Stealth Backdoor “Android/Xamalicious” Actively Infecting Devices

Authored by Fernando Ruiz 

McAfee Mobile Research Team recognized an Android backdoor carried out with Xamarin, an open-source framework that permits constructing Android and iOS apps with .NET and C#. Dubbed Android/Xamalicious it tries to realize accessibility privileges with social engineering after which it communicates with the command-and-control server to judge whether or not or to not obtain a second-stage payload that’s dynamically injected as an meeting DLL at runtime stage to take full management of the machine and probably carry out fraudulent actions similar to clicking on advertisements, putting in apps amongst different actions financially motivated with out consumer consent.

The second stage payload can take full management of the contaminated machine because of the highly effective accessibility companies that have been already granted in the course of the first stage which additionally accommodates capabilities to self-update the primary APK which signifies that it has the potential to carry out any sort of exercise like a adware or banking trojan with out consumer interplay. However, we recognized a hyperlink between Xamalicious and the ad-fraud app “Cash Magnet” which mechanically clicks advertisements, installs apps, and different actions to fraudulently generate income whereas customers that put in it might earn factors which might be alleged to be redeemable as a retail reward card. This signifies that the builders behind these threats are financially motivated and drive ad-fraud due to this fact this is likely to be one of many principal payloads of Xamalicious.

The utilization of the Xamarin framework allowed malware authors to remain energetic and with out detection for a very long time, making the most of the construct course of for APK information that labored as a packer to cover the malicious code. In addition, malware authors additionally carried out completely different obfuscation methods and customized encryption to exfiltrate information and talk with the command-and-control server. 

We’ve recognized about 25 completely different malicious apps that carry this risk. Some variants have been distributed on Google Play since mid-2020. The apps recognized on this report have been proactively eliminated by Google from Google Play forward of our reporting. McAfee is a member of the App Defense Alliance and an energetic associate within the malware mitigation program, which goals to rapidly discover Potentially Harmful Applications (PHAs) and cease them earlier than they ever make it onto Google Play. Android customers are protected by Google Play Protect, which may warn customers of recognized malicious apps on Android units. McAfee Mobile Security detects this risk as Android/Xamalicious.  

Based on the variety of installations these apps could have compromised a minimum of 327,000 units from Google Play plus the installations coming from third-party markets that regularly produce new infections primarily based on the detection telemetry of McAfee shoppers around the globe. This risk stays very energetic. 

Figure 1. “Count Easy Calorie Calculator” was out there on Google Play on August 2022 and carries Android/Xamalicious 

Android/Xamalicious trojans are apps associated to well being, video games, horoscope, and productiveness. Most of those apps are nonetheless out there for obtain in third-party marketplaces.  

Previously we detected malware abusing Xamarin framework such because the open-sourced AndroSpy and forked variations of it, however Xamalicious is carried out in a different way. Technical particulars about Xamarin structure are effectively documented and element how .NET code is interpreted by Android utilizing Mono. 

Obtaining Accessibility Services

Let’s use the app “Numerology: Personal horoscope & Number predictions” for example. Once began it instantly requests the sufferer to allow accessibility companies for “correct work” and gives instructions to activate this permission:  

Figure 2. Tricking customers into granting accessibility companies permission 

Users must manually activate the accessibility companies after a number of OS warnings similar to the next on the accessibility choices: 

Figure 3. Accessibility companies configuration immediate highlights the dangers of this permission. 

Where is the malicious code? 

This isn’t the standard Java code or native ELF Android software, the malware module was written initially in .NET and compiled right into a dynamic hyperlink library (DLL). Then it’s LZ4 compressed, and it is likely to be embedded right into a BLOB file, or immediately out there within the /assemblies listing on the APK construction. This code is loaded then by a local library (ELF) or by the DEX file at runtime stage. In easy phrases, which means that in some samples the reversing of the DLL assemblies is easy whereas in others it requires additional steps to unpack them. 

The malicious code is normally out there in two completely different meeting information within the /assemblies listing on the apk. Usually, file names are core.dll and a <package-specific>.dll.

