{"id":1356,"date":"2023-08-28T07:23:31","date_gmt":"2023-08-28T07:23:31","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1356"},"modified":"2024-04-22T12:50:40","modified_gmt":"2024-04-22T12:50:40","slug":"trojan-android-wroba-roamingmantis","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2023\/08\/28\/trojan-android-wroba-roamingmantis\/","title":{"rendered":"Trojan.Android.Wroba.Roamingmantis"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> Trojan<\/p>\n

Potential Damage<\/strong>: Medium<\/p>\n

Prevalence:<\/strong> Medium<\/p>\n

 <\/p>\n

Malware name(s)<\/strong><\/h3>\n
    \n
  • Trojan.Android.Wroba.Roamingmantis (Padvish)<\/li>\n
  • HEUR:Trojan-Dropper.AndroidOS.Wroba.o (Kaspersky)<\/li>\n
  • ANDROID\/Drop.Wroba.monhn (Avira)<\/li>\n<\/ul>\n

     <\/p>\n

    What is a Trojan?<\/h3>\n

    Trojan is a type of malware that disguise itself as cleaned and legitimate software and behaves totally like a useful and functional software. But when executed, it causes a lot of damage to the computer system.
    \nThere are different ways in which trojans could enter the system, some are: Entering through a software downloaded from the Internet, embedding in HTML text, attaching to an email, etc.<\/p>\n

     <\/p>\n

    What is the Wroba malware family?<\/h3>\n

    Wroba malware family is a type of android banking Trojan and its main role is to intercept user’s text messages. So, this trojan can read incoming text messages containing one-time passwords (OTP) or other authentication codes. Therefore, bypassing 2FA implemented by banks is facilitated for Trojans.<\/p>\n

     <\/p>\n

    Technical Review<\/h2>\n

    Indicators of Compromise (IoC)<\/h3>\n
      \n
    • Application’s icon Hiding<\/li>\n
    • Persistent notification bar<\/li>\n
    • Get dangerous permission to contacts and text messages<\/li>\n<\/ul>\n

       <\/p>\n

      How does it work?<\/h3>\n

      Roaming Mantis ( also known as Shaoye) is a cyberattack campaign that distributes mobile malwares via smishing, through targeting Android devices.
      \nSmishing is also a type of cyber-attack in which a malicious link is sent in a text message (SMS) that leads a person to a malicious website or a drive-by download onto their device.
      \nIn fact, Roaming Mantis makes use of APK files to steal device information, and it makes use of phishing pages to steal victims’ credentials or user accounts.
      \nThe malware does this, by accessing Wi-Fi Router’s Settings and changing the DNS IP address (DNS Hijacking).
      \nThis was previously implemented in the known Android malware Wroba.o\/Agent.eq, which was the main malware used in this campaign.<\/p>\n

       <\/p>\n

      CxActivity:<\/strong><\/p>\n

      CxActivity is the main activity of the application. In onCreate it starts another activity called Ce.<\/p>\n

      Cx activity, by asking the user to disable the battery optimization, helps the malware run its services without worrying about being closed by the operating system
      \nThen, it stops running (closes) by calling the finish() function.<\/p>\n

       <\/p>\n

      IqApplication class:<\/strong><\/p>\n

      Once the application is logged in, IqApplication class is executed, and loads functions from the ig.so file generally.<\/p>\n

      The application makes use of functions use in ig.so file to read, decode and execute a file named b.dex.
      \nFor example, one of its important functions is pi, which reads and decodes the file inside the asset folder.<\/p>\n

      Part of the pi function code.<\/span><\/span> According to the figure, this piece of code reads a file from the asset folder:<\/span><\/span><\/span><\/p>\n

      \"\"<\/p>\n

      Part of the mz function code. According to the figure, this piece of code loads a dex file:<\/p>\n

      \"\"<\/p>\n

       <\/p>\n

      b.dex file:<\/strong><\/p>\n

      In this file, in the com.b class, first the Wi-Fi type and the address of the network router is found .
      \nThe following two images show some parts of the x function that do this:<\/p>\n

      Part of the codes of function x from class com.b:<\/p>\n

      \"\"<\/p>\n

      \"\"<\/p>\n

      After finding the Wi-Fi router’s address, based on the router configuration, a request is sent to it.
      \nBut before this, the malware sends a request to an address by calling the w method of the com.b class and receives the dns server IP address. The address that is embedded in dns servers is:<\/p>\n

      https:\/\/m[.]vk[.]com\/id728588947?act=info\u00a0(The address is not available in the time of writing this report)<\/p>\n

      Setting dns server using the w function output:<\/p>\n

      \"\"<\/p>\n

      Function w of class com.b:<\/p>\n

      \"\"<\/p>\n

      Function p of class t:<\/p>\n

      \"\"<\/p>\n

      In general, this type of malware is operated in a way that, after changing the dns, once the victim enters a website like Google, a malware-infected application disguised as an update, or something similar (other legitimate applications) is installed on the smart phone, or it steals person’s user account information by displaying a phishing page when the victim logs into popular websites like facebook.com.<\/p>\n

       <\/p>\n

      How to deal with and clean the system?<\/strong><\/h2>\n

      Padvish anti-malware detects this type of malware.<\/p>\n

      Keep your smart phones up to date and make sure “Automatic update” feature is activated.<\/p>\n

      Make sure you download\/ purchase your applications from trusted sources \/ app stores and do not download them from unknown sources (like Telegram channels, Instagram, or non-authenticated websites).<\/p>\n

      Avoid clicking on suspicious links that you receive via SMS (clicking\u00a0on the\u00a0link\u00a0may have triggered malware to be downloaded).<\/p>\n","protected":false},"excerpt":{"rendered":"

      Overview Type: Trojan Potential Damage: Medium Prevalence: Medium   Malware name(s) Trojan.Android.Wroba.Roamingmantis (Padvish) HEUR:Trojan-Dropper.AndroidOS.Wroba.o (Kaspersky) ANDROID\/Drop.Wroba.monhn (Avira)   What is a Trojan? Trojan is a type of malware that disguise itself as cleaned and legitimate software and behaves totally like a useful and functional software. But when executed, it causes a lot of damage to…<\/p>\n","protected":false},"author":21,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[],"class_list":["post-1356","post","type-post","status-publish","format-standard","hentry","category-trojan"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1356"}],"version-history":[{"count":11,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1356\/revisions"}],"predecessor-version":[{"id":1549,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1356\/revisions\/1549"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}