Because the starting of 2023, ESET researchers have noticed an alarming development of misleading Android mortgage apps, which current themselves as official private mortgage providers, promising fast and easy accessibility to funds.
Regardless of their engaging look, these providers are in actual fact designed to defraud customers by providing them high-interest-rate loans endorsed with deceitful descriptions, all whereas gathering their victims’ private and monetary data to blackmail them, and ultimately acquire their funds. ESET merchandise due to this fact acknowledge these apps utilizing the detection identify SpyLoan, which instantly refers to their spyware and adware performance mixed with mortgage claims.
Key factors of the blogpost:
- Apps analyzed by ESET researchers request varied delicate data from their customers and exfiltrate it to the attackers’ servers.
- This knowledge is then used to harass and blackmail customers of those apps and, in response to consumer evaluations, even when a mortgage was not offered.
- ESET telemetry reveals a discernible development in these apps throughout unofficial third-party app shops, Google Play, and web sites for the reason that starting of 2023.
- Malicious mortgage apps deal with potential debtors primarily based in Southeast Asia, Africa, and Latin America.
- All of those providers function solely by way of cell apps, for the reason that attackers can’t entry all delicate consumer knowledge that’s saved on the sufferer’s smartphone via browsers.
Overview
ESET is a member of the App Protection Alliance and an lively associate within the malware mitigation program, which goals to shortly discover Probably Dangerous Purposes (PHAs) and cease them earlier than they ever make it onto Google Play.
The entire SpyLoan apps which are described on this blogpost and talked about within the IoCs part are marketed via social media and SMS messages, and out there to obtain from devoted rip-off web sites and third-party app shops. All of those apps had been additionally out there on Google Play. As a Google App Protection Alliance associate, ESET recognized 18 SpyLoan apps and reported them to Google, who subsequently eliminated 17 of those apps from their platform. Earlier than their removing, these apps had a complete of greater than 12 million downloads from Google Play. The final app recognized by ESET continues to be out there on Google Play – nevertheless, since its builders modified its permissions and performance, we now not detect it as a SpyLoan app.
It is very important word that each occasion of a selected SpyLoan app, no matter its supply, behaves identically because of its an identical underlying code. Merely put, if customers obtain a particular app, they’ll expertise the identical capabilities and face the identical dangers, no matter the place they received the app. It would not matter if the obtain got here from a suspicious web site, a third-party app retailer, and even Google Play – the app’s habits would be the identical in all instances.
None of those providers present an choice to request a mortgage utilizing an internet site, since via a browser the extortionists can’t entry all delicate consumer knowledge that’s saved on a smartphone and is required for blackmailing.
On this blogpost, we describe the mechanism of SpyLoan apps and the varied misleading strategies they use to bypass Google Play insurance policies and mislead and defraud customers. We additionally share steps victims can take if they’ve fallen for this rip-off and a number of other suggestions about how you can distinguish between malicious and legit mortgage apps in order that potential debtors can shield themselves.
Victimology
In line with ESET telemetry, the enforcers of those apps function primarily in Mexico, Indonesia, Thailand, Vietnam, India, Pakistan, Colombia, Peru, the Philippines, Egypt, Kenya, Nigeria, and Singapore (see map in Determine 2). All these nations have varied legal guidelines that govern non-public loans – not solely their charges but additionally their communication transparency; nevertheless, we don’t understand how efficiently they’re enforced. We imagine that any detections exterior of those nations are associated to smartphones which have, for varied causes, entry to a cellphone quantity registered in considered one of these nations.
On the time of writing, we haven’t seen an lively marketing campaign concentrating on European nations, the USA, or Canada.
Technical evaluation
Preliminary entry
ESET Analysis has traced the origins of the SpyLoan scheme again to 2020. At the moment, such apps offered solely remoted instances that didn’t be a focus for researchers; nevertheless, the presence of malicious mortgage apps saved rising and finally, we began to identify them on Google Play, the Apple App Retailer, and on devoted rip-off web sites. Screenshots of 1 such instance are proven in Determine 3 and Determine 4. This multiplatform method maximized their attain and elevated the probabilities of consumer engagement, though these apps had been later taken down from each official app shops.
