Android Marcher now marching via porn sites

Introduction

Android Marcher Trojan was first seen in 2013 scamming users for credit card information by prompting fake Google Play store payment page. In subsequent years, Marcher variants also started targeting banking applications by presenting fake login pages to steal user credentials.

Marcher has continued to stay active and was recently covered by phishlabs. In this blog, we will cover a new wave of Marcher Trojan that is active since past one month where the malware arrives as an adobe flash installer package. We have captured over 50 unique payloads from this campaign. Majority of these Marcher payloads are from pornographic sites serving fake adobe flash player for watching porn. The primary goal of this malware is still the same - display a fake Google Play store payment page and steal financial information from the user.

Technical analysis

The infection cycle starts with the mobile user receiving a malicious URL via e-mail or SMS. Once the user opens this URL, the site will prompt the user to download and install the Adobe Flash Player update as seen below:

Fake Adobe Flash Player outdated warning

The file that gets downloaded as a result of this action is aptly named - AdobeFlashPlayer.apk. Upon installation, malware asks for administrative access in order to perform its functions as seen below:

Requests administrative access

Once installed, Marcher connects to a predetermined Command & Control (C&C) server and sends information about all the installed applications on the infected device as seen here:

Relaying installed package information to C&C

During our analysis, we also observed a unique approach where the C&C server will send a response generating a MMS notification on the infected device saying "You have received MMS" and instructs the user to visit "mms-service[.]info/mms" to see the content of the MMS.

MMS content

This site redirects the user to the X-VIDEO app on official Google Play store. According to several reviews of this app, the users are claiming it to be a fake app that simply crashes after installation. We were able to verify the same crash behavior when installed on the latest Android OS Marshmallow 6.0.1.  We haven't analyzed this app in any further detail but have been in touch with Google's Android team to review these findings. The app in question has been downloaded more than 100,000 times and some of these downloads may have happened from infected devices. (UPDATE: This app has been verified as clean by Google's Android team but they are monitoring it further.)

Official Play store app- X-VIDEO

As part of the infection cycle, Marcher will then display a fake Google Play payment screen asking for payment information to complete the account setup.

Fake Google Play payment screen.

Credit card information.

If the user falls for this screen then the credit card information is logged and relayed to the C&C server as seen below:

Payment information sent to C&C server.

Information being sent to C&C server

Newer variants of the Android marcher will also present a fake online banking login page based on information collected about already installed banking apps on victims device. Here is a sample fake login page that the user will see if the infected device has Commonwealth Bank of Australia mobile app installed.

Fake NetBank login screen

The user banking credential information is relayed back to the C&C server in plain text as seen below:

Stolen information sent in plain text

Following are some of the financial institution mobile apps that are targeted by Marcher:

• BankSA - Bank of South Australia
• Commerzbank
• Commonwealth Bank of Australia - NetBank app
• Deutsche Postbank
• DKB - Deutsche Kreditbank
• DZ Bank
• Deutsche Bank
• Fiducia & GAD IT
• ING Direct
• La Banque Postale
• Mendons
• NAB - National Australia Bank
• PayPal
• Santander Bank
• Westpac
• WellStar billpay app

Conclusion

Android Marcher has been around since year 2013 and continues to actively target mobile user's financial information. To avoid being  a victim of such malware, it is always best to download apps only from trusted app stores, such as Google Play. This can be enforced by unchecking the "Unknown Sources" option under the "Security" settings of your device.

Zscaler ThreatLabZ is actively monitoring this malware and ensuring that Zscaler customers are protected.

IOCs

C&C URLs

• hxxp://78[.]46[.]123[.]205/111/get[.]php
• hxxp://78[.]46[.]123[.]205/111/set_card[.]php
• hxxp[:]//petrporosya[.]com/123/1/01[.]php?id=[UNIQID]

Sample URLs serving the Android Marcher payloads

• hxxp://lovehomevideo[.]cf/adobeflashplayer[.]apk  
• hxxp://videolike[.]ga/adobeflashplayer[.]apk  
• hxxp://lovehomevideo[.]ml/adobeflashplayer[.]apk  
• hxxp://analsextube[.]ml/adobeflashplayer[.]apk  
• hxxp://myporno[.]cf/adobeflashplayer[.]apk 
• hxxp://mymovie-porn[.]ga/adobeflashplayer[.]apk  
• hxxp://lovehomevideo[.]ga/adobeflashplayer[.]apk  
• hxxp://adobe-flash-player[.]su/flashplayer[.]apk

More Porn clicker malware masquerading as Dubsmash on Google Play store

Introduction

Dubsmash is a mobile app to create short "selfie" videos dubbed with famous sounds. It is extremely popular and is currently ranked #10 under Top free Android apps. The users of this app include many well known celebrities who eventually post the dubbed videos on popular social networking platforms like Facebook and Twitter.

The popularity of this app has caught the attention of the malware authors too, which is evident with a string of Trojan Porn Clicker apps disguised as Dubsmash posted on the Google Play Store in the past month (covered in ESET and AVAST blogs). The malicious apps mentioned in those blogs were quickly taken down by Google. However, we continue to see newer variants of the same malware family being uploaded to the Google Play store with the latest one posing as Dubsmash V3.

Google Play - Trojan Porn Clicker app

Although the malicious app poses as Dubsmash, the icon that the user sees upon installation imitates Settings, Memory Game, or a Flappy Bird app. The newest iteration of this malicious app has already been downloaded nearly 5,000 times.

Fake App Icon

The malware automatically removes the icon once the user quits the application for the first time, however it continues to run in the background as seen below.

Porn Clicker Process

Porn Clicker analysis

The purpose of this malware is to generate revenue for the malware author by generating clicks on the adult porn websites. While this may be good news that the user's credentials or sensitive information are not being stolen, it can still lead to financial loss for the end users through increased mobile data usage.

The Porn Clicker variants described in the previous blogs involved hardcoded, encrypted porn URLs in the malicious APK, whereas we are now seeing the newer variant dynamically retrieving the porn URLs from a remote server.

Clicking activity

The malicious app in our case contained two hardcoded URLs shown in the screenshot below:

Porn Clicker remote servers

Preconfigured URLs:

• memr[.]oxti.org/g/getasite/  - The malicious app will get a new porn URL to visit from this location.
• memr[.]oxti.org/z/z2/ - This location currently serves JavaScript code that will result in a random click on the porn site that gets visited by the app.

Screenshots below show the porn URLs that are dynamically retrieved  by the malicious app from the first location.

Porn URL1

Porn URL2

Porn URL3

JavaScript leveraged by the malicious app from a remote location to perform click fraud is shown in the screenshot below.

JavaScript - Random Click

It appears that the malware author keeps uploading and removing the same app on the Google Play store under different accounts. During the course of this write up, we saw the following two variations:

• Dubsmash V3 [Package name: com.memr.gamess] - has been removed
• Dubsmash 2    [Package name: com.jet.dubsh] - still active

Conclusion

The first variant of the Porn Clicker app masquerading as Dubsmash was reported in April, 2015 and it is concerning to see newer variants of the same malware slipping through Google's app vetting process even today.  The malware authors are still targeting Dubsmash as a disguise to trick end users into downloading the malicious app.

It is highly recommended for users to check the reviews & ratings of the apps, even when downloading them from official Google Play store. If you are infected with such an app, you can delete it by going to Settings >Apps > (AppName).

Write-up by: Viral Gandhi & Deepen Desai