Fake BatteryBotPro ClickFraud, AdFraud, SMS & Downloader Trojan

[UPDATE #1 - July 8, 2015] We would like to clarify that at the time of our analysis, the app was not present on the Google Store. We found references to this fake app being hosted on the Google Play store during our research where it showed that the App has been removed from the Google Play store already as seen below:

Link to Google Play Store for the fake app

.....

[UPDATE #2 - July 9, 2015] Google Android security team confirmed that the fake application was uploaded to the Google Play Developer Console by the miscreants.

Google Play Developer Console enables developers to easily publish and distribute their applications directly to users of Android-compatible phones

However, as per Google's Android team the fake app did not make it to the official Google Play Store as Google's security system flagged the fake app during scanning.

.....

Malware authors tend to follow one of the following two methods for malware development:

1. Create a malware app from scratch.
2. Compromise a legit app by embedding malicious modules into it. 

With Android being open source and an Android app being easily reversible, most of the malware developers tend to stick with the second option.

Spoofed Functionality and Ads:

We came across a malicious app recently that followed this path. This time the spoofed app was a copy of a legit app named BatteryBot Pro. The spoofed app had the package name of 'com.polaris.BatteryIndicatorPro' and was removed from the Play Store as soon as Google became aware of it's malicious intent.

We also saw a spoofed version of BatteryBot Pro available for free during our research. The actual price of BatteryBotPro on official Play Store is Rs.179.99. The legit BatteryBotPro app demanded for minimal permissions as shown below:

Legit app permissions

In contrast, the fake app was requesting many more permissions, raising a red flag as can be seen in the screenshot below:

Permission requested by Malware

The screenshot below shows a comparison between the actual app and the fake app. The legit app functionality was modified and embedded at a different location within the fake app:

legit app vs fake app

Upon installation of the malicious app, it demanded administrative access, which clearly portrays the motive of malware developer to obtain full control access of the victim's device.

Request for Administrator access

Once the permission is granted, the fake app will provide the same functionality to the victim found in the original version of BatteryBot Pro but performs malicious activity in the background.

opening BatteryPro screen

ClickFraud and AdFraud activity

Though the app seems to be working normally, at the back-end it tried to load various ad libraries, ultimately delivering a click fraud campaign.

Requests sent in back-end

Some of these URLs were hard coded in the app and some were sent by the remote server.

Hard-coded URLs in database

The malware tries to collect the following information from the victim device:

-Memory available in device
-IMEI
-Phone Operator
-Location
-Langauge
-Phone Model
-Sim Card availability

The following screenshot shows the data being collected.

Parameters sent to server

Parameters sent to server

On the basis of various parameters and conditions in the server request, the malware starts receiving a list of ads to be displayed, along with the URLs from where to fetch the ad.s

Response from server containing ad URL

The malicious app then downloads and installs additional malicious APKs without the user's consent:

  

Downloaded Apps by malware

Apart from the implicit downloads, the malware also displays pop-up ads to the user:

Pop up Ads

This malware was not only built with the purpose of displaying ads, it was also designed with more evil intentions.

Sending SMS messages: 

The main Activity Screen is identical to original app but when the user clicks on "View Battery Use", the malware sends a few requests to its Command & Control server to retrieve short codes. These short codes were premium rate SMS numbers where a message was sent. This will result in financial loss to the affected user.

Requests sent to server can be seen below:

Device info sent in request

Though the content was encoded, we did not have to work hard to determine what was sent as the malware developer forgot to remove the logs. The server responds with short codes that are used for sending messages. The following screenshot shows a premium SMS response received from the server.

Logs showing server response

Uninstall FAILED: 

Apart from displaying ads and sending SMS message, the malware is also very persistent. Being run with administrator privileges, the user cannot delete the app after installation.

Uninstall not possible

"Persistence" Effect:
While  in some of the scenarios we were able to manually delete the app, the malware authors have taken care of ensure persistence. The malware silently installs an app with a package name of com.nb.superuser, which runs as a different thread and resides on the device even if the app is forcefully deleted.

This acts as a service and sends requests to hard-coded URLs found in the app.
The screenshot below shows the hard coded URLs.

Hard-coded URLs

The service started by this app continually sends requests to aforementioned URLs, some of which will deliver new APKs.

