification , but not user verification .


The carrier can determine that the request originates from the user ’ s device , but does not require any interaction from the user that can not be automated .


Here are some highlights .


Standard Encryption Frequently , Bread apps take advantage of standard crypto libraries in ` java.util.crypto ` .


We have discovered apps using AES , Blowfish , and DES as well as combinations of these to encrypt their strings .


Custom Encryption Other variants have used custom-implemented encryption algorithms .


Some common techniques include : basic XOR encryption , nested XOR and custom key-derivation methods .


Split Strings Encrypted strings can be a signal that the code is trying to hide something .


Bread has used a few tricks to keep strings in plaintext while preventing basic string matching .


Going one step further , these substrings are sometimes scattered throughout the code , retrieved from static variables and method calls .


“ .clic ” and “ k ( ) ; ” ) .


Delimiters Another technique to obfuscate unencrypted strings uses repeated delimiters .


A short , constant string of characters is inserted at strategic points to break up keywords : At runtime , the delimiter is removed before using the string : API OBFUSCATION SMS and toll fraud generally requires a few basic behaviors ( for example , disabling WiFi or accessing SMS ) , which are accessible by a handful of APIs .


Reflection Most methods for hiding API usage tend to use Java reflection in some way .


In some samples , Bread has simply directly called the Reflect API on strings decrypted at runtime .


In the native library , it stores the strings to access the SMS API .


The nativesend method uses the Java Native Interface ( JNI ) to fetch and call the Android SMS API .


WebView JavaScript Interface Continuing on the theme of cross-language bridges , Bread has also tried out some obfuscation methods utilizing JavaScript in WebViews .


However , the app does create a WebView and registers a JavaScript interface to this class .


This gives JavaScript run in the WebView access to this method .


The app loads a URL pointing to a Bread-controlled server .


The response contains some basic HTML and JavaScript .


In green , we can see the references to the SMS API .


PACKING In addition to implementing custom obfuscation techniques , apps have used several commercially available packers including : Qihoo360 , AliProtect and SecShell .


The figure below shows a fragment of encrypted JAR stored in .rodata section of a shared object shipped with the APK as well as the XOR key used for decryption .


After we blocked those samples , they moved a significant portion of malicious functionality into the native library , which resulted in a rather peculiar back and forth between Dalvik and native code : COMMAND & CONTROL Dynamic Shortcodes & Content Early versions of Bread utilized a basic command and control infrastructure to dynamically deliver content and retrieve billing details .


In the example server response below , the green fields show text to be shown to the user .


The red fields are used as the shortcode and keyword for SMS billing .


At runtime , the apps can check which carrier the device is connected to and fetch a configuration object from the command and control server .


The steps implemented include : Load a URL in a WebView Run JavaScript in WebView Toggle WiFi state Toggle mobile data state Read/modify SMS inbox Solve captchas Captchas One of the more interesting states implements the ability to solve basic captchas ( obscured letters and numbers ) .


First , the app creates a JavaScript function to call a Java method , getImageBase64 , exposed to WebView using addJavascriptInterface .


The value used to replace GET_IMG_OBJECT comes from the JSON configuration .


The app then uses JavaScript injection to create a new script in the carrier ’ s web page to run the new function .


The base64-encoded image is then uploaded to an image recognition service .


If the text is retrieved successfully , the app uses JavaScript injection again to submit the HTML form with the captcha answer .


The app checks if the device ’ s network matches one of those provided by the server .


Server-side Carrier Checks In the JavaScript bridge API obfuscation example covered above , the server supplied the app with the necessary strings to complete the billing process .


However , analysts may not always see the indicators of compromise in the server ’ s response .


In this example , the requests to the server take the following form : Here , the “ operator ” query parameter is the Mobile Country Code and Mobile Network Code .


The server can use this information to determine if the user ’ s carrier is one of Bread ’ s targets .


If not , the response is scrubbed of the strings used to complete the billing fraud .


