An advertising dropper in Google Play
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | abcdserver.com | rvers. 1 2 3 4 5 6 7 8 9 { "hs" : { "server" : "https://abc.abcdserver[.]com:8888" , "default" : "https://bcd.abcdserver[.]com:9240" , |
| md5 | 10573004477fb4a405d41d6ee4dbdd64 | 05f82632f45ad51226720a45b5 9d6439756af0686974ac9f920d56dd39 10573004477fb4a405d41d6ee4dbdd64 e8d361827438873ae27ac5200f3f91be 85c96e359dd48bb814e2ddf34b |
| md5 | 170646ee90094db9516ca4a054bf2804 | d8e711fd12a6127455afe98e85 3e3db74a1ee8da53f05b61dde65a95b3 170646ee90094db9516ca4a054bf2804 da953233a618570336e2e5ddd6464e67 c69a2d2b0bf67265590c9be65c |
| md5 | 1807f8d8e711fd12a6127455afe98e85 | 4f18d963f0320d8ddee98a9fd0 44196cbce4e57e60443a9c19281e532f 1807f8d8e711fd12a6127455afe98e85 3e3db74a1ee8da53f05b61dde65a95b3 170646ee90094db9516ca4a054 |
| md5 | 19c6604f18d963f0320d8ddee98a9fd0 | ce2ff503a27cb9c1617e9a2583 bcbf463050a0706b008e21a846b3185e 19c6604f18d963f0320d8ddee98a9fd0 44196cbce4e57e60443a9c19281e532f 1807f8d8e711fd12a6127455af |
| md5 | 2087986583416f45ae411ebd8c5db8aa | f1d96fae53d3986b985d787b59 9fbc7c3c3326bfc710f9b079766cf85c 2087986583416f45ae411ebd8c5db8aa a1b3551ec1dcdce7ac2655994697a02d d0ae4282d629518458fb5ca765 |
| md5 | 2e9eef8b88bf942e416ed244a427d20c | 82d629518458fb5ca765627a71 d28ec38edda65324299fc0dcddca9740 2e9eef8b88bf942e416ed244a427d20c 45fac5ad7be24f5110c5e77c2a7a42f6 5d52373b32cbcfdfb25dd20d26 |
| md5 | 3d37fbbffc45b7ca11e20ed06cc2f0f6 | 17e9e469921652ad33f87d7c22 dbb53ee8229cf4e8ae569a443bcd59d3 3d37fbbffc45b7ca11e20ed06cc2f0f6 ec11fb61eababc7586e1874c92f7629e b5c7b67e9650bf819b70d2c0a5 |
| md5 | 3e3db74a1ee8da53f05b61dde65a95b3 | bce4e57e60443a9c19281e532f 1807f8d8e711fd12a6127455afe98e85 3e3db74a1ee8da53f05b61dde65a95b3 170646ee90094db9516ca4a054bf2804 da953233a618570336e2e5ddd6 |
| md5 | 44196cbce4e57e60443a9c19281e532f | 3050a0706b008e21a846b3185e 19c6604f18d963f0320d8ddee98a9fd0 44196cbce4e57e60443a9c19281e532f 1807f8d8e711fd12a6127455afe98e85 3e3db74a1ee8da53f05b61dde6 |
| md5 | 45fac5ad7be24f5110c5e77c2a7a42f6 | 8edda65324299fc0dcddca9740 2e9eef8b88bf942e416ed244a427d20c 45fac5ad7be24f5110c5e77c2a7a42f6 5d52373b32cbcfdfb25dd20d267b5186 66db48ce2ff503a27cb9c1617e |
| md5 | 5bf2d280557e426e90c086fb89dc401f | 44952ca199d292570ff6da5e8f 9eff49dc969eea829e984bad34b7225c 5bf2d280557e426e90c086fb89dc401f e7705517e9e469921652ad33f87d7c22 dbb53ee8229cf4e8ae569a443b |
| md5 | 5d52373b32cbcfdfb25dd20d267b5186 | 8b88bf942e416ed244a427d20c 45fac5ad7be24f5110c5e77c2a7a42f6 5d52373b32cbcfdfb25dd20d267b5186 66db48ce2ff503a27cb9c1617e9a2583 bcbf463050a0706b008e21a846 |
| md5 | 66db48ce2ff503a27cb9c1617e9a2583 | ad7be24f5110c5e77c2a7a42f6 5d52373b32cbcfdfb25dd20d267b5186 66db48ce2ff503a27cb9c1617e9a2583 bcbf463050a0706b008e21a846b3185e 19c6604f18d963f0320d8ddee9 |
| md5 | 7186f405f82632f45ad51226720a45b5 | b8fdfb152f566723112b0fc7c8 d3ccb1b4feea5fee623fad5c5948b09b 7186f405f82632f45ad51226720a45b5 9d6439756af0686974ac9f920d56dd39 10573004477fb4a405d41d6ee4 |
| md5 | 74709014aa553b92fe079cf8941d64f6 | 903cb78babac78f0dd789d262e a02811248a0d316a1f99d07e60aa808e 74709014aa553b92fe079cf8941d64f6 f8b8fd44952ca199d292570ff6da5e8f 9eff49dc969eea829e984bad34 |