Conclusion: 

The Malware we saw in this blog was designed with multiple evil intentions including ClickFraud, AdFraud, Premium rate SMS fraud and the download & installation of additional malicious APKs.

A few traces of command execution were also seen in the app but were not fully implemented. Perhaps the developer is working on an upgraded version of the malware with proper "command-execution" functionality.

The ThreatLabZ team will continue monitoring new mobile malware threats and ensure protection for Zscaler customers.

March Madness Ads, Scams, and Malware

Introduction

March Madness is officially upon us, with the last games of the round of 64 taking place today. As is usual with events that have such a level of interest, bad actors across the internet will be trying to get their cut of the action through topical spam advertising and phishing as well as search engine poisoning to draw ad revenue and in some cases, deliver malicious software. Though it is still early in the cycle of March Madness interest, we have seen a bit of everything: malware purporting to be NCAA bracket templates, a rash of ad-filled sites running March Madness related SEO campaigns, and the usual complement of shady streaming sites promising live streams of the tournament games (with some delivering a nasty surprise).

NCAA Tournament related traffic shows a sharp uptick as the games began.

NCAA Bracket Download Leads to Malware

While reviewing some of the tournament-related security blocks, we spotted an interesting file download attempt. It's not clear if the original click was derived from a search, but the primary link purports to be a zipped PDF file that can be used to create personalized brackets. The link ultimately directs to an unwanted EXE signed by the Ukranian publisher BERSHNET LLC (whose history is well documented on HerdProtect).

The downloaded file features a valid Authenticode Certificate.

The binary features an unusual number of protections against analysis for what appears to be simple adware. At this time, we have not fully explored the capabilities of the binary, but analysis shows that the sample gathers system information and sends it to a CloudFlare-hosted command & control server.

HTTP Check-in activity includes POSTing system information.

Fake .tk Blogs Generate Ad Revenue and Expose Users

Numerous ad-filled and auto-generated blogs have been popping up to take advantage of unwary search-engine users looking for bracket templates and related web-searches. While we have not seen any overtly malicious behavior on these sites, they represent a potential threat against the unwary searcher.

Auto-generated blogs taking advantage of popular search terms.

An interesting trend among these sites is the use of the free country TLD .tk. This isn't too surprising since the use of free domains is similar to the use of a dynamic DNS service, but the .tk TLD is slightly less conspicuous compared to no-ip.com or other common alternatives.

Streaming Scams Deliver Malware

Similar to sites offering bracket templates and insights on the match-ups, a large number of sites promising the ability to stream NCAA games have popped up to capture search traffic and generate ad-revenue. Unlike the SEO blogs, we have spotted -- and blocked -- malicious downloads related to tournament streams.

Numerous scam sites are found among the top Google hits.

Fake streaming site is filled with ads and fake plug-in install prompts.

Download page for fake plug-in emulates Adobe look and feel.

Although this binary does not initially appear as sophisticated as the fake-bracket sample above, it downloads two supplemental encrypted files, one large binary blob and one base-64 encoded text file. Further analysis is needed to enumerate all functionality, but the malware can be observed collecting system information and sending it to a remote server.

Post-infection activity downloads another binary and POSTs system information.

It should be noted that the NCAA has put tight restrictions on the streaming of the tournament, and apart from the first round, streaming the games requires a pay-TV subscription.

Conclusion

All of these examples should highlight the diversity of threats that latch on to the popularity of March Madness. We would like to advise the readers to exercise caution when doing searches or clicking on links related to March Madness.

Zscaler ThreatLabZ has deployed multiple layers of protection against these scams, safeguarding the users even when they are tricked into clicking a nefarious link.

Malvertising leading to Flash Zero Day via Angler Exploit Kit

UPDATE [01/25/2015]: Adobe released an update yesterday (APSA15-01) for CVE-2015-0311 that fixes the zero day exploit mentioned in this blog. Given the number of exploit attempts we are seeing for this vulnerability in the wild, it is critical for users to update the Adobe Flash player to the latest version 16.0.0.296.

Background

Earlier this week, Kafeine published a blog mentioning an Angler Exploit Kit (EK) instance serving a possible zero day Adobe Flash exploit payload. The ThreatLabZ Research Team reviewed Angler Exploit Kit activity across the cloud and were able to identify multiple instances of Angler Exploit Kit hosting sites serving a new Adobe Flash payload that is able to exploit the latest Flash Player version 16.0.0.257.  [Adobe released a patch (APSB15-02) for CVE-2015-0310 today and we can confirm that the patch does not prevent exploitation of the 0day discussed in this blog. The latest version 16.0.0.287 is still vulnerable and is being actively exploited in the wild.]

Upon further investigation, we discovered that this appears to be yet another case of a Malvertising campaign leading unsuspecting users to Angler EK instances. Upon successful exploitation, we observed a new variant of the Bedep Trojan getting dropped and executed on the victim machine. We tested this on a Windows 7 64-bit system and the payload dropped was a 64-bit Bedep Trojan variant which generated a high volume of AdFraud traffic from the infected system.

The affected advertising networks found in this case were:

• oneclickads.net
• adcash.com

Infection Cycle

The infection cycle involves users visiting a legitimate site that displays certain advertisements from the compromised advertising networks, which will redirect them to an Angler EK hosting site and begin the exploit cycle. If the exploit is successful, a new variant of Bedep Trojan gets downloaded in an encrypted form and installed on the target system.

The entire infection cycle occurs silently in the background and is completely transparent to the end user.

The exploit page has the title "Welcome to new site" and is comprised of 220 hidden input elements, followed by three inline scripts.

The first script code snippet is obfuscated with block comment text (ie: /* random text */), but also appears purposefully broken for multiple JavaScript engines. Looking at the code, there are multiple period characters inserted throughout the script which leads to syntax errors at runtime:

The second script code snippet calls a function in the first script leading to "eval" and resulting in JavaScript code that performs Browser plugin detection:

The third script code snippet drew our attention, as it is not obfuscated and simply loads an SWF object. This script serves the Adobe Flash 0-day and it is interesting to note that the script will only execute if the earlier script has thrown an error. The flash payload is only triggered if a variable defined in the first script is undefined:

Successful exploitation will result in download of the Bedep Trojan payload that appears to be encrypted using an incremental XOR technique.

Malware Payload activity - Bedep Trojan

The malware payload dropped is a 64-bit DLL belonging to Bedep Trojan family.  This malware family is known to download additional malware. It is also responsible for generating AdFraud and ClickFraud activity from the infected system.

File: neth.dll
Size: 219608
MD5: EFB584DEA6CBC03765487633BD5A5920
Compiled: Wed, Nov 28 2007, 15:51:15  - 64 Bit DLL
Version: 5.3.3790.3959 (srv03_sp2_rtm.070216-1710)

It drops a copy of itself at the following locations:

C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\neth.dll
C:\Users\All Users\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\neth.dll

It creates the following registry entries to achieve persistence in a discreet manner:

HKLM\SOFTWARE\Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32\: "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\neth.dll"
HKLM\SOFTWARE\Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32\ThreadingModel: "Apartment"


HKU\S-USERID-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32\: "C:\ProgramData\{9A88E103-A20A-4EA5-8636-C73B709A5BF8}\neth.dll"
HKU\S-USERID-1000_Classes\CLSID\{F6BF8414-962C-40FE-90F1-B80A7E72DB9A}\InprocServer32\ThreadingModel: "Apartment"

This ensures that it runs in the context of system process "explorer.exe":

It appears to determine the infected system's timezone and location by connecting to "earthtools.org", however we noticed that it is not able to supply the latitude and longitude parameters in the request, essentially resulting in getting back UTC date and time information.

It employs a Domain Generation Algorithm technique to hide the actual Command & Control server as seen below:

 We found the following two C&C domains registered in past 48 hours:

• gaabbezrezrhe1k.com
• wzrdirqvrh07.com

It attempts to connect to these Command & Control servers to report the infection and receive further instructions. It presumably gets a list of ClickFraud tasking servers, following which we started seeing high volume of ClickFraud activity.

Conclusion
This is the first 0Day Adobe Flash Player exploit for year 2015 and not surprisingly, we are seeing it getting served through a malvertising campaign. The fact that the end malware payload getting served in this case is also involved in AdFraud activity leads us into believing that this campaign appears to be from a gang indulging in ClickFraud and AdFraud activity.

Zscaler ThreatLabZ has deployed multiple layers of protection against this threat to ensure that the customers are protected.

Analysis by Deepen Desai & John Mancuso