Adult themed Android SMS Stealer Trojan

During our continued efforts to protect our customers against the latest mobile threats, we came across another malicious app that used pornography to attract users. Noting that 1 in 5 mobile searches are related to porn, it’s no surprise that hackers continue to create fake porn apps to disguise malware. Our researchers analyzed another similar adult themed malware in November last year.
  
App Name: 岛国速播
URL: hxxp://bhltzgs[.]com:81/sebo363[.]apk
MD5: f71f8db8994699299b0bcda31d951c41
Package Name: ugo.jkh.efp
VirusTotal Detection: 15/55

Overview:

The application in question is presented as a porn player. When the user clicks on the application icon, he or she will be presented with thumbnails to many porn videos. When the user tries to play one of these videos, the application will download 3 files in the background and a shortcut will be placed on the main page of the device. The application also requests on-demand videos via SMS - costing the user money without them knowing. The 3 dropped files are also depicted as porn players. When the user clicks on videos shown in these applications, they again drop more files to the device - resulting in a never-ending process. Some of these dropped files have icons that look similar to the Internet Explorer and Angry Birds applications for the sole purpose of scamming the user. However, these dropped applications are actually SMS stealers or fake installers.

Details:

When you try to install the application, it asks for the following permissions:

Permissions

Upon launching the application, you will be able to see a list of obscene videos. When you click on any of those videos, instead of playing them the malware drops 3 additional porn applications on the device.

Different Levels

Technical Analysis:

When the user tries to play a video from the application, a JAR file is downloaded from the link hxxp://link[.]kssgx[.]com/cj[.]jar. This URL is stored in the application in the following fashion:

cj.jar URL formation

Subsequently it fetches another URL from the downloaded cj.jar, which is then used to drop multiple malicious apps to the user's device. The link for downloading the dropper files are stored in an xml file, the link to which is present in cj.jar

URL for XML file

This xml file contains the URL for downloading the dropper files.

XML file contents

All the downloaded files have been flagged malicious by multiple AV vendors. Here are links to 3 malicious APK files dropped on the device by the main application:

• hxxp://sfgg[.]gpdzj[.]com/download/20160302/mmys1069[.]apk 
• hxxp://www0127[.]007wr[.]com/a[.]php?aid=1313 - Qvodplayer1001.apk
• hxxp://csu[.]hsouying[.]com/IJjyMj - this gets redirected to hxxp://appcdn[.]hsouying[.]com/video/appstore1/destapk/1457085498605/avplay02039[.]apk

These files also take the form of porn players, but are actually SMS stealers. When the user tries to launch one of these applications, it again results in dropping of more files into the device, which continues a never-ending chain. Two of the dropped applications have icons similar to Internet Explorer in order to scam the users into using the application.

Downloaded Applications

This application downloads yet another file from the link hxxp://cdn2[.]upay360[.]cn/pack[.]dat. This is a jar file, which shows some really shady behavior. This jar file uses 3 broadcast receivers:

• SMSReceiver 
• SendBroadcastReceiver
• DeliverBroadcastReceiver

The application uses the concept of pending intents, which allows another application to use your application's permissions to execute a predefined piece of code.

SMSReceiver is triggered whenever an SMS is received. Its functionality is to fetch the details of each new SMS. It checks whether the SMS has been sent from China and if so, will abort the notification so that the user has no knowledge of the new SMS.

SMS Receiver

The application also scams the user with premium on-demand videos, which are requested via SMS without the knowledge of users. This application leverages the commonly known 1npay to scam the victims. The application sends out a POST request, in which the method of payment is specified via SMS.

POST request for SMS

SendBroadcastReceiver listens to the order SMS being sent to the number 106566660020, which is hardcoded in the application. On sending the order message, the user will receive a verify code via SMS. SMSReceiver aborts the broadcast of this message so no notifications are shown for the delivery of the new message to the end user.

DeliverBroadcastReceiver retrieves the verify code from the message and sends it in order to verify the order. This whole process causes the user to lose money.

The application also sends device related information. Below is the POST request sent by the application that was captured during our analysis:

Device Details in post request

Removal:

Since the malware does not ask for Administrator privileges, removing it is not a difficult task.

The victim can traverse to Settings option in the Android device.

• Settings --> Apps
• Find the app in the list and click on it
• Then, click on Uninstall option
• Click Ok

We urge users to not trust any unknown links received via messages or emails. Additionally, disable the option of "Unknown Sources" under Settings of your device. This will not allow installation of apps from unknown sources. 

