We were also able to link the FrozenCell 's Android infrastructure to numerous desktop samples that are part of the larger multi-platform attack .


It appears the attackers sent malicious executables though phishing campaigns impersonating individuals associated with the Palestinian Security Services , the General Directorate of Civil Defence - Ministry of the Interior , and the 7th Fateh Conference of the Palestinian National Liberation Front ( held in late 2016 ) .


The titles and contents of these files suggest that the actor targeted individuals affiliated with these government agencies and the Fatah political party .


Some malicious files associated with these samples were titled the following : Council_of_ministres_decision Minutes of the Geneva Meeting on Troops Summary of today 's meetings.doc.exe The most important points of meeting the memory of the late President Abu Omar may Allah have mercy on him - Paper No .


1 Fadi Alsalamin scandal with an Israeli officer - exclusive - watched before the deletion - Fadi Elsalameen The details of the assassination of President Arafat_06-12-2016_docx Quds.rar Many of these executables are associated with various short links created using Bit.ly , a URL shortening service .


After analyzing the traffic associated with these short links , we determined that each one was associated with a referral path from mail.mosa.pna.ps .


MOSA is the Palestinian Directorate of Social Development whose mandate is to achieve comprehensive development , social security , and economic growth for Palestinian families , according to publicly available information on this ministry .


Infrastructure At the time of writing the following domains have either been used by this family or are currently active .


We expect this list to grow given that this actor has changed its infrastructure numerous times in 2017 .


cecilia-gilbert [ .


] comgooogel [ .


] orgmary-crawley [ .


] commydriveweb [ .


] comrose-sturat [ .


] infokalisi [ .


] xyzdebra-morgan [ .


] comarnani [ .


] infoacount-manager [ .


] infogooogel-drive [ .


] commediauploader [ .


] meacount-manager [ .


] netupload404 [ .


] clubupload999 [ .


] infoal-amalhumandevelopment [ .


] commargaery [ .


] coupload202 [ .


] comgo-mail-accounts [ .


] comupload101 [ .


] netsybil-parks [ .


] infodavos-seaworth [ .


] infoupload999 [ .


] orgacount-manager [ .


] comlila-tournai [ .


] comaccount-manager [ .


] orgmediauploader [ .


] infokalisi [ .


] orgaryastark [ .


] infomavis-dracula [ .


] comkalisi [ .


] infogoogle-support-team [ .


] com9oo91e [ .


] comuseraccount [ .


] websiteaccounts-fb [ .


] comakashipro [ .


] comfeteh-asefa [ .


] comlagertha-lothbrok [ .


] info OpSec fails and use of cryptography While looking at this infrastructure , we identified that one of these domains has directory indexing enabled .


This mistake in operational security allowed us to gain visibility into exfiltrated content for a number of devices .


Continued mirroring suggests it is likely a regularly cleaned staging server .


We sourced the over 561MB of exfiltrated data from this domain alone , all of which we found to be 7z compressed and password protected .


Password generation for compressed files takes place client-side with each device using a unique key in most scenarios .


Key information consists of an MD5 hash of the device 's Android ID , the device manufacturer , and the device model with each separated by an underscore .


Visually , this can be represented as follows : Android ID When combined with our analysis of indexed directories on C2 infrastructure , we were able to easily automate the generation of the password used by each device and , in turn , successfully decompress all exfiltrated content from compromised devices .


Indexed directories on C2 infrastructure While exfiltrated content is encrypted , information used to generate the password is plainly visible in the top level directories for each device .


Taking this information from directory listings , like the one shown above , allowed for the decryption of all content .


In this case , FrozenCell has primarily netted the actors behind it with recorded outbound calls followed closely by images and recorded incoming calls .


FrozenCell is part of a very successful , multi-platform surveillance campaign .


Attackers are growing smarter , targeting individuals through the devices and the services they use most .


Government agencies and enterprises should plan to be hit from all angles - cloud services , mobile devices , laptops - in order to build comprehensive security strategies that work .


TUESDAY , MAY 19 , 2020 The wolf is back ... NEWS SUMMARY Thai Android devices and users are being targeted by a modified version of DenDroid we are calling " WolfRAT , '' now targeting messaging apps like WhatsApp , Facebook Messenger and Line .


We assess with high confidence that this modified version is operated by the infamous Wolf Research .


This actor has shown a surprising level of amateur actions , including code overlaps , open-source project copy/paste , classes never being instanced , unstable packages and unsecured panels .


EXECUTIVE SUMMARY Cisco Talos has discovered a new Android malware based on a leak of the DenDroid malware family .


We named this malware " WolfRAT '' due to strong links between this malware ( and the command and control ( C2 ) infrastructure ) and Wolf Research , an infamous organization that developed interception and espionage-based malware and was publicly described by CSIS during Virus Bulletin 2018 .


We identified infrastructure overlaps and string references to previous Wolf Research work .


The organization appears to be shut down , but the threat actors are still very active .


We identified campaigns targeting Thai users and their devices .


Some of the C2 servers are located in Thailand .


The panels also contain Thai JavaScript comments and the domain names also contain references to Thai food , a tactic commonly employed to entice users to click/visit these C2 panels without much disruption .


We identified a notable lack of sophistication in this investigation such as copy/paste , unstable code , dead code and panels that are freely open .


What 's new ?


WolfRAT is based on a previously leaked malware named DenDroid .


The new malware appears to be linked to the infamous Wolf Research organization and targets Android devices located in Thailand .


How did it work ?


The malware mimics legit services such as Google service , GooglePlay or Flash update .


The malware is not really advanced and is based on a lot of copy/paste from public sources available on the Internet .


The C2 infrastructure contains a lack of sophistication such as open panels , reuse of old servers publicly tagged as malicious… So what ?


After being publicly denounced by CSIS Group — a threat intelligence company in Denmark — Wolf Research was closed and a new organization named LokD was created .


This new organization seems to work on securing Android devices .


However , thanks to the infrastructure sharing and forgotten panel names , we assess with high confidence that this actor is still active , it is still developing malware and has been using it from mid-June to today .


On the C2 panel , we found a potential link between Wolf Research and another Cyprus organization named Coralco Tech .


This organization is also working on interception technology .


LINKS TO WOLF INTELLIGENCE During the Virus Bulletin conference in 2018 , CSIS researchers Benoît Ancel and Aleksejs Kuprins did a presentation on Wolf Research and the offensive arsenal developed by the organization .


They mentioned an Android , iOS and Windows remote access tool ( RAT ) .


Their findings showed that Wolf is headquartered in Germany with offices in Cyprus , Bulgaria , Romania , India and ( possibly ) the U.S .


The organization was closed after the CSIS presentation .


However , the director created a new organization in Cyprus named LokD .


This new organization proposed the creation of a more secure Android phone .


Based on the organization website , it also proposes services and developed zero-day vulnerabilities to test their own products : Zero-day research from lokd.com We can see that the organization owner still has an interest in Android devices .


Based on infrastructure overlaps and leaked information , we assess with high confidence that the malware we identified and present in this paper is linked to Wolf Research .


One of the samples ( e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 ) uses the C2 server svcws [ .


] ponethus [ .


] com .


Based on our research and Benoît Ancel 's tracker , this C2 was used by Wolf Intelligence : Additionally , we identified two empty panels on a C2 server .


The new one with the title " Coralco Archimedes , '' and an older version with the title " Wolf Intelligence : '' New panel Old panel The new panel name contains " Coralco '' in its name .


Coralco Tech is an organization located in Cyprus and providing interception tools .


We can not say for sure if Wolf Research and Coralco Tech are linked , but this panel name , their offerings and the panel layout would suggest it should be considered suspiciously linked .


Coralco Tech 's services description .


VICTIMOLOGY ON THE IDENTIFIED CAMPAIGNS The campaigns we analyzed targeted Android devices in Thailand .


The C2 server domain is linked to Thai food : Nampriknum [ .


] net : Nam Phrik Num Somtum [ .


] today : Som Tum We also identified comments in Thai on the C2 infrastructure mentioned in the previous chapter : MALWARE DenDroid The Android malware is based on the DenDroid Android malware .


Several analysis reports were published on this malware in 2014 and , finally , the source code was leaked in 2015 .


The original leak is no longer available on github.com , but a copy can be found here .


The table below shows the commands available to the operator for tasking on infected devices .


This malware is simplistic in comparison to some modern-day Android malware .


The best example of that is that it does n't take advantage of the accessibility framework , collecting information on non-rooted devices .


The commands are self-explanatory and show the features included in the malware .


Some of them like takephoto , takevideo , recordaudio , getsentsms and uploadpictures are focused on espionage activities .


Others like transferbot , promptupdate and promptuninstall are meant to help the operator manage the malware .


Version # 1 : June 2019 — Domain : databit [ .


] today During our investigation , we identified at least four major releases of the RAT .


The permissions on the first version of the malware lay out the foundations of a spying trojan .


Permissions The package name follows the original style name used on DenDroid .


The code is obfuscated but not packed .


This malware also contains a screen recorder .


This feature is implemented using another open-source software package that can be found here .


The service is implemented in the class com.serenegiant.service.ScreenRecorderService which is declared in the package manifest .


During our analysis of this sample , we did notice that the class itself is never called or used by the malware .


It remains available within the source code but no method of use takes place .


Version # 2 : June - Aug. 2019 — Domain : somtum [ .


] today This is the first version that shows the code organization evolution that will continue to be used on all other functions throughout this malware .


Code structure Obviously , this code is not obfuscated when compared with the previous version it becomes clear that this is the same code base .


One of the first changes that stands out is that the screen recording feature mentioned in the previous sample has been removed .


A new class was added called com.utils.RestClient .


This class is based on public code belonging to the package praeda.muzikmekan , which can be found here among other places .


Just like in previous examples , the malware author does not use this package .


Missing permissions The lack of the READ_FRAME_BUFFER permission can be justified by the removal of the screen record feature .