Originally of 2022, ESET reached out to Google Play to inform the platform about greater than 20 malicious mortgage apps that had over 9 million collective downloads. After our intervention, the corporate deleted these apps from its platform. Safety firm Lookout recognized 251 Android apps on Google Play and 35 iOS apps on the Apple App Retailer that exhibited predatory habits. In line with Lookout, that they had been in touch with Google and Apple concerning the recognized apps and in November 2022 revealed a blogpost about these apps. Google already recognized and took down the vast majority of the malicious mortgage apps forward of Lookout’s analysis publication, with two of the recognized apps being faraway from Google Play by the developer. Collectively these apps throughout Google Play had over 15 million downloads; Apple additionally took down the recognized apps.
In line with ESET telemetry, SpyLoan detections began to rise once more in January 2023 and have continued to develop since then much more throughout unofficial third-party app shops, Google Play, and web sites; we outlined this development within the ESET Risk Report H1 2023.
Of their 2022 safety abstract, Google described how the corporate saved Android and Google Play customers secure by rolling out new necessities for private mortgage apps in a number of areas. As documented, over the previous three years, the state of affairs has developed and Google Play has made a number of modifications to its private mortgage app insurance policies – with country-specific necessities in India, Indonesia, Philippines, Nigeria, Kenya, Pakistan, and Thailand – and has unpublished many malicious mortgage apps.
To lure victims, the perpetrators actively promote these malicious apps with SMS messages and on common social media channels similar to Twitter, Fb, and YouTube. By leveraging this immense consumer base, the scammers purpose to draw unsuspecting victims who’re in want of monetary help.
Though this scheme will not be utilized in each SpyLoan app we analyzed, one other alarming side of some SpyLoan apps is the impersonation of respected mortgage suppliers and monetary providers by misusing the names and branding of official entities. To assist increase consciousness amongst potential victims, some official monetary providers even have warned about SpyLoan apps on social media, as could be seen in Determine 5.
Toolset
As soon as a consumer installs a SpyLoan app, they’re prompted to simply accept the phrases of service and grant in depth permissions to entry delicate knowledge saved on the system. Subsequently, the app requests consumer registration, usually achieved via SMS one-time password verification to validate the sufferer’s cellphone quantity.
These registration types mechanically choose the nation code primarily based on the nation code from the sufferer’s cellphone quantity, making certain that solely people with cellphone numbers registered within the focused nation can create an account, as seen in Determine 6.
After profitable cellphone quantity verification, customers acquire entry to the mortgage software characteristic throughout the app. To finish the mortgage software course of, customers are compelled to offer in depth private data, together with tackle particulars, contact data, proof of earnings, banking account data, and even to add images of the back and front sides of their identification playing cards, and a selfie, as depicted in Determine 7.
SpyLoan apps pose a major menace by stealthily extracting a variety of private data from unsuspecting customers – these apps are able to sending delicate knowledge to their command and management (C&C) servers. The info that’s normally exfiltrated contains the listing of accounts, name logs, calendar occasions, system data, lists of put in apps, native Wi-Fi community data, and even details about recordsdata on the system (similar to Exif metadata from photos with out really sending the images themselves). Moreover, contact lists, location knowledge, and SMS messages are additionally susceptible. To guard their actions, the perpetrators encrypt all of the stolen knowledge earlier than transmitting it to the C&C server.
As SpyLoan apps developed, their malicious code turned extra subtle. In earlier variations, the malware’s dangerous performance wasn’t hidden or protected; nevertheless, later variations included some extra superior strategies like code obfuscation, encrypted strings, and encrypted C&C communication to cover their malicious actions. For a extra detailed understanding of those enhancements, confer with Determine 8 and Determine 9.
On Might 31st, 2023, further insurance policies began to use to mortgage apps on Google Play, stating that such apps are prohibited from asking for permission to entry delicate knowledge similar to photos, movies, contacts, cellphone numbers, location, and exterior storage knowledge. It seems this up to date coverage didn’t have an instantaneous impact on current apps, as a lot of the ones we reported had been nonetheless out there on the platform (together with their broad permissions) after the coverage began to use, as depicted in Determine 10. Nonetheless, as we talked about, Google later unpublished these apps.
Aftermath
After such an app is put in and private knowledge is collected, the app’s enforcers begin to harass and blackmail their victims into making funds, even when – in response to the evaluations – the consumer didn’t apply for a mortgage or utilized however the mortgage wasn’t authorised. Such practices have been described within the evaluations of those apps on Fb and on Google Play, as proven in Determine 11 (even mentioning loss of life threats), Determine 12 (partial machine translation: Is the debt you’ve got value your peace of thoughts and that of your family members? … Do you actually wish to put your security in danger? … Are you keen to pay the results? You may get into a whole lot of issues, keep away from a foul expertise for your self and people round you.), and Determine 13.
