\n(Kaspersky) HEUR:Trojan.AndroidOS.Hiddapp.ay<\/em>
\n(BitDefenderFalx) Android.Trojan.SpyAgent.OK<\/em>
\n(ESET) A Variant Of Android\/Spy.Agent.DET<\/em><\/p>\n
<\/p>\n
What is a Trojan?<\/h3>\n
A Trojan is a type of malware that masquerades as legitimate software, presenting itself as functional and benign. However, once executed, it performs malicious actions that can cause significant damage to the system. Trojans infiltrate systems through various methods, including:
\n\u2022 Downloading software from untrusted sources,
\n\u2022 Embedded malicious code in HTML files,
\n\u2022 Malicious email attachments, and more.<\/p>\n
<\/p>\n
What is the SmsSpy Malware Family?<\/strong><\/h3>\nThe SmsSpy malware family consists of a set of malicious applications designed to steal sensitive user information, specifically targeting bank account details. These apps are often distributed through reputable Android markets such as Cafe Bazaar and Myket, as well as through less trustworthy platforms like unofficial websites, Telegram channels, and SMS messages containing malicious links. While these applications may appear legitimate and useful at first glance, they are designed to deceive users and steal personal data through phishing techniques.<\/p>\n
The malware’s operation typically begins with deceptive promises of offering additional services (such as access to Legal Notice, subsidies, or Justice Shares). If the user is tricked into paying a small fee, they are redirected to a fake bank page. When users enter their login credentials, the malware captures their banking information. Given the malware\u2019s access to SMS messages, it can also retrieve the user\u2019s second-factor authentication code, providing complete access to the compromised account.<\/p>\n
<\/p>\n
Technical Description<\/strong><\/h2>\nIndicators of Compromise<\/strong> (IoCs)<\/h3>\n\n- Requests for dangerous permissions, including access to SMS messages, contacts, installed applications lists, etc.<\/li>\n
- Unusual spikes in battery consumption and system resource usage (CPU, RAM).<\/li>\n
- Fake notifications.<\/li>\n<\/ul>\n
Technical Overview<\/strong><\/h3>\nOnce the malware \u201cEdalat Hamrah\u201d receives the necessary permissions (including access to SMS messages, contacts, notifications, and call data), it launches a web view that directs users to a phishing page designed to extract payment information. This is how the malware steals bank card details by exploiting the permissions it has been granted. Additionally, the malware is capable of listing installed applications, executing hidden USSD codes, and taking screenshots of the compromised device.<\/p>\n
<\/p>\n
![\"\u0628\u062f\u0627\u0641\u0632\u0627\u0631](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/02\/\u0628\u062f\u0627\u0641\u0632\u0627\u0631-\u0639\u062f\u0627\u0644\u062a-\u0647\u0645\u0631\u0627\u0647.png\")
<\/p>\n\n<\/div>\n<\/figure>\n\n<\/div>\n<\/figure>\n\n<\/div>\n<\/figure>\nA notable feature of this malware ,shown in the above images, is the static captcha code displayed during phishing attempts, which does not change between page reloads. The dates shown on the page are outdated, indicating that previous versions of this malware family are still being utilized. The malware periodically evolves, with slight changes to its code structure. After a period of dormancy, it resurfaces through social networks and unreliable sources, continuing the cycle of phishing attacks.<\/p>\n
<\/p>\n
\u25fd Main Activity: com.x.team.main<\/strong><\/span><\/h4>\n\u25ab\ufe0f <\/span>ResumableSub_Activity_Create Class<\/span>
\n<\/em><\/strong><\/p>\nThis class is integral to the malware\u2019s execution process and runs asynchronously. During the initial phase, the malware checks for necessary permissions, verifies internet and Google services connectivity, and loads the phishing web page step by step within this class. This class can pause execution and resume from the point it left off after receiving results from other methods (such as permission requests or server data retrieval).<\/p>\n
The malware uses a state management system in the resume() method, utilizing switch-case and variable state to determine the stage of execution. It terminates its execution in two cases:<\/p>\n
\n- In emulators running on Intel processors.<\/li>\n
- If the SIM card\u2019s country code (retrieved via the getSimCountryIso method) is not \u201cIR\u201d (Iran), the malware displays an error message and terminates its execution.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_GetConfigs Class<\/em><\/span><\/strong><\/p>\nThis class is responsible for sending a request to the C2 (Command and Control) server to retrieve the malware\u2019s configurations. These configurations may include control commands, new server addresses, communication ports, and other sensitive data required for performing malicious activities. The server address to which the malware sends the initial request is obtained from the method vvvvvvvvvvvv7_. The initial request is sent to obtain the original address to load it into the malware\u2019s WebView.<\/p>\n
![\"\u06a9\u0644\u0627\u0633](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/02\/\u06a9\u0644\u0627\u0633-ResumableSub_GetConfigs.png\")
<\/p>\n
The method tries to read the server address from the Domain.txt file. If the file does not exist, it retrieves the value from the vvvvvvvvvvvv0_ method. The server address is then stored in the v5_ server variable and saved to the Domain.txt file. This method utilizes the code to encrypt and decrypt C2 server\u2019s main addresses that is written in Domain.txt file.<\/p>\n
After decryption, the -v5 value consists of a list of \u00a0the following C2 server addresses which is also written in the Domain.txt file:<\/p>\n
https[:]\/\/api0.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api1.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api2.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api3.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api4.x-pdomain-zrc9w6pj3a.store\/X.php<\/em><\/span><\/p>\nOnce the initial connection is made to the server, the malware retrieves additional configuration data, which is stored as a JSON file in the data\/data\/com.x.team\/files directory, named config.json. This file contains critical operational data, including commands, permissions, and security settings that are usually created after reading the Domain.txt file and tell the malware how to behave. These include:<\/p>\n
\n- The malware\u2019s phishing page URL (https:\/\/ikdplc.org\/c\/app.php<\/span>).<\/li>\n
- Requested permissions.<\/li>\n
- Admin panel requests.<\/li>\n
- Initial malicious actions, such as the collection of banking and contact information.<\/li>\n
- Offline communication settings.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_ScreenShot Class<\/em><\/strong><\/span><\/p>\nThe primary function of this class is to capture screenshots of the victim\u2019s device and send them to the C2 server. The malware captures the current activity screen of the device and saves it (Bitmap) in the file AkumaScreenShot.jpg. This file is subsequently uploaded to the server using the send_screen_ method. Along with the screenshot, the following information is sent:<\/p>\n
\n- Operation type (here, “screenshot”).<\/li>\n
- Device model.<\/li>\n
- Android version.<\/li>\n
- Port used by the malware.<\/li>\n
- Screen status (whether the screen is on or off).<\/li>\n<\/ul>\n
![\"\u06a9\u0644\u0627\u0633](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/02\/2-\u06a9\u0644\u0627\u0633-ResumableSub_ScreenShot.png\")
<\/p>\n