Conclusion:

The application divides the overall functionality between the various dropped files. This can be a mechanism to evade detection by AVs. If one of the applications is detected by AV, the other applications can continue with their work. It is also interesting to note that each of these dropped applications try to target different sim operators in China.

There has been an increasing tendency of malware in disguise of adult rated applications in order to attract victims. The best way to avoid such applications is to stick to official app stores like Google Play and the Amazon app store.

---
Research Blog by - Lakshmi Devi & Shivang Desai

Pornography - A Favorite Costume For Android Malware

30% of Internet traffic is in some way related to pornography and this is the primary reason why malware authors are using porn apps to infect large numbers of users. During recent data mining, we noticed an increasing volume of mobile malware using pornography (disguised as porn apps) to lure victims into different scams and stealing personal data or locking phones and demanding ransom payments. We recently wrote about Android Ransomware and an SMS Trojan leveraging pornography to scam victims. In this blog we share the analysis of two adult themed malicious apps - SMS and Infostealer Trojans that we recently spotted.

Case 1: SMS Trojan

Here we look at a Chinese SMS Trojan disguised as porn app. Upon installation, the malware fools the victim by displaying random adult sites, steals sensitive information and sends SMS to predetermined Chinese numbers in the background.

• Name : 浴室自拍
• URL:  http://yg-file.91wapbang[.]com/apk/appad/14461771841467103.apk?uid=ef2592f22af8c568f2b2993467a1e21a
• Package Name : com.uryioen.lkhgonsd
• Flagged by 6/53 AVs on VirusTotal at the time of analysis.

The malware installs the app with a lewd icon as shown below.

Icon

Once a user clicks on the icon, the user will be directed to a random URL from an array defined in the main code module. Interestingly, all the URLs are encoded in base64 format. 

Base64 URLs

List of URLs:

•  http://www.4493[.]com/star/sifang/(aHR0cDovL3d3dy40NDkzLmNvbS9zdGFyL3NpZmFuZy8=)
•  http://m.mnsfz[.]com/h/meihuo/(aHR0cDovL20ubW5zZnouY29tL2gvbWVpaHVvLw==)
•  http://m.4493[.]com/gaoqingmeinv/(aHR0cDovL20uNDQ5My5jb20vZ2FvcWluZ21laW52Lw==)
•  http://www.mm131[.]com/xinggan/(aHR0cDovL3d3dy5tbTEzMS5jb20veGluZ2dhbi8=)
• http://www.5542[.]cc/xingganmeinv/(aHR0cDovL3d3dy41NTQyLmNjL3hpbmdnYW5tZWludi8=)
• http://www.100mz[.]com/a/xingganmeinv/(aHR0cDovL3d3dy4xMDBtei5jb20vYS94aW5nZ2FubWVpbnYv)
• http://m.xgmtu[.]com/( aHR0cDovL20ueGdtdHUuY29tLw==)

The malware is collecting all the device information in the background and sending it to a remote Command & Control (C&C) server as seen below.

Post Request

The C&C server responds back to the bot with further instructions as seen below.

Response

The C&C response in screenshot shows the malware receiving a phone number with content that needs to be sent to that number via SMS. The following code shows how the malware will parse this response and start sending SMS messages.

Send SMS code

SMS

After sending the message, the malware sends another POST request notifying the C&C server about the sent SMS activity.

Post Request

• C&C server - http[:]//www[.]mscdea[.]com:7981

This activity occurs once a day at a random time interval where the malware sends a post request to the C&C server and receives phone numbers with SMS content to be sent out. 

The continuous SMS activity can lead to a significant financial loss for the victim. 

Case 2: Fake Ransomware stealing personal data

The malware in this case is trying to scare the user with a warning screen accusing them of watching child porn. The malware steals victim's personal data in background and send it to C&C server.

• URL: http://maturefuckporn[.]info/download/kyvcuwc/diper/video.apk (down as of now)
• App Name :  video
• Package Name : com.gi.to
• Flagged by 12/53 AV vendors on VirusTotal.

Upon installing the app on device, the user will see a video player icon on the screen.

Icon

Once the user clicks on the icon, the malware displays a fake warning page as seen below. The warning page pretends to be from the Industrial Control Systems - Cyber Emergency Response Team (ICS-CERT) but is different from the classic FBI/Police Ransomware pages.

Warning page

The malicious app does not ask for administrative privileges to lock the device and is fairly easy to remove. We did not find any code for locking the device. The malware harvests inbox messages, contacts & e-mail addresses, which are then relayed to a remote C&C server in the background.