MISLEADING USERS Bread apps sometimes display a pop-up to the user that implies some form of compliance or disclosure , showing terms and conditions or a confirm button .


Other versions included all the pieces needed for a valid disclosure message .


Bread apps frequently contain no functionality beyond the billing process or simply clone content from other popular apps .


VERSIONING Bread has also leveraged an abuse tactic unique to app stores : versioning .


Some apps have started with clean versions , in an attempt to grow user bases and build the developer accounts ’ reputations .


Some are first uploaded with all the necessary code except the one line that actually initializes the billing process .


Others may have the necessary permissions , but are missing the classes containing the fraud code .


FAKE REVIEWS When early versions of apps are first published , many five star reviews appear with comments like : “ So .. good .. ” “ very beautiful ” Later , 1 star reviews from real users start appearing with comments like : “ Deception ” “ The app is not honest … ” SUMMARY Sheer volume appears to be the preferred approach for Bread developers .


At different times , we have seen three or more active variants using different approaches or targeting different carriers .


Within each variant , the malicious code present in each sample may look nearly identical with only one evasion technique changed .


Sample 1 may use AES-encrypted strings with reflection , while Sample 2 ( submitted on the same day ) will use the same code but with plaintext strings .


This family showcases the amount of resources that malware authors now have to expend .


SELECTED SAMPLES Package Name SHA-256 Digest com.rabbit.artcamera 18c277c7953983f45f2fe6ab4c7d872b2794c256604e43500045cb2b2084103f org.horoscope.astrology.predict 6f1a1dbeb5b28c80ddc51b77a83c7a27b045309c4f1bff48aaff7d79dfd4eb26 com.theforest.rotatemarswallpaper 4e78a26832a0d471922eb61231bc498463337fed8874db5f70b17dd06dcb9f09


com.jspany.temp 0ce78efa764ce1e7fb92c4de351ec1113f3e2ca4b2932feef46d7d62d6ae87f5 com.hua.ru.quan 780936deb27be5dceea20a5489014236796a74cc967a12e36cb56d9b8df9bc86 com.rongnea.udonood 8b2271938c524dd1064e74717b82e48b778e49e26b5ac2dae8856555b5489131


com.mbv.a.wp 01611e16f573da2c9dbc7acdd445d84bae71fecf2927753e341d8a5652b89a68 com.pho.nec.sg b4822eeb71c83e4aab5ddfecfb58459e5c5e10d382a2364da1c42621f58e119b Exobot ( Marcher ) - Android banking Trojan on the rise February 2017 Introduction The past months many different banking Trojans for


the Android platform have received media attention .


One of these , called Marcher ( aka Exobot ) , seems to be especially active with different samples appearing on a daily basis .


This malware variant also appears to be technically superior to many other banking Trojans being able to use its overlay attack even on Android 6 , which has technical improvements compared to the previous Android versions to prevent such attacks .


The main infection vector is a phishing attack using SMS/MMS .


On installation , the app requests the user to provide SMS storage access and high Android privileges such as Device Admin .


Other infection vectors include pornographic websites serving apps called Adobe Flash or YouPorn .


The first attack vector is to compromise the out of band authentication for online banks that rely on SMS using SMS forwarding .


The second attack vector , the overlay attack , shows a customized phishing window whenever a targeted application is started on the device .


The overlay window is often indistinguishable from the expected screen ( such as a login screen for a banking app ) and is used to steal the victim ’ s banking credentials .


The target list and bank specific fake login pages can be dynamically updated via their C2 panel ( dashboard back-end ) which significantly increases the adaptability and scalability of this attack .


In addition , this type of Android banking malware does not require the device to be rooted or the app to have any specific Android permission ( besides android.permission.INTERNET to retrieve the overlay contents and send its captured data ) .


The many changes we see in the way the attacks are performed show that attackers are heavily experimenting to find the best way of infecting a mobile device and abusing existing functionality to perform successful phishing attacks .