? com.x.team.r4 Service<\/em><\/strong><\/span><\/h4>\nThe r4 service functions as a foreground service with several malicious capabilities. Using the vvvvvvvvvvvvvvvvvvvvvvv0_ method, it generates a fake notification titled “Settings” with the message “Receiving data” to disguise its activity. This helps prevent the malware from being easily terminated. The malware also changes its application icon to appear as a “settings” icon using the changeicon_ method, further concealing its malicious intent. The original malware icon is hidden via the hideicon_ method to make it harder for the user to remove. Additionally, the r4 service sets up a receiver that checks for the malware every 3 seconds, restarting it if necessary to maintain persistence.<\/p>\n
? com.x.team.r6 Service<\/em><\/strong><\/span><\/h4>\nThe r6 service runs an automated process called AutoTar, which operates in the foreground via a hidden notification. If the system attempts to terminate the service, it is automatically restarted. This service sends device information to the C2 server. The vvvvvvvvvvvvvvvvvvvvvvvvvvv3_ method is used by the service to creates a fake notification that appears as a system update process. \u00a0Then, the malware uses the runautotar_ method to execute an automated process that is responsible for sending device information to the malware server and then propagating malicious SMS messages to the victim\u2019s contacts. The input parameter str in the method contains the text of the SMS message that is to be sent to the user’s contacts, then the send_autotarstart_ method sends the victim’s device information, including Android ID, phone model, communication port, request time, and message ID, to the malware server. After a 30-second delay, the vvvvvvvv5_ method is triggered, sending the malicious SMS to the victim’s contact list. After sending the malicious SMS messages, the service temporarily halts to avoid detection.<\/p>\n
? <\/span>com.x.team.firebasemessaging Receiver<\/span>
\n<\/em><\/strong><\/h4>\nThe firebasemessaging<\/strong> receiver, receives incoming messages from the C2 server via Firebase Cloud Messaging FCM). This receiver acts as a communication channel, executing commands received from the server to perform malicious actions on the victim’s device. These commands include sending SMS messages, stealing bank and credit card information, extracting contacts, retrieving SMS messages, and executing USSD codes to steal account balances. This receiver processes and executes the attacker’s desired commands received from the Firebase server through the resume method (in the ResumableSub_ProcessFCMMessage class).<\/p>\nMalicious Commands and Their Functions:<\/p>\n
\n- oneping<\/span>: Sends basic information about the victim\u2019s phone, such as the model, Android ID, installed apps list, received bank messages, contacts, etc.<\/li>\n
- allping<\/span>: Collects comprehensive data about the device\u2019s status.<\/li>\n
- mutephone<\/span>: Mutes the victim\u2019s phone<\/li>\n
- normalphone<\/span>: Restores the phone to its normal state.<\/li>\n
- fullinformation<\/span>: Sends complete device information, including text messages, call history, contacts, and installed apps information<\/li>\n
- AppList<\/span>: Sends a list of apps installed on the phone.<\/li>\n
- \u00a0\u00a0\u00a0 screenshot: Captures screenshot of the current activity screen and sends it to the server.<\/li>\n
- \u00a0putdomain<\/span>: Changes the malware’s C2 server address.<\/li>\n
- \u00a0hideicon<\/span>: Hides the malware\u2019s application icon for stealth.<\/li>\n
- \u00a0unhideicon<\/span>: Restores the application icon to its normal state.<\/li>\n
- \u00a0changeicon<\/span>: Alters the application icon to prevent detection by the user.<\/li>\n
- \u00a0BankInformation<\/span>: Extracts sensitive bank-related messages and account information from the victim\u2019s device.<\/li>\n
- \u00a0CardNumbers<\/span>: Extracts the victim’s bank card numbers from available data.<\/li>\n
- \u00a0lastmessage<\/span>: Retrieves the last sent and received text messages.<\/li>\n
- \u00a0BankSMS<\/span>: Extracts bank-related SMS messages from the inbox.<\/li>\n
- \u00a0inboxSMS<\/span>: Retrieves all incoming SMS messages.<\/li>\n
- \u00a0outboxSMS<\/span>: Retrieves all sent SMS messages.<\/li>\n
- \u00a0getphones<\/span>: Retrieves the list of phone numbers stored on the device.<\/li>\n
- \u00a0updatesimcard<\/span>: Gathers SIM card information, such as IMSI and ICCID numbers.<\/li>\n
- \u00a0send_default<\/span>: Sends SMS from the phone\u2019s default number.<\/li>\n
- \u00a0send_solt<\/span>: Sends SMS from the second SIM card on dual SIM devices.<\/li>\n
- \u00a0send_contacts<\/span>: Sends the victim\u2019s contact list to the server.<\/li>\n
- \u00a0offlinemodeon<\/span>: Activates the malware\u2019s offline mode, allowing it to send data via SMS.<\/li>\n
- \u00a0offlinemodeoff<\/span>: Deactivates offline mode.<\/li>\n
- \u00a0detect_saderat<\/span>: Detects SMS messages from Saderat Bank.<\/li>\n
- detect_target<\/span>: Detects SMS messages received from specific numbers<\/li>\n
- detect_exchange<\/span>: Detects cryptocurrency applications installed on the phone<\/li>\n
- runussdcode<\/span>: Runs USSD codes on the victim’s phone<\/li>\n<\/ul>\n
<\/p>\n
<\/p>\n
? _send_bankdata Method<\/em><\/strong><\/span><\/p>\nThis method examines the user’s bank SMS messages and extracts information such as account balance, bank name, account number, and cut number using the getvvvvvvvvv2_ method and sends it to its server along with other user-related information (such as the victim’s phone model, phone ID, user’s phone operator, malware icon status, and screen status). In the getvvvvvvvvv2_ method, as shown in the image below, the list of received SMS messages is first extracted and then each user’s SMS message is examined to find bank messages, along with the text and sender number of the SMS. Next, it detects the bank name from the SMS text and sender number using the detect_bankname_ method. The name of the bank sending the message is obtained using a series of keywords and Regex. The malware then extracts the account balance from bank SMS messages using the bank_findbalance_ method, such that if the SMS text contains phrases such as \u201cbalance\u201d, it identifies the amount followed by this as the account balance. The detect_bankaccountnumber_ method also extracts the account number or card number from the SMS text, if the SMS text contains phrases such as \u201caccount\u201d, \u201cwithdrawal from\u201d or \u201ccard\u201d, the malware tries to extract the number followed by these phrases. Finally, the account and balance information is sent to the send_bankdata_ method.<\/p>\n
![\"\u0645\u062a\u062f](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/02\/3-\u0645\u062a\u062f-_send_bankdata.png\")
<\/p>\n
<\/p>\n
\u00a0? sendUssdRequest Method<\/em><\/strong><\/span><\/p>\nThe sendUssdRequest method allows the malware to send USSD requests using the TelephonyManager class. These codes, such as #123* or #1*140*, are sent to the mobile operator, and the response is captured by the onReceiveUssdResponse method. The response, which may include account balances or other operator-related information, is then forwarded to the C2 server.<\/p>\n
The malware uses this method to determine if an active SIM card is present and, if so, sends the USSD response to the attacker\u2019s desired number via the vvvvvvvv4_ method.<\/p>\n
![\"\u0645\u062a\u062f](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/02\/4-\u0645\u062a\u062f-sendUssdRequest.png\")
<\/p>\n
How to Deal with and Clean the System<\/h2>\n
Indicators of Compromise<\/strong> (IoCs)<\/h3>\n\n- Requests for dangerous permissions, including access to SMS messages, contacts, installed applications lists, etc.<\/li>\n
- Unusual spikes in battery consumption and system resource usage (CPU, RAM).<\/li>\n
- Fake notifications.<\/li>\n<\/ul>\n
Technical Overview<\/strong><\/h3>\nOnce the malware \u201cEdalat Hamrah\u201d receives the necessary permissions (including access to SMS messages, contacts, notifications, and call data), it launches a web view that directs users to a phishing page designed to extract payment information. This is how the malware steals bank card details by exploiting the permissions it has been granted. Additionally, the malware is capable of listing installed applications, executing hidden USSD codes, and taking screenshots of the compromised device.<\/p>\n
