Privacy News Fake AV Investigation Unearths KevDroid, New Android Malware

[upnorth]

Content source

http://blog.talosintelligence.com/2018/04/fake-av-investigation-unearths-kevdroid.html

Several days ago, EST Security published a post concerning a fake antivirus malware targeting the Android mobile platform. In the Korean media, it was mentioned that there could be a link between this Android malware and Group 123. Talos decided to investigate this malware. And due to our reporting and history of following of Group 123, we discovered some interesting elements.

Talos identified two variants of the Android Remote Administration Tool (RAT). Both samples have the same capabilities — namely to steal information on the compromised device (such as contacts, SMS and phone history) and record the victim's phone calls. One variant uses a known Android exploit (CVE-2015-3636) in order to get root access on the compromised Android device. The data of both variants was sent using an HTTP POST to a unique command and control (C2) server. The ability to record calls was implemented based on an open-source project available on GitHub. We named this malware "KevDroid."

Another RAT (this time targeting Windows) was identified hosted on the command and control server in use by KevDroid. This malware specifically uses the PubNub platform as its C2 server. PubNub is a global data stream network (DSN). The attackers use the PubNub API in order to publish orders to the compromised systems. This behaviour explains why we named it "PubNubRAT."

We discovered a Windows binary on the server. The downloaded executables are RATs developed in .NET, and the desktops.ini file is the configuration file (XOR'd with key 0x17). The malware uses a public service as C2 servers. It also uses PubNub.

CONCLUSION. Originally, Talos took the time to investigate this malware due to its potential link to Group 123. As discovered, we do not have a strong link between the two malware samples and Group 123. The TTP overlaps are tenuous — using public cloud infrastructure as a C2 server is something other malware has used before as a technique, not just Group 123. Additionally, the C2 server is hosted in Korea, and this malware has been known to target Korean users. However, this information cannot lead us to a strong link. In light of this, we did discover some new Android-based malware and some Windows-based malware attempting to steal information and control infected systems. These samples are not documented and not massively used, but we hope than this post will highlight campaigns performed by this actor.