Fakecalls Android Malware Abuses Legitimate Signing Key

Authored
by
Dexter
Shin 

McAfee
Mobile
Research
Team

found

an
Android

banking
trojan

signed
with
a

key

used
by
legitimate

apps
in
South
Korea

last
year.

By

design,

Android
requires
that
all
applications

must

be
signed
with
a

key,

in
other
words a
keystore,

so
they
can

be
installed
or
updated.

Because
this

key

can
only
be
used
by
the
developer

who

created
it,
an
application
signed
with
the
same

key

is

assumed

to

belong
to
the
same
developer.

That
is
the
case
of
this
Android

banking
trojan

that
uses
this
legitimate

signing
key

to

bypass
signature-based
detection
techniques.

And
these
banking
trojans
weren’t
distributed
on
Google
Play
or
official
app
stores
until
now.

This
threat

had
been

disclosed

to

the

company

that
owns

the
legitimate

key

last
year

and

the
company
has
taken

precautions.
The
company
has

confirmed

that

they
have
replaced

the

signing
key

and

currently,

all
their

legitimate
apps

are
signed
with
a
new

signing
key. 

Android
malware
using
a
legitimate

signing

key 

While

tracking

the
Android

banking
trojan

Fakecalls

we
found
a

sample

using
the
same

signing
key

as

a

well–known

app

in
Korea.

This
app

is
developed
by

a

reputable

IT

services

company

with

extensive

businesses

across
various
sectors,

including
but
not
limited
to
IT,

gaming,

payment,

and
advertising.

We
confirmed
that
most
of
the

malicious
samples

using
this

key

pretend
to
be
a

banking

app

as
they
use
the

same
icon
as
the
real
banking
apps. 

Figure



1.

Malware

and

legitimate
app
on
Google
Play 

Distribution
method
and
latest
status 

Domains
verified

last

August
when
we
first
discovered
the
samples
are
now
down.

However,

we
investigated
URLs
related

to

this

malware

and

we

found

similar

ones

related
to
this
threat.

Among
them,
we

identified

a

phishing
site
that

is

still
alive
during
our
research.

The
site
is
also
disguised
as
a
banking
site. 

Figure

2.

A
phishing
page
disguised
as

a

Korean

banking

site 

We
also
found
that

they
updated

the

domain
information

of
this
web
page

a
few
days
before
our
investigation. 

So

we

took
a
deeper
look
into
this

domain

and
we
found

additional

unusual
IP

addresses
that
led
us
to
the

Command
and

control(C2)

server

admin
pages

used
by
the
cybercriminals

to
control

the

infected
devices. 

Figure



3.

Fakecalls

Command
and

control(C2)

admin

pages 

How
does
it

work 

When

we
check
the

APK
file
structure,

we
can
see
that

this
malware
uses

a

packer
to
avoid
analysis
and
detection.

The
malicious
code
is
encrypted
in
one
of
the
files
below. 

Figure

4.

Tencent’s

Legu

Packer

libraries 

After
decrypting
the
DEX
file,
we
found
some
unusual
functionality.
The
code
below
gets
the
Android
package
information
from
a
file
with
a
HTML
extension. 

 Figure

5.

Questionable
code
in
the
decrypted
DEX
file 

This
file
is
in
fact
another
APK
(Android
Application)
rather
than
a
traditional
HTML
file
designed
to
be
displayed
in
a
web
browser. 

Figure

6.

APK
file
disguised
as
an
HTML

file 

When

the
user

launches

the
malware,

it

immediately

asks
for

permission
to
install

another

app.

Then

it

tries
to
install

an
application

stored
in

the

“assets”

directory

as

“introduction.html”.

The

“introduction.html”
is an

APK
file

and

real

malicious

behavior

happens
here. 

Figure

7.

Dropper asks you
to
install

the
main

payload 

When
the
dropped
payload
is
about
to
be
installed,
it
asks
for
several
permissions

to
access
sensitive
personal
information. 

Figure

8.

Permissions
required
by
the
main
malicious

application 

It
also

registers

several

services
and
receivers
to
control
notifications
from
the
device
and
to
receive
commands
from

a
remote
Command
and
Control
server. 

 Figure
9.
Services
and
receivers
registered
by
the
main
payload

By
contrast,

the
malware

uses

a
legitimate

push

SDK

to

receive

commands

from

a
remote
server.

Here
are

the

complete
list
of
commands
and

their

purpose. 

Cybercriminals
are
constantly
evolving
and
using
new
ways
to
bypass
security
checks,
such
as
abusing
legitimate
signing
keys.
Fortunately,
there
was
no
damage
to
users
due
to
this
signing
key
leak.
However,
we
recommend
that
users

install
security
software
on
their
devices
to
respond
to
these
threats.
Also,
users
are
recommended
to
download
and
use
apps
from
the
official
app
stores. 

McAfee
Mobile
Security
detects
this
threat
as
Android/Banker
regardless
of
the
application,
is
signed
with
the
previously
legitimate
signing
key. 

Indicators
of
Compromise 

Domains: 

• 
  http[://]o20-app.dark-app.net 
• 
  http[://]o20.orange-app.today 
• 
  http[://]orange20.orange-app.today 

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts