Android malware apps are nothing new, but this one is of particular interest in how it implements no such functionality that can be readily detected by security products. The apps named and rely mainly on Android's to conduct malicious activities, and go undetected. DEFENSOR ID Defensor Digital Accessibility Service In fact, a released May 22nd 2020 by malware researcher Lukas Stefanko of ESET states: blog post "the banking trojan was available on Google Play at the time of the analysis. The app is fitted with standard information-stealing capabilities; however, this banker is in that after installation – enable Android’s – to fully unleash the app’s malicious functionality." exceptionally insidious it requires a single action from the victim Accessibility Service The blog post also demonstrates at the time of its inception, . no antivirus engine detected this malware sample Even today, only 5-6 detection engines are flagging these two apps, according to VirusTotal. This raises concern for the of malware that may be nothing but a slight modification of these apps. next iteration Android Accessibility Service To make smartphones more accessible to users with special needs, the allows for the device to extend permissions to an app to read screen content (e.g. for providing text to speech synthesis capability). You can imagine how useful would such a functionality be to a malicious app. Accessibility Service Existing detection models can reliably predict when certain combinations of permissions requested by an app may pose problems. But because the Defensor apps mainly relied on obtaining permissions from the user, along with some other minimalistic ones, no red flags were raised anywhere. The permissions requested by the app include the following, of which the critical ones are highlighted: Accessibility Service android.permission.INTERNET com.secure.protect.world.permission.C2D_MESSAGEandroid.permission.ACCESS_NETWORK_STATEandroid.permission.FOREGROUND_SERVICEandroid.permission.REQUEST_DELETE_PACKAGESandroid.permission.SYSTEM_OVERLAY_WINDOW android.permission.WRITE_SETTINGScom.google.android.c2dm.permission.RECEIVE android.permission.SYSTEM_ALERT_WINDOWandroid.permission.BIND_ACCESSIBILITY_SERVICE android.permission.WAKE_LOCK In practice, this means the app can capture credentials entered by the user on mobile banking apps, read or generate SMS messages, read emails, read Two-Factor Authentication (2FA) codes generated by authenticator apps — thereby bypassing 2FA, steal cryptocurrency private keys, and so on, to an attacker-controlled server! and upload all of this vital information The app also requests the permission, letting it override the default screen timeout setting, and keeping the device turned on persistently. This would give malware an extended opportunity to launch other apps and to continuously capturing sensitive information. WAKE_LOCK The screenshots provided by ESET demonstrate this behaviour: Indicators of Compromise (IOCs) To make things easy for the security community, malware researchers at ESET have thankfully provided two useful IOCs identifying the malicious apps that have now been yanked from the Google Play store. Package Name & SHA-1 Hash: com.secure.protect.world:
F17AEBC741957AA21CFE7C7D7BAEC0900E863F61
com.brazil.android.free:
EA069A5C96DC1DB0715923EB68192FD325F3D3CE New information and my analysis ESET researchers have done a brilliant job of presenting their comprehensive analysis of these apps and their documented behaviour. Further to their report however, I'd like to add a bit of my own findings. Command & Control (C&C) domains The attacker controlled C&C domains are still up — well at least one of them, and that's problematic. Domains & IP addresses : 132.148.42.16 empresasenegocios.online : 184.168.221.46 atendimentoempresarial.digital The URLs specifically used by the app to establish communication between the attacker-controlled server include: https://empresasenegocios.online/remoteControl/ https://empresasenegocios.online/remoteControl/api/main/index/ http://atendimentoempresarial.digital/remoteControl/api/main/index http://atendimentoempresarial.digital/remoteControl/ Interestingly, VirusTotal reports most antivirus engines are still not flagging these URLs, except for FortiNet which flags just one of the empresasenegocios.online URLs as phishing: Nevermind the fact, the domain still has for the attackers to log into and glance over the juicy details of their victims 🍿: empresasenegocios.online a fancy admin panel Here's also a preview of the API: And the domain continues to be hosted on GoDaddy's shared hosting, with its beautiful cPanel and WebMail interfaces accessible: : empresasenegocios.online/cpanel : empresasenegocios.online/webmail At least, domain has its GoDaddy parking page showing for now. While that's no guarantee that the domain's ownership or activities have ceased, so far there are no strong signs indicating ongoing activity either. atendimentoempresarial.digital malicious The Takeaways Because prominent antivirus engines are not detecting apps like these — even now, advice to "scan your mobile device" is futile. Enforcing BYOD policies SOC Analysts and Security Ops professionals are strongly advised to enforce a corporate mobile device policy which restricts employee access to Google Play app store on their work devices. Apps like these pose significant threats to an organization's secrets especially when an organization has a relaxed Bring Your Own Device (BYOD) policy, allowing for corporate email accounts to be accessible on an employee's personal mobile device (e.g. Gmail's Android app managing both personal and work accounts of a user would not be immune to attacks like these, and could easily infiltrate corporate trade secrets to malicious actors). Additionally, extensive network monitoring in your SIEM/EDR products should be setup for these servers, with network blocks implemented, given at least one of these domains is still active. That way, any device on your corporate network would be prevented from inadvertently making calls to these domains. Network monitoring and blocks The IP addresses appear to belong to GoDaddy's shared hosting, therefore blocking these could potentially block legitimate websites. It is best to block the malicious domains for the time being. Note: DEFENSOR ID and Defensor Digital were just two of the apps which have been identified and removed from the Play store, but given their stealthy behaviour, we do not know as of yet how many other apps might be using these servers or leveraging the weakness. Accessibility Service © 2020. ( ). All Rights Reserved. Originally published on . Ax Sharma Twitter dev.to

Google

Twitter

My other blog: Security Report

Book a call

Read My Stories

Too Long; Didn't Read

Questions about cloud security? Get answers here.

☢️ Dissecting DEFENSOR - An Android Malware That Affects Your Banking Apps

Too Long; Didn't Read

Companies Mentioned

Ax Sharma

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

☢️ Dissecting DEFENSOR - An Android Malware That Affects Your Banking Apps

Too Long; Didn't Read

Companies Mentioned

Ax Sharma

About Author

TOPICS

THIS ARTICLE WAS FEATURED IN...

RELATED STORIES