The ACCESS_SUPERUSER may have been removed because it was deprecated upon the release of Android 5.0 Lollipop which happened in 2014 .


The reality is that the RAT permissions can be implemented just with the permissions declared on the manifest , thus there is no need for higher permissions .


Version # 3 : Sept. - Dec. 2019 — Domain : ponethus [ .


] com Given that there is some overlap in the previous two versions , it came as no surprise to us that we finally identified a sample which is an evolution based on both previous versions .


This sample is clearly a mix between the two .


This is also the first version where the package name changes into something that a less aware user may be tricked by , com.android.playup .


This version brings back the ACCESS_SUPERUSER and READ_FRAME_BUFFER permissions .


However , this time , the permission is actually used .


WhatsApp message capture The service com.serenegiant.service.ScreenRecorderService , is invoked by the ScreenRecorderActivity .


Upon creation , this activity launches a thread that will loop on a 50-second interval .


In the first iteration , the screen recording is started and will only stop when the RAT determines that WhatsApp is not running .


It 's restarted in the next cycle independently based on if WhatsApp is running .


In this version , the developer added more classes from the same package .


Even though we could not find indications of being in use , two stand out .


Bluetooth — which allows the interaction with the Bluetooth interface , and net/deacon — which implements a beaconing system based on UDP .


Android shell A new package was added that allows the execution of commands in the Android shell .


Again , this package source code is publicly available and can be found here .


One of the uses the malware gives to this package is the execution of the command " dumpsys '' to determine if certain activities are running .


Check if chat apps are running In the above example , the malware is searching for Line , Facebook Messenger and WhatsApp activities .


This is part of a class called CaptureService , which already existed in the previous version but it was not duly implemented .


Previous version The capture service class implements the chat applications interception .


Upon creation the class will start to take screenshots that will be stopped and uploaded to the C2 once the service ca n't find the targeted applications running .


The core of this functionality is also based on an open-source project that can be found here .


Another novelty is a VPN-related package , which is based on OrbotVPN .


Once again , it does n't seem to actually be in use .


The same happens with the package squareup.otto , which is an open-source bus implementation focused on Android implementation .


Both sources can be found here and here .


Version # 4 : April 2020 — Domain : nampriknum.net Following the same pattern , this version has some added features and others , which were not in use , removed .


First of all the new package name is com.google.services , which can easily be confused with a legitimate Google service .


The VPN package is no longer present , further reinforcing our conclusion that it was not in use .


WolfRAT application screen The Google GMS and Firebase service has been added , however , no configuration has been found , even though services seem to be referenced in the of a new class .


The new class is called NotificationListener and extends the NotificationListenerService class .


This would allow the RAT to receive system notifications .


Notification handling method The class is only implemented in debug mode , pushing all captured information into the log .


The usage of the PlusShare API in 2020 denotes some unprofessional development , since this is the API to access Google+ .


This service , along with the API , was fully decommissioned in March 2019 .


This version adds one significant class — it requests DEVICE_ADMIN privileges .


Device admin policies Looking at the policy 's definition , we can see that it lists all the available policies even if most of them are deprecated on Android 10.0 and their usage results in a security exception .


The code implementation again seems that it has been added for testing purposes only .


Versions overview The DenDroid code base was kept to such an extent that even the original base64-encoded password was kept .


Original password The main service follows the same structure as the first version , the anti-analysis features are primitive , only checking the emulator environment without any kind of packing or obfuscation .


The malware will start the main service if all the requested permissions and the device admin privileges are granted .


Otherwise , it will launch an ACTION_APPLICATION_SETTINGS intent trying to trick the user to grant the permissions .


Each sample contains a userId hardcoded , meaning that each sample can only be used in a victim .


It seems , however , if the same victim has more than one device the malware can be reused since the IMEI is sent along with each data exfiltration .


It is clear that this RAT is under intense development , however , the addition and removal of packages , along with the huge quantity of unused code and usage of deprecated and old techniques denotes an amateur development methodology .


CONCLUSION We witness actors continually using open-source platforms , code and packages to create their own software .


Some are carried out well , others , like WolfRAT , are designed with an overload of functionality in mind as opposed to factoring any sensible approach to the development aspect .


After all , a working product is often more important than a stable product .


We watched WolfRAT evolve through various iterations which shows that the actor wanted to ensure functional improvements — perhaps they had deadlines to meet for their customers , but with no thought given to removing old code blocks , classes , etc .


throughout the Android package .


WolfRAT is a specifically targeted RAT which we assess to be aimed at Thai individuals and , based on previous work from Wolf Research , most likely used as an intelligence-gathering tool or interception tool .


This can be packaged and " sold '' in many different ways to customers .


A " Tracking tool '' or an " Admin tool '' are often cited for these kinds of tools for " commercial '' or " enterprise '' usage .


Wolf Research claimed to shut down their operations but we clearly see that their previous work continues under another guise .


The ability to carry out these types of intelligence-gathering activities on phones represents a huge score for the operator .


The chat details , WhatsApp records , messengers and SMSs of the world carry some sensitive information which people often forget when communicating with their devices .


We see WolfRAT specifically targeting a highly popular encrypted chat app in Asia , Line , which suggests that even a careful user with some awareness around end-to-end encryption chats would still be at the mercy of WolfRAT and it 's prying eyes .


IOCS Hashes 139edb1bc033725539b117f50786f3d3362ed45845c57fe1f82e7ed72b044367 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e19823a1ba4a0e40cf459f4a0489fc257720cc0d71ecfb7ad94b3ca86fbd85d1 e5f346d8f312cc1f93c2c6af611e2f50805c528934786ea173cabc6a39b14cda


ac5abaebd9f516b8b389450f7d27649801d746fb14963b848f9d6dad0a505e66 3a45d7a16937d4108b5b48f44d72bb319be645cbe15f003dc9e77fd52f45c065 Domains cvcws [ .


] ponethus [ .


] com svc [ .


] com www [ .


] com webmail [ .


] com nampriknum [ .


] net www [ .


] nampriknum [ .


] net svc [ .


] net svcws [ .


] somtum [ .


] today svcws [ .


] today www [ .


] today somtum [ .


] today shop [ .


] databit [ .


] today svc [ .


] today test [ .


] today admin [ .databit [ .today cendata [ .


] cendata [ .


] today PHA Family Highlights : Zen and its cousins January 11 , 2019 Google Play Protect detects Potentially Harmful Applications ( PHAs ) which Google Play Protect defines as any mobile app that poses a potential security risk to users or to user data—commonly referred to as " malware .


'' in a variety of ways , such as static analysis , dynamic analysis , and machine learning .


While our systems are great at automatically detecting and protecting against PHAs , we believe the best security comes from the combination of automated scanning and skilled human review .


With this blog series we will be sharing our research analysis with the research and broader security community , starting with the PHA family , Zen .


Zen uses root permissions on a device to automatically enable a service that creates fake Google accounts .


These accounts are created by abusing accessibility services .


Zen apps gain access to root permissions from a rooting trojan in its infection chain .


In this blog post , we do not differentiate between the rooting component and the component that abuses root : we refer to them interchangeably as Zen .


We also describe apps that we think are coming from the same author or a group of authors .


All of the PHAs that are mentioned in this blog post were detected and removed by Google Play Protect .


Background Uncovering PHAs takes a lot of detective work and unraveling the mystery of how they 're possibly connected to other apps takes even more .


PHA authors usually try to hide their tracks , so attribution is difficult .


Sometimes , we can attribute different apps to the same author based on a small , unique pieces of evidence that suggest similarity , such as a repetition of an exceptionally rare code snippet , asset , or a particular string in the debug logs .


Every once in a while , authors leave behind a trace that allows us to attribute not only similar apps , but also multiple different PHA families to the same group or person .


However , the actual timeline of the creation of different variants is unclear .


In April 2013 , we saw the first sample , which made heavy use of dynamic code loading ( i.e. , fetching executable code from remote sources after the initial app is installed ) .


Dynamic code loading makes it impossible to state what kind of PHA it was .


This sample displayed ads from various sources .


More recent variants blend rooting capabilities and click fraud .


As rooting exploits on Android become less prevalent and lucrative , PHA authors adapt their abuse or monetization strategy to focus on tactics like click fraud .


This post does n't follow the chronological evolution of Zen , but instead covers relevant samples from least to most complex .


Apps with a custom-made advertisement SDK The simplest PHA from the author 's portfolio used a specially crafted advertisement SDK to create a proxy for all ads-related network traffic .


By proxying all requests through a custom server , the real source of ads is opaque .


This example shows one possible implementation of this technique .


This approach allows the authors to combine ads from third-party advertising networks with ads they created for their own apps .


It may even allow them to sell ad space directly to application developers .


The advertisement SDK also collects statistics about clicks and impressions to make it easier to track revenue .


Selling the ad traffic directly or displaying ads from other sources in a very large volume can provide direct profit to the app author from the advertisers .


We have seen two types of apps that use this custom-made SDK .


The first are games of very low quality that mimic the experience of popular mobile games .


While the counterfeit games claim to provide similar functionality to the popular apps , they are simply used to display ads through a custom advertisement SDK .


The second type of apps reveals an evolution in the author 's tactics .


Instead of implementing very basic gameplay , the authors pirated and repackaged the original game in their app and bundled with it their advertisement SDK .


The only noticeable difference is the game has more ads , including ads on the very first screen .


In all cases , the ads are used to convince users to install other apps from different developer accounts , but written by the same group .


Those apps use the same techniques to monetize their actions .


Click fraud apps The authors ' tactics evolved from advertisement spam to real PHA ( Click Fraud ) .


Click fraud PHAs simulate user clicks on ads instead of simply displaying ads and waiting for users to click them .


This allows the PHA authors to monetize their apps more effectively than through regular advertising .


This behavior negatively impacts advertisement networks and their clients because advertising budget is spent without acquiring real customers , and impacts user experience by consuming their data plan resources .


The click fraud PHA requests a URL to the advertising network directly instead of proxying it through an additional SDK .