<\/p>\n
<\/p>\n\n<\/div>\n<\/figure>\n\n<\/div>\n<\/figure>\n\n<\/div>\n<\/figure>\nA notable feature of this malware ,shown in the above images, is the static captcha code displayed during phishing attempts, which does not change between page reloads. The dates shown on the page are outdated, indicating that previous versions of this malware family are still being utilized. The malware periodically evolves, with slight changes to its code structure. After a period of dormancy, it resurfaces through social networks and unreliable sources, continuing the cycle of phishing attacks.<\/p>\n
<\/p>\n
\u25fd Main Activity: com.x.team.main<\/strong><\/span><\/h4>\n\u25ab\ufe0f <\/span>ResumableSub_Activity_Create Class<\/span>
\n<\/em><\/strong><\/p>\nThis class is integral to the malware\u2019s execution process and runs asynchronously. During the initial phase, the malware checks for necessary permissions, verifies internet and Google services connectivity, and loads the phishing web page step by step within this class. This class can pause execution and resume from the point it left off after receiving results from other methods (such as permission requests or server data retrieval).<\/p>\n
The malware uses a state management system in the resume() method, utilizing switch-case and variable state to determine the stage of execution. It terminates its execution in two cases:<\/p>\n
\n- In emulators running on Intel processors.<\/li>\n
- If the SIM card\u2019s country code (retrieved via the getSimCountryIso method) is not \u201cIR\u201d (Iran), the malware displays an error message and terminates its execution.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_GetConfigs Class<\/em><\/span><\/strong><\/p>\nThis class is responsible for sending a request to the C2 (Command and Control) server to retrieve the malware\u2019s configurations. These configurations may include control commands, new server addresses, communication ports, and other sensitive data required for performing malicious activities. The server address to which the malware sends the initial request is obtained from the method vvvvvvvvvvvv7_. The initial request is sent to obtain the original address to load it into the malware\u2019s WebView.<\/p>\n
<\/p>\n
The method tries to read the server address from the Domain.txt file. If the file does not exist, it retrieves the value from the vvvvvvvvvvvv0_ method. The server address is then stored in the v5_ server variable and saved to the Domain.txt file. This method utilizes the code to encrypt and decrypt C2 server\u2019s main addresses that is written in Domain.txt file.<\/p>\n
After decryption, the -v5 value consists of a list of \u00a0the following C2 server addresses which is also written in the Domain.txt file:<\/p>\n
https[:]\/\/api0.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api1.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api2.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api3.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api4.x-pdomain-zrc9w6pj3a.store\/X.php<\/em><\/span><\/p>\nOnce the initial connection is made to the server, the malware retrieves additional configuration data, which is stored as a JSON file in the data\/data\/com.x.team\/files directory, named config.json. This file contains critical operational data, including commands, permissions, and security settings that are usually created after reading the Domain.txt file and tell the malware how to behave. These include:<\/p>\n
\n- The malware\u2019s phishing page URL (https:\/\/ikdplc.org\/c\/app.php<\/span>).<\/li>\n
- Requested permissions.<\/li>\n
- Admin panel requests.<\/li>\n
- Initial malicious actions, such as the collection of banking and contact information.<\/li>\n
- Offline communication settings.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_ScreenShot Class<\/em><\/strong><\/span><\/p>\nThe primary function of this class is to capture screenshots of the victim\u2019s device and send them to the C2 server. The malware captures the current activity screen of the device and saves it (Bitmap) in the file AkumaScreenShot.jpg. This file is subsequently uploaded to the server using the send_screen_ method. Along with the screenshot, the following information is sent:<\/p>\n
\n- Operation type (here, “screenshot”).<\/li>\n
- Device model.<\/li>\n
- Android version.<\/li>\n
- Port used by the malware.<\/li>\n
- Screen status (whether the screen is on or off).<\/li>\n<\/ul>\n
<\/p>\n
? com.x.team.r4 Service<\/em><\/strong><\/span><\/h4>\nThe r4 service functions as a foreground service with several malicious capabilities. Using the vvvvvvvvvvvvvvvvvvvvvvv0_ method, it generates a fake notification titled “Settings” with the message “Receiving data” to disguise its activity. This helps prevent the malware from being easily terminated. The malware also changes its application icon to appear as a “settings” icon using the changeicon_ method, further concealing its malicious intent. The original malware icon is hidden via the hideicon_ method to make it harder for the user to remove. Additionally, the r4 service sets up a receiver that checks for the malware every 3 seconds, restarting it if necessary to maintain persistence.<\/p>\n
? com.x.team.r6 Service<\/em><\/strong><\/span><\/h4>\nThe r6 service runs an automated process called AutoTar, which operates in the foreground via a hidden notification. If the system attempts to terminate the service, it is automatically restarted. This service sends device information to the C2 server. The vvvvvvvvvvvvvvvvvvvvvvvvvvv3_ method is used by the service to creates a fake notification that appears as a system update process. \u00a0Then, the malware uses the runautotar_ method to execute an automated process that is responsible for sending device information to the malware server and then propagating malicious SMS messages to the victim\u2019s contacts. The input parameter str in the method contains the text of the SMS message that is to be sent to the user’s contacts, then the send_autotarstart_ method sends the victim’s device information, including Android ID, phone model, communication port, request time, and message ID, to the malware server. After a 30-second delay, the vvvvvvvv5_ method is triggered, sending the malicious SMS to the victim’s contact list. After sending the malicious SMS messages, the service temporarily halts to avoid detection.<\/p>\n
? <\/span>com.x.team.firebasemessaging Receiver<\/span>
\n<\/em><\/strong><\/h4>\nThe firebasemessaging<\/strong> receiver, receives incoming messages from the C2 server via Firebase Cloud Messaging FCM). This receiver acts as a communication channel, executing commands received from the server to perform malicious actions on the victim’s device. These commands include sending SMS messages, stealing bank and credit card information, extracting contacts, retrieving SMS messages, and executing USSD codes to steal account balances. This receiver processes and executes the attacker’s desired commands received from the Firebase server through the resume method (in the ResumableSub_ProcessFCMMessage class).<\/p>\nMalicious Commands and Their Functions:<\/p>\n
\n- oneping<\/span>: Sends basic information about the victim\u2019s phone, such as the model, Android ID, installed apps list, received bank messages, contacts, etc.<\/li>\n
- allping<\/span>: Collects comprehensive data about the device\u2019s status.<\/li>\n
- mutephone<\/span>: Mutes the victim\u2019s phone<\/li>\n
- normalphone<\/span>: Restores the phone to its normal state.<\/li>\n
- fullinformation<\/span>: Sends complete device information, including text messages, call history, contacts, and installed apps information<\/li>\n
- AppList<\/span>: Sends a list of apps installed on the phone.<\/li>\n
