Authored by Fernando Ruiz
McAfee Cell Analysis Workforce recognized an Android backdoor carried out with Xamarin, an open-source framework that enables constructing Android and iOS apps with .NET and C#. Dubbed Android/Xamalicious it tries to realize accessibility privileges with social engineering after which it communicates with the command-and-control server to guage whether or not or to not obtain a second-stage payload that’s dynamically injected as an meeting DLL at runtime degree to take full management of the machine and doubtlessly carry out fraudulent actions reminiscent of clicking on advertisements, putting in apps amongst different actions financially motivated with out consumer consent.
The second stage payload can take full management of the contaminated machine as a result of highly effective accessibility providers that have been already granted through the first stage which additionally incorporates features to self-update the primary APK which implies that it has the potential to carry out any kind of exercise like a spyware and adware or banking trojan with out consumer interplay. Nonetheless, we recognized a hyperlink between Xamalicious and the ad-fraud app “Money Magnet” which robotically clicks advertisements, installs apps, and different actions to fraudulently generate income whereas customers that put in it might earn factors which might be purported to be redeemable as a retail reward card. Which means the builders behind these threats are financially motivated and drive ad-fraud subsequently this is perhaps one of many fundamental payloads of Xamalicious.
The utilization of the Xamarin framework allowed malware authors to remain lively and with out detection for a very long time, making the most of the construct course of for APK recordsdata that labored as a packer to cover the malicious code. As well as, malware authors additionally carried out completely different obfuscation methods and customized encryption to exfiltrate information and talk with the command-and-control server.
We’ve recognized about 25 completely different malicious apps that carry this menace. Some variants have been distributed on Google Play since mid-2020. The apps recognized on this report have been proactively eliminated by Google from Google Play forward of our reporting. McAfee is a member of the App Protection Alliance and an lively associate within the malware mitigation program, which goals to shortly discover Doubtlessly Dangerous Functions (PHAs) and cease them earlier than they ever make it onto Google Play. Android customers are protected by Google Play Shield, which might warn customers of recognized malicious apps on Android units. McAfee Cell Safety detects this menace as Android/Xamalicious.
Based mostly on the variety of installations these apps could have compromised at the very least 327,000 units from Google Play plus the installations coming from third-party markets that frequently produce new infections based mostly on the detection telemetry of McAfee shoppers all over the world. This menace stays very lively.
Determine 1. “Depend Straightforward Calorie Calculator” was accessible on Google Play on August 2022 and carries Android/Xamalicious
Android/Xamalicious trojans are apps associated to well being, video games, horoscope, and productiveness. Most of those apps are nonetheless accessible for obtain in third-party marketplaces.
Beforehand we detected malware abusing Xamarin framework such because the open-sourced AndroSpy and forked variations of it, however Xamalicious is carried out otherwise. Technical particulars about Xamarin structure are properly documented and element how .NET code is interpreted by Android utilizing Mono.
Acquiring Accessibility Providers
Let’s use the app “Numerology: Private horoscope & Quantity predictions” for example. As soon as began it instantly requests the sufferer to allow accessibility providers for “appropriate work” and gives instructions to activate this permission:
Determine 2. Tricking customers into granting accessibility providers permission
Customers have to manually activate the accessibility providers after a number of OS warnings reminiscent of the next on the accessibility choices:
Determine 3. Accessibility providers configuration immediate highlights the dangers of this permission.
The place is the malicious code?
This isn’t the normal Java code or native ELF Android utility, the malware module was written initially in .NET and compiled right into a dynamic hyperlink library (DLL). Then it’s LZ4 compressed, and it is perhaps embedded right into a BLOB file, or instantly accessible within the /assemblies listing on the APK construction. This code is loaded then by a local library (ELF) or by the DEX file at runtime degree. In easy phrases, which means that in some samples the reversing of the DLL assemblies is simple whereas in others it requires further steps to unpack them.
The malicious code is often accessible in two completely different meeting recordsdata within the /assemblies listing on the apk. Normally, file names are core.dll and a <package-specific>.dll.
Some malware variants has obfuscated the DLL assemblies to keep away from evaluation and reversing of the malicious code whereas others hold the unique code accessible.
Determine 4. Core.dll and GoogleService.dll comprise malicious code.
Communication with the command-and-control server
As soon as accessibility permissions are granted the malware initiates communication with the malicious server to dynamically load a second-stage payload.