Moreover the information harvesting and blackmailing, these providers current a type of modern-day digital usury, which refers back to the charging of extreme rates of interest on loans, profiting from susceptible people with pressing monetary wants, or debtors who’ve restricted entry to mainstream monetary establishments. One consumer gave a destructive overview (proven in Determine 14) to a SpyLoan app not as a result of it was harassing him, however as a result of it had already been 4 days since he utilized for a mortgage, however nothing had occurred and he wanted cash for treatment.
Usury is usually seen as so unethical that it’s condemned in varied spiritual texts and is regulated by legal guidelines to guard debtors from such predatory practices. It’s, nevertheless, essential to notice that a regular mortgage settlement will not be thought of usury if the curiosity is ready at an affordable price and follows authorized pointers.
Causes behind the fast development
There are a number of causes behind the fast development of SpyLoan apps. One is that the builders of those apps take inspiration from profitable FinTech (monetary expertise) providers, which leverage expertise to offer streamlined and user-friendly monetary providers. FinTech apps and platforms are identified to disrupt the standard monetary trade by providing comfort by way of accessibility, permitting individuals, in a user-friendly means, to carry out varied monetary actions anytime, anyplace, utilizing solely their smartphones. In distinction, the one factor SpyLoan apps disrupt is the belief in expertise, monetary establishments, and comparable entities.
One more reason for his or her development was famous in Zimperium’s evaluation of how malicious actors took benefit of the Flutter framework and used it to develop malicious mortgage apps. Flutter is an open-source software program growth equipment (SDK) designed for constructing cross-platform functions that may run on varied platforms similar to Android, iOS, net, and Home windows. Since its launch in December 2018, Flutter has performed a major position in facilitating the event of recent cell functions and driving their introduction into the market.
Whereas solely app builders can verify with certainty whether or not they used Flutter to program their apps or elements of them, out of the 17 apps we reported to Google, three of them include Flutter-specific libraries or .dart extensions, which confer with Flutter’s Dart programming language. This means that no less than among the attackers are utilizing benign third-party instruments to facilitate the event of their malicious apps.
Misleading communication strategies
Malicious mortgage apps typically use wording and design components that carefully resemble official mortgage apps. This intentional similarity makes it tough for typical customers to find out the authenticity of an app, particularly when monetary and authorized phrases are concerned. The misleading communications deployed by these apps are divided into a number of layers.
Official Google Play description
To have the ability to put their foot within the door of Google Play and be revealed on the platform, all the SpyLoan apps we analyzed offered an outline that principally seems to be in line not solely with Google Play necessities but additionally appears to cowl native authorized calls for; some apps even claimed to be registered non-banking monetary firms. Nonetheless, the on-the-ground transactions and enterprise practices – as evidenced by consumer evaluations and different experiences – carried out by the builders of those apps didn’t meet the requirements explicitly said by them.
Typically, SpyLoan apps overtly state what permissions are requested, declare to have the appropriate license, and supply the vary of the annual share price (that’s all the time throughout the authorized restrict set by native usury legal guidelines or comparable laws). The annual share price (APR) describes and contains the rate of interest and sure charges, or fees related to the mortgage, similar to origination charges, processing charges, or different finance fees. In lots of nations, it’s legally capped and for example, within the case of private mortgage suppliers within the US, Google capped the APR at 36%.
The full annual price (TAC; or CAT – costo annual complete – in Spanish) goes past the APR and contains not solely the rate of interest and costs but additionally different prices, similar to insurance coverage premiums or further bills associated to the mortgage. The TAC, due to this fact, supplies debtors with a extra correct estimate of the overall monetary dedication required by the mortgage, together with all related prices. As some Latin American nations require mortgage suppliers to reveal the TAC, SpyLoan apps marketed on this area revealed the true excessive price of their loans with TACs between 160% and 340%, proven in Determine 15.