Some malware variants has obfuscated the DLL assemblies to keep away from evaluation and reversing of the malicious code whereas others preserve the unique code out there.  

Figure 4. Core.dll and GoogleService.dll comprise malicious code. 

Communication with the command-and-control server

Once accessibility permissions are granted the malware initiates communication with the malicious server to dynamically load a second-stage payload.  

Figure 5. App execution and communication with the malicious server 

Collect Device Information 

Android/Xamalicious collects a number of machine information together with the listing of put in functions obtained by way of system instructions to find out if the contaminated sufferer is an effective goal for the second stage payload. The malware can accumulate location, provider, and community info amongst machine rooting standing, adb connectivity configuration, as an example, if the machine is linked by way of ADB or is rooted, the C2 won’t present a second-stage payload DLL for obtain. 

Data Encryption in JWT 

To evade evaluation and detection, malware authors encrypted all communication and information transmitted between the C2 and the contaminated machine, not solely protected by HTTPS, it’s encrypted as a JSON Web Encryption (JWE) token utilizing RSA-OAEP with a 128CBC-HS256 algorithm nevertheless the RSA key values utilized by the Xamalicious are hardcoded within the decompiled malicious DLL so decryption of transmitted info is feasible if C2 infrastructure is on the market in the course of the evaluation. 

In the Send() perform Android/Xamalicious first prepares the acquired object, normally a JSON construction calling the perform encrypt() which creates the JWT utilizing a hardcoded RSA key. So the info is exfiltrated absolutely encrypted to the malware host pointing to the trail  “/Updater” by way of HTTP POST technique. 

Then it waits for the C2 response and passes it to the decrypt() perform which has a hardcoded RSA non-public key to correctly decrypt the acquired command which could comprise a second stage payload for the “getURL” command. 

Encrypt Method: 

Figure 6. Encrypt perform with hardcoded RSA Key values as XML string 

The decryption technique can be hardcoded into malware which allowed the analysis workforce to intercept and decrypt the communication from the C2 utilizing the RSA key values supplied as XML string it’s potential to construct a certificates with the parameters to decrypt the JWE tokens content material. 

C2 analysis

Collected information is transmitted to the C&C to find out if the machine is a correct goal to obtain a second-stage payload. The self-protection mechanism of the malware authors goes past conventional emulation detection and nation code operator limitations as a result of on this case, the command-and-control server won’t ship the second stage payload if the machine is rooted or linked as ADB by way of USB or doesn’t have a SIM card amongst a number of different surroundings validations. 

DLL Custom Encryption 

With the getURL command, the contaminated consumer requests the malicious payload, if the C&C Server determines that the machine is “Ok” to obtain the malicious library it’s going to encrypt a DLL with Advanced encryption customary (AES) in Cipher block chaining (CBC) utilizing a customized key for the consumer that requested it primarily based on the machine id and different parameters defined under to decrypt the code because it’s a symmetric encryption technique, the identical key works for encryption and decryption of the payload. 

Delivers the Payload in JWT 

The encrypted DLL is inserted as a part of the HTTP response within the encrypted JSON Web Token “JWT”. Then the consumer will obtain the token, decrypt it, after which decrypt the ‘url’ parm with AES CBC and a customized key.  

The AES key used to decrypt the meeting is exclusive per contaminated machine and its string of 32 chars of size accommodates appended the machine ID, model, mannequin, and a hardcoded padding of “1” as much as 32 chars of size. 

For occasion, if the machine ID is 0123456ABCDEF010 and the affected machine is a Pixel 5, then the AES key’s: “0123456ABCDEF010googlePixel 5111” 

This signifies that the DLL has a number of layers of encryption. 

1. It’s a HTTPS protected.
2. It’s encrypted as a JWE Token utilizing RSA-OAEP with a 128CBC-HS256 algorithm.
3. URL parameter that accommodates the DLL is encrypted with AES and encoded as base64 

All these efforts are associated to hiding the payload and making an attempt to remain underneath the radar the place this risk had relative success since some variants might need been energetic years in the past with out AV detections. 

DLL Injected 

Xamalicious will title this DLL “cache.bin” and retailer it within the native system to lastly dynamically load it utilizing the Assembly.Load technique. 