- \u00a0\u00a0\u00a0 screenshot: Captures screenshot of the current activity screen and sends it to the server.<\/li>\n
- \u00a0putdomain<\/span>: Changes the malware’s C2 server address.<\/li>\n
- \u00a0hideicon<\/span>: Hides the malware\u2019s application icon for stealth.<\/li>\n
- \u00a0unhideicon<\/span>: Restores the application icon to its normal state.<\/li>\n
- \u00a0changeicon<\/span>: Alters the application icon to prevent detection by the user.<\/li>\n
- \u00a0BankInformation<\/span>: Extracts sensitive bank-related messages and account information from the victim\u2019s device.<\/li>\n
- \u00a0CardNumbers<\/span>: Extracts the victim’s bank card numbers from available data.<\/li>\n
- \u00a0lastmessage<\/span>: Retrieves the last sent and received text messages.<\/li>\n
- \u00a0BankSMS<\/span>: Extracts bank-related SMS messages from the inbox.<\/li>\n
- \u00a0inboxSMS<\/span>: Retrieves all incoming SMS messages.<\/li>\n
- \u00a0outboxSMS<\/span>: Retrieves all sent SMS messages.<\/li>\n
- \u00a0getphones<\/span>: Retrieves the list of phone numbers stored on the device.<\/li>\n
- \u00a0updatesimcard<\/span>: Gathers SIM card information, such as IMSI and ICCID numbers.<\/li>\n
- \u00a0send_default<\/span>: Sends SMS from the phone\u2019s default number.<\/li>\n
- \u00a0send_solt<\/span>: Sends SMS from the second SIM card on dual SIM devices.<\/li>\n
- \u00a0send_contacts<\/span>: Sends the victim\u2019s contact list to the server.<\/li>\n
- \u00a0offlinemodeon<\/span>: Activates the malware\u2019s offline mode, allowing it to send data via SMS.<\/li>\n
- \u00a0offlinemodeoff<\/span>: Deactivates offline mode.<\/li>\n
- \u00a0detect_saderat<\/span>: Detects SMS messages from Saderat Bank.<\/li>\n
- detect_target<\/span>: Detects SMS messages received from specific numbers<\/li>\n
- detect_exchange<\/span>: Detects cryptocurrency applications installed on the phone<\/li>\n
- runussdcode<\/span>: Runs USSD codes on the victim’s phone<\/li>\n<\/ul>\n
<\/p>\n
<\/p>\n
? _send_bankdata Method<\/em><\/strong><\/span><\/p>\nThis method examines the user’s bank SMS messages and extracts information such as account balance, bank name, account number, and cut number using the getvvvvvvvvv2_ method and sends it to its server along with other user-related information (such as the victim’s phone model, phone ID, user’s phone operator, malware icon status, and screen status). In the getvvvvvvvvv2_ method, as shown in the image below, the list of received SMS messages is first extracted and then each user’s SMS message is examined to find bank messages, along with the text and sender number of the SMS. Next, it detects the bank name from the SMS text and sender number using the detect_bankname_ method. The name of the bank sending the message is obtained using a series of keywords and Regex. The malware then extracts the account balance from bank SMS messages using the bank_findbalance_ method, such that if the SMS text contains phrases such as \u201cbalance\u201d, it identifies the amount followed by this as the account balance. The detect_bankaccountnumber_ method also extracts the account number or card number from the SMS text, if the SMS text contains phrases such as \u201caccount\u201d, \u201cwithdrawal from\u201d or \u201ccard\u201d, the malware tries to extract the number followed by these phrases. Finally, the account and balance information is sent to the send_bankdata_ method.<\/p>\n
<\/p>\n
<\/p>\n
\u00a0? sendUssdRequest Method<\/em><\/strong><\/span><\/p>\nThe sendUssdRequest method allows the malware to send USSD requests using the TelephonyManager class. These codes, such as #123* or #1*140*, are sent to the mobile operator, and the response is captured by the onReceiveUssdResponse method. The response, which may include account balances or other operator-related information, is then forwarded to the C2 server.<\/p>\n
The malware uses this method to determine if an active SIM card is present and, if so, sends the USSD response to the attacker\u2019s desired number via the vvvvvvvv4_ method.<\/p>\n
<\/p>\n
How to Deal with and Clean the System<\/h2>\n
Technical Overview<\/strong><\/h3>\nOnce the malware \u201cEdalat Hamrah\u201d receives the necessary permissions (including access to SMS messages, contacts, notifications, and call data), it launches a web view that directs users to a phishing page designed to extract payment information. This is how the malware steals bank card details by exploiting the permissions it has been granted. Additionally, the malware is capable of listing installed applications, executing hidden USSD codes, and taking screenshots of the compromised device.<\/p>\n
<\/p>\n
<\/p>\n\n<\/div>\n<\/figure>\n\n<\/div>\n<\/figure>\n\n<\/div>\n<\/figure>\nA notable feature of this malware ,shown in the above images, is the static captcha code displayed during phishing attempts, which does not change between page reloads. The dates shown on the page are outdated, indicating that previous versions of this malware family are still being utilized. The malware periodically evolves, with slight changes to its code structure. After a period of dormancy, it resurfaces through social networks and unreliable sources, continuing the cycle of phishing attacks.<\/p>\n
<\/p>\n
\u25fd Main Activity: com.x.team.main<\/strong><\/span><\/h4>\n\u25ab\ufe0f <\/span>ResumableSub_Activity_Create Class<\/span>
\n<\/em><\/strong><\/p>\nThis class is integral to the malware\u2019s execution process and runs asynchronously. During the initial phase, the malware checks for necessary permissions, verifies internet and Google services connectivity, and loads the phishing web page step by step within this class. This class can pause execution and resume from the point it left off after receiving results from other methods (such as permission requests or server data retrieval).<\/p>\n
The malware uses a state management system in the resume() method, utilizing switch-case and variable state to determine the stage of execution. It terminates its execution in two cases:<\/p>\n
\n- In emulators running on Intel processors.<\/li>\n
- If the SIM card\u2019s country code (retrieved via the getSimCountryIso method) is not \u201cIR\u201d (Iran), the malware displays an error message and terminates its execution.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_GetConfigs Class<\/em><\/span><\/strong><\/p>\nThis class is responsible for sending a request to the C2 (Command and Control) server to retrieve the malware\u2019s configurations. These configurations may include control commands, new server addresses, communication ports, and other sensitive data required for performing malicious activities. The server address to which the malware sends the initial request is obtained from the method vvvvvvvvvvvv7_. The initial request is sent to obtain the original address to load it into the malware\u2019s WebView.<\/p>\n
<\/p>\n
The method tries to read the server address from the Domain.txt file. If the file does not exist, it retrieves the value from the vvvvvvvvvvvv0_ method. The server address is then stored in the v5_ server variable and saved to the Domain.txt file. This method utilizes the code to encrypt and decrypt C2 server\u2019s main addresses that is written in Domain.txt file.<\/p>\n
After decryption, the -v5 value consists of a list of \u00a0the following C2 server addresses which is also written in the Domain.txt file:<\/p>\n
https[:]\/\/api0.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api1.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api2.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api3.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api4.x-pdomain-zrc9w6pj3a.store\/X.php<\/em><\/span><\/p>\nOnce the initial connection is made to the server, the malware retrieves additional configuration data, which is stored as a JSON file in the data\/data\/com.x.team\/files directory, named config.json. This file contains critical operational data, including commands, permissions, and security settings that are usually created after reading the Domain.txt file and tell the malware how to behave. These include:<\/p>\n
\n- The malware\u2019s phishing page URL (https:\/\/ikdplc.org\/c\/app.php<\/span>).<\/li>\n
- Requested permissions.<\/li>\n
- Admin panel requests.<\/li>\n
- Initial malicious actions, such as the collection of banking and contact information.<\/li>\n
- Offline communication settings.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_ScreenShot Class<\/em><\/strong><\/span><\/p>\nThe primary function of this class is to capture screenshots of the victim\u2019s device and send them to the C2 server. The malware captures the current activity screen of the device and saves it (Bitmap) in the file AkumaScreenShot.jpg. This file is subsequently uploaded to the server using the send_screen_ method. Along with the screenshot, the following information is sent:<\/p>\n
\n- Operation type (here, “screenshot”).<\/li>\n
- Device model.<\/li>\n
- Android version.<\/li>\n
- Port used by the malware.<\/li>\n
- Screen status (whether the screen is on or off).<\/li>\n<\/ul>\n
<\/p>\n
? com.x.team.r4 Service<\/em><\/strong><\/span><\/h4>\nThe r4 service functions as a foreground service with several malicious capabilities. Using the vvvvvvvvvvvvvvvvvvvvvvv0_ method, it generates a fake notification titled “Settings” with the message “Receiving data” to disguise its activity. This helps prevent the malware from being easily terminated. The malware also changes its application icon to appear as a “settings” icon using the changeicon_ method, further concealing its malicious intent. The original malware icon is hidden via the hideicon_ method to make it harder for the user to remove. Additionally, the r4 service sets up a receiver that checks for the malware every 3 seconds, restarting it if necessary to maintain persistence.<\/p>\n
? com.x.team.r6 Service<\/em><\/strong><\/span><\/h4>\nThe r6 service runs an automated process called AutoTar, which operates in the foreground via a hidden notification. If the system attempts to terminate the service, it is automatically restarted. This service sends device information to the C2 server. The vvvvvvvvvvvvvvvvvvvvvvvvvvv3_ method is used by the service to creates a fake notification that appears as a system update process. \u00a0Then, the malware uses the runautotar_ method to execute an automated process that is responsible for sending device information to the malware server and then propagating malicious SMS messages to the victim\u2019s contacts. The input parameter str in the method contains the text of the SMS message that is to be sent to the user’s contacts, then the send_autotarstart_ method sends the victim’s device information, including Android ID, phone model, communication port, request time, and message ID, to the malware server. After a 30-second delay, the vvvvvvvv5_ method is triggered, sending the malicious SMS to the victim’s contact list. After sending the malicious SMS messages, the service temporarily halts to avoid detection.<\/p>\n
? <\/span>com.x.team.firebasemessaging Receiver<\/span>
\n<\/em><\/strong><\/h4>\nThe firebasemessaging<\/strong> receiver, receives incoming messages from the C2 server via Firebase Cloud Messaging FCM). This receiver acts as a communication channel, executing commands received from the server to perform malicious actions on the victim’s device. These commands include sending SMS messages, stealing bank and credit card information, extracting contacts, retrieving SMS messages, and executing USSD codes to steal account balances. This receiver processes and executes the attacker’s desired commands received from the Firebase server through the resume method (in the ResumableSub_ProcessFCMMessage class).<\/p>\nMalicious Commands and Their Functions:<\/p>\n
\n- oneping<\/span>: Sends basic information about the victim\u2019s phone, such as the model, Android ID, installed apps list, received bank messages, contacts, etc.<\/li>\n
- allping<\/span>: Collects comprehensive data about the device\u2019s status.<\/li>\n
- mutephone<\/span>: Mutes the victim\u2019s phone<\/li>\n
- normalphone<\/span>: Restores the phone to its normal state.<\/li>\n
- fullinformation<\/span>: Sends complete device information, including text messages, call history, contacts, and installed apps information<\/li>\n
- AppList<\/span>: Sends a list of apps installed on the phone.<\/li>\n
- \u00a0\u00a0\u00a0 screenshot: Captures screenshot of the current activity screen and sends it to the server.<\/li>\n
- \u00a0putdomain<\/span>: Changes the malware’s C2 server address.<\/li>\n
- \u00a0hideicon<\/span>: Hides the malware\u2019s application icon for stealth.<\/li>\n
- \u00a0unhideicon<\/span>: Restores the application icon to its normal state.<\/li>\n
- \u00a0changeicon<\/span>: Alters the application icon to prevent detection by the user.<\/li>\n
- \u00a0BankInformation<\/span>: Extracts sensitive bank-related messages and account information from the victim\u2019s device.<\/li>\n
- \u00a0CardNumbers<\/span>: Extracts the victim’s bank card numbers from available data.<\/li>\n
- \u00a0lastmessage<\/span>: Retrieves the last sent and received text messages.<\/li>\n
- \u00a0BankSMS<\/span>: Extracts bank-related SMS messages from the inbox.<\/li>\n
- \u00a0inboxSMS<\/span>: Retrieves all incoming SMS messages.<\/li>\n
- \u00a0outboxSMS<\/span>: Retrieves all sent SMS messages.<\/li>\n
- \u00a0getphones<\/span>: Retrieves the list of phone numbers stored on the device.<\/li>\n
- \u00a0updatesimcard<\/span>: Gathers SIM card information, such as IMSI and ICCID numbers.<\/li>\n
- \u00a0send_default<\/span>: Sends SMS from the phone\u2019s default number.<\/li>\n
- \u00a0send_solt<\/span>: Sends SMS from the second SIM card on dual SIM devices.<\/li>\n
- \u00a0send_contacts<\/span>: Sends the victim\u2019s contact list to the server.<\/li>\n
- \u00a0offlinemodeon<\/span>: Activates the malware\u2019s offline mode, allowing it to send data via SMS.<\/li>\n
- \u00a0offlinemodeoff<\/span>: Deactivates offline mode.<\/li>\n
- \u00a0detect_saderat<\/span>: Detects SMS messages from Saderat Bank.<\/li>\n
- detect_target<\/span>: Detects SMS messages received from specific numbers<\/li>\n
- detect_exchange<\/span>: Detects cryptocurrency applications installed on the phone<\/li>\n
- runussdcode<\/span>: Runs USSD codes on the victim’s phone<\/li>\n<\/ul>\n
<\/p>\n
<\/p>\n
? _send_bankdata Method<\/em><\/strong><\/span><\/p>\nThis method examines the user’s bank SMS messages and extracts information such as account balance, bank name, account number, and cut number using the getvvvvvvvvv2_ method and sends it to its server along with other user-related information (such as the victim’s phone model, phone ID, user’s phone operator, malware icon status, and screen status). In the getvvvvvvvvv2_ method, as shown in the image below, the list of received SMS messages is first extracted and then each user’s SMS message is examined to find bank messages, along with the text and sender number of the SMS. Next, it detects the bank name from the SMS text and sender number using the detect_bankname_ method. The name of the bank sending the message is obtained using a series of keywords and Regex. The malware then extracts the account balance from bank SMS messages using the bank_findbalance_ method, such that if the SMS text contains phrases such as \u201cbalance\u201d, it identifies the amount followed by this as the account balance. The detect_bankaccountnumber_ method also extracts the account number or card number from the SMS text, if the SMS text contains phrases such as \u201caccount\u201d, \u201cwithdrawal from\u201d or \u201ccard\u201d, the malware tries to extract the number followed by these phrases. Finally, the account and balance information is sent to the send_bankdata_ method.<\/p>\n
<\/p>\n
<\/p>\n