The command & control server ( C & C server ) returns the URL to click along with a very long list of additional parameters in JSON format .


After rendering the ad on the screen , the app tries to identify the part of the advertisement website to click .


If that part is found , the app loads Javascript snippets from the JSON parameters to click a button or other HTML element , simulating a real user click .


Because a user interacting with an ad often leads to a higher chance of the user purchasing something , ad networks often " pay per click '' to developers who host their ads .


Therefore , by simulating fraudulent clicks , these developers are making money without requiring a user to click on an advertisement .


This example code shows a JSON reply returned by the C & C server .


It has been shortened for brevity .


Based on this JSON reply , the app looks for an HTML snippet that corresponds to the active element ( show_hide btnnext ) and , if found , the Javascript snippet tries to perform a click ( ) method on it .


Rooting trojans The Zen authors have also created a rooting trojan .


Using a publicly available rooting framework , the PHA attempts to root devices and gain persistence on them by reinstalling itself on the system partition of rooted device .


Installing apps on the system partition makes it harder for the user to remove the app .


This technique only works for unpatched devices running Android 4.3 or lower .


Devices running Android 4.4 and higher are protected by Verified Boot .


Zen 's rooting trojan apps target a specific device model with a very specific system image .


After achieving root access the app tries to replace the framework.jar file on the system partition .


Replicating framework.jar allows the app to intercept and modify the behavior of the Android standard API .


In particular , these apps try to add an additional method called statistics ( ) into the Activity class .


When inserted , this method runs every time any Activity object in any Android app is created .


This happens all the time in regular Android apps , as Activity is one of the fundamental Android UI elements .


The only purpose of this method is to connect to the C & C server .


The Zen trojan After achieving persistence , the trojan downloads additional payloads , including another trojan called Zen .


Zen requires root to work correctly on the Android operating system .


The Zen trojan uses its root privileges to turn on accessibility service ( a service used to allow Android users with disabilities to use their devices ) for itself by writing to a system-wide setting value enabled_accessibility_services .


Zen does n't even check for the root privilege : it just assumes it has it .


This leads us to believe that Zen is just part of a larger infection chain .


The trojan implements three accessibility services directed at different Android API levels and uses these accessibility services , chosen by checking the operating system version , to create new Google accounts .


This is done by opening the Google account creation process and parsing the current view .


The app then clicks the appropriate buttons , scrollbars , and other UI elements to go through account sign-up without user intervention .


During the account sign-up process , Google may flag the account creation attempt as suspicious and prompt the app to solve a CAPTCHA .


To get around this , the app then uses its root privilege to inject code into the Setup Wizard , extract the CAPTCHA image , and sends it to a remote server to try to solve the CAPTCHA .


It is unclear if the remote server is capable of solving the CAPTCHA image automatically or if this is done manually by a human in the background .


After the server returns the solution , the app enters it into the appropriate text field to complete the CAPTCHA challenge .


The Zen trojan does not implement any kind of obfuscation except for one string that is encoded using Base64 encoding .


It 's one of the strings - " How you 'll sign in '' - that it looks for during the account creation process .


The code snippet below shows part of the screen parsing process .


Apart from injecting code to read the CAPTCHA , the app also injects its own code into the system_server process , which requires root privileges .


This indicates that the app tries to hide itself from any anti-PHA systems that look for a specific app process name or does not have the ability to scan the memory of the system_server process .


The app also creates hooks to prevent the phone from rebooting , going to sleep or allowing the user from pressing hardware buttons during the account creation process .


These hooks are created using the root access and a custom native code called Lmt_INJECT , although the algorithm for this is well known .


First , the app has to turn off SELinux protection .


Then the app finds a process id value for the process it wants to inject with code .


This is done using a series of syscalls as outlined below .


The " source process '' refers to the Zen trojan running as root , while the " target process '' refers to the process to which the code is injected and [ pid ] refers to the target process pid value .


The source process checks the mapping between a process id and a process name .


This is done by reading the /proc/ [ pid ] /cmdline file .


This very first step fails in Android 7.0 and higher , even with a root permission .


The /proc filesystem is now mounted with a hidepid=2 parameter , which means that the process can not access other process /proc/ [ pid ] directory .


A ptrace_attach syscall is called .


This allows the source process to trace the target .


The source process looks at its own memory to calculate the offset between the beginning of the libc library and the mmap address .


The source process reads /proc/ [ pid ] /maps to find where libc is located in the target process memory .


By adding the previously calculated offset , it can get the address of the mmap function in the target process memory .


The source process tries to determine the location of dlopen , dlsym , and dlclose functions in the target process .


It uses the same technique as it used to determine the offset to the mmap function .


The source process writes the native shellcode into the memory region allocated by mmap .


Additionally , it also writes addresses of dlopen , dlsym , and dlclose into the same region , so that they can be used by the shellcode .


Shellcode simply uses dlopen to open a .so file within the target process and then dlsym to find a symbol in that file and run it .


The source process changes the registers in the target process so that PC register points directly to the shellcode .


This is done using the ptrace syscall .


This diagram illustrates the whole process .


Summary PHA authors go to great lengths to come up with increasingly clever ways to monetize their apps .


Zen family PHA authors exhibit a wide range of techniques , from simply inserting an advertising SDK to a sophisticated trojan .


The app that resulted in the largest number of affected users was the click fraud version , which was installed over 170,000 times at its peak in February 2018 .


The most affected countries were India , Brazil , and Indonesia .


In most cases , these click fraud apps were uninstalled by the users , probably due to the low quality of the apps .


If Google Play Protect detects one of these apps , Google Play Protect will show a warning to users .


We are constantly on the lookout for new threats and we are expanding our protections .


Every device with Google Play includes Google Play Protect and all apps on Google Play are automatically and periodically scanned by our solutions .


You can check the status of Google Play Protect on your device : Open your Android device 's Google Play Store app .


Tap Menu > Play Protect .


Look for information about the status of your device .


Hashes of samples Type Package name SHA256 digest Custom ads com.targetshoot.zombieapocalypse.sniper.zombieshootinggame 5d98d8a7a012a858f0fa4cf8d2ed3d5a82937b1a98ea2703d440307c63c6c928 Click fraud com.counterterrorist.cs.elite.combat.shootinggame 84672fb2f228ec749d3c3c1cb168a1c31f544970fd29136bea2a5b2cefac6d04


Rooting trojan com.android.world.news bd233c1f5c477b0cc15d7f84392dab3a7a598243efa3154304327ff4580ae213 Zen trojan com.lmt.register eb12cd65589cbc6f9d3563576c304273cb6a78072b0c20a155a0951370476d8d Mobile Campaign ‘ Bouncing Golf ’ Affects Middle East We uncovered a cyberespionage campaign targeting Middle


Eastern countries .


We named this campaign “ Bouncing Golf ” based on the malware ’ s code in the package named “ golf. ” June 18 , 2019 We uncovered a cyberespionage campaign targeting Middle Eastern countries .


We named this campaign “ Bouncing Golf ” based on the malware ’ s code in the package named “ golf. ” The malware involved , which Trend Micro detects as AndroidOS_GolfSpy.HRX , is notable for its wide range of cyberespionage capabilities .


Malicious codes are embedded in apps that the operators repackaged from legitimate applications .


Monitoring the command and control ( C & C ) servers used by Bouncing Golf , we ’ ve so far observed more than 660 Android devices infected with GolfSpy .


Much of the information being stolen appear to be military-related .


The campaign ’ s attack vector is also interesting .


These repackaged , malware-laden apps are neither on Google Play nor popular third-party app marketplaces , and we only saw the website hosting the malicious apps being promoted on social media when we followed GolfSpy ’ s trail .


We were also able to analyze some GolfSpy samples sourced from the Trend Micro mobile app reputation service .


Also of note is Bouncing Golf ’ s possible connection to a previously reported mobile cyberespionage campaign that researchers named Domestic Kitten .


The strings of code , for one , are similarly structured .


The data targeted for theft also have similar formats .


Figure 1 .


GolfSpy ’ s infection chain GolfSpy 's Potential Impact Given GolfSpy ’ s information-stealing capabilities , this malware can effectively hijack an infected Android device .


Here is a list of information that GolfSpy steals : Device accounts List of applications installed in the device Device ’ s current running processes Battery status Bookmarks/Histories of the device ’ s default browser Call logs and records Clipboard contents Contacts , including those in VCard format Mobile operator information Files stored on SDcard Device location List of image , audio , and video files stored on the device Storage and memory information Connection information Sensor information SMS messages Pictures GolfSpy also has a function that lets it connect to a remote server to fetch and perform commands


, including : searching for , listing , deleting , and renaming files as well as downloading a file into and retrieving a file from the device ; taking screenshots ; installing other application packages ( APK ) ; recording audio and video ; and updating the malware .


Technical Analysis The repackaged applications are embedded with malicious code , which can be found in the com.golf package .


These repackaged apps pose as communication , news , lifestyle , book , and reference apps popularly used in the Middle East .


The GolfSpy malware embedded in the apps is hardcoded with an internal name used by the attacker .


Figure 2 .


Icons of the apps that Bouncing Golf ’ s operators repackaged ( top ) and a comparison of packages between the original legitimate app ( bottom left ) and GolfSpy ( bottom right ) Figure 3 .


GolfSpy ’ s configurations encoded by a custom algorithm ( right ) and its decoded version ( left ) As shown in Figure 3 , GolfSpy ’ s configurations ( e.g. , C & C server , secret keys ) are encoded by a customized algorithm .


After it is launched , GolfSpy will generate a unique ID for the affected device and then collect its data such as SMS , contact list , location , and accounts in this format : “ % , [ ] , time ” ( shown in Figure 4 ) .


The information is written into a file on the device .


The attacker can choose the data types to collect , which are written in a certain format .


Figure 4 .


Code snippet showing GolfSpy generating UUID The value of % is in the range of 1-9 or a-j .