Once the second stage payload has been loaded the machine may be absolutely compromised as a result of as soon as accessibility permissions are granted, it may possibly obverse and work together with any exercise opening a backdoor to any sort of malicious exercise. 

During the evaluation, the downloaded second stage payload contained a DLL with the category “MegaSDKXE” which was obfuscated and incomplete in all probability as a result of the C2 didn’t obtain the anticipated params to supply the whole malicious second stage that is likely to be restricted to a particular provider, language, app put in, location, time zone or unknown circumstances of the affected machine, nevertheless, we will guarantee that this can be a high-risk backdoor that leaves the chance to dynamically execute any command on the affected machine not restricted to spying, impersonation or as a financially motivated malware. 

Cash Magnet Ad-Fraud and Xamalicious

One of the Xamalicious samples detected by McAfee Mobile generic signatures was “LetterLink” (com.regaliusgames.llinkgame) which was out there on Google Play on the finish of 2020, with a e-book icon. It was poorly described as a hidden model of “Cash Magnet”: An app that performs ad-fraud with automated clicker exercise, apps downloads, and different duties that result in monetization for online marketing. This software presents customers factors which might be alleged to be redeemable by retail reward playing cards or cryptocurrency.

Figure 8a. LetterLink login web page after working the app for the primary time.

Figure 8b. LetterLink settlement for Cash Magnet

Originally printed in 2019 on Google Play, “Cash Magnet” (com.uicashmagnet) was described as a passive revenue software providing customers to earn as much as $30 USD per thirty days working automated advertisements. Since it was eliminated by Google the authors then infiltrated LetterLink and extra lately “Dots: One Line Connector” (com.orlovst.dots) that are hidden variations of the identical ad-fraud scheme.

Figure 9. LetterLink Icon that hides Cash Magnet

“LetterLink” performs a number of Xamalicious actions because it accommodates the “core.dll” library, it connects to the identical C2 server, and it makes use of the identical hardcoded non-public RSA certificates to construct the JWE encrypted tokens which give a non-repudiation proof that the builders of Cash Magnet are behind Xamalicious.

Figure 10. Cash Magnet infiltrated the app as a Game, out there till the top of 2023

“Dots: One Line Connector” app isn’t a sport, the screenshot printed by Google Play doesn’t correspond to the appliance habits as a result of as soon as it’s began it simply asks for authentication credentials with none brand or reference to Cash Magnet. “Dots” doesn’t comprise the identical DLLs as its predecessor, nevertheless the communication with the C2 is analogous utilizing the identical RSA key parameters. We reported this app to Google and so they promptly eliminated it from Google Play.

Affected Users 

Based on our telemetry we noticed that extra affected customers are within the American continent with essentially the most exercise within the USA, Brazil, and Argentina. In Europe, shoppers additionally reported the an infection, particularly within the UK, Spain, and Germany. 

Figure 11. McAfee detections Android/Xamalicious around the globe 

Conclusion 

Android functions written in non-java code with frameworks similar to Flutter, react native and Xamarin can present an extra layer of obfuscation to malware authors that deliberately choose these instruments to keep away from detection and attempt to keep underneath the radar of safety distributors and preserve their presence on apps markets. 

Avoid utilizing apps that require accessibility companies except there’s a real want to be used. If a brand new app tries to persuade you to activate accessibility companies claiming that it’s required with no actual and cheap motive and requesting to disregard the operative system warning, then it’s a crimson flag. 

The second stage payload may take management of the machine as a result of accessibility permissions are granted so every other permission or motion can then be carried out by the malware if these directions are supplied within the injected code. 

Because it’s tough for customers to actively cope with all these threats, we strongly suggest that customers set up safety software program on their units and at all times preserve updated. By utilizing McAfee Mobile Security merchandise, customers can additional safeguard their units and mitigate the dangers linked with these sorts of malware, offering a safer and safer expertise. 

Android/Xamalicious Samples Distributed on Google Play: 

Indicators of Compromise 

Introducing McAfee+

Identity theft safety and privateness in your digital life

Download McAfee+ Now