Trojan.Android.Phishing.GameCo

General Explanation

Type: Trojan

Degree of destruction: average

Prevalence: average

What is Phishing?

Phishing is a social engineering technique that an attacker uses to mislead the user and steals personal information of the user such as username, password, bank card 16-digit number, second password, CVV2 code, etc. The common methods of Phishing are using decisive emails and attaching infected links to emails, social networks, and bank payment terminals. There are multiple ways for Phishing attacks, one of these ways is that the attacker designs a page similar to the bank payment terminal and replaces it with the original page. By adding the address of this fake page in the application which will be attached to social networks for download and by promoting tempting buying suggestions tries to make you enter the fake payment terminal page that they designed and transfer the money. Addresses whose only differences from the original address mean one or two words or used misleading subdomains to create them.

What is GameCo malware?

Users download and install applications “PES 2019 EVOLUTION SOCCER”, “Buying half-price Charge”, “ESET mobile security” and “Games with obscene names” which all have a packagename named “ir.game.co” from social networks. The process of infecting these types of malware is usually through ads of these applications on Telegram channels and Instagram pages.  To access more features in installed applications, most attackers persuade users by using in-app purchases.

For instance, in this report, we will check “PES 2019 EVOLUTION SOCCER”. This application claims to give you the possibility of viewing and using the game features by paying the price. But in fact, its payment page is fake and attempts to steal users’ banking information. Also, this application contains an advertising package to show ads inside the application. The malware author has added the fake payment page on free hosts which are generally filtered, so to be able to keep the fake payment page open for the user, it necessitates the user to use an anti-filter to attain application features. For example, to reach this aim in this application, it pretends that “because some offline support servers are abroad, you need to use an anti-filter to execute the application without any problem”

Technical Explanation

After parsing JSON files and executing their codes in the applications, the following goals will be followed:

• By pressing the “our channel” and “support” keys, the intent will be sent to the browser by android to open “https://telegram.me/joinchat/AAAAAEFEG5G1Ym_DVHK-Vw” and “https://telegram.me/joinchat/AAAAAEHQb0xPRcm6t3_1qA” addresses.
• By pressing the “activating game” key, the intent will be sent to the browser by android to open the “https://newhoster.000webhostapp.com/Source/Saman/payment=5698542365.php?amount=20000” address. This address is the fake payment page that the user refers to.
• If the user clicks on “run game and helps” the related activity is loaded according to JSON file data which is added to the assets/data/1.json path and will be shown to the user.  In the provided explanation it is mentioned that: “because some offline support servers are abroad, you need to use an anti-filter to execute the application without any problem” 
• There is a part named “use the below button to activate” that as soon as clicking on it, the user will directly refer to the fake page of the payment terminal: because some offline support servers are abroad, you need to use an anti-filter to execute the application without any problem “https://newhoster.000webhostapp.com/Source/Saman/payment=5698542365.php?amount=20000”. In this part, as soon as entering bank card information and pressing the “Pay” key, all bank card information of the user will be sent to the attacker server: “https://newhoster.000webhostapp.com/Source/Saman/token.php”. Thus, an attacker can easily steal from a user’s bank account.

Other infected examples and URLs:

You can view Other examples of this family in the following table. The MD5 hash of each one of these applications exists in the table and in front of them there are specified URLs which are fake bank payment terminals for each example. As soon as the user clicks to purchase in-application, will lead to an infected URL, and by entering bank card information, this information will be sent to the attacker server. Many of these servers are disabled but some of them such as the above example are still active.

How to deal with it and disinfect the system

To ensure that the system is not infected, install the Padvish Antivirus database file, keep it up to date, and scan the anti-virus.

Method of preventing phone infection:

• Avoid downloading and installing the application from unauthorized resources.
• Note the desired permission, when installing the application.
• Constantly back up the stored files and data.
• Do not use unofficial versions of any applications. Applications such as Telegram and Instagram have many unofficial versions and most of them are released through the Telegram channel.
• Pay attention tath the page you want to buy from is not a Phishing type.