Anomali Threat Research Identifies Fake COVID-19 Contact Tracing Apps Used to Download Malware that Monitors Devices, Steals Personal Data

Authored by: Tara Gould, Gage Mele, Parthiban Rajendran, and Rory Gould<h2>Overview</h2>Threat actors are distributing fake Android applications themed around official government COVID-19 contact tracing apps. Anomali Threat Research (ATR) identified multiple applications that contain malware, primarily Anubis and SpyNote, and other generic malware families. These apps, once installed on a device, are designed to download and install malware to monitor infected devices, and to steal banking credentials and personal data. The wider security community continues to monitor ongoing malicious activity themed around COVID-19.[1] ATR believes that the fake apps are likely being distributed through other apps, third-party stores, and websites, among others. As of the publication of this research, the fake apps had not been identified as being present in the Google Play Store.Anomali Threat Research identified 12 malicious applications that appear to be targeting citizens of multiple countries. This activity consists of separate incidents of malicious activity themed around COVID-19 and should not be viewed as a coordinated campaign. Multiple countries were found to have malicious activity themed directly after government and/or malicious COVID-19-themed applications. Anomali Threat Research findings are shown below in Table 1.Table 1 - Malicious Applications<table class="table table-striped table-bordered" style="table-layout: fixed;"><thead><tr><th scope="col">Government Tracing App</th><th scope="col">Official Package Name</th><th scope="col">Malicious Package Name</th><th scope="col">Detection Name</th></tr></thead><tbody><tr><td>Armenia</td><td style="word-wrap: break-word;">am.gov.covid19</td><td style="word-wrap: break-word;">am.ac19.health</td><td style="word-wrap: break-word;">*Trojan</td></tr><tr><td>Arrogyasetu (India)</td><td style="word-wrap: break-word;">nic.goi.aarogyasetu</td><td style="word-wrap: break-word;">com.android.tester</td><td style="word-wrap: break-word;">Spynote</td></tr><tr><td>Brazil</td><td style="word-wrap: break-word;">br.gov.datasus.guardioes</td><td style="word-wrap: break-word;">wocwvy.czyxoxmbauu.slsa</td><td>Anubis</td></tr><tr><td>Chhattisgarh</td><td style="word-wrap: break-word;">com.mobcoder.govcth</td><td style="word-wrap: break-word;">cmf0.c3b5bm90zq.patch</td><td>*Trojan</td></tr><tr><td>Columbia</td><td style="word-wrap: break-word;">co.gov.ins.guardianes</td><td style="word-wrap: break-word;">qmkeasedjeumxmgb.czmofiuouafiuwtmwonw.eeepqsunrbflk</td><td>*Trojan</td></tr><tr><td>Indonesia</td><td style="word-wrap: break-word;">com.telkom.tracencare</td><td style="word-wrap: break-word;">cmf0.c3b5bm90zq.patch</td><td>Spynote</td></tr><tr><td>Iran</td><td style="word-wrap: break-word;">ir.covidapp.android</td><td style="word-wrap: break-word;">co.health.covid</td><td>*Trojan</td></tr><tr><td>Italy (impersonating INPS)</td><td style="word-wrap: break-word;">certificati.farma.droid</td><td style="word-wrap: break-word;">ynhsumknjtd.hphsefyntauykl.hauqklysedjjnukso</td><td>*Trojan</td></tr><tr><td>Kyrgyzstan</td><td style="word-wrap: break-word;">kg.cdt.stopcovid19</td><td style="word-wrap: break-word;">kg.cdt.stopcovid19</td><td>*Adware</td></tr><tr><td>Russia - EMERCOM</td><td style="word-wrap: break-word;">com.minsvyaz.gosuslugi.stopcorona</td><td style="word-wrap: break-word;">anubis.bot.myapplication</td><td>Anubis</td></tr><tr><td>Singapore</td><td style="word-wrap: break-word;">sg.gov.tech.bluetrace</td><td style="word-wrap: break-word;">iiyyxasgfmaeph.jyefwosxdajh.ubempzgulrqdkcmjaplqrxeq</td><td>*Trojan</td></tr><tr><td>Singapore</td><td style="word-wrap: break-word;">sg.gov.tech.bluetrace</td><td style="word-wrap: break-word;">zfhxmtepnxyljw.wqnszljeb.bkolzgalth</td><td>*Trojan</td></tr></tbody></table>*Unnamed or generic malware<h2>Technical Analysis</h2><h3>Anubis</h3>Anubis is an Android banking trojan that utilizes overlays to access infected devices and steal user credentials. The malware has been reportedly