The next stage in device infection could be the use of exploit kits and malvertising , which would be quite effective due the many Android vulnerabilities and consumers with unpatched devices .


Technical Analysis Permissions Marcher ’ s APK size is fairly small ( only 683KB for sample eb8f02fc30ec49e4af1560e54b53d1a7 ) , much smaller than most legitimate apps and other popular mobile malware samples .


This sample only includes Dalvik bytecode and resources without any native libraries .


The package name ( vyn.hhsdzgvoexobmkygffzwuewrbikzud ) and its many activities and services have randomized names , probably to make it a bit more difficult to detect the package using blacklisting .


The set of permissions required by Marcher according to the manifest is as follows : ∗ android.permission.CHANGE_NETWORK_STATE ( change network connectivity state ) ∗ android.permission.SEND_SMS ( send SMS messages ) ∗ android.permission.USES_POLICY_FORCE_LOCK ( lock the device ) ∗ android.permission.RECEIVE_BOOT_COMPLETED ( start malware when device boots ) ∗ android.permission.INTERNET ( communicate with the internet ) ∗ android.permission.VIBRATE


( control the vibrator ) ∗ android.permission.ACCESS_WIFI_STATE ( view information about the status of Wi-Fi ) ∗ android.permission.WRITE_SMS ( edit/delete SMS ) ∗ android.permission.ACCESS_NETWORK_STATE ( view the status of all networks ) ∗ android.permission.WAKE_LOCK ( prevent the phone from going to sleep ) ∗ android.permission.GET_TASKS ( retrieve running applications ) ∗ android.permission.CALL_PHONE ( call phone numbers )


∗ android.permission.WRITE_SETTINGS ( read/write global system settings ) ∗ android.permission.RECEIVE_SMS ( intercept SMS messages ) ∗ android.permission.READ_PHONE_STATE ( read phone details of the device such as phone number and serial number ) ∗ android.permission.CHANGE_WIFI_STATE ( connect to and disconnect from Wi-Fi networks and make changes to configured networks ) ∗ android.permission.READ_CONTACTS ( read all contact data ) * android.permission.READ_SMS


( read SMS messages ) Obviously a fairly significant list of permissions of which many are suspicious , especially when combined .


Runtastic sample permission prompt Runtastic sample permission prompt Checking foreground app Marcher is one of the few Android banking Trojans to use the AndroidProcesses library , which enables the application to obtain the name of the Android package that is currently running in the foreground .


This library is used because it uses the only ( publicly known ) way to retrieve this information on Android 6 ( using the process OOM score read from the /proc directory ) .


When the current app on the foreground matches with an app targeted by the malware , the Trojan will show the corresponding phishing overlay , making the user think it is the app that was just started .


The complete list of apps can be seen below .


The phishing pages shown in the overlay use Ajax calls to communicate with a PHP back-end which stores all user input .


The C2 backend url looks like this : https : //evilhost/c2folder/njs2/ ?


There is no way to access the original app again even if victims terminate the overlay process and reopen app , until credit card ( name , number , expiry date , security code ) and/or bank information ( PIN , VBV passcode , date of birth , etc .


Agent Smith : A New Species of Mobile Malware July 10 , 2019 Check Point Researchers recently discovered a new variant of mobile malware that quietly infected around 25 million devices , while the user remains completely unaware .


This activity resembles previous campaigns such as Gooligan , HummingBad and CopyCat .


In a much-improved Android security environment , the actors behind Agent Smith seem to have moved into the more complex world of constantly searching for new loopholes , such as Janus , Bundle and Man-in-the-Disk , to achieve a 3-stage infection chain , in order to build a botnet of controlled devices to earn profit for the perpetrator .


“ Agent Smith ” is possibly the first campaign seen that ingrates and weaponized all these loopholes and are described in detail below .


However , it could easily be used for far more intrusive and harmful purposes such as banking credential theft .


