# MA-788.062020: MyCERT Alert - Malicious Android APK theme Covid-19 targeting Malaysia users

**Date:** 25 Jun 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-788.062020  
**Advisory ID:** MA-788.062020

---

**1.0 Introduction**
Amidst Movement Control Order to contain the spread of COVID-19, new malware campaign that are targeting Malaysia internet user has emerged. Taking advantage proliferation of new patient tracking and COVID-19 latest information app for internet user, Mobile Lab, CTRC, MyCERT discovered new malware campaign that have complex and sophisticated functionality such as information harvesting, automation, dropper and remote access capabilities.
During our analysis on this malware, we discover that this malware has set of functionalities that harm and devastating to the victims. This StayAtHome Android malware makes extensive use of its services to exfiltrate information it requires, extending its capabilities by downloading and dynamically load additional binary during runtime, compromising user privacy by collecting credential, personal information and track user activities. This malware will communicate with its Command and Control (C2) Server for information exchange and downloading additional Android executable. All data and communication are encoded and encrypted even though via HTTP.
With this set of capabilities, we believe that this malware could be used as banking trojan for financial gain and spyware for corporate espionage. Furthermore, MyCERT have received incident from financial institution that their customer has been affected by this malware, resulting in financial lost.
Every release version of the malware appears in a very limited time as it has been detected or taken down by other authority agency during its campaign. MyCERT data indicate that this malware is still being actively deployed and has been used widely, not only effecting Malaysian Android Smartphone user but globally, which came from same threat actor.
MyCERT is providing, with this report Indicator of Compromise (IOC) from malware sample we collected and provide in-depth technical details and analysis of this malware behaviour and capabilities that would allow other security analyst understand this malware variant in the wild.
**2.0 Impact**
Observation from this malware sample, we identified that this malware variant has cause severe impact toward the victims such as:
- Account compromise.
- Continuation of the campaign towards new victims through information stolen from infected device.
- Data exfiltration.
- Illegally use of victim’s premium-charge calls and sending paid SMS.
- Possible lateral movement in the network.
- Steals sensitive information and credential from infected devices.
- Violation on victim’s privacy.
**3.0 Affected System and Devices**
This malware is compiled to be run and executed in Android devices. Affected Android API level is:
- Android 10 - API level 29
- Android 9.0 Pie - API level 28
- Android 8.1 Oreo - API level 27
- Android 8.0 Oreo - API level 26
- Android 7.1 Nougat - API level 25
- Android 7.0 Nougat - API level 24
- Android 6.0 Marshmallow - API level 23
- Android 5.1 Lollipop - API level 22
- Android 5.0 Lollipop - API level 21
**4.0 Malicious Functionality**
- Acquiring Device Administrator privileges.
- Block attempt to disable the application.
- Built in capabilities of Mobile Remote Administration Tool (MRAT).
- Bypass and disable Google Play Protect.
- Collect and upload all application information to C2 server.
- Collect and upload contact information from victims’ devices.
- Collect and upload device information to C2 server.
- Collect and upload file to C2 server.
- Collect and upload SMS and call log to C2 server.
- Dynamically compile, download and load additional module and binary.
- Execute remote command from C2 server controlled by threat actor.
- Hide its application icon.
- Intercept incoming SMS and Call to C2 server.
- Keylogging.
- Maintaining persistence.
- Record audio.
- Record user activity.
- Send SMS and forwarding call.
- Steal and intercept user account credential using different type of payload.
- Steal lock pattern.
**5.0 Behavioral Analysis**
When the malicious application is downloaded and installed on device, it is required to be started by the victim. In the background, the malware is dynamically load a DEX binary to extend its capabilities.
Figure 1: Logcat output indicating additional DEX binary is being compile during runtime.
During analysis, this GCayL.json is embedded in parent APK file and it will be compiled to a DEX file during runtime execution.