available since at least 2017 and disguises itself as legitimate applications such as fake software updates. Custom injects are used by threat actors to make the victim believe they are viewing their banking application whilean overlay controlled by the actor and placed on top of the application is used to steal sensitive information.Primary functionalities:<ul><li>Access to SMS messages, location, contact list, system information</li><li>Custom injections to a wide range of banking and social media applications, to harvest sensitive information</li><li>Hides itself from App drawer as launched</li><li>Keylogging</li><li>Permissions</li><li>Record phone calls</li><li>Steals data</li><li>Use of overlays to steal credentials</li></ul><h4>Brazil</h4>Legitimate application - Coronavírus - SUS Malicious application - Coronavírus - SUS Malicious package - wocwvy.czyxoxmbauu.slsa Sample - ec70b3f8db8a66d353cc69704b4d7141Anomali Threat Research has found a malicious application hosted on a website btc-chenger[.]xyz that impersonates the Brazilian government’s official COVID tracing app. The malicious application imitates the legitimate application as a lure for victims to download the Anubis malware. When the app is first started on the device it will ask for the accessibility service privilege as shown in the figure 2. Once the user enables the permissions the app will run in the background and hides the icon from the application drawer.<img alt="Icon as it Appears on Android Device" src="https://cdn.filestackcontent.com/0M188DKUQmGIWDr2YYiy"/> Figure 1 - Icon as it Appears on Android Device<img alt="Malicious app requests Accessibility permissions" src="https://cdn.filestackcontent.com/nIcv3nMbR2qylDtx3mD1" style="width: 400px;"/> Figure 2 - Malicious app requests Accessibility permissions<img alt="List of Permissions Granted by Anubis" src="https://cdn.filestackcontent.com/fPIVR6rlReWM5OaLfWW2"/> Figure 3 - List of Permissions Granted by Anubis<img alt="Anubis SMS-Stealing Abilities" src="https://cdn.filestackcontent.com/BECFIEhCTKGAeOJp0hWm"/> Figure 4 - Anubis SMS-Stealing Abilities<img alt="Anubis Accessing Users’ Contacts" src="https://cdn.filestackcontent.com/ZNrN9qBT9axxE4hv7RRe"/> Figure 5 - Anubis Accessing Users’ Contacts<h3>SpyNote</h3>SpyNote is an Android trojan with the primary objective of gathering and monitoring data on infected devices. The trojan was first identified by Palo Alto Unit 42 researchers in December 2016.[2] SpyNote is based off of leaked source code from malware forums and functions similarly to the Remote Access Trojans (RATs) DroidJack and OmniRat.[3]Primary Functionalities:<ul><li>Access SMS, GPS Location, Contacts</li><li>Call From Victims Number</li><li>Capture Photos From Camera</li><li>Check Browser History</li><li>Check Installed Apps</li><li>Device Information</li><li>Exfiltrate Files </li><li>Installed Application</li><li>Read Or Write Messages</li><li>Read Or Write The Contacts List</li><li>Record Calls</li></ul><h4>Indonesia </h4>Legitimate application - PeduliLindungi Malicious application - PeduliLindungi Malicious package - cmf0.c3b5bm90zq.patch Sample - 0bc3d828e7ab270a8baab7a32633de0d<img alt="App Icon in App Drawer" src="https://cdn.filestackcontent.com/fciM2NUVSwypskH4jncc"/> Figure 6 - App Icon in App DrawerPeduliLindungi is an Indonesian COVID-19 tracing application created by the Republic of Indonesia Ministry of Communication and Information Technology.[4] Anomali Threat Research found an application impersonating PeduliLindungi, also called PeduliLindungi, that contains the SpyNote malware. The malicious application contains the legitimate app inside itself under the “/raw/” folder. When the malicious app is run, the legitimate application is installed on the device, with the malicious app hiding from the app drawer.<img alt="Code showing install command, used to install the legitimate APK" src="https://cdn.filestackcontent.com/91f2SwxBS4qthnX4QcXY"/> Figure 7 - Code showing install command, used to install the legitimate APK.