Collecting data

The malware logs the harvested SMS messages & sender's phone number in a specific format to a temporary file as seen in the code snippet above.

C&C construction.

The screenshot above shows the C&C URI construction code. The file containing the stolen data is then sent to the remote C&C server as seen in the network capture below.

Post capture.

The stolen SMS messages being sent to the C&C server in a file.

Inbox messages

The stolen contacts & e-mail addresses being sent to the C&C in a file

Contacts

• C&C server - http[:]//maturefucklist[.]com

Conclusion

We are seeing an increasing number of adult themed Android malware apps using pornography to lure victims. To avoid being  a victim of such malware, it is always best to download apps only from trusted app stores, such as Google Play. This can be enforced by unchecking the "Unknown Sources" option under the "Security" settings of your device.

Fake porn site serving Chinese SMS Trojan

The majority of Android malware continues to target Android devices that permit the installation of apps beyond the official Google Play store. Often, the malicious Android apps are delivered via third party app stores, but we do also see rogue apps delivered directly from malicious sites. Recently, we came across a fake porn site which is serving a Chinese SMS Trojan.

http://baidu-google{-}sogou-soso-360-qq.lrh6.com/cdn/index.html?l{}=banmeng&uid=3002&t=ar

Malware payload.

The above screenshot shows the malicious APK file being downloaded following user acceptance. When a user visits the page and attempts to view a video they will then be prompted to install an app. The user is social engineered into believing that installing the app is necessary to view the video, but in doing so, they are actually installing the malicious app that will carry out SMS fraud.

File Info:

Md5: 96caed56d6d735dd14a21a4d504e82c3.

Name: GA2161.apk

Size: 0.9 MB.

Package name: iickcf.ndakik.feockk.gcahbp.oefdnc.omeonn

Interestingly, the payload filename is dynamically generated and will change with each new download. This is likely an attempt to bypass basic blacklisting of a known malicious app name.

Changing APK names

Upon successful infection, the following icon is visible to the end user on their mobile phone:

Icon of installed malware

The malware then declares a Broadcast Receiver, which is registered to intercept all future SMS messages received by the user. The received message is analyzed by the malware to determine where it was received from. Once the sender's identity is confirmed, it parses the content of the received messages and matches it against certain hard coded message strings as seen below:

Receives SMS.

The following is the list of hard coded Chinese message strings and their English translations:

Hard coded message strings.

Translated Chinese message strings [Credit: Google]

The intention of the malware author is clear from these message strings. The app generates fraudulent transactions from an infected device by purchasing on-demand videos and premium SMS services controlled by the attacker. SMS messages are generated by the app to initiate a purchase. The app then monitors incoming SMS messages to identify the purchase validation message, which must be accurately responded to in order to complete the transaction. When the validation message has been intercepted, it is parsed and matched against the hardcoded strings in the image above, to determine and submit the appropriate response. Once this occurs, the transaction is complete and the victim will be charged by their mobile provider.

SMS Trojan Fraud cycle

SMS send function.

The malware also leverages the International Mobile Subscriber Identity (IMSI) property for determining the location of the device, as well as service provider information as seen below:

Checks for IMSI.

After a successful SMS send operation, the app submits a POST request to its Command & Control (C2) server 'msg-web.pw' on port 8456.

Post request.

The app sends the following information to the C2 server:

Post request capture.

We were able to observe portions of the C2 server panel used by the malware author due to a lack of authentication applied to specific web pages. The administration panel used to manage the Trojan can be seen in the screenshots below:

C&C Panel Login

C&C Panel Actions

It also sends the same information to IP Address 115.28.252.178, which appears to be an alternate C2 server for the same Trojan:

Portal 3

Post request.

The malicious app then sends a POST request checking for updates and in response, receives a URL pointing to a JAR file named "firstpay_v7.0.jar" as seen below:

Jar file location

This jar file consists of a Dex file which is capable of running on the infected mobile device as seen below:

Dex execution.

Below you can see the warning message dislayed by the phone when sending an SMS message which may incur additional charges.

Money warning

Conclusion

This malware is yet another addition to the Android SMS Trojan Family. It scams the user by purchasing subscriptions for porn services, on-demand videos and sending premium rate SMS messages. SMS fraud remains the most common form of monetization that we see with malicious mobile apps and it is almost exclusively a problem on the Android platform. One simple yet effective defense, involves restricting app installation to reputable App stores such as those operated by Google & Amazon.

Research & Analysis by Viral and Shivang.