Each value represents a different type of data to steal from the device : Value Data Type 1 Accounts 2 Installed APP list 3 Running processes list 4 Battery status 5 Browser bookmarks and histories 6 Call logs 7 Clipboard 8 Contacts 9 Mobile operator information a File list on SD card b Location c Image list d Audio list e Video list f Storage and memory information g Connection information h Sensors information i SMS messages j VCard format contacts Table 1 .


The type of data corresponding to the value coded in GolfSpy Figure 5 shows the code snippets that are involved in monitoring and recording the device ’ s phone call .


It will also take a photo using the device ’ s front camera when the user wakes the device .


Apart from collecting the above data , the spyware monitors users ’ phone calls , records them , and saves the recorded file on the device .


GolfSpy encrypts all the stolen data using a simple XOR operation with a pre-configured key before sending it to the C & C server using the HTTP POST method .


Figure 5 .


Code snippets showing how GolfSpy monitors phone calls via register receiver ( top left ) , its actions when the device is woken up ( top right ) , and how it encrypts the stolen data ( bottom ) The malware retrieves commands from the C & C server via HTTP , and attackers can steal specific files on the infected device .


The command is a constructed string split into three parts using " " as a separator .


The first part is the target directory , the second is a regular expression used to match specific files , while the last part is an ID .


Figure 6 .


Example of a command that steals specific files from an infected device ’ s application ( top ) , and GolfSpy ’ s parse-and-perform command ( bottom ) Apart from the HTTP POST method , GolfSpy also creates a socket connection to the remote C & C server in order to receive and perform additional commands .


Stolen data will also be encrypted and sent to the C & C server via the socket connection .


The encryption key is different from the one used for sending stolen data via HTTP .


Figure 7 .


The additional commands that attackers can carry out via a socket connection ( top ) and the key used to encrypt the stolen data ( bottom ) Correlating Bouncing Golf 's Activities We monitored Bouncing Golf ’ s C & C-related activities and saw that the campaign has affected more than 660 devices as of this writing .


The small or limited number is understandable given the nature of this campaign , but we also expect it to increase or even diversify in terms of distribution .


Most of the affected devices were located in the Middle East , and many of the stolen data we saw is military-related ( e.g. , images , documents ) .


Bouncing Golf ’ s operators also try to cover their tracks .


The registrant contact details of the C & C domains used in the campaign , for instance , were masked .


The C & C server IP addresses used also appear to be disparate , as they were located in many European countries like Russia , France , Holland , and Germany .


It ’ s not a definite correlation , but Bouncing Golf also seems to have a connection with Domestic Kitten due to similarities we found in their code .


For example , the Android malware that both deploy share the same strings of code for their decoding algorithm .


The data that Domestic Kitten steals follows a similar format with Bouncing Golf ’ s , with each type of data having a unique identifying character .


It ’ s also worth noting that both campaigns repackage apps that are commonly used in their target ’ s countries , such as Telegram , Kik , and Plus messaging apps .


Figure 8 .


Code snippets showing : the decoding algorithm shared by both Bouncing Golf and Domestic Kitten ( top ) , the format of data that Domestic Kitten ’ s malware targets to steal ( center ) , and how both Bouncing Golf ( bottom left ) and Domestic Kitten ( bottom right ) use " " as a separator in their command strings .


As we ’ ve seen in last year ’ s mobile threat landscape , we expect more cyberespionage campaigns targeting the mobile platform given its ubiquity , employing tried-and-tested techniques to lure unwitting users .


The extent of information that these kinds of threats can steal is also significant , as it lets attackers virtually take over a compromised device .


Users should adopt best practices , while organizations should ensure that they balance the need for mobility and the importance of security .


End users and enterprises can also benefit from multilayered mobile security solutions such as Trend Micro™ Mobile Security™ .


Trend Micro™ Mobile Security for Enterprise provides device , compliance and application management , data protection , and configuration provisioning , as well as protects devices from attacks that exploit vulnerabilities , preventing unauthorized access to apps , and detecting and blocking malware and fraudulent websites .


Trend Micro ’ s Mobile App Reputation Service ( MARS ) covers Android and iOS threats using leading sandbox and machine learning technologies , protecting devices against malware , zero-day and known exploits , privacy leaks , and application vulnerabilities .


Several weeks ago , Check Point Mobile Threat Prevention detected and quarantined the Android device of an unsuspecting customer employee who downloaded and installed a 0day mobile ransomware from Google Play dubbed “ Charger. ” This incident demonstrates how malware can be a dangerous threat to your business , and how advanced behavioral detection fills mobile security gaps attackers use to penetrate entire networks .


Charger was found embedded in an app called EnergyRescue .


The infected app steals contacts and SMS messages from the user ’ s device and asks for admin permissions .


If granted , the ransomware locks the device and displays a message demanding payment : You need to pay for us , otherwise we will sell portion of your personal information on black market every 30 minutes .


WE GIVE 100 % GUARANTEE THAT ALL FILES WILL RESTORE AFTER WE RECEIVE PAYMENT .


WE WILL UNLOCK THE MOBILE DEVICE AND DELETE ALL YOUR DATA FROM OUR SERVER !


TURNING OFF YOUR PHONE IS MEANINGLESS , ALL YOUR DATA IS ALREADY STORED ON OUR SERVERS !


WE STILL CAN SELLING IT FOR SPAM , FAKE , BANK CRIME etc… We collect and download all of your personal data .


All information about your social networks , Bank accounts , Credit Cards .


We collect all data about your friends and family .


The ransom demand for 0.2 Bitcoins ( roughly $ 180 ) is a much higher ransom demand than has been seen in mobile ransomware so far .


By comparison , the DataLust ransomware demanded merely $ 15 .


Payments are made to a specific Bitcoin account , but we haven ’ t identified any payments so far .


Adware commonly found on Play collects profits from ad networks , but mobile ransomware inflicts direct harm to users .


Like FakeDefender and DataLust , Charger could be an indicator of a wider effort by mobile malware developers to catch up with their PC ransomware cousins .


Similar to other malware seen in the past , Charger checks the local settings of the device and does not run its malicious logic if the device is located in Ukraine , Russia , or Belarus .


This is likely done to keep the developers from being prosecuted in their own countries or being extradited between countries .


Most malware found on Google Play contains only a dropper that later downloads the real malicious components to the device .


Charger , however , uses a heavy packing approach which it harder for the malware to stay hidden , so it must compensate with other means .


The developers of Charger gave it everything they had to boost its evasion capabilities and so it could stay hidden on Google Play for as long as possible .


The malware uses several advanced techniques to hide its real intentions and makes it harder to detect .


It encodes strings into binary arrays , making it hard to inspect them .


It loads code from encrypted resources dynamically , which most detection engines can not penetrate and inspect .


The dynamically-loaded code is also flooded with meaningless commands that mask the actual commands passing through .


It checks whether it is being run in an emulator before it starts its malicious activity .


PC malware first introduced this technique which is becoming a trend in mobile malware having been adopted by several malware families including Dendroid .


Emulator and location conditions for the malware ’ s activity Check Point Mobile Threat Prevention customers are protected from Charger and similar malware .


Check Point ’ s Analysis and Response Team ( ART ) disclosed the finding to Android ’ s Security team who took the appropriate security steps to remove the infected app and added the malware to Android ’ s built-in protection mechanisms .


Charger SHA256 hash : 58eb6c368e129b17559bdeacb3aed4d9a5d3596f774cf5ed3fdcf51775232ba0 Infostealer , Keylogger , and Ransomware in One : Anubis Targets More than 250 Android Applications October 29 , 2021 The Cofense Phishing Defense Center uncovered a phishing campaign that specifically targets users of Android devices that could result in compromise if unsigned Android applications are permitted on the device .


The campaign seeks to deliver Anubis , a particularly nasty piece of malware that was originally used for cyber espionage and retooled as a banking trojan .


Anubis can completely hijack an Android mobile device , steal data , record phone calls , and even hold the device to ransom by encrypting the victim ’ s personal files .


With mobile devices increasingly used in the corporate environment , thanks to the popularity of BYOD policies , this malware has the potential to cause serious harm , mostly to consumers , and businesses that allow the installation of unsigned applications .


Here ’ s how it works : At first glance , the email shown in Figure 1 looks like any other phishing email that asks the user to download an invoice .


However , this particular email downloads an Android Package Kit ( APK ) , which is the common format used by Android to distribute and install applications .


Let ’ s take a closer look at the suspicious file .


Figure 1 – Phishing Email When the email link is opened from an Android device , an APK file ( Fattura002873.apk ) , is downloaded .


Upon opening the file , the user is asked to enable “ Google Play Protect ” as shown in Figure 2 .


However , this is not a genuine “ Google Play Protect ” screen ; instead it gives the app all the permissions it needs while simultaneously disabling the actual Google Play Protect .


Figure 2 – Granting Permissions The following permissions are granted to the app : Figure 3 – Permissions Granted to App A closer look at the code reveals the application gathers a list of installed applications to compare the results against a list of targeted applications ( Figure 4 ) .


The malware mainly targets banking and financial applications , but also looks for popular shopping apps such as eBay or Amazon .


A full list of targeted applications is included in the IOC section at the end of this post .


Once an application has been identified , Anubis overlays the original application with a fake login page to capture the user ’ s credentials .


Figure 4 – Checking for installed apps Based on a thorough analysis of the code , the most interesting technical capabilities include : Capturing screenshots Enabling or changing administration settings Opening and visiting any URL Disabling Play Protect Recording audio Making phone calls Stealing the contact list Controlling the device via VNC Sending , receiving and deleting SMS Locking the device Encrypting files on the device and external drives Searching for files Retrieving the GPS location Capturing remote control commands from Twitter and Telegram Pushing overlays Reading the device ID The malware includes


a keylogger that works in every app installed on the Android device .


However , the keylogger needs to be specifically enabled by a command sent from the C2 server .


The keylogger can track three different events ( Figure 5 ) : TYPE_VIEW_CLICKED Represents the event of clicking on a View-like Button , CompoundButton , etc .