Once the app is executed by the victims, it will request user to enable this malware a feature from Accessibility setting to enable the malware to monitor activity on the device and it window content displayed to the victim.
Figure 2: the malware start activity followed by functionality it requested from Accessibility settings.
After the settings has been allowed by victims, it will automatically close the setting activity and block any user attempt to disable this feature from Accessibility settings automatically by closing the settings window.
Meanwhile, the application is hiding its icon and requesting any necessary permission it require to have more functionality during runtime.
Figure 3: Permission requested by the malware during runtime.
This permission is required for the malware to have full functionality during its runtime. This enable all malicious activity to be successfully executed or the malware will encounter any error during its execution cycle.
While this is happening, the malware will register itself to its C2 server and sending initial communication and information about infected device to its C2 server.
Figure 4: Logcat output shows a JSON string that is to be sent to C2 server.
Next the malware will request for Device Administrator functionality to be enable. This request dialog message will only popup of few second and the permission is granted automatically by the malware through auto-click features.
Figure 5: The malware requesting Device Administrator and the logcat output from the event.
After these features is enable, the malware is downloading additional binary from C2 server to extend the capabilities of this malware. The binary is an APK file named as ring0.apk that will be compiled and loaded to its parent application.
Figure 6: Logcat output show ring0.apk is being compile.
After this is completed, the malicious application will be running continuously on the infected devices to performed its malicious activity in the background and waiting any command from threat actor C2 server.
**6.0 Application Static Analysis6.1 Application module**
This malware variant has 3 separate module that is loaded and executed in different time during runtime. First module is the parent APK package of the malware. This is the Android package downloaded and installed by the victims.
Second module is compiled together in parent APK package and usually named with JSON file extension to hide this binary. This binary will be compiled and dynamically loaded to the parent application during runtime. This executable is the main module of the malware itself. To analyse this binary, it is located under /data/data/package.name/app\_DynamicOptDex. Rename the file extension of the JSON file to a DEX file.
Third module is binary downloaded from its C2 server and is name as ring0.apk. This is the additional module to the current executable that already in the execution cycle.
Figure 7: Logcat output indicating the malware downloading additional module
Second and third module can be retrieved in it package data directory. Structure tree of the malware data folder is as in figure 8.
Figure 8: Folder structure of the malware data directory.
**6.2 Mobile Remote Administration Tools (MRAT)**
This malware is built with very comprehensive and sophisticated features. Among that features that stand out is its ability to execute command and remotely accessible by the threat actor. Its main module has the ability to control TeamViewer on command in infected device.
Figure 9: Snippet of code that allows the threat actor run TeamViewer in infected device.
This malware has built-in tools that allow the threat actor to execute command from its C2 server to interact with device environment without using TeamViewer. Functionality of the MRAT is as follow:
- Call forwarding and send SMS.
- Collect call logs and SMS in inbox.
- Configure and execute TeamViewer app.
- Execute specific application or remove an application.
- Get list of installed application, contact information.
- Grab device lock pattern through a payload that show fake lock window.
- Grab Google Authentication 2 factor authentication code.
- Grab victims account credential through a payload that show fake Gmail login page.
- Patching the malware.
- Record audio file.
- Request all permission the malware require.
- Send device settings.
- Traverse device storage.
- Unlock device.
- Update new URL and C2 domain.
- Upload file.
Figure 10: Fake HTML login page to steal victims account information.
Figure 11: Code snippet that able the malware to grab lock pattern
Figure 12: Logcat output generate by the malware to collect installed application package name
Figure 13: part of the code to open a folder in device storage if it receives command from threat actor.
**6.3 Record screen activity**
This malware can listen to incoming notification and specific application can trigger it screen recording functionality.
Figure 14: This code snippet shows that notification from Whatsapp can trigger screen recording.
**6.4 Record audio in background**
One of the spying capabilities of this malware toward its victims is it is able to record audio in background. This capability is activated by command given by the threat actor.