| md5 | 7b7064d3876fc3cb1b3593e3c173a1a2 | eir mobile account by charging paid subscriptions. IOCs MD5 7b7064d3876fc3cb1b3593e3c173a1a2 b6656bb8fdfb152f566723112b0fc7c8 d3ccb1b4feea5fee623fad5c59 |
| md5 | 85c96e359dd48bb814e2ddf34bc964fa | 04477fb4a405d41d6ee4dbdd64 e8d361827438873ae27ac5200f3f91be 85c96e359dd48bb814e2ddf34bc964fa cdf045f1d96fae53d3986b985d787b59 9fbc7c3c3326bfc710f9b07976 |
| md5 | 96db624fa2532d14dd43c7ad3124c385 | 33a618570336e2e5ddd6464e67 c69a2d2b0bf67265590c9be65cd4286b 96db624fa2532d14dd43c7ad3124c385 d07846903cb78babac78f0dd789d262e a02811248a0d316a1f99d07e60 |
| md5 | 9d6439756af0686974ac9f920d56dd39 | b4feea5fee623fad5c5948b09b 7186f405f82632f45ad51226720a45b5 9d6439756af0686974ac9f920d56dd39 10573004477fb4a405d41d6ee4dbdd64 e8d361827438873ae27ac5200f |
| md5 | 9eff49dc969eea829e984bad34b7225c | 14aa553b92fe079cf8941d64f6 f8b8fd44952ca199d292570ff6da5e8f 9eff49dc969eea829e984bad34b7225c 5bf2d280557e426e90c086fb89dc401f e7705517e9e469921652ad33f8 |
| md5 | 9fbc7c3c3326bfc710f9b079766cf85c | 359dd48bb814e2ddf34bc964fa cdf045f1d96fae53d3986b985d787b59 9fbc7c3c3326bfc710f9b079766cf85c 2087986583416f45ae411ebd8c5db8aa a1b3551ec1dcdce7ac26559946 |
| md5 | a02811248a0d316a1f99d07e60aa808e | 4fa2532d14dd43c7ad3124c385 d07846903cb78babac78f0dd789d262e a02811248a0d316a1f99d07e60aa808e 74709014aa553b92fe079cf8941d64f6 f8b8fd44952ca199d292570ff6 |
| md5 | a1b3551ec1dcdce7ac2655994697a02d | 3c3326bfc710f9b079766cf85c 2087986583416f45ae411ebd8c5db8aa a1b3551ec1dcdce7ac2655994697a02d d0ae4282d629518458fb5ca765627a71 d28ec38edda65324299fc0dcdd |
| md5 | b5c7b67e9650bf819b70d2c0a5ca7c63 | bffc45b7ca11e20ed06cc2f0f6 ec11fb61eababc7586e1874c92f7629e b5c7b67e9650bf819b70d2c0a5ca7c63 7b7064d3876fc3cb1b3593e3c173a1a2 b6656bb8fdfb152f566723112b |
| md5 | b6656bb8fdfb152f566723112b0fc7c8 | id subscriptions. IOCs MD5 7b7064d3876fc3cb1b3593e3c173a1a2 b6656bb8fdfb152f566723112b0fc7c8 d3ccb1b4feea5fee623fad5c5948b09b 7186f405f82632f45ad5122672 |
| md5 | bcbf463050a0706b008e21a846b3185e | 3b32cbcfdfb25dd20d267b5186 66db48ce2ff503a27cb9c1617e9a2583 bcbf463050a0706b008e21a846b3185e 19c6604f18d963f0320d8ddee98a9fd0 44196cbce4e57e60443a9c1928 |
| md5 | c69a2d2b0bf67265590c9be65cd4286b | ee90094db9516ca4a054bf2804 da953233a618570336e2e5ddd6464e67 c69a2d2b0bf67265590c9be65cd4286b 96db624fa2532d14dd43c7ad3124c385 d07846903cb78babac78f0dd78 |
| md5 | cdf045f1d96fae53d3986b985d787b59 | 827438873ae27ac5200f3f91be 85c96e359dd48bb814e2ddf34bc964fa cdf045f1d96fae53d3986b985d787b59 9fbc7c3c3326bfc710f9b079766cf85c 2087986583416f45ae411ebd8c |
| md5 | d07846903cb78babac78f0dd789d262e | 2b0bf67265590c9be65cd4286b 96db624fa2532d14dd43c7ad3124c385 d07846903cb78babac78f0dd789d262e a02811248a0d316a1f99d07e60aa808e 74709014aa553b92fe079cf894 |
| md5 | d0ae4282d629518458fb5ca765627a71 | 6583416f45ae411ebd8c5db8aa a1b3551ec1dcdce7ac2655994697a02d d0ae4282d629518458fb5ca765627a71 d28ec38edda65324299fc0dcddca9740 2e9eef8b88bf942e416ed244a4 |
| md5 | d28ec38edda65324299fc0dcddca9740 | 1ec1dcdce7ac2655994697a02d d0ae4282d629518458fb5ca765627a71 d28ec38edda65324299fc0dcddca9740 2e9eef8b88bf942e416ed244a427d20c 45fac5ad7be24f5110c5e77c2a |
| md5 | d3ccb1b4feea5fee623fad5c5948b09b | d3876fc3cb1b3593e3c173a1a2 b6656bb8fdfb152f566723112b0fc7c8 d3ccb1b4feea5fee623fad5c5948b09b 7186f405f82632f45ad51226720a45b5 9d6439756af0686974ac9f920d |