App descriptions additionally included the tenure for private loans, which is ready by the mortgage supplier and in response to Google’s Monetary Providers coverage can’t be set to 60 days or much less. Mortgage tenure represents the interval inside which the borrower is anticipated to repay the borrowed funds and all related prices to the lender. The apps we analyzed had tenure set between 91 and 360 days (see Determine 15); nevertheless, prospects offering suggestions on Google Play (see Determine 16) complained that the tenure was considerably shorter and curiosity was excessive. If we take a look at the third instance within the suggestions in Determine 16, the curiosity (549 pesos) was increased than the precise mortgage (450 pesos), and the mortgage along with the curiosity (999 pesos) should have been repaid in 5 days, due to this fact violating Google’s mortgage tenure insurance policies.
Privateness coverage
As a result of it’s mandated by Google Play Developer Coverage, and in keeping with Know Your Buyer (KYC) requirements, builders who wish to place their apps on Google Play should present a sound and simply accessible privateness coverage. This coverage should cowl features such because the kinds of knowledge collected, how it’s used, who it could be shared with, safety measures in place to guard consumer knowledge, and the way customers can train their rights concerning their knowledge. That is akin to KYC pointers that require transparency in knowledge utilization and safety. KYC necessities for knowledge assortment usually embody gathering private data similar to full identify, date of beginning, tackle, contact particulars, and a government-issued identification quantity or doc. Within the monetary providers context, this may additionally contain gathering knowledge on employment standing, earnings supply, credit score historical past, and different data related to assessing creditworthiness.
Despite the fact that a privateness coverage is a authorized doc, it may be mechanically generated in a very simple means – there are a lot of free privateness coverage mills that may generate such a doc after the app developer inserts primary knowledge such because the identify of the app, the corporate behind it, and knowledge the app is gathering. This implies it is fairly easy to create a privateness coverage that appears real to the typical individual.
In stark distinction to KYC norms, the SpyLoan apps we recognized used misleading techniques of their privateness insurance policies. They claimed to want permission to entry media recordsdata “to conduct a danger evaluation”, storage permission “to assist submit paperwork”, entry SMS knowledge they claimed is expounded solely to monetary transactions “to correctly establish you”, entry calendar “with a purpose to schedule the respective fee date and the respective reminders”, digicam permission “to assist customers add required picture knowledge”, and name log permissions “to substantiate our app is put in by yourself cellphone”. In actuality, in response to KYC requirements, identification verification and danger evaluation could possibly be achieved utilizing a lot much less intrusive knowledge assortment strategies. As we beforehand talked about, in response to privateness insurance policies of those apps, if these permissions aren’t granted to the app, the service, and due to this fact the mortgage, is not going to be offered. The reality is these apps don’t want all of those permissions, as all of this knowledge could be uploaded into the app with one-time permission that has entry solely to chose footage and paperwork, to not all of them, a calendar request could be despatched to the mortgage recipient by e mail, and the permission to entry name logs is totally pointless.
Some privateness insurance policies had been worded in a particularly contradictory means. On one hand, they listed deceitful causes for gathering private knowledge, whereas alternatively, they claimed no delicate private knowledge is collected, as depicted in Determine 17. This goes towards KYC requirements, which require sincere and clear communication about knowledge assortment and utilization, together with the particular kinds of knowledge talked about earlier.
We imagine the true objective of those permissions is to spy on the customers of those apps and harass and blackmail them and their contacts.
One other privateness coverage revealed that the app offering loans for Egyptians is operated by SIMPAN PINJAM GEMILANG SEJAHTERA MANDIRI. In line with the Egyptian Basic Authority for Funding and Free Zones, no such firm is registered in Egypt; we discovered it, nevertheless, on the listing of dozens of unlawful peer-to-peer lending platforms that the Indonesian Funding Alert Job Pressure warned about in January 2021.
In conclusion, whereas these SpyLoan apps technically adjust to the necessities of getting a privateness coverage, their practices clearly transcend the scope of knowledge assortment needed for offering monetary providers and complying with the KYC banking requirements. In step with KYC laws, official mortgage apps would solely request needed private knowledge to confirm identification and creditworthiness, not demand entry to unrelated knowledge like media recordsdata or calendar entries. Total, it is essential for customers to know their rights and be cautious in regards to the permissions they grant to any app. This contains being conscious of the requirements set by KYC banking laws, that are designed not solely to guard monetary establishments from fraud and different unlawful actions, but additionally the non-public knowledge and monetary transactions of their customers.