\u00a0? sendUssdRequest Method<\/em><\/strong><\/span><\/p>\nThe sendUssdRequest method allows the malware to send USSD requests using the TelephonyManager class. These codes, such as #123* or #1*140*, are sent to the mobile operator, and the response is captured by the onReceiveUssdResponse method. The response, which may include account balances or other operator-related information, is then forwarded to the C2 server.<\/p>\n
The malware uses this method to determine if an active SIM card is present and, if so, sends the USSD response to the attacker\u2019s desired number via the vvvvvvvv4_ method.<\/p>\n
<\/p>\n
How to Deal with and Clean the System<\/h2>\n
<\/p>\nA notable feature of this malware ,shown in the above images, is the static captcha code displayed during phishing attempts, which does not change between page reloads. The dates shown on the page are outdated, indicating that previous versions of this malware family are still being utilized. The malware periodically evolves, with slight changes to its code structure. After a period of dormancy, it resurfaces through social networks and unreliable sources, continuing the cycle of phishing attacks.<\/p>\n
<\/p>\n
\u25fd Main Activity: com.x.team.main<\/strong><\/span><\/h4>\n\u25ab\ufe0f <\/span>ResumableSub_Activity_Create Class<\/span>
\n<\/em><\/strong><\/p>\nThis class is integral to the malware\u2019s execution process and runs asynchronously. During the initial phase, the malware checks for necessary permissions, verifies internet and Google services connectivity, and loads the phishing web page step by step within this class. This class can pause execution and resume from the point it left off after receiving results from other methods (such as permission requests or server data retrieval).<\/p>\n
The malware uses a state management system in the resume() method, utilizing switch-case and variable state to determine the stage of execution. It terminates its execution in two cases:<\/p>\n
\n- In emulators running on Intel processors.<\/li>\n
- If the SIM card\u2019s country code (retrieved via the getSimCountryIso method) is not \u201cIR\u201d (Iran), the malware displays an error message and terminates its execution.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_GetConfigs Class<\/em><\/span><\/strong><\/p>\nThis class is responsible for sending a request to the C2 (Command and Control) server to retrieve the malware\u2019s configurations. These configurations may include control commands, new server addresses, communication ports, and other sensitive data required for performing malicious activities. The server address to which the malware sends the initial request is obtained from the method vvvvvvvvvvvv7_. The initial request is sent to obtain the original address to load it into the malware\u2019s WebView.<\/p>\n
<\/p>\n
The method tries to read the server address from the Domain.txt file. If the file does not exist, it retrieves the value from the vvvvvvvvvvvv0_ method. The server address is then stored in the v5_ server variable and saved to the Domain.txt file. This method utilizes the code to encrypt and decrypt C2 server\u2019s main addresses that is written in Domain.txt file.<\/p>\n
After decryption, the -v5 value consists of a list of \u00a0the following C2 server addresses which is also written in the Domain.txt file:<\/p>\n
https[:]\/\/api0.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api1.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api2.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api3.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api4.x-pdomain-zrc9w6pj3a.store\/X.php<\/em><\/span><\/p>\nOnce the initial connection is made to the server, the malware retrieves additional configuration data, which is stored as a JSON file in the data\/data\/com.x.team\/files directory, named config.json. This file contains critical operational data, including commands, permissions, and security settings that are usually created after reading the Domain.txt file and tell the malware how to behave. These include:<\/p>\n
\n- The malware\u2019s phishing page URL (https:\/\/ikdplc.org\/c\/app.php<\/span>).<\/li>\n
- Requested permissions.<\/li>\n
- Admin panel requests.<\/li>\n
- Initial malicious actions, such as the collection of banking and contact information.<\/li>\n
- Offline communication settings.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_ScreenShot Class<\/em><\/strong><\/span><\/p>\nThe primary function of this class is to capture screenshots of the victim\u2019s device and send them to the C2 server. The malware captures the current activity screen of the device and saves it (Bitmap) in the file AkumaScreenShot.jpg. This file is subsequently uploaded to the server using the send_screen_ method. Along with the screenshot, the following information is sent:<\/p>\n
\n- Operation type (here, “screenshot”).<\/li>\n
- Device model.<\/li>\n
- Android version.<\/li>\n
- Port used by the malware.<\/li>\n
- Screen status (whether the screen is on or off).<\/li>\n<\/ul>\n
<\/p>\n
? com.x.team.r4 Service<\/em><\/strong><\/span><\/h4>\nThe r4 service functions as a foreground service with several malicious capabilities. Using the vvvvvvvvvvvvvvvvvvvvvvv0_ method, it generates a fake notification titled “Settings” with the message “Receiving data” to disguise its activity. This helps prevent the malware from being easily terminated. The malware also changes its application icon to appear as a “settings” icon using the changeicon_ method, further concealing its malicious intent. The original malware icon is hidden via the hideicon_ method to make it harder for the user to remove. Additionally, the r4 service sets up a receiver that checks for the malware every 3 seconds, restarting it if necessary to maintain persistence.<\/p>\n
? com.x.team.r6 Service<\/em><\/strong><\/span><\/h4>\nThe r6 service runs an automated process called AutoTar, which operates in the foreground via a hidden notification. If the system attempts to terminate the service, it is automatically restarted. This service sends device information to the C2 server. The vvvvvvvvvvvvvvvvvvvvvvvvvvv3_ method is used by the service to creates a fake notification that appears as a system update process. \u00a0Then, the malware uses the runautotar_ method to execute an automated process that is responsible for sending device information to the malware server and then propagating malicious SMS messages to the victim\u2019s contacts. The input parameter str in the method contains the text of the SMS message that is to be sent to the user’s contacts, then the send_autotarstart_ method sends the victim’s device information, including Android ID, phone model, communication port, request time, and message ID, to the malware server. After a 30-second delay, the vvvvvvvv5_ method is triggered, sending the malicious SMS to the victim’s contact list. After sending the malicious SMS messages, the service temporarily halts to avoid detection.<\/p>\n
? <\/span>com.x.team.firebasemessaging Receiver<\/span>
\n<\/em><\/strong><\/h4>\nThe firebasemessaging<\/strong> receiver, receives incoming messages from the C2 server via Firebase Cloud Messaging FCM). This receiver acts as a communication channel, executing commands received from the server to perform malicious actions on the victim’s device. These commands include sending SMS messages, stealing bank and credit card information, extracting contacts, retrieving SMS messages, and executing USSD codes to steal account balances. This receiver processes and executes the attacker’s desired commands received from the Firebase server through the resume method (in the ResumableSub_ProcessFCMMessage class).<\/p>\nMalicious Commands and Their Functions:<\/p>\n
\n- oneping<\/span>: Sends basic information about the victim\u2019s phone, such as the model, Android ID, installed apps list, received bank messages, contacts, etc.<\/li>\n
- allping<\/span>: Collects comprehensive data about the device\u2019s status.<\/li>\n
- mutephone<\/span>: Mutes the victim\u2019s phone<\/li>\n
