Authored by Dexter Shin 

McAfee Cellular Analysis Staff discovered an Android banking trojan signed with a key utilized by reputable apps in South Korea final 12 months. By design, Android requires that each one functions should be signed with a key, in different phrases a keystore, to allow them to be put in or replaced. As a result of this key can solely be utilized by the developer who created it, an software signed with the identical key is assumed to belong to the identical developer. That’s the case of this Android banking trojan that makes use of this reputable signing key to bypass signature-based detection strategies. And these banking trojans weren’t distributed on Google Play or official app shops till now. This menace had been disclosed to the firm that owns the reputable key final 12 months and the firm has taken precautions. The firm has confirmed that they’ve changed the signing key and at the moment, all of their reputable apps are signed with a brand new signing key. 

Android malware utilizing a reputable signing key 

Whereas monitoring the Android banking trojan Fakecalls we discovered a pattern utilizing the identical signing key as a properly–identified app in Korea. This app is developed by a respected IT companies firm with in depth enterprisees throughout varied sectors, together with however not restricted to IT, gaming, cost, and advertising. We confirmed that a lot of the malicious samples utilizing this key fake to be a financial institutioning app as they use the similar icon as the actual banking apps. 

Determine 1. Malware and reputable app on Google Play 

Distribution methodology and newest status 

Domains verified final August once we first found the samples at the moment are down. Nevertheless, we investigated URLs associated to this malware and we discovered comparable ones associated to this menace. Amongst them, we recognized a phishing web site that is nonetheless alive throughout our analysis. The positioning can also be disguised as a banking web site. 

Determine 2. A phishing web page disguised as a Korean banking web site 

We additionally discovered that they up to date the area info of this internet web page a couple of days earlier than our investigation. 

So we took a deeper look into this area and we discovered extra uncommon IP addresses that led us to the Command and control(C2) server admin pages utilized by the cybercriminals to regulate the contaminated units. 

Determine 3. Fakecalls Command and management(C2) admin web pages 

How does it work 

When we examine the APK file construction, we are able to see that this malware makes use of a packer to keep away from evaluation and detection. The malicious code is encrypted in one of many recordsdata beneath. 

Determine 4. Tencent’s Legu Packer libraries 

After decrypting the DEX file, we discovered some uncommon performance. The code beneath will get the Android package deal info from a file with a HTML extension. 

 Determine 5. Questionable code within the decrypted DEX file 

This file is in truth one other APK (Android Software) quite than a conventional HTML file designed to be displayed in an online browser. 

Determine 6. APK file disguised as an HTML file 

When the consumer launches the malware, it instantly asks for permission to put in one other app. Then it tries to put in an software saved in the “property” listing as “introduction.html”. The “introduction.html” is an APK file and actual malicious habits occurs right here. 

Determine 7. Dropper asks you to put in the primary payload 

When the dropped payload is about to be put in, it asks for a number of permissions to entry delicate private info. 

Determine 8. Permissions required by the primary malicious software 

It additionally registers a number of companies and receivers to regulate notifications from the machine and to obtain instructions from a distant Command and Management server. 

 Determine 9. Providers and receivers registered by the primary payload

In contrast, the malware makes use of a reputable push SDK to obtain commands from a distant server. Listed here are the full record of instructions and their function. 

Cybercriminals are continuously evolving and utilizing new methods to bypass safety checks, akin to abusing reputable signing keys. Happily, there was no injury to customers because of this signing key leak. Nevertheless, we suggest that customers set up safety software program on their units to answer these threats. Additionally, customers are advisable to obtain and use apps from the official app shops. 

McAfee Cellular Safety detects this menace as Android/Banker whatever the software, is signed with the beforehand reputable signing key. 

Indicators of Compromise 

Domains: 

• http[://]o20-app.dark-app.web 
• http[://]o20.orange-app.in the present day 
• http[://]orange20.orange-app.in the present day