TYPE_VIEW_FOCUSED Represents the event of setting input focus of a View .


TYPE_VIEW_TEXT_CHANGED Represents the event of changing the text of an EditText .


Figure 5 – Keylogger component Figure 6 shows one of the most noteworthy functions of Anubis : its ransomware module .


The malware searches both internal and external storage and encrypts them using RC4 .


It adds the file extension .AnubisCrypt to each encrypted file and sends it to the C2 .


Figure 6 – Ransomware component Anubis has been known to utilize Twitter or Telegram to retrieve the C2 address and this sample is no exception ( Figure 7 ) .


Figure 7 – C2 As seen in Figure 8 , this version of Anubis is built to run on several iterations of the Android operating system , dating back to version 4.0.3 , which was released in 2012 .


Figure 8 – Android requirements Android malware has been around for many years and will be with us for the foreseeable future .


Users who have configured their Android mobile device to receive work-related emails and allow installation of unsigned applications face the most risk of compromise .


APK files will not natively open in an environment other than an Android device .


With the increased use of Android phones in business environments , it is important to defend against these threats by ensuring devices are kept current with the latest updates .


Limiting app installations on corporate devices , as well as ensuring that applications are created by trusted developers on official marketplaces , can help in reducing the risk of infection as well .


ViceLeaker Operation : mobile espionage targeting Middle East 26 JUN 2019 In May 2018 , we discovered a campaign targeting dozens of mobile Android devices belonging to Israeli citizens .


Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims ; and a hash of the APK involved ( Android application ) was tagged in our sample feed for inspection .


Once we looked into the file , we quickly found out that the inner-workings of the APK included a malicious payload , embedded in the original code of the application .


This was an original spyware program , designed to exfiltrate almost all accessible information .


During the course of our research , we noticed that we were not the only ones to have found the operation .


Researchers from Bitdefender also released an analysis of one of the samples in a blogpost .


Although something had already been published , we decided to do something different with the data we acquired .


The following month , we released a private report on our Threat Intelligence Portal to alert our clients about this newly discovered operation and began writing YARA rules in order to catch more samples .


We decided to call the operation “ ViceLeaker ” , because of strings and variables in its code .


Mobile ViceLeaker The following table shows meta information on the observed samples , including compiler timestamps : MD5 Package Compiler C2 51df2597faa3fce38a4c5ae024f97b1c com.xapps.SexGameForAdults dexlib 2.x 188.165.28 [ .


] 251 2d108ff3a735dea1d1fdfa430f37fab2 com.psiphon3 dexlib 2.x 188.165.49 [ .


] 205 7ed754a802f0b6a1740a99683173db73 com.psiphon3 dexlib 2.x 188.165.49 [ .


] 205 3b89e5cd49c05ce6dc681589e6c368d9 ir.abed.dastan dexlib 2.x 185.141.60 [ .


] 213 To backdoor legitimate applications , attackers used a Smali injection technique – a type of injection that allows attackers to disassemble the code of original app with the Baksmali tool , add their malicious code , and assemble it with Smali .


As a result , due to such an unusual compilation process , there were signs in the dex file that point to dexlib , a library used by the Smali tool to assemble dex files .


Original code of the APK on the left , versus injected APK on the right The analysis of the APK was rather interesting , because some of the actions were very common spyware features , such as the exfiltration of SMS messages , call logs and other data .


However , in addition to the traditional functionality , there were also backdoor capabilities such as upload , download , delete files , camera takeover and record surrounding audio .


The malware uses HTTP for communication with the C2 server for command handling and data exfiltration .


Here is a command and control protocol fragment : Commands from C2 server parsing In total , the malicious APK handles 16 different commands : Command Endpoint Description 1 reqsmscal.php Send specified SMS message 2 reqsmscal.php Call specified number 3 reqsmscal.php Exfiltrate device info , such as phone model and OS version 4 reqsmscal.php Exfiltrate a list of all installed applications 5 reqsmscal.php Exfiltrate default browser history ( limited to a given date ) 6 reqsmscal.php


Exfiltrate Chrome browser history ( limited to a given date ) 7 reqsmscal.php Exfiltrate memory card file structure 8 reqsmscal.php Record surrounding sound for 80 seconds 1 reqcalllog.php Exfiltrate all call logs 2 reqcalllog.php Exfiltrate all SMS messages 3 reqcalllog.php Upload specified file from the device to the C2 4 reqcalllog.php Download file from specified URL and save on device 5 reqcalllog.php Delete specified file 6,7,8 reqcalllog.php Commands not yet


implemented 9 reqcalllog.php Take photo ( muted audio ) with rear camera , send to C2 10 reqcalllog.php Take photo ( muted audio ) with front camera , send to C2 All observed samples with Smali injections were signed by the same debug certificate ( 0x936eacbe07f201df ) .


As we know from our investigation , traces of the first development activities were found at the end of 2016 , but the main distribution campaign began in 2018 ( end of 2017 ) .


Based on our detection statistics , the main infection vector is the spread of Trojanized applications directly to victims via Telegram and WhatsApp messengers .


There are the following relevant detection paths ( the last one is an alternative Telegram client – “ Telegram X “ ) : Name Detection path Sex Game For Adults 18.apk /storage/emulated/0/WhatsApp/Media/WhatsApp Documents/ 4_6032967490689041387.apk /storage/emulated/0/Telegram/Telegram Documents/ Psiphon-v91.apk /storage/emulated/0/Android/data/org.thunderdog.challegram/files/documents/ Backdoored Open Source During the course


of our analysis , we also found samples sharing code with the ViceLeaker malware , in particular they shared a delimiter that was used in both cases to parse commands from the C2 server .


This would be a very unusual coincidence .


Even when a false flag might also be a possibility , we consider this to be unlikely .


The samples sharing this overlap are modified versions of an open source Jabber/XMPP client called “ Conversations ” with some code additions .


The legitimate version of this app is also available on Google Play .


The Conversations modified samples differ from the original one in the getKnownHosts method that was modified to replace the main XMPP host with the attackers ’ C2 server : It appears that the attackers were using a specific C2 for the use of that app .


Another important modification is in the message transfer process : With this modification , an application sends device location coordinates with every message .


There are also many other modifications , fully described in our private report .


In addition , we did not see traces of the Smali injection .


In this case we found traces of dx/dexmerge compilers , which means that , this time , the attackers just imported the original source code into an Android IDE ( such as Android Studio , for instance ) and compiled it with their own modifications .


In addition to adding the code , the attackers also changed the icon and package name .


We do not know why , but we suspect that it was an attempt to hide the origin of the application .


Conversations-based app mimics Telegram messenger Even when we originally thought this was a backdoored version of the Conversations app , used to infect victims , we didn´t discovered anything malicious in it .


This brought to us the hypothesis that this might be a version used by the group behind ViceLeaker for internal communication or for other , unclear purposes .


All the detections of this backdoored app were geolocated in Iran .


Backdoored Conversations C2 server analysis During the analysis of the Smali injected apps and their C2 server infrastructure we hadn ’ t found any interesting clues , but things changed when we looked at the C2 server of the linked Conversations messenger .


It uses “ 185.51.201 [ .


] 133 ” as a main C2 address , and there is only one domain that is hosted on this dedicated server – iliageram [ .


] ir .


Note that we later found versions that used the domain as a C2 directly instead of the IP address .


The record contains a personal email address : WHOIS records of C2 server exposing the attacker ’ s email address We were aware of the possibility that the attackers might be using a compromised email account , so we dug deeper to find more information related to this email address .


A quick search produced results about a personal page and , what is more interesting , a GitHub account that contains a forked Conversation repository .


Related Github account contains forked Conversations repository Summarizing all the found clues , we have the following attribution flow : Conclusion The operation of ViceLeaker is still ongoing , as is our research .


The attackers have taken down their communication channels and are probably looking for ways to assemble their tools in a different manner .


Kaspersky detects and blocks samples of the ViceLeaker operation using the following verdict : Trojan-Spy.AndroidOS.ViceLeaker .


* Actually , we are currently investigating whether this group might also be behind a large-scale web-oriented attack at the end of 2018 using code injection and exploiting SQL vulnerabilities .


Even when this would not be directly related to the Android malware described in this blogpost , it would be an indicator of wider capabilities and objectives of this actor .


XLoader Android Spyware and Banking Trojan Distributed via DNS Spoofing We have been detecting a new wave of network attacks since early March , which , for now , are targeting Japan , Korea , China , Taiwan , and Hong Kong .


Trend Micro detects these as ANDROIDOS_XLOADER.HRX .


By : Trend Micro April 20 , 2018 We have been detecting a new wave of network attacks since early March , which , for now , are targeting Japan , Korea , China , Taiwan , and Hong Kong .


The attacks use Domain Name System ( DNS ) cache poisoning/DNS spoofing , possibly through infringement techniques such as brute-force or dictionary attacks , to distribute and install malicious Android apps .


These malware pose as legitimate Facebook or Chrome applications .


They are distributed from polluted DNS domains that send a notification to an unknowing victim ’ s device .


The malicious apps can steal personally identifiable and financial data and install additional apps .


XLoader can also hijack the infected device ( i.e. , send SMSs ) and sports self-protection/persistence mechanisms through device administrator privileges .


Infection Chain As with our earlier reports in late March , the attack chain involves diverting internet traffic to attacker-specified domains by compromising and overwriting the router ’ s DNS settings .


A fake alert will notify and urge the user to access the malicious domain and download XLoader .


Technical Analysis XLoader first loads the encrypted payload from Assets/db as test.dex to drop the necessary modules then requests for device administrator privileges .


Once granted permission , it hides its icon from the launcher application list then starts a service that it keeps running in the background .


The background service uses the reflection technique ( a feature that allows the inspection and modification of Java-based programs ’ internal properties ) to invoke the method com.Loader.start in the payload .


Monitoring Broadcast Events XLoader registers many broadcast receivers in the payload dynamically ( to monitor broadcast events sent between system and applications ) .


