TgToxic Malware’s Automated Framework Targets Southeast Asia Android Users

Supplementary
Scams:
Sextortion
and
Cryptocurrency

Tracking
the
network
infrastructure
used
by
TgToxic,
we
subsequently
found
the
threat
actors
also
behind
sextortion
and
cryptocurrency
scams
in
Taiwan
and
Indonesia.
The
malicious
apps
could
also
be
downloaded
from
the
same
website

down[.]tw1988[.]link
and
masqueraded
as
dating,
messaging,
lifestyle,
or
cryptocurrency-related
apps
to
trick
users
into
installing
and
enabling
the
permissions
for
it.

Recent
Activities:
Phishing
in
Thailand

As
we
continued
monitoring
TgToxic
malware
and
its
network
infrastructure,
we
found
that
in
some
weeks
toward
the
end
of
2022
to
early
January
2023,
the
cybercriminals
behind
the
campaign
began
targeting
Thai
users
with
similar
sextortion
and
phishing
lures
observed
targeting
Taiwanese
users,
and
the
group
started
to
add
malicious
code
to
steal
credentials
from
bank
applications.
We
also
found
both
schemes
already
raising
attention
in
the
local
media
and
were
reported
on
Facebook
among
popular
communities.

The
phishing,
sextortion,
and
cryptocurrency
scams
connect
to
the
latest
deployment
samples
of
TgToxic
malware
as
they
all
download
from
the
same
website,

down[.]tw1988[.]link.
Observing
the
communications
to
and
from
the
command
and
control
(C&C)
servers,
the
C&C
for
these
apps
and
malware
changed
from

api[.]tw1988[.]link
to

test[.]ja7[.]site,
and
later
to

us[.]ja7[.]site
corresponding
the
change
of
targeting
from
Taiwan
to
Thailand.

Technical
Analysis
of
TgToxic

We
analyzed
that
the
malware
TgToxic
was
developed
based
on
a
legitimate
automation
test
framework
called
Easyclick,
which
supports
writing
automation
script
via
JavaScript.
This
script
can
be
used
to
hijack
an
Android
device’s
user
interface
(UI)
automatically
to
automate
functions
such
as
monitoring
of
user
input
and
performing
clicks
and
gestures.

With
the
said
framework,
TgToxic
can
develop
its
own
automation
script
to
hijack
cryptocurrency
wallets
and
bank
apps
by
stealing
the
user’s
credentials
as
the
victim
places
their
username
and
password.
Once
the
credentials
are
acquired,
the
cybercriminals
can
make
small
transactions
using
the
official
app
without
needing
the
user’s
approval
or
acknowledgement.
Like
other
banking
malware,
TgToxic
can
also
steal
users’
personal
information
via
SMS
and
installed
apps,
which
can
be
used
to
select
targeted
victims
by
further
scanning
if
the
device
stores
apps
the
threat
actors
are
interested
in
abusing.

Currently,
TgToxic
is
still
rapidly
evolving
and
continues
to
add
new
functions,
copying
more
apps
to
steal
credentials
and
adapt
to
different
app
UIs,
and
collecting
more
information
from
victims.
For
this
analysis,
we
took
the
latest
sample
that
targeted
mobile
users
in
Thailand
to
analyze.

Code
obfuscation
and
payload
encryption

TgToxic
malware
uses
two
methods
to
evade
detection
and
analysis,
and
we
divide
this
into
two
parts:

1. Code
   Obfuscation:
   TgToxic
   obfuscates
   the
   classes’
   names,
   method
   name,
   and
   fields
   name,
   which
   make
   it
   harder
   for
   some
   analysts
   to
   reverse
   engineer.
2. Payload
   Encryption:
   TgToxic
   puts
   the
   Easyclick
   script
   in
   an
   asset
   file
   named
   “tg.iapk”,
   which
   is
   an
   encrypted
   Zip
   file,
   and
   will
   dynamically
   read
   content
   from
   it
   when
   the
   app
   launches.
   The
   malware
   implements
   a
   fileless
   way
   to
   decrypt
   and
   load
   the
   payload,
   and
   adds
   an
   additional
   logic
   after
   unzipping.

Decrypt
payload
and
abuse
Accessibility
service
to
hijack
a
device
UI

As

noted
by
the
researchers
of
McAiden,
tg.iapk
is
an
encrypted
.zip
file.
Through
static
analysis,
we
found
that
the
decompression
password
is
specially
encoded
and
stored
in
the
.zip
comment
section,
which
is
usually
used
to
record
the
.zip
description.
The
content
of
this
section
will
not
affect
the
compressed
content.
To
acquire
the
password
for
the
.zip
file,
the
contents
of
the
comment
section
are
decoded
as
specified
in
the
code.

