MoqHao evolution: New variants begin routinely proper after set up

Authored by Dexter Shin 

MoqHao is a widely known Android malware household related to the Roaming Mantis menace actor group first found in 2015. McAfee Cell Analysis Workforce has additionally posted a number of articles associated to this malware household that historically targets Asian nations comparable to Korea and Japan. 

 Lately McAfee Cell Analysis Workforce discovered that MoqHao started distributing variants utilizing very harmful approach. Mainly, the distribution methodology is similar. They ship a hyperlink to obtain the malicious app through the SMS message. Typical MoqHao requires customers to put in and launch the app to get their desired goal, however this new variant requires no execution. Whereas the app is put in, their malicious exercise begins routinely. This system was launched in a earlier put up however the distinction is that this harmful approach is now being abused by different well-known energetic malware campaigns like MoqHao. We’ve got already reported this method to Google and they’re already engaged on the implementation of mitigations to forestall this kind of auto-execution in a future Android model. Android customers are at present protected by Google Play Defend, which is on by default on Android units with Google Play Companies. Google Play Defend can warn customers or block apps recognized to exhibit malicious conduct, even when these apps come from sources exterior of Play. McAfee Cell Safety detects this menace as Android/MoqHao. 

How it’s distributed 

MoqHao is distributed through phishing SMS messages (also referred to as Smishing). When a consumer receives an SMS message containing a malicious hyperlink and clicks it, the machine downloads the malicious software. Phishing messages are nearly the identical as in earlier campaigns: 

Determine 1. Smishing message impersonating a notification from a courier service. 

 Japanese message: I went to the supply deal with, however nobody was there. So, I introduced it again. 

One noticeable change is that they now use URL shortener companies. If the malware authors use their very own area, it may be shortly blocked but when they use professional URL shortener companies, it’s tough to dam the brief area as a result of it might have an effect on all of the URLs utilized by that service. When a consumer clicks on the hyperlink within the message, will probably be redirected to the precise malicious web site by the URL shortener service. 

What’s new on this variant 

As talked about originally, this variant behaves in a different way from earlier ones. Typical MoqHao have to be launched manually by the consumer after it’s put in however this variant launches routinely after set up with out consumer interplay: 

Determine 2. Variations between typical MoqHao and Fashionable MoqHao 

We defined this auto-execution approach intimately in a earlier put up however to briefly summarize it right here, Android is designed so when an app is put in and a selected worth utilized by the app is ready to be distinctive, the code runs to examine whether or not the worth is exclusive upon set up. This characteristic is the one that’s being abused by the extremely energetic Trojan household MoqHao to auto-execute itself with out consumer interplay. The distribution, set up, and auto-execution of this latest MoqHao variant could be seen within the following video: 

On the opposite hand, this latest MoqHao variant makes use of Unicode strings in app names in a different way than earlier than. This approach makes some characters seem daring, however customers visually acknowledge it as “Chrome”. This will likely have an effect on app name-based detection strategies that evaluate app title (Chrome) and bundle title (com.android.chrome): 

Determine 3. App title utilizing Unicode strings. 

Moreover, additionally they use social engineering strategies to set malicious apps because the default SMS app. Earlier than the settings window seems, they present a message telling you to arrange the app to forestall spam, but this message is pretend: 

Determine 4. Faux message utilizing social engineering strategies. 

Additionally, the totally different languages used within the textual content related to this conduct means that, along with Japan, they are additionally concentrating on South Korea, France, Germany, and India: 

Determine 5. Faux messages designed to focus on totally different nations. 

After the initialization of the malware is accomplished, it will create a notification channel that might be used to show phishing messages: 

Determine 6. Create a notification channel for the subsequent phishing assault. 

The malware checks the machine’s service and makes use of this notification to ship phishing messages accordingly to trick customers into click oning on them. MoqHao will get the phishing message and the phishing URL from Pinterest profiles.  

Determine 7. Phishing message and URL in Pinterest profile 

If the phishing string is empty, MoqHao will use the phishing message within the code: 

Determine 8. Phishing notification code for every service 

 This variant additionally connects to the C2 server through WebSocket. Nevertheless, it has been confirmed that a number of different instructions have been added along with the instructions launched in the earlier put up: 

 MoqHao malware household is an energetic malware that has been round for years. Though a few years have handed, they’re utilizing an increasing number of alternative ways to cover and attain customers. We’re seeing a a lot greater variety of C2 instructions than in earlier, the energetic use of professional websites like Pinterest to retailer and replace phishing knowledge, and code with the potential to focus on Asian nations like Japan and South Korea, in addition to nations like France, Germany, and India. Furthermore, we count on this new variant to be extremely impactful as a result of it infects units just by being put in with out execution. 

 It’s tough for basic customers to seek out pretend apps utilizing professional icons and software names, so we suggest customers to put in safe software program to guard their units. For extra data, go to McAfee Cell Safety. 

Indicators of Compromise (IOCs)