Figure 15: This code snippet shows this malware capable to record audio.
**6.5 Collecting, intercepting and sent SMS, call and contact information.**
With proper and approved permission as default messaging app, this malware capable of collecting and intercepting victims SMS and call logs. This information is periodically collected and send to its C2 server.
Figure 16: Snippet of code indicating parsing function to collect SMS messages.
This malware is also capable of sending SMS messages, make a call and forwarding call using USSD code. Using USSD code allows threat actor to quickly forward the call using special code. This activity is hidden from victim’s knowledge and this incurs premium charges to victims from telco service provider.
Figure 17: Snippet of code where to make call, call forwarding and sending SMS.
The malware capable to parse infected device contact list to get victims contact information, this information will be sent to its C2 server or to perform activity for such as sending SMS or to make a call.
Figure 18: Code snippet show the malware contact information parsing function.
**6.6 Dynamically download, load additional module and binary**
This malware utilizes DexClassLoader class to dynamically load an APK or DEX file that are not part of installed application during runtime execution. This allow this malware to expand and extending it functionality.
Figure 19: DexClassLoader class implemented in parent application.
Figure 20: DexClassLoader class implemented in main module to load ring0.apk.
Additional to this feature, this malware has capability to download additional module from its C2 server. During this malware runtime, it will download and loading additional APK file which is ring0.apk.
Figure 21: Logcat output and code functionality to download additional APK or DEX file.
**6.7 Encryption and obfuscation**
This malware implements anti reverse engineering mechanisms such as obfuscation, encoding and encryption on its communication with C2 server, all the output and its source code to hide its functionality and capabilities. Static analysis on its parent APK file does not provide much valuable information about its capabilities, because the main module is dynamically loaded during runtime which contains most of its malicious functionality. Every string literal and payload is encrypted using symmetrical encryption and encoded using Base64 and hexadecimal. Recovering its secret key and reversing its encryption function allow the researcher to reconstruct its function and identify its capability.
Figure 22: Code snippet shows comparison between original encrypted source code and after it has been decrypted.
Figure 23: Encrypted communication send by this malware to its C2 server.
**6.8 Disabling Google Play Protect Service**
Google Play Protect is Android built-in malware detection and defence that come with Google Play Service. By utilizing Accessibility settings, this malware is capable to disable Google Play Protect service to avoid detection.
Figure 24: Snippet of code that allow this malware to disable Google Play Protect services.
**6.9 Device administrator capabilities**
This malware has capabilities to activate device administrator to be granted to itself. This request dialog is showed for a while and granted with auto-click. When this malware is allowed to have device administrator privileges, it can control screen locks and remotely erase phone’s data without acknowledging the victims.
Figure 25: Device admin features and permission requested by the malware.
**6.10 Grabbing victims banking credentials**
This malware capable of grabbing victims’ financial credential through its phishing payload. Figure 28 show the database structure for information that will be save to this database.
Figure 26: Tables in the database from phishing payload in the malware.
Figure 27: Table structures from one of the database tables.