<img alt="The legitimate app, stored inside ‘res/raw’" src="https://cdn.filestackcontent.com/cN6v4iztRPOHpYsr7MAf"/>Figure 8 - The legitimate app, stored inside ‘res/raw’<h2>Conclusion</h2>The potential security and privacy-related risk of malicious COVID-19 apps is evident in Anomali Threat Research and other security researchers' findings. Threat actors continue to imitate official apps to take advantage of the brand recognition and perceived trust of those released by government agencies. The global impact of the COVID-19 pandemic makes the virus a recognizable and potentially fear-inducing name, of which actors will continue to abuse. This research reveals a glimpse into some of the applications threat actors are actively distributing, and there are likely numerous others in the wild that have not yet been detected.<h2>IOCs</h2>c448ae9ad80f088e9296f08a114605e2 66b3529f7589cac62960bfacc9dbc5f4 0ba9d47e0d9fa0b6db4f397a34f7efab 1d94952245f517602227938a26c498006143d7b8a92dd259f595715255b99ade 885d07d1532dcce08ae8e0751793ec30ed0152eee3c1321e2d051b2f0e3fa3d7 41bb86666543349bbf82e157b4d69a893f9b9c0fd37a8dce59048d8e000af3d6 add9a29ee75b55ec8d6d7ee4f5119084edbeb3db04cbcce0af30c28758182296 8b8dfb8fa7c313d9d7c1b1a67646abdb54d8cfd18773b136a10f191ca27098fc d7fc4377b7a765d6bc3901d0de01008095965d02062fda3707957163afe8884d a03fe22f32b683a34c452a74fbc8e78f5f33132332149fe726945397c37d37a6 e6786770a2a81ce798178f4eef4ae2290dfb1977ba5ced8cdbd01ddca3fadd17 a76bb2e56079dca73d759cdae9857cd5626c200785f004e492f60ce52784f745 cafc2a8e3dc818de9bb5b0eff1a9983426e5db9cc8c0d42905cefeb99b442099 a891a9f77671623f6c397a03bc9ec7effc362a56e6f2ebb22967eeb6e4e9a14d a9eaea748420a5f832a208b35be7107b5fef389a844c0659688466d3a8fd3eb6 090b5fb792b62225df6ca55fac2d96b630d596a61b7071009e0084056d04240a be2a9bbdb89e48b5eadc52830d6f92dc4355adc2bc95d5ac5d6748fee68acf1c<h2>Endnotes</h2>[1] “A Deep Dive Into SpyNote 6.5 Android RAT,” 70ry, accessed June 3, 2020, published February 13, 2020, https://70ry.tistory.com/412; Amrita Nayak Dutta, “Pakistani operatives create fake Arogya Setu app to ‘steal info’ from Indian defence forces,” ThePrint, accessed June 3, 2020, published April 27, 2020, https://theprint.in/defence/fears-rise-that-pakistan-based-intel-operatives-could-misuse-aarogya-setu-app/409798/; “FAKE AAROGYA SETU ANDROID APPS HARBOR SPYWARE CAPABILITIES,” Security News - SonicWall, accessed June 3, 2020, published May 20, 2020, https://securitynews.sonicwall.com/xmlpost/fake-aarogya-setu-android-apps-harbor-spyware-capabilities/.[2] Jacob Soo, “SpyNote Android Trojan Builder Leaked,” Unit 42 Palo Alto Networks, accessed June 3, 2020, published July 28, 2016, https://unit42.paloaltonetworks.com/unit42-spynote-android-trojan-builder-leaked/.[3] Ibid.[4] “PeduliLindungi,” Google Play, accessed June 3, 2020, https://play.google.com/store/apps/details?id=com.telkom.tracencare.<h2>Appendix</h2>App name - com.android.tester Country - India<img alt="Language selector from malicious Arrogya Setu App" src="https://cdn.filestackcontent.com/NteySybbTjGnlx32e8k3" style="width: 400px;"/> Figure 9 - Language selector from malicious Arrogya Setu App<img alt="Arrogya Setu App Home Page" src="https://cdn.filestackcontent.com/Sii2pZYASVCPwfTU5Usw" style="width: 400px;"/> <img alt="Arrogya Setu App Home Page" src="https://cdn.filestackcontent.com/lJvATdO5RW6CgEohOVny" style="width: 400px;"/> Figure 10 - Arrogya Setu App Home Page<img alt="Registration Page for Arrogya Setu App" src="https://cdn.filestackcontent.com/LRSRenQxQf2fF6r7jSvO" style="width: 400px;"/> Figure 10 - Registration Page for Arrogya Setu AppApp Name - kg.cdt.stopcovid19 Country - Kyrgyzstan<img alt="Sign Up Page from Kyrgyzstani app" src="https://cdn.filestackcontent.com/5ZOgbSjdRiWfYeshwUk6" style="width: 400px;"/> Figure 11 - Sign Up Page from Kyrgyzstani appApp name - am.ac19.health Country - Armenia<img alt="Home screen of malicious Armenian app" src="https://cdn.filestackcontent.com/umTr0duxTUqnjl4WIbYj" style="width: 400px;"/> Figure 12 - Home screen of malicious Armenian appApp Name - co.health.covid Country - Iran<img alt="Home Screen of Malicious Iranian App" src="https://cdn.filestackcontent.com/s7S8oK4sS8ePMftKqdEt" style="width: 400px;"/> Figure 13 - Home Screen of Malicious Iranian App