Fake Security App for AliPay customers - Android SMS Stealer

During an ongoing analysis to protect our customers from the latest mobile threats, we came across an Android malware that disguised itself as a security feature for a famous Chinese online payment app, AliPay. Upon analysis, we discovered that the fake app is a malicious SMS stealer Trojan.

The malware developers were interested in targeting AliPay due to its widespread customer base.

Alipay is a third-party online payment platform with no transaction fees, with more than 65 financial institutions including Visa as well as Mastercard. Globally, more than 300 merchants use Alipay. It currently supports transactions in 14 major foreign currencies. AliPay is also considered the PayPal of the East.


Fake AliPay Security Controls App

Appname (app label) : 安全控件
Md5 : fad55b4432ed9eeb5d7426c55681586c
Package Name : com.bing.receive
Virus Total Detection : 2/55 (at the time of analysis)

The app portrays itself as "Security Controls" tricking victim to think it’s an app enhancing AliPay security. Upon installation, the app hides itself and the icon disappears, which is a usual technique for a malware to stay hidden. Once installed, the malware registers Android services, which steals SMS and forwards them to the Command and Control (C&C) server.

Technical details 

Upon installation, the app shows itself as a part of AliPay group.

App Icon

As soon as the victim tries to use the app, it displays an introductory screen and it was programmed to disappear after 3 seconds. Both the screen and the icon are gone at this instance.

Introductory Screen

The victim might think that the app must be faulty and was removed implicitly by Android OS.  Lesser does s/he knows that malware is activated in the background and achieves its tasks through services.

Android services are components that can run in background and perform long running tasks without user's knowledge. Following are the services used and defined by the malware:

• MyService
• DealService
• TestService

The malware also registers few broadcast receivers alongside. Broadcast receivers are Android components which acts upon activation of particular events they are registered for.

Following are the receivers registered by malware:

• System Boot Receiver 
• Massage Receiver (Note the typo - Massage instead of Message)
• Screen-On Receiver

The function MainActivity of malware hides the icon and starts the service named, MyService.

Main Activity

As soon as MyService is started, it initiates other tasks and registers SystemBootReceiver and MassageReceiver.

MyService Service

MassageReceiver is a broadcast receiver and is triggered whenever an SMS is received. Its main task is to look for any incoming SMS message and fetch its details. Once the details are fetched, it calls DealService and passes the SMS data along with the call.

MassageReceiver Broadcast Receiver

DealService's task is to get the SMS messages from receiver and send it across to the C&C server. It starts an Asynchronous task (AsyncTask, as shown in screenshot below) which then forwards the messages to C&C server in the form of POST request.

Fetching SMS and POST request

SMS details are sent to the C&C server using POST request, as seen in screenshot below. Unfortunately the C&C server was already taken down during the analysis and so further details related to campaign could not be fetched.

SMS data sent to CnC

Along with MassageReceiver, another receiver named SystemBootReceiver plays an important role for malware's persistent nature by making sure that the motive of malware is achieved all the time.

SystemBootReceiver is a broadcast receiver that triggers itself at every system reboot.
Its main task is to make sure MyService is up and running. At every reboot, it starts MyService as seen below:

System Boot Receiver

The main motive of malware developer was to collect SMS messages from victim's phone. The malware author's end goal is unknown at present but we will be actively looking for traces of this campaign.

Work Flow of Malware: 

Work Flow

Mitigations

We always suggest that our customers and everyone, do not trust apps from unknown parties and only download items from the official app stores that are trustworthy, like Google's Playstore.

The only official apps provided by AliPay are as shown in the screenshot below. There is no mention of any app named AliPay-Security Controls.

Playstore - Official AliPay Apps

Removal

Since the malware does not ask for Administrator privileges, removing it is not a difficult task.

The victim can traverse to Settings option in the Android device.

• Settings --> Apps
• Find the app in the list and click on it
• Then, click on Uninstall option
• Click Ok

We urge users to not trust any unknown links received via messages or emails. Additionally, disable the option of "Unknown Sources" under Settings of your device. This will not allow installation of apps from unknown sources. 