After
decompression,
we
found
that
all
files
were
binary
files,
and
the
first
four
bytes
of
all
the
files
are
“0x00092383”,
which
are
specially
encrypted
files.
Through
reverse
analysis,
we
located
the
decryption
function.
To
hide
the
decryption
details,
key
classes
and
key
methods
are
invoked
using
reflection,
and
related
symbol
names
are
encrypted.

By
analyzing
the
decryption
function,
we
get
the
format
of
the
encrypted
file.
Encrypted
files
encoded
the
password
and
saved
it
at
the
beginning
of
the
file
(following
the
magic
number)
while
saving
the
encrypted
data
at
the
end
of
the
file.
The
password
is
decoded
in
the
same
way
as
the
zip
password
is
decoded. 

Precompiled
script
running
in
runtime
engine

The
automation
script
is
precompiled
to
Java
and
using
the
runtime
of
Rhino,
an
open
source
engine
to
run
JavaScript
in
Java.
Each
switch
branch
in
a
call
function
is
a
JavaScript
function,
and
we
explain
how
the
code
runs
with
a
simple
function
from
the
malware.

This
function
is
used
to
collect
the
device
information
and
send
to
the
C&C
server.
It
first
iterates
over
a
predefined
variable
“walletListAry”,
which
contains
a
list
of
package
names
of
a
cryptocurrency
wallet
that
the
threat
actor
is
interested
in.
Then
the
malware
calls
“isAppExist”
to
check
whether
the
app
is
in
the
system.
If
confirmed,
the
package
name
will
be
pushed
into
an
array.

The
malware
then
checks
the
email
applications
in
the
same
way
and
creates
a
.json
object
that
includes
the
information
it
collects.
The
“apps”
field
contains
package
names
of
installed
cryptocurrency
wallets,
and
the
“mails”
field
contains
package
names
of
installed
email
apps.
Finally,
it
calls
“JSON.stringify”
to
serialize
the
.json
object
into
a
string
and
calls
“emitEnc”
to
send
the
information
to
the
C&C
server
over
WebSocket.

C&C
communication
and
data
exfiltration

The
malware
uses
WebSocket
as
a
C&C
channel
where
the
script
executes.
It
will
call
“StartWs”
to
connect
to
the
WebSocket
server,
then
set
“new_msg”
event
listener
to
receive
and
parse
C&C
commands.
The
full
C&C
command
list
used
is
listed
as
follows:

Another
detail
worth
noting
is
that
TgToxic
will
connect
to
different
C&C
servers
depending
on
the
infected
device’s
locale.
While
we
continue
tracking
and
have
yet
to
find
TgToxic
activity
in
other
regions
or
countries
outside
of
the
three
we
have
identified
so
far,
we
believe
that
the
malicious
actors
behind
this
deployment
is
trying
to
expand
its
activities
to
other
countries
based
on
the
availability
of
these
different
servers.

The
data
is
exfiltrated
through
the
C&C
channel.
Taking
SMS
exfiltration
as
an
example,
the
malware
first
calls
“getSmsInPhone”
to
extract
all
SMS
from
the
message
inbox,
then
uploads
the
stolen
data
to
the
server
via
the
WebSocket
C&C
channel.

Automatic
permission
grants
and
uninstallation
prevention

TgToxic
can
hijack
the
system
app
to
automatically
grant
itself
permissions,
as
well
as
prevent
uninstallation
when
the
victim
tries
to
uninstall
the
malware.
Below
is
a
list
of
system
apps
that
the
malware
tries
to
hijack
and
its
corresponding
purposes:

Control
financial
apps
for
automatic
transfers

TgToxic
implements
automatic
transfer
service
(ATS)
to
transfer
money
to
the
threat
actors
without
the
users
knowing.
The
malware
starts
with
secretly
stealing
passwords
and
unlocking
gestures.
When
it
detects
the
user
having
a
wallet
app,
the
malware
will
check
for
the
specific
activity
and
record
via
key
logging
if
the
user
will
input
the
password.
It
can
also
take
screenshots
if
the
user
does
a
gesture
to
unlock
the
device.