Indeed , due to its ability to hide it ’ s icon from the launcher and impersonates any popular existing apps on a device , there are endless possibilities for this sort of malware to harm a user ’ s device .


Check Point Research has submitted data to Google and law enforcement units to facilitate further investigation .


As the research progressed , it started to reveal unique characteristics which made us believe we were looking at an all-new malware campaign found in the wild .


After a series of technical analysis ( which is covered in detail below ) and heuristic threat hunting , we discovered that a complete “ Agent Smith ” infection has three main phases : A dropper app lures victim to install itself voluntarily .


The initial dropper has a weaponized Feng Shui Bundle as encrypted asset files .


Dropper variants are usually barely functioning photo utility , games , or sex related apps .


The dropper automatically decrypts and installs its core malware APK which later conducts malicious patching and app updates .


The core malware is usually disguised as Google Updater , Google Update for U or “ com.google.vending ” .


The core malware ’ s icon is hidden .


The core malware extracts the device ’ s installed app list .


If it finds apps on its prey list ( hard-coded or sent from C & C server ) , it will extract the base APK of the target innocent app on the device , patch the APK with malicious ads modules , install the APK back and replace the original one as if it is an update .


“ Agent Smith ” repacks its prey apps at smali/baksmali code level .


In certain situations , variants intercept compromised apps ’ original legitimate ads display events and report back to the intended ad-exchange with the “ Agent Smith ” campaign hacker ’ s ad IDs .


Our intelligence shows “ Agent Smith ” droppers proliferate through third-party app store “ 9Apps ” , a UC team backed store , targeted mostly at Indian ( Hindi ) , Arabic , and Indonesian users .


“ Agent Smith ” itself , though , seems to target mainly India users .


Technical Analysis “ Agent Smith ” has a modular structure and consists of the following modules : Loader Core Boot Patch AdSDK Updater As stated above , the first step of this infection chain is the dropper .


The dropper is a repacked legitimate application which contains an additional piece of code – “ loader ” .


If any application from that list was found , it utilizes the Janus vulnerability to inject the “ boot ” module into the repacked application .


After the next run of the infected application , the “ boot ” module will run the “ patch ” module , which hooks the methods from known ad SDKs to its own implementation .


Figure 1 : ‘ Agent Smith ’ s modular structure Technical Analysis – Loader Module The “ loader ” module , as stated above , extracts and runs the “ core ” module .


While the “ core ” module resides inside the APK file , it is encrypted and disguised as a JPG file – the first two bytes are actually the magic header of JPG files , while the rest of the data is encoded with an XOR cipher .


Figure 2 : “ Agent Smith ’ s jpg file structure After the extraction , the “ loader ” module adds the code to the application while using the legitimate mechanism by Android to handle large DEX files .


Figure 3 : Loading core malicious code into the benign application Once the “ core ” module is extracted and loaded , the “ loader ” uses the reflection technique to initialize and start the “ core ” module .


Figure 4 : Loader calls initialization method Technical Analysis – Core Module With the main purpose of spreading the infection , “ Agent Smith ” implements in the “ core ” module : A series of ‘ Bundle ’ vulnerabilities , which is used to install applications without the victim ’ s awareness .


The Janus vulnerability , which allows the actor to replace any application with an infected version .


The “ core ” module contacts the C & C server , trying to get a fresh list of applications to search for , or if that fails , use a default app list : whatsapp lenovo.anyshare.gps mxtech.videoplayer.ad jio.jioplay.tv jio.media.jiobeats jiochat.jiochatapp jio.join good.gamecollection opera.mini.native startv.hotstar meitu.beautyplusme domobile.applock touchtype.swiftkey flipkart.android cn.xender


eterno truecaller For each application on the list , the “ core ” module checks for a matching version and MD5 hash of the installed application , and also checks for the application running in the user-space .


The decompile method is based on the fact that Android applications are Java-based , meaning it is possible to recompile it .