**7.0 Indicator of Compromise (IOC)
7.1 Application icon and name of the application**
Figure 28: Example of the icon and application name used by the malware
**7.2 Permission requires by the malware**
Figure 29: Permission require by the malware
**7.3 Collection of binary signatures by package name**
|  | --- | --- | File name | didazb.zzfkkagaqqzxl.sjalofqempuglocpj.apk | MD5 | 9c4c5035012b3b8a88d8bbe5a2f94baa | SHA1 | 06f0328d713ae4593b4563ba3d1cff66661ea37e | SHA256 | 84638c9b4302fef17ad9415bcd95029b1ea7db15a31082ec82aa063c097b7f25 |  |
| --- | --- | File name | faixrsobkxahh.ejikbxiafxpwmhrcwnhwgjt.ssnwdiykoiexagzdgyryadgmbma.apk | MD5 | b61c8f5157a38a1b40b4294be3e8cb29 | SHA1 | 7e10f666db9ecc143f4aa53ec39e5ce6b2bbe793 | SHA256 | b7cb5ae55f339bafc95c0b69bfb7ac46a71f2df1d3f457abf94659b67829a583 |  |
| --- | --- | File name | iacwbhsjeilmwqpkwlupjwgh.pqbfwodsumdmomlophymwhtr.anmfsglmitufcragdhjom.apk | MD5 | 548bae857891cc7e578031922def6c5a | SHA1 | c7f7499262d4619a7dbf03b480883793f9fe4b6f | SHA256 | 8e36e5f1de62ec48bbdf8eeca4e2ab65c186d4978f1cd715611e06b16aa3fc34 |  |
| --- | --- | File name | linsxobdgkiizpisy.gzmbxztaaaejxf.oyipejwfhczlhkpcgqsj.apk | MD5 | 8ff52a49b6efc41c5bd3f77c406297f3 | SHA1 | 5f7e1f00eef53c3654b406bc097094d4a2727469 | SHA256 | 4a21ec52a544e3b77ed0ddb5dea5f5fac91714a4aa0a40396cc85663d4e15444 |  |
| --- | --- | File name | ring0.dex | MD5 | 1974bd3c5efbe76fbfe58664c0906fa9 | SHA1 | ed068afc2d41bed7c6e5f4a6f380431babd43a00 | SHA256 | 13dcb880e3263363acef3c772178257490fe08ab31bc03e949bb8d4bad73d3f4 |  |
| --- | --- | File name | ring0.apk | MD5 | e1dab20d26cad225b29c715f24ce0594 | SHA1 | 95275d4b4f3fe820283cf522f7379629fd150d49 | SHA256 | 2a63fa5630774ab652f0f1338d7c251cf74e615d6d52452d027d2e38f53b96c7 |  |
| --- | --- | File name | 20GBGift.apk | MD5 | 69efe778721dcd66bbd7ed1eaf2ae116 | SHA1 | 486302fd8dee7ad3b1f068e3143edfa603ae54c6 | SHA256 | 5386abd90497dc0b97537ae585addfa1772b10cd4353e41b413e90eb07a145fe |  |
| --- | --- | File name | baFXrX.dex | MD5 | 097f4b26211d6d50c3635147168710d2 | SHA1 | 60895094b942c46926df2ca20b175f073b331552 | SHA256 | 7aac3e2b9a9a044e54f8e1c0998ad48a4cc2fe9e6246a66d8f334d243bbe9523 |  |
| --- | --- | File name | GCayL.dex | MD5 | 4ab5a95e8443dd5a98bccff50a49d0cc | SHA1 | a8c709ff95ba07d79c4b61b3f1f2c99e6b578958 | SHA256 | 9471fc333219acb41c7f39724aa117a6a6c771d536bd09570e06134fbdc427dd |  |
| --- | --- | File name | YMlw.dex | MD5 | 086aa916e3de9133415dab0075deeced | SHA1 | c88487090bbf266aeac211a5aa50044ec3447785 | SHA256 | 952381377ca43239b1105a89f9d0aa7fda11f51b488fb2fe4f4ac570b7829503 |  |
| --- | --- | File name | hw.dex | MD5 | 97d31fb3c830f7a441288e1853371c07 | SHA1 | e0941fea65541fed509b25ccab37162ae3fc4857 | SHA256 | acc88ccd3e39926086c173b094dca31b9ca79f70c34cbed52ea3d24e1797aac5 |  |
| --- | --- | File name | bafXrX.json | MD5 | 98fd5e686e897007f1625ed6850127b1 | SHA1 | 6b55b2763bcf26008e004c40136e2f2fafd275f4 | SHA256 | 298ec58a1d1d1ce242e9ffb3d44bfdcac2bea1fc3fdfa87e93742771edc2d44d |  |
| --- | --- | File name | GCayL.json | MD5 | cebc0c87d6426b595a3ff5bcc9af352a | SHA1 | 1e93d8c0d68a8cc53d91b15b74ab909531637961 | SHA256 | 8a76716af58fe4dae5b4fab0c6dbbbf7ffb9f04786dfc1e64f45a46f8901f0d2 |  |
| --- | --- | File name | hw.json | MD5 | 64a9c5b43dfde507de727ba7a2346d72 | SHA1 | 8ffc913798760ca3256e9d096228cea26c8deb0e | SHA256 | 6c2461889c1387ceb7c80bb38f540ee88e651c971913528ecd818a2108135593 |  |
| --- | --- | File name | YMlw.json | MD5 | 6f67733de9ed9cd26d4f74011e0c5b74 | SHA1 | 00a3aed7d00164a61aa705d76678f70a54b13e31 | SHA256 | 01260ca05c79ab84d0750c8b2b2e6ca79f46349b2ed698ab7cbe875bc2209f87 |  |
| --- | --- | File name | PWgAR.dex | MD5 | a26286972e7ff06ffba100af1c1f8d4f | SHA1 | 7faf27c0c682c578c64405aa391c415a05279107 | SHA256 | 9153637aef23e94409e37270c1bdd907a2a5d79c83a87309e2c5f5016fa896b1 |  |
| --- | --- | File name | PWgAR.json | MD5 | 6d59408703e9eb19686fd10d349a5319 | SHA1 | 2dba2aa12f967220d124416ac5d19db7eac87dce | SHA256 | 5d9fff3e5cb62214a06493fc1b2c72494eab03cb8868d9a895e6980d4978d32e |
**7.4 Command and control server domain and IP addresses**
Details information about this malware command and control server is redacted and protected.
gladyobreic24e1s[.]top
cabel1lan4ightice2[.]top
fe2rltao23ts[.]top
ucuzplastk[.]tk
47[.]252[.]20[.]45
148[.]66[.]159[.]235
This malware is hosted at:
https://defase241.s3.eu-central-1.amazonaws[.]com
https://fewfasdfwerta.s3.eu-central-1.amazonaws[.]com/StayAtHome.apk
https://stayinghomemalaysia.s3.eu-central-1.amazonaws[.]com/StayingHomeMalaysia.apk
https://fesastatre214s.s3.eu-central-1.amazonaws[.]com
https://20gbcampaings[.]tk/APK/20GBGift.apk
**8.0 Conclusion**
MyCERT data indicate that this malware is still being actively deployed. This campaign and threat actor have evolved their operation and malicious application until now have been in several version. This might indicate that this threat actor is not an individual but operate in organization level.
Future monitoring and evidence collection are needed to help Cyber999 escalate to respective parties and stop this campaign.
**9.0 Recommendation**
- Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
- Avoid sharing your device with anybody else and restrict any access to your device.
- Avoid side loading (installing from non-official sources) when you can. If you do install Android software from a source other than the Market, be sure that it is coming from a reputable source.
- Do not click on adware or suspicious URL sent through SMS/messaging services. Malicious program could be attached to collect user's information.
- Do not root or 'Jailbreak' your phone.
- For safe keeping of your data, make sure to regularly back up your personal files and data.
- If you’re using Android smartphone, always enable Play Protect Service to secure your device from known malware.
- If your smartphone is infected with a malware, you can simply uninstall the malware from your smartphone. However, if uninstalling does not remove the malware, then you need to reinstall the Operating System of the smartphone (refer to phone manufacturer) to completely remove the malware.
- Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
- Verify application permission and the application author or publisher before installing it.
- Verify an app's permission before installing it i.e. online banking app shouldn’t require access to camera, microphone and SMS permission.
- Verify given URLs with the official financial institution or law enforcement agency website. On mobile, site URL may appear differently from desktop browser, make sure to verify it too.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>