Registering broadcast receivers enable XLoader to trigger its malicious routines .


Here is a list of broadcast actions : android.provider.Telephony.SMS_RECEIVED android.net.conn.CONNECTIVITY_CHANGE android.intent.action.BATTERY_CHANGED android.intent.action.USER_PRESENT android.intent.action.PHONE_STATE android.net.wifi.SCAN_RESULTS android.intent.action.PACKAGE_ADDED android.intent.action.PACKAGE_REMOVED android.intent.action.SCREEN_OFF android.intent.action.SCREEN_ON


android.media.RINGER_MODE_CHANGED android.sms.msg.action.SMS_SEND android.sms.msg.action.SMS_DELIVERED Creating a Web Server to Phish XLoader creates a provisional web server to receive the broadcast events .


It can also create a simple HTTP server on the infected device to deceive victims .


It shows a web phishing page whenever the affected device receives a broadcast event ( i.e. , if a new package is installed or if the device ’ s screen is on ) to steal personal data , such as those keyed in for banking apps .


The phishing page is translated in Korean , Japanese , Chinese , and English , which are hardcoded in the payload .


It will appear differently to users depending on the language set on the device .


XLoader as Spyware and Banking Trojan XLoader can also collect information related to usage of apps installed in the device .


Its data-stealing capabilities include collecting SMSs after receiving an SMS-related broadcast event and covertly recording phone calls .


XLoader can also hijack accounts linked to financial or game-related apps installed on the affected device .


XLoader can also start other attacker-specified packages .


A possible attack scenario involves replacing legitimate apps with repackaged or malicious versions .


By monitoring the package installation broadcast event , XLoader can start their packages .


This enables it to launch malicious apps without the user ’ s awareness and explicit consent .


We reverse engineered XLoader and found that it appears to target South Korea-based banks and game development companies .


XLoader also prevents victims from accessing the device ’ s settings or using a known antivirus ( AV ) app in the country .


XLoader can also load multiple malicious modules to receive and execute commands from its remote command-and-control ( C & C ) server , as shown below : Here ’ s a list of the modules and their functions : sendSms — send SMS/MMS to a specified address setWifi — enable or disable Wi-Fi connection gcont — collect all the device ’ s contacts lock — currently just an input lock status in the settings ( pref ) file , but may be used as a screenlocking ransomware bc — collect all contacts


from the Android device and SIM card setForward — currently not implemented , but can be used to hijack the infected device getForward — currently not implemented , but can be used to hijack the infected device hasPkg — check the device whether a specified app is installed or not setRingerMode — set the device ’ s ringer mode setRecEnable — set the device ’ s ringer mode as silent reqState — get a detailed phone connection status , which includes activated network and Wi-Fi ( with or without password ) showHome —


force the device ’ s back to the home screen getnpki : get files/content from the folder named NPKI ( contains certificates related to financial transactions ) http — access a specified network using HttpURLConnection onRecordAction — simulate a number-dialed tone call — call a specified number get_apps — get all the apps installed on the device show_fs_float_window — show a full-screen window for phishing Of note is XLoader ’ s abuse of the WebSocket protocol ( supported in many browsers


and web applications ) via ws ( WebSockets ) or wss ( WebSockets over SSL/TLS ) to communicate with its C & C servers .


The URLs — abused as part of XLoader ’ s C & C — are hidden in three webpages , and the C & C server that XLoader connects to differ per region .


The abuse of the WebSocket protocol provides XLoader with a persistent connection between clients and servers where data can be transported any time .


XLoader abuses the MessagePack ( a data interchange format ) to package the stolen data and exfiltrate it via the WebSocket protocol for faster and more efficient transmission .


Mitigations XLoader will not download malicious apps if the Android device uses a mobile data connection .


Nevertheless , users should practice proper security hygiene to mitigate threats that may take advantage of a home or business router ’ s security gaps .


Employ stronger credentials , for instance , to make them less susceptible to unauthorized access .


Regularly update and patch the router ’ s software and firmware to prevent exploits , and enable its built-in firewall .


For system administrators and information security professionals , configuring the router to be more resistant to attacks like DNS cache poisoning can help mitigate similar threats .


Everyday users can do the same by checking the router ’ s DNS settings if they ’ ve been modified .


Even threats like DNS cache poisoning employ social engineering , so users should also be more prudent against suspicious or unknown messages that have telltale signs of malware .


We have worked with Google and they ensure that Google Play Protect proactively catches apps of this nature .


No instances of these apps were found in Google Play .


September 08 , 2020 TikTok Spyware A detailed analysis of spyware masquerading as TikTok A recent threat to ban TikTok in the United States has taken the internet by storm and received mixed reactions from social media and internet users .


U.S. President Donald Trump has ordered ByteDance , the parent company of TikTok , to sell its U.S. TikTok assets and also issued executive orders that would ban the social media apps TikTok and WeChat from operating in the U.S. if the sale doesn ’ t happen in the next few weeks .


On the other side , ByteDance has filed a lawsuit suing the Trump administration .


When popular applications come under fire and are featured prominently in the news , hackers get excited as these newsworthy apps can become their latest target .


And TikTok is no exception .


Generally , after an application gets banned from an official app store , such as Google Play , users try to find alternative ways to download the app .


In doing so , users can become victims to malicious apps portraying themselves as the original app .


Recently there was a huge wave of SMS messages , as well as Whatsapp messages , making the rounds asking users to download the latest version of TikTok at hxxp : //tiny [ .


] cc/TiktokPro .


In reality , this downloaded app is a fake app that asks for credentials and Android permissions ( including camera and phone permissions ) , resulting in the user being bombarded with advertisements .


Recently , we have come across another variant of this app portraying itself as TikTok Pro , but this is a full-fledged spyware with premium features to spy on victim with ease .


( Please note this is a different app and not the same as the one being spread by hxxp : //tiny [ .


) Technical Analysis App Name : TikTok Pro Hash : 9fed52ee7312e217bd10d6a156c8b988 Package Name : com.example.dat.a8andoserverx Upon installation , the spyware portrays itself as TikTok using the name TikTok Pro .


As soon as a user tries to open the app , it launches a fake notification and soon the notification as well as the app icon disappears .


This fake notification tactic is used to redirect the user 's attention , meanwhile the app hides itself , making the user believe the app to be faulty .


This functionality can be seen in Figure 1 .


App Icon Figure 1 : App icon and fake notification .


Behind the scenes , there are number of process occurring simultaneously .


First , an activity named MainActivity fires up , taking care of hiding the icon and showing the fake notification .


It also starts an Android service named MainService .


The spyware also appears to have an additional payload stored under the /res/raw/ directory .


This is a common technique used by malware developers to bundle the main payload inside the Android package to avoid easy detection .


As seen in Figure 2 , the app tries to open the payload from the /res/raw/ directory and generate an additional Android Package Kit ( APK ) named .app.apk : Decoy Code Figure 2 : The decoy code for the fake TikTok .


Upon analysis , we discovered that this is a decoy functionality and no new payload is generated .


The conditions to build an additional payload are never met .


Going one step further , we rebuilt the malware to execute the apparent functionality of generating a payload , but discovered that the APK stored in the /res/raw/ directory is empty .


The placement of the decoy functionality is likely designed to confuse the malware researchers .


It is also possible that this functionality is under development , making this placeholder code incomplete .


Coming back to the execution flow , once the spyware hides itself , it starts an Android service named MainService .


Android services are components that can be made to execute independently in the background without the victim 's knowledge .


MainService is the brain of this spyware and controls almost everything—from stealing the victim 's data to deleting it .


All of its capabilities are discussed later in this blog .


Hide Icon Figure 3 : Code showing the hiding icon and starting service .


As MainService is the main controller , the developer has taken the appropriate actions to keep it functional and running at all times .


The malware developer uses various tactics to do so , and one of them is using Android 's broadcast receivers .


Broadcast receivers are components that allow you to register for various Android events .


In this case , it registers three broadcast receivers : MyReceiver - Triggers when the device is booted .


Intercept Call - Triggers on incoming and outgoing calls .


AlarmReceiver - Triggers every three minutes .


MyReceiver and AlarmReceiver start the MainService whenever appropriate events occur .


This tactic is very common among malware developers to ensure the malware is not killed by the Android OS or by any other means .


Figure 4 shows MyReceiver in action where it eventually calls the MainService service .


Broadcast Receiver Figure 4 : MyReceiver broadcast receiver .


The InterceptCall receiver is triggered whenever there is an incoming or outgoing call .


It sets particular parameters in relation to call details and a further service named calls takes the control as seen in Figure 5 .


Call Service Figure 5 : Code for the calls service As seen above , the calls service stores incoming call details in .mp3 format in the /sdcard/DCIM/.dat/ directory with file name appended with " In_ '' for incoming calls and " Out_ '' for outgoing calls .


How these recorded calls are sent to the command and control server ( CnC ) is taken care of by MainService , which is discussed next .


MainService is the central controller of this spyware .


It controls each and every functionality based on the commands sent by the command and control ( C & C ) server .


As soon as this service is started , it creates two processes that take care of connection and disconnection to the C & C server .


This functionality can be seen in Figure 6 .


TimerTask Figure 6 : The timer task .


MainService has the following capabilities : Steal SMS messages Send SMS messages Steal the victim 's location Capture photos Execute commands Capture screenshots Call phone numbers Initiate other apps Steal Facebook credentials , etc All of the above functionalities take place on the basis of commands sent by the attacker .


Stolen data is stored in external storage under the /DCIM/ directory with a hidden sub-directory named " .dat '' .


Below is the list of all the commands catered by the C & C server .


