{"id":89800,"date":"2021-04-30T20:07:41","date_gmt":"2021-04-30T14:37:41","guid":{"rendered":"https:\/\/blogs.quickheal.com\/?p=89800"},"modified":"2023-08-08T17:41:55","modified_gmt":"2023-08-08T12:11:55","slug":"alert-wormable-android-malware-is-spreading-through-social-media-applications","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/alert-wormable-android-malware-is-spreading-through-social-media-applications\/","title":{"rendered":"Alert! Wormable Android malware is spreading through social media applications"},"content":{"rendered":"

Autoreply is a convenient feature through which users can send a custom message as an automatic reply for unanswered incoming email, SMS, WhatsApp messages, and more. There are many applications on Google Play Store which offers such functionality.<\/p>\n

We have recently noticed malicious applications which are abusing this particular functionality.<\/p>\n

\"\"<\/p>\n

Fig 1. Content used for spreading malware<\/strong><\/h6>\n

 <\/p>\n

Fig 1 highlights samples of messages used by attackers to lure users into installing malicious apps<\/a>. In many cases, these messages come from a trusted contact (who is already infected). As a result, users are likely to consider the message legitimate and follow the mentioned steps. In this case, the message asks users to open a web link and download an application. To lure users further, the website displays lucrative offers such as Free Netflix, watch Free IPL, New feature in WhatsApp. (Refer Fig.2)<\/p>\n

 <\/p>\n

\"\"<\/p>\n

Fig.2 Application hosting site<\/strong><\/h6>\n

 <\/p>\n

We recently analyzed two applications that are spreading through this mechanism – \u201cWhatsApp Pink\u201d and \u201cOnline stream.\u201d<\/p>\n

\"\"<\/p>\n

Fig.3 Icons<\/strong><\/h6>\n

 <\/p>\n

Once installed, these applications ask for notification access. After getting the permission, the application hides its icon from the users.<\/p>\n

\"\"<\/p>\n

Fig.4 Asking Notification access<\/strong><\/h6>\n

 <\/p>\n

These applications maintain a list they target for auto-replies of apps such as Facebook, Instagram, WhatsApp, Twitter, Telegram, Skype, Viber, etc. Till now, we have seen two variants of lists (refer to Fig.5). These applications have another string array that has text messages with a link to download the applications. One of the message strings is selected at random at runtime.<\/p>\n

\"\"<\/p>\n

Fig.5 Target List<\/strong><\/h6>\n

 <\/p>\n

After getting notification access, whenever a new notification is received, the callback function onNotificationPosted gets called. In this method, the package name of the application is checked.<\/p>\n

There is an additional check for Android notification direct reply action (The direct reply action, introduced in Android 7.0 (API level 24)), allowing users to enter text directly into the notification.<\/p>\n

\"\"<\/p>\n

Fig. 6 onNotificationPosted function callback<\/strong><\/h6>\n

 <\/p>\n

In onNotificationPosted<\/em> by accessing this action, instead of user input, this malware populates an intent with its own text data using RemoteInput.addResultsToIntent <\/em>method.<\/p>\n

\"\"<\/p>\n

Fig.7 Sending the message<\/strong><\/h6>\n

 <\/p>\n

Same actor Behind these two variants:<\/strong><\/p>\n

Quick Heal<\/a> has collected 6 samples of the WhatsApp Pink application and 4 samples of the Online stream application. All these applications are signed with the same certificate. That likely means that the same malware author (or authors) is behind these malicious applications.<\/p>\n

\"\"<\/p>\n

Fig. 8 Certificate Information<\/strong><\/h6>\n

 <\/p>\n

For now, these applications have functionalities of hiding icon, monitoring notifications, and autoreply. In future, they may develop a new variant and add more malicious functionality.<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n
IOC <\/strong><\/td>\nHosting sites<\/strong><\/td>\n<\/tr>\n
a8a687abf84271d181358374666b4f1b<\/td>\nh**p:\/\/pinkapp[.]xyz\/?whatsapp<\/td>\n<\/tr>\n
e1870d613d54239e8fb5f09b6a4e880d<\/td>\nh**p:\/\/lookpink[.]xyz\/?whatsapp<\/td>\n<\/tr>\n
d13d3eeaf8db5515577cc9b390fefbc9<\/td>\nh**p:\/\/colorpink[.]xyz\/?whatsapp<\/td>\n<\/tr>\n
9a902d186c948e72af6b269862c27055<\/td>\nh**p:\/\/pinklook[.]profileviewz[.]com\/WhatsappPink.apk
\nh**p:\/\/whatsapp[.]profileviewz[.]com\/WhatsappPink.apk<\/td>\n<\/tr>\n
90cfcde60b6cd57a2e9b2047cff51fb7<\/td>\nh**p:\/\/whatsapp[.]wwwy[.]xyz\/WhatsappPink.apk<\/td>\n<\/tr>\n
2ca849e5913aa3fd47db7b381db6ad24<\/td>\nh**p:\/\/looknew[.]xyz\/?whatsapp<\/td>\n<\/tr>\n
00d45a3846a90d7bd0d021447101efb6
\n3fa23903a9fa6f7d504f99e272c0d997<\/td>\n		h**p:\/\/streamapp[.]club\/?netflix<\/td>\n<\/tr>\n
2f0b61ef74e87b0aea52871d1bb4efb0<\/td>\nh**p:\/\/mobilestream[.]club\/?netflix<\/td>\n<\/tr>\n
E1af660c6c71ad191749755aa057aef7<\/td>\nh**p:\/\/profilelist[.]xyz\/?livestream<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

Follow the below guidelines to stay safe:<\/strong><\/p>\n