- normalphone<\/span>: Restores the phone to its normal state.<\/li>\n
- fullinformation<\/span>: Sends complete device information, including text messages, call history, contacts, and installed apps information<\/li>\n
- AppList<\/span>: Sends a list of apps installed on the phone.<\/li>\n
- \u00a0\u00a0\u00a0 screenshot: Captures screenshot of the current activity screen and sends it to the server.<\/li>\n
- \u00a0putdomain<\/span>: Changes the malware’s C2 server address.<\/li>\n
- \u00a0hideicon<\/span>: Hides the malware\u2019s application icon for stealth.<\/li>\n
- \u00a0unhideicon<\/span>: Restores the application icon to its normal state.<\/li>\n
- \u00a0changeicon<\/span>: Alters the application icon to prevent detection by the user.<\/li>\n
- \u00a0BankInformation<\/span>: Extracts sensitive bank-related messages and account information from the victim\u2019s device.<\/li>\n
- \u00a0CardNumbers<\/span>: Extracts the victim’s bank card numbers from available data.<\/li>\n
- \u00a0lastmessage<\/span>: Retrieves the last sent and received text messages.<\/li>\n
- \u00a0BankSMS<\/span>: Extracts bank-related SMS messages from the inbox.<\/li>\n
- \u00a0inboxSMS<\/span>: Retrieves all incoming SMS messages.<\/li>\n
- \u00a0outboxSMS<\/span>: Retrieves all sent SMS messages.<\/li>\n
- \u00a0getphones<\/span>: Retrieves the list of phone numbers stored on the device.<\/li>\n
- \u00a0updatesimcard<\/span>: Gathers SIM card information, such as IMSI and ICCID numbers.<\/li>\n
- \u00a0send_default<\/span>: Sends SMS from the phone\u2019s default number.<\/li>\n
- \u00a0send_solt<\/span>: Sends SMS from the second SIM card on dual SIM devices.<\/li>\n
- \u00a0send_contacts<\/span>: Sends the victim\u2019s contact list to the server.<\/li>\n
- \u00a0offlinemodeon<\/span>: Activates the malware\u2019s offline mode, allowing it to send data via SMS.<\/li>\n
- \u00a0offlinemodeoff<\/span>: Deactivates offline mode.<\/li>\n
- \u00a0detect_saderat<\/span>: Detects SMS messages from Saderat Bank.<\/li>\n
- detect_target<\/span>: Detects SMS messages received from specific numbers<\/li>\n
- detect_exchange<\/span>: Detects cryptocurrency applications installed on the phone<\/li>\n
- runussdcode<\/span>: Runs USSD codes on the victim’s phone<\/li>\n<\/ul>\n
<\/p>\n
<\/p>\n
? _send_bankdata Method<\/em><\/strong><\/span><\/p>\nThis method examines the user’s bank SMS messages and extracts information such as account balance, bank name, account number, and cut number using the getvvvvvvvvv2_ method and sends it to its server along with other user-related information (such as the victim’s phone model, phone ID, user’s phone operator, malware icon status, and screen status). In the getvvvvvvvvv2_ method, as shown in the image below, the list of received SMS messages is first extracted and then each user’s SMS message is examined to find bank messages, along with the text and sender number of the SMS. Next, it detects the bank name from the SMS text and sender number using the detect_bankname_ method. The name of the bank sending the message is obtained using a series of keywords and Regex. The malware then extracts the account balance from bank SMS messages using the bank_findbalance_ method, such that if the SMS text contains phrases such as \u201cbalance\u201d, it identifies the amount followed by this as the account balance. The detect_bankaccountnumber_ method also extracts the account number or card number from the SMS text, if the SMS text contains phrases such as \u201caccount\u201d, \u201cwithdrawal from\u201d or \u201ccard\u201d, the malware tries to extract the number followed by these phrases. Finally, the account and balance information is sent to the send_bankdata_ method.<\/p>\n
<\/p>\n
<\/p>\n
\u00a0? sendUssdRequest Method<\/em><\/strong><\/span><\/p>\nThe sendUssdRequest method allows the malware to send USSD requests using the TelephonyManager class. These codes, such as #123* or #1*140*, are sent to the mobile operator, and the response is captured by the onReceiveUssdResponse method. The response, which may include account balances or other operator-related information, is then forwarded to the C2 server.<\/p>\n
The malware uses this method to determine if an active SIM card is present and, if so, sends the USSD response to the attacker\u2019s desired number via the vvvvvvvv4_ method.<\/p>\n
<\/p>\n
How to Deal with and Clean the System<\/h2>\n
\n<\/em><\/strong><\/p>\n
This class is integral to the malware\u2019s execution process and runs asynchronously. During the initial phase, the malware checks for necessary permissions, verifies internet and Google services connectivity, and loads the phishing web page step by step within this class. This class can pause execution and resume from the point it left off after receiving results from other methods (such as permission requests or server data retrieval).<\/p>\n
The malware uses a state management system in the resume() method, utilizing switch-case and variable state to determine the stage of execution. It terminates its execution in two cases:<\/p>\n
- \n
- In emulators running on Intel processors.<\/li>\n
- If the SIM card\u2019s country code (retrieved via the getSimCountryIso method) is not \u201cIR\u201d (Iran), the malware displays an error message and terminates its execution.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_GetConfigs Class<\/em><\/span><\/strong><\/p>\n
This class is responsible for sending a request to the C2 (Command and Control) server to retrieve the malware\u2019s configurations. These configurations may include control commands, new server addresses, communication ports, and other sensitive data required for performing malicious activities. The server address to which the malware sends the initial request is obtained from the method vvvvvvvvvvvv7_. The initial request is sent to obtain the original address to load it into the malware\u2019s WebView.<\/p>\n
<\/p>\nThe method tries to read the server address from the Domain.txt file. If the file does not exist, it retrieves the value from the vvvvvvvvvvvv0_ method. The server address is then stored in the v5_ server variable and saved to the Domain.txt file. This method utilizes the code to encrypt and decrypt C2 server\u2019s main addresses that is written in Domain.txt file.<\/p>\n
After decryption, the -v5 value consists of a list of \u00a0the following C2 server addresses which is also written in the Domain.txt file:<\/p>\n
https[:]\/\/api0.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api1.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api2.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api3.x-pdomain-zrc9w6pj3a.store\/X.php A-K-U-M-A<\/em><\/span>
\nhttps[:]\/\/api4.x-pdomain-zrc9w6pj3a.store\/X.php<\/em><\/span><\/p>\nOnce the initial connection is made to the server, the malware retrieves additional configuration data, which is stored as a JSON file in the data\/data\/com.x.team\/files directory, named config.json. This file contains critical operational data, including commands, permissions, and security settings that are usually created after reading the Domain.txt file and tell the malware how to behave. These include:<\/p>\n
- \n
- The malware\u2019s phishing page URL (https:\/\/ikdplc.org\/c\/app.php<\/span>).<\/li>\n
- Requested permissions.<\/li>\n
- Admin panel requests.<\/li>\n
- Initial malicious actions, such as the collection of banking and contact information.<\/li>\n
- Offline communication settings.<\/li>\n<\/ul>\n
<\/p>\n
\u25ab\ufe0f ResumableSub_ScreenShot Class<\/em><\/strong><\/span><\/p>\n
The primary function of this class is to capture screenshots of the victim\u2019s device and send them to the C2 server. The malware captures the current activity screen of the device and saves it (Bitmap) in the file AkumaScreenShot.jpg. This file is subsequently uploaded to the server using the send_screen_ method. Along with the screenshot, the following information is sent:<\/p>\n
- \n