Pornography - A Favorite Costume For Android Malware

30% of Internet traffic is in some way related to pornography and this is the primary reason why malware authors are using porn apps to infect large numbers of users. During recent data mining, we noticed an increasing volume of mobile malware using pornography (disguised as porn apps) to lure victims into different scams and stealing personal data or locking phones and demanding ransom payments. We recently wrote about Android Ransomware and an SMS Trojan leveraging pornography to scam victims. In this blog we share the analysis of two adult themed malicious apps - SMS and Infostealer Trojans that we recently spotted.

Case 1: SMS Trojan

Here we look at a Chinese SMS Trojan disguised as porn app. Upon installation, the malware fools the victim by displaying random adult sites, steals sensitive information and sends SMS to predetermined Chinese numbers in the background.

• Name : 浴室自拍
• URL:  http://yg-file.91wapbang[.]com/apk/appad/14461771841467103.apk?uid=ef2592f22af8c568f2b2993467a1e21a
• Package Name : com.uryioen.lkhgonsd
• Flagged by 6/53 AVs on VirusTotal at the time of analysis.

The malware installs the app with a lewd icon as shown below.

Icon

Once a user clicks on the icon, the user will be directed to a random URL from an array defined in the main code module. Interestingly, all the URLs are encoded in base64 format. 

Base64 URLs

List of URLs:

•  http://www.4493[.]com/star/sifang/(aHR0cDovL3d3dy40NDkzLmNvbS9zdGFyL3NpZmFuZy8=)
•  http://m.mnsfz[.]com/h/meihuo/(aHR0cDovL20ubW5zZnouY29tL2gvbWVpaHVvLw==)
•  http://m.4493[.]com/gaoqingmeinv/(aHR0cDovL20uNDQ5My5jb20vZ2FvcWluZ21laW52Lw==)
•  http://www.mm131[.]com/xinggan/(aHR0cDovL3d3dy5tbTEzMS5jb20veGluZ2dhbi8=)
• http://www.5542[.]cc/xingganmeinv/(aHR0cDovL3d3dy41NTQyLmNjL3hpbmdnYW5tZWludi8=)
• http://www.100mz[.]com/a/xingganmeinv/(aHR0cDovL3d3dy4xMDBtei5jb20vYS94aW5nZ2FubWVpbnYv)
• http://m.xgmtu[.]com/( aHR0cDovL20ueGdtdHUuY29tLw==)

The malware is collecting all the device information in the background and sending it to a remote Command & Control (C&C) server as seen below.

Post Request

The C&C server responds back to the bot with further instructions as seen below.

Response

The C&C response in screenshot shows the malware receiving a phone number with content that needs to be sent to that number via SMS. The following code shows how the malware will parse this response and start sending SMS messages.

Send SMS code

SMS

After sending the message, the malware sends another POST request notifying the C&C server about the sent SMS activity.

Post Request

• C&C server - http[:]//www[.]mscdea[.]com:7981

This activity occurs once a day at a random time interval where the malware sends a post request to the C&C server and receives phone numbers with SMS content to be sent out. 

The continuous SMS activity can lead to a significant financial loss for the victim. 

Case 2: Fake Ransomware stealing personal data

The malware in this case is trying to scare the user with a warning screen accusing them of watching child porn. The malware steals victim's personal data in background and send it to C&C server.

• URL: http://maturefuckporn[.]info/download/kyvcuwc/diper/video.apk (down as of now)
• App Name :  video
• Package Name : com.gi.to
• Flagged by 12/53 AV vendors on VirusTotal.

Upon installing the app on device, the user will see a video player icon on the screen.

Icon

Once the user clicks on the icon, the malware displays a fake warning page as seen below. The warning page pretends to be from the Industrial Control Systems - Cyber Emergency Response Team (ICS-CERT) but is different from the classic FBI/Police Ransomware pages.