Determine 5. App execution and communication with the malicious server
Acquire Machine Data
Android/Xamalicious collects a number of machine information together with the listing of put in purposes obtained by way of system instructions to find out if the contaminated sufferer is an effective goal for the second stage payload. The malware can acquire location, service, and community data amongst machine rooting standing, adb connectivity configuration, for example, if the machine is related by way of ADB or is rooted, the C2 won’t present a second-stage payload DLL for obtain.
| Technique/Command | Description |
| DevInfo | {Hardware} and machine data that features:
|
| GeoInfo | Location of the machine based mostly on IP deal with, the malware contacts providers reminiscent of api.myip.com to confirm the machine location and ISP information.
FraudScore: Self-protection to determine if the machine is just not an actual consumer |
| EmuInfo | It lists all adbProperties that in an actual machine are round 640 properties. This listing is encoded as a string param in URL encoded format.
This information could also be used to determinate if the affected shopper is an actual machine or emulator because it incorporates params reminiscent of:
|
| RootInfo | After making an attempt to determine if the machine is rooted or not with a number of methods the output is consolidated on this command |
| Packages | It makes use of the system instructions “pm listing packages -s” and “pm listing packages -3” to listing system and put in apps on the machine. |
| Accessibility | It gives the standing if accessibility providers permissions are granted or not |
| GetURL | This command solely gives the Android Id and it’s a request for the second-stage payload. The C2 evaluates the offered shopper request and returns a standing and an encrypted meeting DLL. |
Information Encryption in JWT
To evade evaluation and detection, malware authors encrypted all communication and information transmitted between the C2 and the contaminated machine, not solely protected by HTTPS, it’s encrypted as a JSON Net Encryption (JWE) token utilizing RSA-OAEP with a 128CBC-HS256 algorithm nevertheless the RSA key values utilized by the Xamalicious are hardcoded within the decompiled malicious DLL so decryption of transmitted data is feasible if C2 infrastructure is on the market through the evaluation.
Within the Ship() operate Android/Xamalicious first prepares the obtained object, often a JSON construction calling the operate encrypt() which creates the JWT utilizing a hardcoded RSA key. So the info is exfiltrated absolutely encrypted to the malware host pointing to the trail “/Updater” by way of HTTP POST methodology.
Then it waits for the C2 response and passes it to the decrypt() operate which has a hardcoded RSA non-public key to correctly decrypt the obtained command which could comprise a second stage payload for the “getURL” command.
Encrypt Technique:
Determine 6. Encrypt operate with hardcoded RSA Key values as XML string
The decryption methodology can be hardcoded into malware which allowed the analysis workforce to intercept and decrypt the communication from the C2 utilizing the RSA key values offered as XML string it’s potential to construct a certificates with the parameters to decrypt the JWE tokens content material.
C2 analysis
Collected information is transmitted to the C&C to find out if the machine is a correct goal to obtain a second-stage payload. The self-protection mechanism of the malware authors goes past conventional emulation detection and nation code operator limitations as a result of on this case, the command-and-control server won’t ship the second stage payload if the machine is rooted or related as ADB by way of USB or doesn’t have a SIM card amongst a number of different surroundings validations.
DLL Customized Encryption
With the getURL command, the contaminated shopper requests the malicious payload, if the C&C Server determines that the machine is “Okay” to obtain the malicious library it’s going to encrypt a DLL with Superior encryption normal (AES) in Cipher block chaining (CBC) utilizing a customized key for the shopper that requested it based mostly on the machine id and different parameters defined beneath to decrypt the code because it’s a symmetric encryption methodology, the identical key works for encryption and decryption of the payload.
Delivers the Payload in JWT
The encrypted DLL is inserted as a part of the HTTP response within the encrypted JSON Net Token “JWT”. Then the shopper will obtain the token, decrypt it, after which decrypt the ‘url’ parm with AES CBC and a customized key.
The AES key used to decrypt the meeting is exclusive per contaminated machine and its string of 32 chars of size incorporates appended the machine ID, model, mannequin, and a hardcoded padding of “1” as much as 32 chars of size.
As an illustration, if the machine ID is 0123456ABCDEF010 and the affected machine is a Pixel 5, then the AES key’s: “0123456ABCDEF010googlePixel 5111”
Which means the DLL has a number of layers of encryption.
- It’s a HTTPS protected.
- It’s encrypted as a JWE Token utilizing RSA-OAEP with a 128CBC-HS256 algorithm.
- URL parameter that incorporates the DLL is encrypted with AES and encoded as base64
All these efforts are associated to hiding the payload and making an attempt to remain below the radar the place this menace had relative success since some variants may need been lively years in the past with out AV detections.
DLL Injected
Xamalicious will identify this DLL “cache.bin” and retailer it within the native system to lastly dynamically load it utilizing the Meeting.Load methodology.
As soon as the second stage payload has been loaded the machine may be absolutely compromised as a result of as soon as accessibility permissions are granted, it might probably obverse and work together with any exercise opening a backdoor to any kind of malicious exercise.