| md5 | da953233a618570336e2e5ddd6464e67 | 4a1ee8da53f05b61dde65a95b3 170646ee90094db9516ca4a054bf2804 da953233a618570336e2e5ddd6464e67 c69a2d2b0bf67265590c9be65cd4286b 96db624fa2532d14dd43c7ad31 |
| md5 | dbb53ee8229cf4e8ae569a443bcd59d3 | 80557e426e90c086fb89dc401f e7705517e9e469921652ad33f87d7c22 dbb53ee8229cf4e8ae569a443bcd59d3 3d37fbbffc45b7ca11e20ed06cc2f0f6 ec11fb61eababc7586e1874c92 |
| md5 | e7705517e9e469921652ad33f87d7c22 | dc969eea829e984bad34b7225c 5bf2d280557e426e90c086fb89dc401f e7705517e9e469921652ad33f87d7c22 dbb53ee8229cf4e8ae569a443bcd59d3 3d37fbbffc45b7ca11e20ed06c |
| md5 | e8d361827438873ae27ac5200f3f91be | 756af0686974ac9f920d56dd39 10573004477fb4a405d41d6ee4dbdd64 e8d361827438873ae27ac5200f3f91be 85c96e359dd48bb814e2ddf34bc964fa cdf045f1d96fae53d3986b985d |
| md5 | ec11fb61eababc7586e1874c92f7629e | e8229cf4e8ae569a443bcd59d3 3d37fbbffc45b7ca11e20ed06cc2f0f6 ec11fb61eababc7586e1874c92f7629e b5c7b67e9650bf819b70d2c0a5ca7c63 7b7064d3876fc3cb1b3593e3c1 |
| md5 | f8b8fd44952ca199d292570ff6da5e8f | 248a0d316a1f99d07e60aa808e 74709014aa553b92fe079cf8941d64f6 f8b8fd44952ca199d292570ff6da5e8f 9eff49dc969eea829e984bad34b7225c 5bf2d280557e426e90c086fb89 |
Full article470 words · extracted from securelist.com · click to collapse
27 Aug 2019
minute read
Recently, the popular CamScanner – Phone PDF creator app caught our attention. According to Google Play, it has been installed more than 100 million times. The developers position it as a solution for scanning and managing digitized documents, but negative user reviews that have been left over the past month have indicated the presence of unwanted features.
After analyzing the app, we saw an advertising library in it that contains a malicious dropper component. Previously, a similar module was often found in preinstalled malware on Chinese-made smartphones. It can be assumed that the reason why this malware was added was the app developers’ partnership with an unscrupulous advertiser.
Kaspersky solutions detect this malicious component as Trojan-Dropper.AndroidOS.Necro.n. We reported to Google company about our findings, and the app was promptly removed from the Google Play.
Technical details about Necro.n
When the app is run, dropper decrypts and executes the malicious code contained in the mutter.zip file in the app resources.
Next, the configuration file with the name “comparison” is decrypted.
Once we decrypt it, we obtain the following configuration with the addresses of the attackers’ servers.
|
1 2 3 4 5 6 7 8 9 |
{ "hs":{ "server":"https://abc.abcdserver[.]com:8888", "default":"https://bcd.abcdserver[.]com:9240", "dataevent":"http://cba.abcdserver[.]com:8888", "PluginServer":"https://bcd.abcdserver[.]com:9240" }, …. } |
Dropper downloads an additional module from these URLs:
And then it executes its code:
The above-described Trojan-Dropper.AndroidOS.Necro.n functions carry out the main task of the malware: to download and launch a payload from malicious servers. As a result, the owners of the module can use an infected device to their benefit in any way they see fit, from showing the victim intrusive advertising to stealing money from their mobile account by charging paid subscriptions.