Warning page

The malicious app does not ask for administrative privileges to lock the device and is fairly easy to remove. We did not find any code for locking the device. The malware harvests inbox messages, contacts & e-mail addresses, which are then relayed to a remote C&C server in the background.

Collecting data

The malware logs the harvested SMS messages & sender's phone number in a specific format to a temporary file as seen in the code snippet above.

C&C construction.

The screenshot above shows the C&C URI construction code. The file containing the stolen data is then sent to the remote C&C server as seen in the network capture below.

Post capture.

The stolen SMS messages being sent to the C&C server in a file.

Inbox messages

The stolen contacts & e-mail addresses being sent to the C&C in a file

Contacts

• C&C server - http[:]//maturefucklist[.]com

Conclusion

We are seeing an increasing number of adult themed Android malware apps using pornography to lure victims. To avoid being  a victim of such malware, it is always best to download apps only from trusted app stores, such as Google Play. This can be enforced by unchecking the "Unknown Sources" option under the "Security" settings of your device.

Android Banking Trojan and SMS stealer floating in the wild

We recently came across an Android Banking Trojan with a very low antivirus detection rate that is targeting Chinese mobile users. This Android malware is capable of stealing banking information by intercepting SMS messages looking for certain keywords. It also steals all the contact information from the user's mobile device and relays it to a remote Command & Control (C2) server.

Malicious Android package details

• Name : 888.apk.
• MD5 :  ff081c1400a948f2bcc4952fed2c818b.
• VT : 7/56 (at the time of analysis)
• Source: http://wap{.}jhgxc{.}com/888.apk

Functionality

•  Intercept and capture all incoming and outgoing SMS messages
•  Intercept incoming calls and the ability to end calls
•  Receive C2 commands via SMS
•  Sends stolen data via SMS, e-mail, and possibly web requests to the C2 server

Let's take a look at some of the above mentioned malware features and how they have been implemented:

Email sent SMS

In the screenshot above, you can see that it is e-mailing the captured outbound SMS messages using a hardcoded 163.com email address. It e-mails the stolen data to itself with the subject "Send SMS".

Email and SMS all sniffed data

Here you can see that it is e-mailing the captured inbound SMS messages using the same parameters that it used for outbound SMS messages. Additionally, it is also relaying the same information via SMS to a hardcoded Chinese phone number "15996581524".

Intercepting call

The above screenshot shows the ability to intercept incoming calls and send the caller's number via e-mail with subject "Intercept incoming call once the call!". It also has the ability to end the call.

Receives SMS as commands.

It's also capable of receiving C2 commands via SMS from the malware author to act further.

Commands to act

As seen in the screenshot above, the attacker can start the data capturing activity by sending the SMS command "intercept#" and can also stop the capturing activity by sending SMS command "interceptstop#".

Banking strings

In the screenshot above, you can see that there are string checks in place which are related to online banking transactions. It checks for strings like "Pay","Check","Bank","Balance","Validation"  which clearly shows the intent of the malware author to sniff banking related information.

Setting high priorities

The malware sets the SMS receiver and outgoing call services to high priority. This will ensure that the malicious application will get a higher preference for these events compared to other applications.

Web request for sending stolen contacts

We also saw some code that can allow the malware to send stolen contact information & SMS data through web requests. However, it appears to be non-functional in this version and the malware author might still be testing out this feature, as seen by the usage of the private IP address:

 "http://192.168.1.102/input/input_data_get_contact.asp?user=XXX&pwd=XXXX&addr="

Web request for sending stolen SMS data

"http://192.168.1.102/input/input_data_get_sms.asp?user=XXX&pwd=XXX&addr=XXX&id=XXX"

The following are screenshots showing a sample of stolen information that the malware author has been able to capture through these malicious APK infections till now:

Sent email section

E-mailed stolen SMS message

Intercepted incoming call notification

SMS matching online banking strings

Stolen contact information

Infected mobile users.

Intercepted online banking SMS

Intercepted online banking SMS

Here you can see some serious financial information sniffed by this malware illustrating the impact of such banking sniffers.

-Viral.