# MA-790.072020: MyCERT Alert - SMSSpy using Malaysian Law Enforecement as theme

**Date:** 10 Jul 2020  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-790.072020  
**Advisory ID:** MA-790.072020

---

**1.0 Introduction**
MyCERT observed a malicious android application that is leveraging on Law Enforcement Agency theme.  The application is disguising as a mobile antivirus and as an application that tests mobile signal for Malaysian users purportedly created by a trusted organization, Royal Malaysian Police (PDRM).
**2.0 Impact**
Android version from Froyo (8.0) and below.
**3.0 Affected System and Devices**
Disclosure of personal information to scammers or unknown parties may increase similar scamming campaigns in future.
**4.0 Techniques, Tactics and Procedures**
The malware is similar to a malware dubbed as SMSSpy. The variant appears to be fake mobile applications that intercept received SMS messages and forward them to a remote site. The spyware collects all contacts including contact name, phone number, email address, street address, organization. The malware is also capable of modifying the contact data. It also capture SMS inbox content probably with intention to retrieve any TAC numbers sent through SMS as it is able to send and received SMS/MMS.
We retrieved the sample of malware through a URL: **hxxp://app.0189110.com**Figure 1: The website that hosted the malicious apk*
The website can only be view from mobile device as there is a javascript code that will redirect the website to Interpol legitimate website, *“https://www.interpol.int/”* if viewed using desktop internet browsers.
*Figure 2: Javascript that allows mobile view only*
The buttons in Figure 1 both links to downloadable link provided below to begin downloading the malicious apk that uses PDRM.apk as app name.
hxxps://app.0189110.com/PDRM-MY.apk
*Figure 3: Malicious APK installed in application drawer*
Once the user executes the application, it will automatically request for permission to use the malicious application as SMS application as shown in figure 4 below.
| --- |  |
*Figure 4: Permission to change SMS app*
If the user allows these changes, the application will then connects to its C2 from the URL  hxxp://vip.0109101.com:2052/WebMobileD1//phoneajax/index.do that sends the application logs kept in SQLite Database.
*Figure 5: Code snippet sending to C2*
The malware capabilities are listed as below:
1. Receive Mms
2. Write External Storage
3. Receive Boot Complete
4. Access Coarse Location
5. Read Phone State
6. Read Sms
7. Write Sms
8. Internet
9. Receive Sms
10. Modify Audio Settings
11. Vibrate
12. Read Contacts
13. Write Contacts
14. Access Network State
15. Process Outgoing Calls
16. Send Sms
17. Access Fine Location
18. Access Wifi State
19. Change Wifi State
20. Write Settings
21. Read External Storage
22. Read Call Log
23. Write Call Log
The Chinese characters in the codes suggest that  the actor might be from China origin. Further investigation of the C2 address, it seems that it is pointing to China Banking Regulatory Commission phishing website which indicates China is targeted too.
| --- |  |
*Figure 6: China Banking Regulatory Comission phishing website*
Previously, there was another malicious APK that disguise as the same entity and can be reffered to our advisory in the link provided below:
[MA-690.122017: MyCERT Alert - Fake PDRM Malicious APK](https://www.mycert.org.my/portal/advisory?id=MA-690.122017)
Below is the techniques used being map according to Mobile Mitre ATT&CK.
*FIrgure 7: Mobile Mitre Att&CK*5.0 Indicator of CompromisedURL**
- hxxp://app.0189110.com/
- hxxp://vip.0109101.com:2052/WebMobileD1
- hxxp://vip.0109101.com:2052/webmobiled1/phoneajax/index.do
- hxxp://vip.0109101.com/d2
- hxxp://vip.0109101.com/d2/BANK.php
**Domains**
- app.0189110.com
- vip.0109101.com
**IP Address**
- 104.31.92.196
- 104.18.37.4
**Hashes**
- 5a7dce8fd26a263ca25644fe7058c284
**6.0 Conclusion**
The application is meant to retrieve information in victim’s phone and could be used for other malicious purpose. Although the C2 is pointing to China’s banking phishing website, it is possible that the actors are going to design Malaysian banking website to be used together with the malicious application.
**7.0 Recommendations**
As CERT, we would highly recommend the followings:
- Verify an application permission and the application author or publisher before installing it.
- Avoid side loading (installing from non-official sources) when you can. If you do install Android software from a source other than the Market, be sure that it is coming from a reputable source.
- Do not click on adware or suspicious URL sent through SMS/messaging services.
- Malicious program could be attached to collect user's information.
- Always run a reputable anti-virus on your smartphone/mobile devices, and keep it up to date regularly.
- Update the operating system and applications on smartphone/tablet, including the browser, in order to avoid any malicious exploits of security holes in out-dates versions.
- Do not root or 'Jailbreak' your phone.
- Contact relevant authorities such as Cyber999 for any inquiries and assistance needed 
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. https://unit42.paloaltonetworks.com/unit42-spydealer-android-trojan-spying-40-apps/
2. https://www.hybrid-analysis.com/sample/15931b5c49e456fde13f7b1c952e769a92fbb6fa60c54533a0fb9c9f5bcff0a9?environmentId=200
3. https://www.f-secure.com/v-descs/trojan\_android\_smsspy.shtml
4. https://www.hybrid-analysis.com/sample/310170f7cf8119630c9bb660f3acb28a5135520b6b318ceb6a19ada822f64808
5. https://www.virustotal.com/gui/file/310170f7cf8119630c9bb660f3acb28a5135520b6b318ceb6a19ada822f64808/details