Once
it
receives
a
“walletSend”
command
from
the
C&C
server,
the
malware
will
put
a
full
black
screen
overlay
to
prevent
the
victim
from
becoming
aware
of
the
malicious
activities
and
transfers.
It
then
opens
the
wallet
application
and
collects
the
details
such
as
chain
type
and
balance.
TgToxic
will
then
simulate
user
clicks
for
transfers
to
specific
recipients
across
all
chain
types
through
the
Accessibility
service:

1. Check
   if
   chain
   type
   is
   “usdt”
   and
   enter
   wallet
   details
2. Click
   the
   transfer
   button
3. Input
   receiver
   address
4. Input
   transfer
   money
5. Enter
   transfer
   detail
   page
6. Input
   password
7. Click
   the
   “Confirm”
   button

Targeted
applications

Here
is
a
list
of
apps
that
the
malware
extracted
victims’
information
from,
as
studied
from
the
latest
samples
targeting
Thailand:

Conclusion

Despite
having
different
deployment
periods,
we
found
the
social
media
phishing
campaigns
and
network
infrastructure
targeting
Taiwan,
Indonesia,
and
Thailand
similar.
When
the
victim
downloads
the
fake
app
from
the
website
given
by
the
threat
actor,
or
if
victim
tries
to
send
a
direct
message
to
the
threat
actor
through
messaging
apps
such
as
WhatsApp
or
Viber,
the
cybercriminal
deceives
the
user
into
registering,
installing
the
malware,
and
enabling
the
permissions
it
needs.
Once
granted,
the
phone
is
automatically
controlled
by
the
malicious
actors,
and
the
legitimate
apps
and
their
respective
assets
in
the
device
become
at
risk.

Looking
at
the
analysis,
the
malware
in
itself
is
not
sophisticated
but
interesting.
The
abuse
of
legitimate
automation
frameworks
like
Easyclick
and
Autojs
can
make
it
easier
to
develop
sophisticated
malware,
especially
for
Android
banking
trojans
that
can
abuse
Accessibility
services.
The
complexity
of
the
frameworks
also
makes
it
difficult
to
reverse
engineer
for
analysis.
It
is
highly
likely
that
due
to
the
framework’s
convenience
and
anti-reverse
engineering
features,
more
threat
actors
can
take
advantage
and
use
this
method
in
the
future.

Looking
at
the
malicious
actors,
we
determined
that
the
group
or
individual
responsible
for
this
campaign
is
new
at
this,
but
relatively
informed
with
the
ongoings
in
the
region
and
targets
as
there
are
components
reflecting
the
familiar
use
of
traditional
and
simplified
Chinese.
One
interesting
detail
we
observed
is
that
there
are
a
lot
of
scams
abusing
the
themes
of
allowance
assistance
distribution
in
Taiwan
in
August
2022.
While
the
official
agency
had
and
continuously
warned
the
public
about
these
scams,
mainstream
news
coverage
was
not
as
widely
distributed
and
did
not
offer
details
that
we
could
use
for
our
investigation.

While
we
also
have
an
insight
on
deployments
and
attempts
to
victimize,
there
is
little
information
on
the
actual
number
of
victims
on
the
ground.
The
growing
threat
intelligence
and
capability
of
devices
at
detecting
these
kinds
of
threats
have
improved,
coupled
with
users’
grown
awareness
of
the
fact
that
they
can
avoid
threats
like
these
(i.e.,
by
not
downloading
from
unofficial
platforms),
and
make
it
easier
to
prevent
these
types
of
malware
infections.
As
additional
precautions
to
avoid
becoming
a
victim
of
these
kinds
of
threats,
here
are
some
signs
of
infections
to
watch
for
and
best
practices:

• 
  Avoid
  installing
  apps
  from
  unknown
  sources
  and
  platforms.
  Do
  not
  click
  on
  apps,
  installers,
  websites
  directly
  embedded
  in
  SMS
  or
  emails,
  especially
  from
  unknown
  senders.
• 
  Do
  not
  enable
  sensitive
  permissions
  such
  as
  Accessibility
  services
  from
  and
  for
  enabling
  and/or
  download
  of
  unknown
  apps.
• 
  For
  signs
  of
  malware
  infection,
  battery
  drain
  of
  devices
  despite
  the
  user’s
  non-usage
  is
  a
  red
  flag
  of
  potential
  malware
  infection.

Trend
Micro
solutions

Trend
Micro
Mobile
Security
Solutions
can
scan
mobile
devices
in
real
time
and
on
demand
to
detect
malicious
apps,
sites,
or
malware
to
block
or
delete
them.
These
solutions
are
available
on
Android
and
iOS,
and
can
protect
users’
devices
and
help
them
minimize
the
threats
brought
by
fraudulent
applications
and
websites
such
as
TgToxic.

Indicators
of
compromise
(IOCs)

For
a
full
list
of
the
IOCs,
find
the
list

here.