Fakecalls Android Malware Abuses Reliable Signing Key

Authored by Dexter Shin 

McAfee Cell Analysis Group discovered an Android banking trojan signed with a key utilized by reputable apps in South Korea final 12 months. By design, Android requires that every one functions should be signed with a key, in different phrases a keystore, to allow them to be put in or replaced. As a result of this key can solely be utilized by the developer who created it, an utility signed with the identical key is assumed to belong to the identical developer. That’s the case of this Android banking trojan that makes use of this reputable signing key to bypass signature-based detection strategies. And these banking trojans weren’t distributed on Google Play or official app shops till now. This risk had been disclosed to the firm that owns the reputable key final 12 months and the firm has taken precautions. The firm has confirmed that they’ve substituted the signing key and at present, all of their reputable apps are signed with a brand new signing key. 

Android malware utilizing a reputable signing key 

Whereas monitoring the Android banking trojan Fakecalls we discovered a pattern utilizing the identical signing key as a effectively–identified app in Korea. This app is developed by a respected IT companies firm with in depth enterprisees throughout numerous sectors, together with however not restricted to IT, gaming, fee, and advertising. We confirmed that a lot of the malicious samples utilizing this key fake to be a financial institutioning app as they use the identical icon as the actual banking apps. 

Determine 1. Malware and reputable app on Google Play 

Distribution methodology and newest status 

Domains verified final August once we first found the samples at the moment are down. Nonetheless, we investigated URLs associated to this malware and we discovered related ones associated to this risk. Amongst them, we recognized a phishing web site that is nonetheless alive throughout our analysis. The location can also be disguised as a banking web site. 

Determine 2. A phishing web page disguised as a Korean banking web site 

We additionally discovered that they up to date the area data of this internet web page just a few days earlier than our investigation. 

So we took a deeper look into this area and we discovered further uncommon IP addresses that led us to the Command and control(C2) server admin pages utilized by the cybercriminals to regulate the contaminated units. 

Determine 3. Fakecalls Command and management(C2) admin web pages 

How does it work 

When we test the APK file construction, we will see that this malware makes use of a packer to keep away from evaluation and detection. The malicious code is encrypted in one of many recordsdata under. 

Determine 4. Tencent’s Legu Packer libraries 

After decrypting the DEX file, we discovered some uncommon performance. The code under will get the Android package deal data from a file with a HTML extension. 

 Determine 5. Questionable code within the decrypted DEX file 

This file is in actual fact one other APK (Android Software) slightly than a conventional HTML file designed to be displayed in an online browser. 

Determine 6. APK file disguised as an HTML file 

When the consumer launches the malware, it instantly asks for permission to put in one other app. Then it tries to put in an utility saved in the “property” listing as “introduction.html”. The “introduction.html” is an APK file and actual malicious conduct occurs right here. 

Determine 7. Dropper asks you to put in the principle payload 

When the dropped payload is about to be put in, it asks for a number of permissions to entry delicate private data. 

Determine 8. Permissions required by the principle malicious utility 

It additionally registers a number of companies and receivers to regulate notifications from the machine and to obtain instructions from a distant Command and Management server. 

 Determine 9. Companies and receivers registered by the principle payload

In contrast, the malware makes use of a reputable push SDK to obtain commands from a distant server. Listed here are the full listing of instructions and their objective. 

Cybercriminals are continuously evolving and utilizing new methods to bypass safety checks, equivalent to abusing reputable signing keys. Thankfully, there was no injury to customers on account of this signing key leak. Nonetheless, we advocate that customers set up safety software program on their units to answer these threats. Additionally, customers are really useful to obtain and use apps from the official app shops. 

McAfee Cell Safety detects this risk as Android/Banker whatever the utility, is signed with the beforehand reputable signing key. 

Indicators of Compromise 

Domains: 

• http[://]o20-app.dark-app.internet 
• http[://]o20.orange-app.right now 
• http[://]orange20.orange-app.right now 

Introducing McAfee+

Obtain McAfee+ Now