The app, still in Google Play, made by the same band of “Cloudsota”.

 
The Trojan found by Cheetah Mobile, is preinstalled in tablets, restores itself after reboots if deleted, hijacks the browser homepage and downloads apps from some servers to install them silently if the device is rooted (which, in these tablets, is very likely). We found a very similar behavior in a Google Play app, downloading apps from the same servers and with quite similar code. What we can be sure is that is made by the same people behind this Cloudsota. Although maybe with enough changes to be able to get in the official market.

How it works

Once the apps found by Cheetah were analyzed, thanks to Tacyt, we found a strong correlation with just one out of 4.6 million apps in our database. It has been in Google Play since August 2015. This app, when booting or if a user is present (unlocks the screen), calls a method called “b” inside the  com.android.ThreeTyCon.c class, that visits this site hxxp://union.dengandroid.com/getconfig and sends some interesting information.

JSon sent to the server before being encoded

After sending some encoded personal information (email, MAC, if the device is rooted or not, etc) it finally downloads (with some encoding as well) a dex file called business.dex. We guess the file may be different depending on this information previously sent.

The code to download and use business.dex

This business.dex is terribly offuscated, and contains most of the malicious code. Business.dex is as well programmed to download different versions of business_X.dex (the X depends on the configuration in the device) that we suppose that makes its behavour quite unpredictable.

If busybox util is found in the device, it tries to load libraries, install and uninstall apps… This is done just before business.dex is downloaded, we guess this is for uninstalling any antivirus the user may have just before downloading the (even more) malicious code, that is more likely to be detected.

Triying to uninstall code

As far as we know, the app itself or the business.dex does not contain code to survive and install itself after reboot or hijack the homepage, but it definitely could, as we can see some references in the code. 

It may hijacks the homepage

  
Aside, it shares with Cheetah samples, the use of a very particular library libshellcmd.so.
 

It uses libshellcmd.so, shared with Cloudsota

The app in Google Play is detected by some antiviruses. But most of them do not detect the app because of this behavior, but because of it containing some Airpush SDK code. Airpush was considered a potentially unwanted adware SDK long time ago by the antiviruses. It is interesting as well that the app has been downloaded 5.000 and 10.000 times, but only 3 votes have been given.

Too many downloads for so few votes…

That make us think about some time of artificial boost with unreal downloads made by the same developers to enhance searching position.

This SDK is called Moplus. Aside its “official features” it sets up a local HTTP server (the well known nanoHttpd), that listens in different ports, depending on the app and SDK version (probably 6259 TCP port). If connected to that port, nothing is served (documentRoot is at data/data/apkNamefileslocal_http_server)… but it allows the attacker to send POST requests with commands.

Defining the port where the server will listen

And that is all. Any attacker may send commands to the port via HTTP POST requests with no strong authentication. One of the weakest version only needs the header “remote-addr” to be set to 127.0.0.1. But some others need the referer header to match this.

^http[s]?://[^/]+(.baidu.com|.hao123.com|.hiapk.com|.91.com)(:d+)?(/.*|)$”;

If it works, it will execute the orders and return a JSON with the response (given the right permissions, which most of the spotted apps seem to have).

What commands does it support?

It is very clear with this piece of code:

Code with the accepted commands

It allows downloading files, and uploading anything. From retrieving the lists of apps to inserting new contacts. In rooted devices, any new apk could be installed silently.

Code to add contacts silently

Part of the code to upload files

Trend Micro contacted Baidu, that has created a new version that removes most of the malicious commands of the list. They are replacing most of the affected apps.
 
What did we found?

Trend Micro talks about thousands of apps affected. With Tacyt, we found the ones using the SDK and still available in Google Play. Some of them with up to 5 million downloads and not related to Baidu at all.