Command Action Unistxcr Restart the app dowsizetr Send the file stored in the /sdcard/DCIM/.dat/ directory to the C & C server Caspylistx Get a list of all hidden files in the /DCIM/.dat/ directory spxcheck Check whether call details are collected by the spyware S8p8y0 Delete call details stored by the spyware screXmex Take screenshots of the device screen Batrxiops Check battery status L4oclOCMAWS Fetch the victim 's location GUIFXB Launch


the fake Facebook login page IODBSSUEEZ Send a file containing stolen Facebook credentials to the C & C server FdelSRRT Delete files containing stolen Facebook credentials chkstzeaw Launch Facebook LUNAPXER Launch apps according to the package name sent by the C & C server Gapxplister Get a list of all installed applications DOTRall8xxe Zip all the stolen files and store in the /DCIM/.dat/ directory Acouxacour Get a list of accounts on the victim 's device Fimxmiisx Open the camera


Scxreexcv4 Capture an image micmokmi8x Capture audio Yufsssp Get latitude and longitude GExCaalsss7 Get call logs PHOCAs7 Call phone numbers sent by the C & C server Gxextsxms Get a list of inbox SMS messages Msppossag Send SMS with message body sent by the C & C server Getconstactx Get a list of all contacts Rinxgosa Play a ringtone bithsssp64 Execute commands sent by the C & C server DOWdeletx Deletes


the file specified by the C & C server Deldatall8 Delete all files stored in the /sdcard/DCIM/.dat/ directory We do n't have the space to cover all of the commands , but let 's take a look at some of the major ones .


Facebook phishing One of the interesting features of this spyware is the ability to steal Facebook credentials using a fake login page , similar to phishing .


Upon receiving the command GUIFXB , the spyware launches a fake Facebook login page .


As soon as the victim tries to log in , it stores the victim 's credentials in /storage/0/DCIM/.fdat Facebook Login Figure 7 : Fake Facebook login The second command is IODBSSUEEZ , which further sends stolen credentials to the C & C server , as seen in Figure 8 .


Stolen Data Figure 8 : Sending data to the attacker .


This functionality can be easily further extended to steal other information , such as bank credentials , although we did not see any banks being targeted in this attack .


Calling functionality Command PHOCAs7 initiates calling functionality .


The number to call is received along with the command , as seen in Figure 9 .


Call Command Figure 9 : The calling functionality .


The phone number is fetched from a response from the C & C server and is stored in str3 variable , which further is utilized using the tel : function .


Stealing SMS The Gxextsxms command is responsible for fetching all the SMS messages from the victim 's device and sending it over to the C & C server .


Stealing SMS Figure 10 : Stealing SMS messages .


Similarly , there are many crucial commands that further allow this spyware to perform additional functionality , such as executing commands sent by the C & C , clicking photos , capturing screenshots , stealing location information , and more .


Further analysis Upon further research , we found this spyware to be developed by a framework similar to Spynote and Spymax , meaning this could be an updated version of these Trojan builders , which allow anyone , even with limited knowledge , to develop full-fledged spyware .


Many of the functionalities seen in this spyware are similar to Spynote and Spymax based on the samples we analyzed with some modifications .


This spyware sample communicates over dynamic DNS .


By doing so , attackers can easily set up the Trojan to communicate back to them without any need for high-end servers .


Other common functionalities include executing commands received from the attacker , taking screenshots of the victim 's device , fetching locations , stealing SMS messages and most common features that every spyware may poses .


Stealing Facebook credentials using fake Facebook activity is something we did n't observe in Spynote/Spymax versions but was seen in this spyware .


This framework allows anyone to develop a malicious app with the desired icon and communication address .


Some of the icons used can be seen below .


We found 280 such apps in the past three months .


A complete list of hashes can be found here .


icons Figure 11 : Icons used to pose as famous apps .


All of these apps are developed by the same framework and hence have the same package name and certificate information as seen in Figure 12. certificate Figure 12 : Package name and certificate information .


Conclusion Due to the ubiquitous nature of mobile devices and the widespread use of Android , it is very easy for attackers to victimize Android users .


In such situations , mobile users should always take the utmost precautions while downloading any applications from the internet .


It is very easy to trick victims to fall for such attacks .


Users looking forward to using the TikTok app amidst the ban might look for alternative methods to download the app .


In doing so , users can mistakenly install malicious apps , such as the spyware mentioned in this blog .


The precautions you take online have been covered extensively in almost all of our blogs ; even so , we believe this information bears repeating .


Please follow these basic precautions during the current crisis—and at all times : Install apps only from official stores , such as Google Play .


Never click on unknown links received through ads , SMS messages , emails , or the like .


Always keep the " Unknown Sources '' option disabled in the Android device .


This disallows apps to be installed on your device from unknown sources .


We would also like to mention that if you come across an app hiding it 's icon , always try to search for the app in your device settings ( by going to Settings - > Apps - > Search for icon that was hidden ) .


In the case of this spyware , search for app named TikTok Pro .


MITRE TAGS Action Tag ID App auto-start at device boot T1402 Input prompt T1411 Capture SMS messages T1412 Application discovery T1418 Capture audio T1429 Location tracking T1430 Access contact list T1432 Access call log T1433 Commonly used port T1436 Standard application layer protocol T1437 Masquerage as legitimate application T1444 Suppress application icon T1508 Capture camera T1512 Screen capture T1513 Foreground persistence T1541 DualToy : New Windows Trojan Sideloads Risky Apps to Android and iOS Devices


By Claud Xiao September 13 , 2016 at 5:00 AM Over the past two years , we ’ ve observed many cases of Microsoft Windows and Apple iOS malware designed to attack mobile devices .


This attack vector is increasingly popular with malicious actors as almost everyone on the planet carries at least one mobile device they interact with throughout any given day .


Thanks to a relative lack of security controls applied to mobile devices , these devices have become very attractive targets for a broad range of malicious actors .


For example : WireLurker installed malicious apps on non-jailbroken iPhones Six different Trojan , Adware and HackTool families launched “ BackStab ” attacks to steal backup archives of iOS and BlackBerry devices The HackingTeam ’ s RCS delivered its Spyware from infected PCs and Macs to jailbroken iOS devices and BlackBerry phones Recently , we discovered another Windows Trojan we named “ DualToy ” which side loads malicious or risky apps to both Android and iOS devices via a USB connection .


When DualToy began to spread in January 2015 , it was only capable of infecting Android devices .


However , within six months the malicious actors added the capability to infect iOS devices .


DualToy is still active and we have detected over 8,000 unique samples belonging to this Trojan family to date .


It mainly targets Chinese users , but has also successfully affected people and organizations in the United States , United Kingdom , Thailand , Spain , and Ireland .


Credential phishing and an Android banking Trojan combine in Austrian mobile attacks NOVEMBER 03 , 2017 Overview Credential phishing , banking Trojans , and credit card phishing schemes are common threats that we regularly observe both at scale and in more targeted attacks .


However , Proofpoint researchers have recently observed phishing attacks that incorporate all of these elements in a single , multistep scheme involving the Marcher Android banking Trojan targeting customers of large Austrian banks .


Attacks involving Marcher have become increasingly sophisticated , with documented cases involving multiple attack vectors and a variety of targeted financial services and communication platforms [ 1 ] [ 2 ] .


In this case , a threat actor has been targeting customers of Bank Austria , Raiffeisen Meine Bank , and Sparkasse since at least January 2017 .


The attacks described here begin with a banking credential phishing scheme , followed by an attempt to trick the victim into installing Marcher , and finally with attempts to steal credit card information by the banking Trojan itself .


Analysis Marcher is frequently distributed via SMS , but in this case , victims are presented with a link in an email .


Oftentimes , the emailed link is a bit.ly shortened link , used to potentially evade detection .


The link leads to a phishing page that asks for banking login credentials or an account number and PIN .


Figure 1 shows one such landing page using stolen branding from Bank Austria .


Figure 1 : Landing page for phishing scheme asking for the victim ’ s signatory number and PIN using stolen branding from Bank Austria Because the actor delivered phishing links using the bit.ly URL shortener , we can access delivery statistics for this particular campaign .


The link resolves to a URL designed to appear legitimate , with a canonical domain of sicher97140 [ .


] info including the “ bankaustria ” brand .


Figure 2 : Bit.ly statistics for a phishing landing page targeting Bank Austria customers The actor appears to have recently begun using “ .top ” top-level domains ( TLDs ) for their phishing landing pages and have implemented a consistent naming structure as shown below .


Earlier this year , the actor used “ .pw ” TLDs while the Bank Austria scheme highlighted above used “ .info ” .


Some recent campaigns against other bank customers also used “ .gdn ” TLDs .


Other attacks on Bank Austria customers that we observed resolved to the following .top domains : Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817062 [ .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817461 [ .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817465 [ .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817466 [ .


] top/ Oct 23 , 2017 hxxp : //online.bankaustria.at.id8817469 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58712 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58717 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id58729 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87721 [ .


] top/ Oct 17 , 2017 hxxp : //online.bankaustria.at.id87726 [ .


] top/ These permutations of TLDs and canonical domains incorporating the legitimate domain expected by the targeted banking customers exemplifies recent trends in social engineering by threat actors .


Just as threat actors may use stolen branding in their email lures to trick potential victims , they reproduce a legitimate domain name in a fraudulent domain that is not controlled by the bank .


Once the victim enters their account information on the landing page , the phishing attack then requests that the user log in with their email address and phone number .


Figure 3 : Step two of the credential phish asking for the victim ’ s email address and phone number Having stolen the victim ’ s account and personal information , the scammer introduces a social engineering scheme , informing users that they currently do not have the “ Bank Austria Security App ” installed on their smartphone and must download it to proceed .


Figure 4 shows the download prompt for this fake app ; an English translation follows .


Figure 4 : Alert prompting the victim to download an Android banking app ( English translation below ) , with stolen branding and fraudulent copy * * * Translation * * * Dear Customer , The system has detected that the Bank Austria Security App is not installed on your smartphone .


Due to new EU money laundering guidelines , the new Bank Austria security app is mandatory for all customers who have a mobile phone number in our system .


Please install the app immediately to avoid blocking your account .


Follow the instructions at the bottom of this page .


Why you need the Bank Austria Security App : Due to outdated technology of the mobile network important data such as mTan SMS and online banking connections are transmitted unencrypted .