- Operation type (here, “screenshot”).<\/li>\n
- Device model.<\/li>\n
- Android version.<\/li>\n
- Port used by the malware.<\/li>\n
- Screen status (whether the screen is on or off).<\/li>\n<\/ul>\n<\/p>\n
? com.x.team.r4 Service<\/em><\/strong><\/span><\/h4>\n
The r4 service functions as a foreground service with several malicious capabilities. Using the vvvvvvvvvvvvvvvvvvvvvvv0_ method, it generates a fake notification titled “Settings” with the message “Receiving data” to disguise its activity. This helps prevent the malware from being easily terminated. The malware also changes its application icon to appear as a “settings” icon using the changeicon_ method, further concealing its malicious intent. The original malware icon is hidden via the hideicon_ method to make it harder for the user to remove. Additionally, the r4 service sets up a receiver that checks for the malware every 3 seconds, restarting it if necessary to maintain persistence.<\/p>\n
? com.x.team.r6 Service<\/em><\/strong><\/span><\/h4>\n
The r6 service runs an automated process called AutoTar, which operates in the foreground via a hidden notification. If the system attempts to terminate the service, it is automatically restarted. This service sends device information to the C2 server. The vvvvvvvvvvvvvvvvvvvvvvvvvvv3_ method is used by the service to creates a fake notification that appears as a system update process. \u00a0Then, the malware uses the runautotar_ method to execute an automated process that is responsible for sending device information to the malware server and then propagating malicious SMS messages to the victim\u2019s contacts. The input parameter str in the method contains the text of the SMS message that is to be sent to the user’s contacts, then the send_autotarstart_ method sends the victim’s device information, including Android ID, phone model, communication port, request time, and message ID, to the malware server. After a 30-second delay, the vvvvvvvv5_ method is triggered, sending the malicious SMS to the victim’s contact list. After sending the malicious SMS messages, the service temporarily halts to avoid detection.<\/p>\n
? <\/span>com.x.team.firebasemessaging Receiver<\/span>
\n<\/em><\/strong><\/h4>\nThe firebasemessaging<\/strong> receiver, receives incoming messages from the C2 server via Firebase Cloud Messaging FCM). This receiver acts as a communication channel, executing commands received from the server to perform malicious actions on the victim’s device. These commands include sending SMS messages, stealing bank and credit card information, extracting contacts, retrieving SMS messages, and executing USSD codes to steal account balances. This receiver processes and executes the attacker’s desired commands received from the Firebase server through the resume method (in the ResumableSub_ProcessFCMMessage class).<\/p>\n
Malicious Commands and Their Functions:<\/p>\n
- \n
- oneping<\/span>: Sends basic information about the victim\u2019s phone, such as the model, Android ID, installed apps list, received bank messages, contacts, etc.<\/li>\n
- allping<\/span>: Collects comprehensive data about the device\u2019s status.<\/li>\n
- mutephone<\/span>: Mutes the victim\u2019s phone<\/li>\n
- normalphone<\/span>: Restores the phone to its normal state.<\/li>\n
- fullinformation<\/span>: Sends complete device information, including text messages, call history, contacts, and installed apps information<\/li>\n
- AppList<\/span>: Sends a list of apps installed on the phone.<\/li>\n
- \u00a0\u00a0\u00a0 screenshot: Captures screenshot of the current activity screen and sends it to the server.<\/li>\n
- \u00a0putdomain<\/span>: Changes the malware’s C2 server address.<\/li>\n
- \u00a0hideicon<\/span>: Hides the malware\u2019s application icon for stealth.<\/li>\n
- \u00a0unhideicon<\/span>: Restores the application icon to its normal state.<\/li>\n
- \u00a0changeicon<\/span>: Alters the application icon to prevent detection by the user.<\/li>\n
- \u00a0BankInformation<\/span>: Extracts sensitive bank-related messages and account information from the victim\u2019s device.<\/li>\n
- \u00a0CardNumbers<\/span>: Extracts the victim’s bank card numbers from available data.<\/li>\n
- \u00a0lastmessage<\/span>: Retrieves the last sent and received text messages.<\/li>\n
- \u00a0BankSMS<\/span>: Extracts bank-related SMS messages from the inbox.<\/li>\n
- \u00a0inboxSMS<\/span>: Retrieves all incoming SMS messages.<\/li>\n
- \u00a0outboxSMS<\/span>: Retrieves all sent SMS messages.<\/li>\n
- \u00a0getphones<\/span>: Retrieves the list of phone numbers stored on the device.<\/li>\n
- \u00a0updatesimcard<\/span>: Gathers SIM card information, such as IMSI and ICCID numbers.<\/li>\n
- \u00a0send_default<\/span>: Sends SMS from the phone\u2019s default number.<\/li>\n
- \u00a0send_solt<\/span>: Sends SMS from the second SIM card on dual SIM devices.<\/li>\n
- \u00a0send_contacts<\/span>: Sends the victim\u2019s contact list to the server.<\/li>\n
- \u00a0offlinemodeon<\/span>: Activates the malware\u2019s offline mode, allowing it to send data via SMS.<\/li>\n
- \u00a0offlinemodeoff<\/span>: Deactivates offline mode.<\/li>\n
- \u00a0detect_saderat<\/span>: Detects SMS messages from Saderat Bank.<\/li>\n
- detect_target<\/span>: Detects SMS messages received from specific numbers<\/li>\n
- detect_exchange<\/span>: Detects cryptocurrency applications installed on the phone<\/li>\n
- runussdcode<\/span>: Runs USSD codes on the victim’s phone<\/li>\n<\/ul>\n
<\/p>\n
<\/p>\n
? _send_bankdata Method<\/em><\/strong><\/span><\/p>\n
This method examines the user’s bank SMS messages and extracts information such as account balance, bank name, account number, and cut number using the getvvvvvvvvv2_ method and sends it to its server along with other user-related information (such as the victim’s phone model, phone ID, user’s phone operator, malware icon status, and screen status). In the getvvvvvvvvv2_ method, as shown in the image below, the list of received SMS messages is first extracted and then each user’s SMS message is examined to find bank messages, along with the text and sender number of the SMS. Next, it detects the bank name from the SMS text and sender number using the detect_bankname_ method. The name of the bank sending the message is obtained using a series of keywords and Regex. The malware then extracts the account balance from bank SMS messages using the bank_findbalance_ method, such that if the SMS text contains phrases such as \u201cbalance\u201d, it identifies the amount followed by this as the account balance. The detect_bankaccountnumber_ method also extracts the account number or card number from the SMS text, if the SMS text contains phrases such as \u201caccount\u201d, \u201cwithdrawal from\u201d or \u201ccard\u201d, the malware tries to extract the number followed by these phrases. Finally, the account and balance information is sent to the send_bankdata_ method.<\/p>\n
<\/p>\n<\/p>\n
\u00a0? sendUssdRequest Method<\/em><\/strong><\/span><\/p>\n
The sendUssdRequest method allows the malware to send USSD requests using the TelephonyManager class. These codes, such as #123* or #1*140*, are sent to the mobile operator, and the response is captured by the onReceiveUssdResponse method. The response, which may include account balances or other operator-related information, is then forwarded to the C2 server.<\/p>\n
The malware uses this method to determine if an active SIM card is present and, if so, sends the USSD response to the attacker\u2019s desired number via the vvvvvvvv4_ method.<\/p>\n
<\/p>\nHow to Deal with and Clean the System<\/h2>\n
- allping<\/span>: Collects comprehensive data about the device\u2019s status.<\/li>\n
- oneping<\/span>: Sends basic information about the victim\u2019s phone, such as the model, Android ID, installed apps list, received bank messages, contacts, etc.<\/li>\n
- The malware\u2019s phishing page URL (https:\/\/ikdplc.org\/c\/app.php<\/span>).<\/li>\n