IOCs
MD5
- 7b7064d3876fc3cb1b3593e3c173a1a2
- b6656bb8fdfb152f566723112b0fc7c8
- d3ccb1b4feea5fee623fad5c5948b09b
- 7186f405f82632f45ad51226720a45b5
- 9d6439756af0686974ac9f920d56dd39
- 10573004477fb4a405d41d6ee4dbdd64
- e8d361827438873ae27ac5200f3f91be
- 85c96e359dd48bb814e2ddf34bc964fa
- cdf045f1d96fae53d3986b985d787b59
- 9fbc7c3c3326bfc710f9b079766cf85c
- 2087986583416f45ae411ebd8c5db8aa
- a1b3551ec1dcdce7ac2655994697a02d
- d0ae4282d629518458fb5ca765627a71
- d28ec38edda65324299fc0dcddca9740
- 2e9eef8b88bf942e416ed244a427d20c
- 45fac5ad7be24f5110c5e77c2a7a42f6
- 5d52373b32cbcfdfb25dd20d267b5186
- 66db48ce2ff503a27cb9c1617e9a2583
- bcbf463050a0706b008e21a846b3185e
- 19c6604f18d963f0320d8ddee98a9fd0
- 44196cbce4e57e60443a9c19281e532f
- 1807f8d8e711fd12a6127455afe98e85
- 3e3db74a1ee8da53f05b61dde65a95b3
- 170646ee90094db9516ca4a054bf2804
- da953233a618570336e2e5ddd6464e67
- c69a2d2b0bf67265590c9be65cd4286b
- 96db624fa2532d14dd43c7ad3124c385
- d07846903cb78babac78f0dd789d262e
- a02811248a0d316a1f99d07e60aa808e
- 74709014aa553b92fe079cf8941d64f6
- f8b8fd44952ca199d292570ff6da5e8f
- 9eff49dc969eea829e984bad34b7225c
- 5bf2d280557e426e90c086fb89dc401f
- e7705517e9e469921652ad33f87d7c22
- dbb53ee8229cf4e8ae569a443bcd59d3
- 3d37fbbffc45b7ca11e20ed06cc2f0f6
- ec11fb61eababc7586e1874c92f7629e
- b5c7b67e9650bf819b70d2c0a5ca7c63
- 7b7064d3876fc3cb1b3593e3c173a1a2
- b6656bb8fdfb152f566723112b0fc7c8
- d3ccb1b4feea5fee623fad5c5948b09b
- 7186f405f82632f45ad51226720a45b5
- 9d6439756af0686974ac9f920d56dd39
- 10573004477fb4a405d41d6ee4dbdd64
- e8d361827438873ae27ac5200f3f91be
- 85c96e359dd48bb814e2ddf34bc964fa
- cdf045f1d96fae53d3986b985d787b59
- 9fbc7c3c3326bfc710f9b079766cf85c
- 2087986583416f45ae411ebd8c5db8aa
- a1b3551ec1dcdce7ac2655994697a02d
- d0ae4282d629518458fb5ca765627a71
- d28ec38edda65324299fc0dcddca9740
- 2e9eef8b88bf942e416ed244a427d20c
- 45fac5ad7be24f5110c5e77c2a7a42f6
- 5d52373b32cbcfdfb25dd20d267b5186
- 66db48ce2ff503a27cb9c1617e9a2583
- bcbf463050a0706b008e21a846b3185e
- 19c6604f18d963f0320d8ddee98a9fd0
- 44196cbce4e57e60443a9c19281e532f
- 1807f8d8e711fd12a6127455afe98e85
- 3e3db74a1ee8da53f05b61dde65a95b3
- 170646ee90094db9516ca4a054bf2804
- da953233a618570336e2e5ddd6464e67
- c69a2d2b0bf67265590c9be65cd4286b
C&C
- https://abc.abcdserver[.]com:8888
- https://bcd.abcdserver[.]com:9240
- http://cba.abcdserver[.]com:8888
- https://bcd.abcdserver[.]com:9240
Latest Webinars
Reports
Kaspersky researchers have discovered new Mirage Kitten attacks using previously undocumented malware families: NodeRabbit in Node.js and PollCat in JavaScript.
Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.
Kaspersky experts break down a new Armored Likho campaign that poses as a fundraising efforts and delivers a new Still Toolkit aimed at stealing Telegram data and eavesdropping on victims.
Kaspersky researchers reveal previously undocumented malware attributed to Mirage Kitten (UNC1549, Smoke Sandstorm, Nimbus Manticore): NightLedger backdoor, ArcBridge, and BridgeHead tunneling tools.
Text extracted automatically; images, tables and formatting may be missing. Original: https://securelist.com/dropper-in-google-play/92496/