Web sites
A few of these apps had official web sites that helped to create the phantasm of a longtime, customer-focused private mortgage supplier, contained a hyperlink to Google Play, and different principally generic and easy data that was much like the outline the developer offered on Google Play, earlier than the app was taken down. They normally didn’t reveal the identify of the enterprise that was behind the app. Nonetheless, one of many a number of web sites we analyzed went additional and contained particulars about open job positions, photos of a cushty workplace surroundings, and footage of the Board of Administrators – all of which had been stolen from different web sites.
Open job positions had been copied from different firms and edited solely in minor methods. Within the one copied from Instahyre, a hiring platform primarily based in India, and proven in Determine 18, solely the road “Good information about Ameyo” was moved to a unique place within the textual content.
Three photos of the workplace surroundings depicted in Determine 19 had been copied from two firms – workplace and enjoying discipline images are from PaywithRing, an Indian fee app with thousands and thousands of consumers, and the workforce picture is from The Higher India, an Indian digital media platform.
The Board of Administrators members correspond to the names that had been associated to the corporate that claims to be behind this explicit app, however the footage that had been used on the web site (proven in Determine 20) depicted three totally different inventory picture fashions, and the web site didn’t state that these photos had been for illustrative functions solely.
Whereas it’s straightforward to do a reverse picture search on Google to search for the supply of those footage in a desktop browser, you will need to word that that is rather more tough to do on a cellphone. As we beforehand famous, suppliers of those apps focus solely on potential debtors who wish to use a cell phone to acquire a mortgage.
Authentic vs malicious mortgage apps – how you can distinguish between them
As talked about within the Misleading communication strategies part, even when the app or the corporate behind it says it’s an authorised mortgage supplier, this doesn’t mechanically assure its legitimacy or moral practices – it could nonetheless trick potential prospects through the use of misleading techniques and deceptive details about the mortgage phrases. As talked about by Lookout, making use of for a mortgage from established establishments would possibly appear to be the perfect recommendation for potential debtors, however SpyLoan apps make it actually tough to tell apart them from normal monetary organizations and a few debtors don’t have entry to conventional monetary entities. It’s due to this fact important to method mortgage apps with warning and take further steps to make sure their credibility, as their set up may need a really destructive impression on the monetary state of affairs of the borrower.
Sticking to official sources and utilizing a safety app must be ample to detect a malicious mortgage app; nevertheless, there are further steps customers can make use of to safeguard themselves:
- Keep on with official sources
Android customers ought to keep away from the set up of mortgage apps from unofficial sources and third-party app shops, and keep on with trusted platforms like Google Play, which implement app overview processes and safety measures. Whereas this doesn’t assure full safety, it reduces the chance of encountering rip-off mortgage apps. - Use a safety app
A dependable Android safety app protects its consumer from malicious mortgage apps and malware. Safety apps present a further layer of safety by scanning and figuring out doubtlessly dangerous apps, detecting malware, and warning customers about suspicious actions. Malicious mortgage apps talked about on this blogpost are detected by ESET merchandise as Android/SpyLoan, Android/Spy.KreditSpy, or a variant of Android/Spy.Agent. - Evaluation scrutiny
When downloading apps from Google Play, you will need to pay shut consideration to consumer evaluations (these won’t be out there on unofficial shops). It’s essential to bear in mind that optimistic evaluations could be faked and even extorted from earlier victims to extend the credibility of rip-off apps. As a substitute, debtors ought to deal with destructive evaluations and thoroughly consider the issues raised by customers as they might reveal essential data similar to extortion techniques and the precise price being charged by the mortgage supplier. - Privateness coverage and knowledge entry examination
Previous to putting in a mortgage app, people ought to take the time to learn its privateness coverage, whether it is out there. This doc typically comprises precious details about how the app accesses and shops delicate data. Nonetheless, scammers might make use of misleading clauses or obscure language to trick customers into granting pointless permissions or sharing private knowledge. Throughout set up, you will need to take note of the information the app requests entry to and query whether or not the requested knowledge is critical for the mortgage app’s performance, similar to contacts, messages, images, recordsdata, and calendar occasions. - If prevention doesn’t work
There are a number of avenues the place people can search assist and take motion in the event that they fall sufferer to digital mortgage sharks. Victims ought to report the incident to their nation’s legislation enforcement or related authorized authorities, contact shopper safety companies, and alert the establishment that governs the phrases of personal loans; in most nations, it’s the nationwide financial institution or its equal. The extra alerts these establishments obtain, the likelier it’s they are going to take motion. If the deceitful mortgage app was obtained via Google Play, people can search help from Google Play Assist the place they’ll report the app and request the removing of their private knowledge related to it. Nonetheless, you will need to word that the information may need already been extracted to the attacker’s C&C server.
Conclusion
Even after a number of takedowns, SpyLoan apps maintain discovering their method to Google Play, and function an essential reminder of the dangers debtors face when in search of monetary providers on-line. These malicious functions exploit the belief customers place in official mortgage suppliers, utilizing subtle strategies to deceive and steal a really big selection of private data.
It’s essential for people to train warning, validate the authenticity of any monetary app or service, and depend on trusted sources. By staying knowledgeable and vigilant, customers can higher shield themselves from falling sufferer to such misleading schemes.
For any inquiries about our analysis revealed on WeLiveSecurity, please contact us at threatintel@eset.com.
ESET Analysis gives non-public APT intelligence experiences and knowledge feeds. For any inquiries about this service, go to the ESET Risk Intelligence web page.
IoCs
Recordsdata
|
SHA-1 |
Filename |
Detection |
Description |
|
136067AC519C23EF7B9E8EB788D1F5366CCC5045 |
com.aa.kredit.android.apk |
Android/SpyLoan.AN |
SpyLoan malware. |
|
C0A6755FF0CCA3F13E3C9980D68B77A835B15E89 |
com.amorcash.credito.prestamo.apk |
Android/SpyLoan.BE |
SpyLoan malware. |
|
0951252E7052AB86208B4F42EB61FC40CA8A6E29 |
com.app.lo.go.apk |
Android/Spy.Agent.CMO |
SpyLoan malware. |
|
B4B43FD2E15FF54F8954BAC6EA69634701A96B96 |
com.cashwow.cow.eg.apk |
Android/Spy.Agent.EY |
SpyLoan malware. |
|
D5104BB07965963B1B08731E22F00A5227C82AF5 |
com.dinero.profin.prestamo.credito.credit score.credibus.mortgage.efectivo.money.apk |
Android/Spy.Agent.CLK |
SpyLoan malware. |
|
F79D612398C1948DDC8C757F9892EFBE3D3F585D |
com.flashloan.wsft.apk |
Android/Spy.Agent.CNB |
SpyLoan malware. |
|
C0D56B3A31F46A7C54C54ABEE0B0BBCE93B98BBC |
com.guayaba.money.okredito.mx.tala.apk |
Android/Spy.Agent.CLK |
SpyLoan malware. |
|
E5AC364C1C9F93599DE0F0ADC2CF9454F9FF1534 |
com.mortgage.money.credit score.tala.prestmo.quick.department.mextamo.apk |
Android/SpyLoan.EZ |
SpyLoan malware. |
|
9C430EBA0E50BD1395BB2E0D9DDED9A789138B46 |
com.mlo.xango.apk |
Android/Spy.Agent.CNA |
SpyLoan malware. |
|
6DC453125C90E3FA53988288317E303038DB3AC6 |
com.mmp.optima.apk |
Android/Spy.Agent.CQX |
SpyLoan malware. |
|
532D17F8F78FAB9DB953970E22910D17C14DDC75 |
com.mxolp.postloan.apk |
Android/Spy.KreditSpy.E |
SpyLoan malware. |
|
720127B1920BA8508D0BBEBEA66C70EF0A4CBC37 |
com.okey.prestamo.apk |
Android/Spy.Agent.CNA |
SpyLoan malware. |
|
2010B9D4471BC5D38CD98241A0AB1B5B40841D18 |
com.shuiyiwenhua.gl.apk |
Android/Spy.KreditSpy.C |
SpyLoan malware. |
|
892CF1A5921D34F699691A67292C1C1FB36B45A8 |
com.swefjjghs.weejteop.apk |
Android/SpyLoan.EW |
SpyLoan malware. |
|
690375AE4B7D5D425A881893D0D34BB63462DBBF |
com.truenaira.cashloan.moneycredit.apk |
Android/SpyLoan.FA |
SpyLoan malware. |
|
1F01654928FC966334D658244F27215DB00BE097 |
king.credit score.ng.apk |
Android/SpyLoan.AH |
SpyLoan malware. |
|
DF38021A7B0B162FA661DB9D390F038F6DC08F72 |
om.sc.secure.credit score.apk |
Android/Spy.Agent.CME |
SpyLoan malware. |