Our security app allows us to transmit this sensitive data encrypted to you , thus increasing the security that you will not suffer any financial loss .


Step 1 : Download Bank Austria Security App Download the Bank Austria security app to your Android device .


To do this , open the displayed link on your mobile phone by typing in the URL field of your browser or scan the displayed QR code .


* * * End translation * * * The phishing template then presents additional instructions for installing the fake security application ( Figure 5 ) : Figure 5 : Additional instructions telling the victim to give the app the requested permissions ( English translation below ) , with stolen branding and fraudulent copy * * * Translation * * * Step 2 : Allow installation Open your device 's settings , select Security or Applications ( depending on the device ) , and check Unknown sources .


Step 3 : Run installation Start the Bank Austria security app from the notifications or your download folder , tap Install .


After successful installation , tap Open and enable the device administrator .


Finished !


* * * End translation * * * Referring again to bit.ly , we can see click statistics for this campaign ( Figure 6 ) .


Figure 6 : bit.ly statistics for the fake Bank Austria Android app download link From this small sample , we see that 7 % of visitors clicked through to download the application , which is actually a version of the Marcher banking Trojan named “ BankAustria.apk ” , continuing the fraudulent use of the bank ’ s branding to fool potential victims .


This sample is similar to those presented in other recent Marcher analyses [ 1 ] [ 2 ] .


This particular application is signed with a fake certificate : Owner : CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Issuer CN=Unknown , OU=Unknown , O=Unknown , L=Unknown , ST=Unknown , C=Unknown Serial : 1c9157d7 Validity : 11/02/2017 00:16:46 03/20/2045 00:16:46 MD5 Hash : A8:55:46:32:15


: A9 : D5:95 : A9:91 : C2:91:77:5D:30 : F6 SHA1 Hash : 32:17 : E9:7E:06 : FE:5D:84 : BE:7C:14:0C : C6:2B:12:85 : E7:03:9A:5F The app requests extensive permissions during installation that enable a range of activities supported by the malware .


Those permission shown in bold below are the most problematic : Allows an application to write to external storage .


Allows an application to read from external storage .


Allows an application to use SIP service .


Allows an application to collect battery statistics Allows an app to access precise location .


Allows an application to receive SMS messages .


Allows an application to send SMS messages .


Allows an application to read SMS messages .


Allows an application to write SMS messages .


Allows an application to initiate a phone call without going through the Dialer user interface for the user to confirm the call .


Allows applications to access information about networks .


Allows applications to open network sockets .


Allows an application to read the user 's contacts data .


Allows an application to read or write the system settings .


Allows an application to force the device to lock Allows applications to access information about Wi-Fi networks .


Allows applications to change Wi-Fi connectivity state .


Allows applications to change network connectivity state .


Analysis of the malware shows that it uses the common string obfuscation of character replacement ( Figure 7 ) : Figure 7 : Encoded Marcher Strings Figure 8 : Decoded Marcher Strings As noted , the application requests extensive permissions during installation ; Figure 9 shows the request to act as device administrator , a particular permission that should very rarely be granted to an app .


Figure 9 : Prompt for application permissions upon installation Figures 10 and 11 show the other permission screens for the app : Figure 10 Figure 10 : Part 1 of the permission screen for the app Figure 11 : Part 2 of the permission screen for the app Once installed the app will place a legitimate looking icon on the phone ’ s home screen , again using branding stolen from the bank .


Figure 12 : Fake Bank Austria Security application icon In addition to operating as a banking Trojan , overlaying a legitimate banking app with an indistinguishable credential theft page , the malware also asks for credit card information from the user when they open applications such as the Google Play store .


Figure 13 : Popup asking for a credit card number The application also supports stealing credit card verification information ( Figures 14 and 15 ) .


Figure 14 : Information theft via fake credit card verification using stolen branding Figure 15 : Information theft via fake credit card verification using stolen branding Some of the campaigns appear to have a wider reach based on bit.ly statistics like this one from October 13 , 2017 : Figure 16 : bit.ly statistics for an October 13 , 2017 campaign Over several days during the last three months , Proofpoint researchers observed campaigns using similar techniques targeting the banking customers of Raffeisen and Sparkasse .


A review of the bit.ly statistics for these campaigns shows that they were at least as effective in driving end-user clicks as the Bank Austria campaign analyzed above .


Conclusion As our computing increasingly crosses multiple screens , we should expect to see threats extending across mobile and desktop environments .


Moreover , as we use mobile devices to access the web and phishing templates extend to mobile environments , we should expect to see a greater variety of integrated threats like the scheme we detail here .


As on the desktop , mobile users need to be wary of installing applications from outside of legitimate app stores and sources and be on the lookout for bogus banking sites that ask for more information than users would normally provide on legitimate sites .


Unusual domains , the use of URL shorteners , and solicitations that do not come from verifiable sources are also red flags for potential phishing and malware .


Ginp - A malware patchwork borrowing from Anubis November 2019 Intro ThreatFabric analysts have recently investigated an interesting new strain of banking malware .


The malware was first spotted by Tatyana Shishkova from Kaspersky by end October 2019 , but actually dates back to June 2019 .


It is still under active development , with at least 5 different versions of the Trojan released within the last 5 months ( June - November 2019 ) .


What makes Ginp stand out is that it was built from scratch being expanded through regular updates , the last of which including code copied from the infamous Anubis banking Trojan , indicating that its author is cherry-picking the most relevant functionality for its malware .


In addition , its original target list is extremely narrow and seems to be focused on Spanish banks .


Last but not least , all the overlay screens ( injects ) for the banks include two steps ; first stealing the victim ’ s login credentials , then their credit card details .


Although multi-step overlays are not something new , their usage is generally limited to avoid raising suspicion .


Evolution The initial version of the malware dates back to early June 2019 , masquerading as a “ Google Play Verificator ” app .


At that time , Ginp was a simple SMS stealer whose purpose was only to send a copy of incoming and outgoing SMS messages to the C2 server .


A couple of months later , in August 2019 , a new version was released with additional banking-specific features .


This and following versions were masquerading as fake “ Adobe Flash Player ” apps .


The malware was able to perform overlay attacks and become the default SMS app through the abuse of the Accessibility Service .


The overlay consisted of a generic credit card grabber targeting social and utility apps , such as Google Play , Facebook , WhatsApp , Chrome , Skype , Instagram and Twitter .


Although early versions had some basic code and string obfuscation , protection of the third version of the malware was enhanced with the use of payload obfuscation .


The capabilities remained unchanged , but a new endpoint was added to the Trojan C2 allowing it to handle the generic card grabber overlay and specific target overlays ( banking apps ) separately .


In addition , the credit card grabber target list was expanded with Snapchat and Viber .


In the third version spotted in the wild , the author introduced parts of the source code of the infamous Anubis Trojan ( which was leaked earlier in 2019 ) .


This change came hand in hand with a new overlay target list , no longer targeting social apps , but focusing on banking instead .


A remarkable fact is that all the targeted apps relate to Spanish banks , including targets never seen before in any other Android banking Trojan .


The 24 target apps belong to 7 different Spanish banks : Caixa bank , Bankinter , Bankia , BBVA , EVO Banco , Kutxabank and Santander .


The specific apps can be found in the target list in the appendix .


The most recent version of Ginp ( at the time of writing ) was detected at the end of November 2019 .


This version has some small modifications which seems to be unused , as the malware behaviour is the same as the previous version .


The author has introduced the capability to grant the app the device admin permission .


Additionally new endpoint was added that seems related to downloading a module for the malware , probably with new features or configuration .


How it works When the malware is first started on the device it will begin by removing its icon from the app drawer , hiding from the end user .


In the second step it asks the victim for the Accessibility Service privilege as visible in following screenshot : Ginp Accessibility request Once the user grants the requested Accessibility Service privilege , Ginp starts by granting itself additional permissions , such as ( dynamic ) permissions required in order to be able to send messages and make calls , without requiring any further action from the victim .


When done , the bot is functional and ready to receive commands and perform overlay attacks .


The commands supported by the most recent version of the bot are listed below .


As can be observed , the possibilities offered by the bot are pretty common .


Command Description SEND_SMS Send an SMS from the bot to a specific number NEW_URL Update the C2 URL KILL Disable the bot PING_DELAY Update interval between each ping request CLEAN_IGNORE_PKG Empty list of overlayed apps WRITE_INJECTS Update target list READ_INJECTS Get current target list START_ADMIN Request Device Admin privileges ALL_SMS Get all SMS messages DISABLE_ACCESSIBILITY Stop preventing user from disabling the accessibility service ENABLE_ACCESSIBILITY Prevent user from disabling


the accessibility service ENABLE_HIDDEN_SMS Set malware as default SMS app DISABLE_HIDDEN_SMS Remove malware as default SMS app ENABLE_EXTENDED_INJECT Enable overlay attacks DISABLE_EXTENDED_INJECT Disable overlay attacks ENABLE_CC_GRABBER Enable the Google Play overlay DISABLE_CC_GRABBER Disable the Google Play overlay START_DEBUG Enable debugging GET_LOGCAT Get logs from the device STOP_DEBUG Disable debugging GET_APPS


Get installed applications GET_CONTACTS Get contacts SEND_BULK_SMS Send SMS to multiple numbers UPDATE_APK Not implemented INJECT_PACKAGE Add new overlay target CALL_FORWARD Enable/disable call forwarding START_PERMISSIONS Starts request for additional permissions ( Accessibility privileges , battery optimizations bypass , dynamic permissions ) Features The most recent version of Ginp has the same capabilities as most other Android banking Trojans , such as the use of overlay attacks , SMS control and contact


list harvesting .


Overall , it has a fairly common feature list , but it is expected to expand in future updates .


Since Ginp is already using some code from the Anubis Trojan , it is quite likely that other , more advanced features from Anubis or other malware , such as a back-connect proxy , screen-streaming and RAT will also be added in the future .