Fakecalls Android Malware Abuses Legitimate Signing Key

Authored by Dexter Shin 

McAfee Mobile Research Team discovered an Android banking trojan signed with a key utilized by professional apps in South Korea final 12 months. By design, Android requires that every one purposes should be signed with a key, in different phrases a keystore, to allow them to be put in or replaced. Because this key can solely be utilized by the developer who created it, an software signed with the identical key is assumed to belong to the identical developer. That is the case of this Android banking trojan that makes use of this professional signing key to bypass signature-based detection strategies. And these banking trojans weren’t distributed on Google Play or official app shops till now. This menace had been disclosed to the firm that owns the professional key final 12 months and the firm has taken precautions. The firm has confirmed that they’ve substituted the signing key and at the moment, all of their professional apps are signed with a brand new signing key. 

Android malware utilizing a professional signing key 

While monitoring the Android banking trojan Fakecalls we discovered a pattern utilizing the identical signing key as a effectively–recognized app in Korea. This app is developed by a respected IT companies firm with intensive enterprisees throughout varied sectors, together with however not restricted to IT, gaming, fee, and advertising. We confirmed that a lot of the malicious samples utilizing this key faux to be a financial institutioning app as they use the identical icon as the actual banking apps. 

Figure 1. Malware and professional app on Google Play 

Distribution methodology and newest status 

Domains verified final August once we first found the samples at the moment are down. However, we investigated URLs associated to this malware and we discovered comparable ones associated to this menace. Among them, we recognized a phishing website that is nonetheless alive throughout our analysis. The website can be disguised as a banking website. 

Figure 2. A phishing web page disguised as a Korean banking website 

We additionally discovered that they up to date the area data of this internet web page a number of days earlier than our investigation. 

So we took a deeper look into this area and we discovered further uncommon IP addresses that led us to the Command and control(C2) server admin pages utilized by the cybercriminals to regulate the contaminated gadgets. 

Figure 3. Fakecalls Command and management(C2) admin web pages 

How does it work 

When we examine the APK file construction, we will see that this malware makes use of a packer to keep away from evaluation and detection. The malicious code is encrypted in one of many recordsdata under. 

Figure 4. Tencent’s Legu Packer libraries 

After decrypting the DEX file, we discovered some uncommon performance. The code under will get the Android bundle data from a file with a HTML extension. 

 Figure 5. Questionable code within the decrypted DEX file 

This file is the truth is one other APK (Android Application) fairly than a standard HTML file designed to be displayed in an internet browser. 

Figure 6. APK file disguised as an HTML file 

When the consumer launches the malware, it instantly asks for permission to put in one other app. Then it tries to put in an software saved in the “assets” listing as “introduction.html”. The “introduction.html” is an APK file and actual malicious conduct occurs right here. 

Figure 7. Dropper asks you to put in the principle payload 

When the dropped payload is about to be put in, it asks for a number of permissions to entry delicate private data. 

Figure 8. Permissions required by the principle malicious software 

It additionally registers a number of companies and receivers to regulate notifications from the gadget and to obtain instructions from a distant Command and Control server. 

 Figure 9. Services and receivers registered by the principle payload

By distinction, the malware makes use of a professional push SDK to obtain commands from a distant server. Here are the full checklist of instructions and their objective. 

Cybercriminals are consistently evolving and utilizing new methods to bypass safety checks, resembling abusing professional signing keys. Fortunately, there was no injury to customers as a result of this signing key leak. However, we advocate that customers set up safety software program on their gadgets to reply to these threats. Also, customers are beneficial to obtain and use apps from the official app shops. 

McAfee Mobile Security detects this menace as Android/Banker whatever the software, is signed with the beforehand professional signing key. 

Indicators of Compromise 

Domains: 

• http[://]o20-app.dark-app.web 
• http[://]o20.orange-app.at present 
• http[://]orange20.orange-app.at present