Community
|
IP |
Area |
Internet hosting supplier |
First seen |
Particulars |
|
3.109.98[.]108 |
pss.aakredit[.]in |
Amazon.com, Inc. |
2023-03-27 |
C&C server. |
|
35.86.179[.]229 |
www.guayabacash[.]com |
Amazon.com, Inc. |
2021-10-17 |
C&C server. |
|
35.158.118[.]139 |
eg.easycredit-app[.]com |
Amazon.com, Inc. |
2022-11-26 |
C&C server. |
|
43.225.143[.]80 |
ag.ahymvoxxg[.]com |
HUAWEI CLOUDS |
2022-05-28 |
C&C server. |
|
47.56.128[.]251 |
hwpamjvk.whcashph[.]com |
Alibaba (US) Know-how Co., Ltd. |
2020-01-22 |
C&C server. |
|
47.89.159[.]152 |
qt.qtzhreop[.]com |
Alibaba (US) Know-how Co., Ltd. |
2022-03-22 |
C&C server. |
|
47.89.211[.]3 |
relaxation.bhvbhgvh[.]area |
Alibaba (US) Know-how Co., Ltd. |
2021-10-26 |
C&C server. |
|
47.91.110[.]22 |
la6gd.cashwow[.]membership |
Alibaba (US) Know-how Co., Ltd. |
2022-10-28 |
C&C server. |
|
47.253.49[.]18 |
mpx.mpxoptim[.]com |
Alibaba (US) Know-how Co., Ltd. |
2023-04-24 |
C&C server. |
|
47.253.175[.]81 |
oy.oyeqctus[.]com |
ALICLOUD-US |
2023-01-27 |
C&C server. |
|
47.254.33[.]250 |
iu.iuuaufbt[.]com |
Alibaba (US) Know-how Co., Ltd. |
2022-03-01 |
C&C server. |
|
49.0.193[.]223 |
kk.softheartlend2[.]com |
IRT-HIPL-SG |
2023-01-28 |
C&C server. |
|
54.71.70[.]186 |
www.credibusco[.]com |
Amazon.com, Inc. |
2022-03-26 |
C&C server. |
|
104.21.19[.]69 |
cy.amorcash[.]com |
Cloudflare, Inc. |
2023-01-24 |
C&C server. |
|
110.238.85[.]186 |
api.yumicash[.]com |
HUAWEI CLOUDS |
2020-12-17 |
C&C server. |
|
152.32.140[.]8 |
app.truenaira[.]co |
IRT-UCLOUD-HK |
2021-10-18 |
C&C server. |
|
172.67.131[.]223 |
apitai.coccash[.]com |
Cloudflare, Inc. |
2021-10-21 |
C&C server. |
MITRE ATT&CK strategies
This desk was constructed utilizing model 13 of the MITRE ATT&CK framework.
|
Tactic |
ID |
Identify |
Description |
|
Discovery |
Software program Discovery |
SpyLoan can acquire an inventory of put in functions. |
|
|
File and Listing Discovery |
SpyLoan lists out there images on exterior storage and extracts Exif data. |
||
|
System Community Configuration Discovery |
SpyLoan extracts the IMEI, IMSI, IP tackle, cellphone quantity, and nation. |
||
|
System Info Discovery |
SpyLoan extracts details about the system, together with SIM serial quantity, system ID, and customary system data. |
||
|
Assortment |
Location Monitoring |
SpyLoan tracks system location. |
|
|
Protected Consumer Information: Calendar Entries |
SpyLoan extracts calendar occasions. |
||
|
Protected Consumer Information: Name Logs |
SpyLoan extracts name logs. |
||
|
Protected Consumer Information: Contact Record |
SpyLoan extracts the contact listing. |
||
|
Protected Consumer Information: SMS Messages |
SpyLoan extracts SMS messages. |
||
|
Command and Management |
Utility Layer Protocol: Internet Protocols |
SpyLoan makes use of HTTPS to speak with its C&C server. |
|
|
Encrypted Channel: Symmetric Cryptography |
SpyLoan makes use of AES to encrypt its communication. |
||
|
Exfiltration |
Exfiltration Over C2 Channel |
SpyLoan exfiltrates knowledge utilizing HTTPS. |