A variation of the code with the commands

These are some of the packageNames spotted in Google Play (although there will be more, for sure), different from the ones published by Trend Micro (so far):

• com.qiyi.video.market
• com.nd.android.launcher91
• com.ivodani.comicsisland.activity
• com.qyer.android.jinnang
• com.pad.comicsisland.activity
• com.cubic.choosecar

We could not confirm that the commands works the same in all of them. For sure, they contain the offensive code, but maybe with slightly different systems to be able to get in. They should be reversed individually to be sure how to make it work (or if they even work).

One of the easiest that we tested, was the very popular Baidu Maps. Not this one, but a previous version (8.7.0).

In the image, we use this Chrome plugin to inject POST commands. The result (inserting a contact remotelly) is shown. As you can see, Baidu Maps icon is on the top.

Adding contacts with a POST

It is worth mentioning that, many of the spotted apks, rely on two different classes.dex files. This means that, once executed, the app may load classes2.dex from its own “main” code, and usually this classes2.dex is the one with the offensive code.

An app containing a second “dex” file

This is not new. Many malware/adware in Google Play use this trick to try to fool detections. They may download the .dex file from elsewhere, or hold it inside. It is quite interesting finding that, some of the apps were using the “Moplus SDK capabilities” in this second dex file.

Aside, one of the most interesting point is that Mobo Launcher, related to the well known Mobogenie market, counts with this code backdoor as well, and it is very popular even outside China. It has been in Google Play since late 2014. In fact, is the oldest in Google Play with this version of the backdoor, as far as we know.

Some of the detected apps in Tacyt

Although we could not get to make it work and actually send a command (not sure why), the nanoHttp service was up, and code to receive commands is there… so there are strongs reasons not to trust this app, and reverse it even deeper to know exactly what is happening and how it works.

Of course, there are a lot of APKS outside Google Play (aptoide, mobogenie…) with this backdoor as well.

The good part is that most of these programs are already detected by several antiviruses, not all of them because of this, but detected, anyway.

Zscaler describes a more or less typical SMS infostealer Chinese malware. The improvement here is that they use a Word document icon for the Android malware. That would make the user believe that they are not installing anything, but trying to view a simple document. We searched and found some other malware (probably from the same attacker) posing as an Excel document, and got access to the email where the stolen info is sent to.

Some interesting stuff

The samples we have analyzed use an Excel icon. They are slightly different depending on the sample.

App that tries to look like an Excel document, and another example of icon it may use

In this samples, the attacker uses an approach different from the one described by Zscaler that seems to be a little bit more advanced. Malware sends SMS history and contact list to the attackers’ email, but in this case, the password for sending the email (and to check it, too) is not directly in the code, but in a configuration file.

Configuration file for the malware. Password and email included

We got to get into the mailbox of these mails and confirmed that, indeed, there were real SMS and contacts there. In an account, we found lots of supposed IMSI numbers and the whole SMS collection of the victim.

Stolen SMS from the victims

Zscaler found the “word document” malware was stealing the IMEI, while this one, as can be seen in the image, is identifying the victim by its supposed IMSI. In another account from other sample, we find the contacts list of the victim (name and number).

Some of the stolen contacts

The malware is able to “silent” the phone as well.

Setting the audio to silence

As usual, the attacker is a “regular” Google Play developer. He has been uploading apps to Google Play for months, and there are some of them online.

Some apps from the same developer

Thanks to Tacyt, we can get to know the developer, more than a single app. Most of the apps by this developer are removed, but they are not like this kind of malware described above. SMS stealers would not be able to bypass Google checks. Most of them are clickers, riskware in general or very aggressive adware. One of the few that are still alive is this:

One of the apps from the same developer still in Google Play. It is not a SMS stealer, but aggresive adware.

Conclusion

We got to expand and improve the Zscaler research. Same old tricks as used in PC are more and more used in Android again and again, like this “icon decoy” system. It is importan to highlight that this malware has nothing to do with Microsoft, Office, Word or Excel in Android, they just use their icons as something attractive to confuse users.