{"id":1349,"date":"2023-07-29T06:52:30","date_gmt":"2023-07-29T06:52:30","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1349"},"modified":"2024-04-22T12:50:21","modified_gmt":"2024-04-22T12:50:21","slug":"trojan-android-fakecalls-banker","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2023\/07\/29\/trojan-android-fakecalls-banker\/","title":{"rendered":"Trojan.Android.Fakecalls.Banker"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> Trojan<\/p>\n

Potential Damage<\/strong>: Medium<\/p>\n

Prevalence:<\/strong> Medium<\/p>\n

 <\/p>\n

Malware name(s)<\/strong><\/h3>\n
    \n
  • Trojan.Android.Fakecalls.Banker<\/li>\n<\/ul>\n

     <\/p>\n

    What is a Trojan?<\/h3>\n

    Trojan is a type of malware that disguises itself as a trusted and legitimate software and behaves totally like a useful and functional software. But once it is executed, it causes a lot of damages to the computer system.
    \nThere are different ways in which trojans could enter the system, some are: Entering through a software downloaded from the Internet, embedding in HTML text, attaching to an email, etc. Unlike viruses and worms, trojans cannot replicate themselves.<\/p>\n

     <\/p>\n

    What is Fake call malware family?<\/h3>\n

    “fake call” is a malware family of Trojans. This banking Trojan acts as a banking software. The infecting method of this type of malware is voice phishing (vishing). The process of voice phishing in this malware family is that, the hacker calls the target victims with the fake title of “banker” and tries to deceive them. The potential victim is deceived by false and attractive offers of loans with low interest rates. The fake conversation takes place while the phone number belonging to the malware operators is replaced with a real bank number. Therefore, the victim thinks that he had the conversation with a real banker. Once trust is established, the victims are tricked to confirm their credit card information.<\/p>\n

     <\/p>\n

    Technical Review<\/h2>\n

    Indicators of Compromise (IoC)<\/h3>\n

    Dangerous permissions request<\/p>\n

    Request permission to use Accessibility feature<\/p>\n

    Once the app is installed, despite its successful installation, the app icon is not visible.<\/p>\n

    The application page is like this:<\/p>\n

    \"\"<\/p>\n

    First, the user is asked to enable the “run in background” option for the application.
    \nThen the user is asked (in Korean) to enable accessibility service in application setting, like this:
    \n(The English equivalent: “In order to use the app, you must allow to use the normal service”)<\/p>\n

    After activating the application, the following page will be displayed.
    \n“Installation setup is complete” is written on the green button.<\/p>\n

    \"\"<\/p>\n

    After enabling the accessibility feature of runtime permissions, the user is requested to set the malware as the default calling app.<\/p>\n

     <\/p>\n

    Performance Description<\/h3>\n

    A cursory look at the application code reveals that the important application items,
    \nincluding the names of some methods and strings, have been encoded.
    \nThe m10 method in the sairwpw3.k7ngwog.ra0mef class acts as a decoder, with this method, encoded items are decoded.<\/p>\n

    \"\"<\/p>\n

    By dynamic analysis of this method and observing its inputs and outputs, we reach the following address:<\/p>\n

    \"\"<\/p>\n

    At the above address, there is a file which it’s name consists of a long string.
    \nThe application generates malware by reading the name of this file and concentrates it with another string and finally with C&C addresses.<\/p>\n

    SERVER39_sn2c4hg6fprb8.com
    \nSERVER40_sn3isv3hf36ef.com
    \nSERVER41_sn4yitf01o3pk.com
    \nSERVER42_sn5us1iw4h9rv.com
    \nSERVER43_sn1lwm3e04gwf.com<\/p>\n

    SERVER44_sn6xs1hfa6x2o.com<\/p>\n

    This malware gets sensitive accesses like list of installed apps, mobile phone operator, serial number, sim card number, contacts, text messages, location, camera, call recordings and call history.
    \nIn addition, by setting itself as the default calling app, it has the ability to answer the call or reject it, delete contacts, text messages and call history. This application makes use of the very sensitive accessibility service to do some of these things.
    \nIn this service, the functionality of dialer application is checked in real time.\"\"<\/p>\n

    <\/h2>\n

    Malware techniques<\/h3>\n

    If the application apk file is converted to a zip file, and then unzipped, the application will encounter the next volume required error.
    \nThis means that the malware is manipulated in a way that it is recognized by compression softwares as a multi-part zip file.
    \nOf course, by binary file checks, and making changes in the software signature, the problem of decompressing the software file is solved.<\/p>\n

    <\/h2>\n

    How to deal with and clean the system?<\/h2>\n

    To ensure that the device is not infected, install Padvish antivirus, keep its database file up-to-date and run an antivirus scan.<\/p>\n

     <\/p>\n

    How to protect your mobile device from infection?<\/h3>\n
      \n
    • Make sure you download\/purchase your applications from trusted sources\/app stores and do not download
      \nthem from unknown sources.<\/li>\n
    • When installing mobile applications, pay attention to app permissions.
      \nIf an application asks for irrelevant access permissions, especially the accessibility service permission, be careful in using it.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"

      Overview Type: Trojan Potential Damage: Medium Prevalence: Medium   Malware name(s) Trojan.Android.Fakecalls.Banker   What is a Trojan? Trojan is a type of malware that disguises itself as a trusted and legitimate software and behaves totally like a useful and functional software. But once it is executed, it causes a lot of damages to the computer…<\/p>\n","protected":false},"author":21,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1349","post","type-post","status-publish","format-standard","hentry","category-trojan"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1349","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1349"}],"version-history":[{"count":10,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1349\/revisions"}],"predecessor-version":[{"id":1548,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1349\/revisions\/1548"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1349"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1349"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1349"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}