Therefore , “ Agent Smith ” decompiles both the original application and the malicious payload and fuses them together .


Figure 5 : core module mixes malicious payload with the original application While decompiling the original app , “ Agent Smith ” has the opportunity to modify the methods inside , replace some of the methods in the original application that handles advertisement with its own code and focus on methods communicating with ‘ AdMob ’ , ‘ Facebook ’ , ‘ MoPub ’ and ‘ Unity Ads ’ .


Figure 6 : Targeted ad network Figure 7 : Injection example After all of the required changes , “ Agent Smith ” compiles the application and builds a DEX file containing both the original code of the original application and the malicious payload .


In some cases , the decompilation process will fail , and “ Agent Smith ” will try another method for infecting the original application – A binary patch , which simply provides a binary file of the “ boot ” module of “ Agent Smith ” .


Once the payload is prepared , “ Agent Smith ” uses it to build another APK file , exploiting the Janus vulnerability : Figure 8 : The new infected APK file structure Solely injecting the code of the loader is not enough .


This means that the only thing possible in this case is to replace its DEX file .


To overcome this issue , “ Agent Smith ” found another solution .


This action changes the original file size of the DEX file , which makes the malicious resources a part of the DEX file , a section that is ignored by the signature validation process .


Figure 9 : Malware secretly adds malicious resources to the DEX file Now , after the alteration of the original application , Android ’ s package manager will think that this is an update for the application signed by the same certificate , but in reality , it will execute the malicious DEX file .


Even now , this is still not enough .


“ Agent Smith ” needs to be updated/installed without the user ’ s consent .


The malicious application sends a request to choose a network account , a specific account that can only be processed by authentication services exported by the malicious application .


The system service ‘ AccountManagerService ’ looks for the application that can process this request .


While doing so , it will reach a service exported by “ Agent Smith ” , and sends out an authentication request that would lead to a call to the ‘ addAccount ’ method .


Figure 10 : The algorithm of the malicious update , while “ Agent Smith ” updates application If all that has failed , “ Agent Smith ” turns to Man-in-the-Disk vulnerability for ‘ SHAREit ’ or ‘ Xender ’ applications .


This is a very simple process , which is replacing their update file on SD card with its own malicious payload .


Figure 11 : ‘ Agent Smith ’ uses man-in-disk to install the malicious update Technical Analysis – Boot Module The “ boot ” module is basically another “ loader ” module , but this time it ’ s executed in the infected application .


The infected application contains its payload inside the DEX file .


All that is needed is to get the original size of the DEX file and read everything that comes after this offset .


While investing a lot of resources in the development of this malware , the actor behind “ Agent Smith ” does not want a real update to remove all of the changes made , so here is where the “ patch ” module comes in to play With the sole purpose of disabling automatic updates for the infected application , this module observes the update directory for the original application and removes the file once it appears .


Another trick in “ Agent Smith ’ s arsenal is to change the settings of the update timeout , making the original application wait endlessly for the update check .


Figure 14 : disabling infected apps auto-update Figure 15 : changing the settings of the update timeout The Ad Displaying Payload Following all of the above , now is the time to take a look into the actual payload that displays ads to the victim .


In the injected payload , the module implements the method ‘ callActivityOnCreate ’ .


“ Agent Smith ” will replace the original application ’ s activities with an in-house SDK ’ s activity , which will show the banner received from the server .


Among multiple sub-domains , “ ad.a * * * d.org ” and “ gd.a * * * d.org ” both historically resolved to the same suspicious IP address .


Figure 19 : C & C infrastructure diagram The Infection Landscape “ Agent Smith ” droppers show a very greedy infection tactic .


It ’ s not enough for this malware family to swap just one innocent application with an infected double .


It does so for each and every app on the device as long as the package names are on its prey list .


Over time , this campaign will also infect the same device , repeatedly , with the latest malicious patches .