Throughout the evaluation, the downloaded second stage payload contained a DLL with the category “MegaSDKXE” which was obfuscated and incomplete most likely as a result of the C2 didn’t obtain the anticipated params to supply the entire malicious second stage that is perhaps restricted to a selected service, language, app put in, location, time zone or unknown circumstances of the affected machine, nevertheless, we will guarantee that it is a high-risk backdoor that leaves the chance to dynamically execute any command on the affected machine not restricted to spying, impersonation or as a financially motivated malware.
Money Magnet Advert-Fraud and Xamalicious
One of many Xamalicious samples detected by McAfee Cell generic signatures was “LetterLink” (com.regaliusgames.llinkgame) which was accessible on Google Play on the finish of 2020, with a guide icon. It was poorly described as a hidden model of “Money Magnet”: An app that performs ad-fraud with automated clicker exercise, apps downloads, and different duties that result in monetization for internet affiliate marketing. This utility affords customers factors which might be purported to be redeemable by retail reward playing cards or cryptocurrency.
Determine 8a. LetterLink login web page after working the app for the primary time.
Determine 8b. LetterLink settlement for Money Magnet
Initially revealed in 2019 on Google Play, “Money Magnet” (com.uicashmagnet) was described as a passive revenue utility providing customers to earn as much as $30 USD per thirty days working automated advertisements. Because it was eliminated by Google the authors then infiltrated LetterLink and extra lately “Dots: One Line Connector” (com.orlovst.dots) that are hidden variations of the identical ad-fraud scheme.
Determine 9. LetterLink Icon that hides Money Magnet
“LetterLink” performs a number of Xamalicious actions because it incorporates the “core.dll” library, it connects to the identical C2 server, and it makes use of the identical hardcoded non-public RSA certificates to construct the JWE encrypted tokens which offer a non-repudiation proof that the builders of Money Magnet are behind Xamalicious.
Determine 10. Money Magnet infiltrated the app as a Sport, accessible till the top of 2023
“Dots: One Line Connector” app is just not a recreation, the screenshot revealed by Google Play doesn’t correspond to the appliance conduct as a result of as soon as it’s began it simply asks for authentication credentials with none brand or reference to Money Magnet. “Dots” doesn’t comprise the identical DLLs as its predecessor, nevertheless the communication with the C2 is analogous utilizing the identical RSA key parameters. We reported this app to Google they usually promptly eliminated it from Google Play.
Affected Customers
Based mostly on our telemetry we noticed that extra affected customers are within the American continent with essentially the most exercise within the USA, Brazil, and Argentina. In Europe, shoppers additionally reported the an infection, particularly within the UK, Spain, and Germany.
Determine 11. McAfee detections Android/Xamalicious all over the world
Conclusion
Android purposes written in non-java code with frameworks reminiscent of Flutter, react native and Xamarin can present a further layer of obfuscation to malware authors that deliberately decide these instruments to keep away from detection and attempt to keep below the radar of safety distributors and hold their presence on apps markets.
Keep away from utilizing apps that require accessibility providers except there’s a real want to be used. If a brand new app tries to persuade you to activate accessibility providers claiming that it’s required with out a actual and cheap purpose and requesting to disregard the operative system warning, then it’s a crimson flag.
The second stage payload would possibly take management of the machine as a result of accessibility permissions are granted so another permission or motion can then be carried out by the malware if these directions are offered within the injected code.
As a result of it’s troublesome for customers to actively cope with all these threats, we strongly advocate that customers set up safety software program on their units and all the time hold updated. Through the use of McAfee Cell Safety merchandise, customers can additional safeguard their units and mitigate the dangers linked with these sorts of malware, offering a safer and safer expertise.
Android/Xamalicious Samples Distributed on Google Play:
| Package deal Identify | App Identify | Installs |
| com.anomenforyou.essentialhoroscope | Important Horoscope for Android | 100,000 |
| com.littleray.skineditorforpeminecraft | 3D Pores and skin Editor for PE Minecraft | 100,000 |
| com.vyblystudio.dotslinkpuzzles | Emblem Maker Professional | 100,000 |
| com.autoclickrepeater.free | Auto Click on Repeater | 10,000 |
| com.lakhinstudio.counteasycaloriecalculator | Depend Straightforward Calorie Calculator | 10,000 |
| com.muranogames.easyworkoutsathome | Sound Quantity Extender | 5,000 |
| com.regaliusgames.llinkgame | LetterLink | 1,000 |
| com.Ushak.NPHOROSCOPENUMBER | NUMEROLOGY: PERSONAL HOROSCOPE &NUMBER PREDICTIONS | 1,000 |
| com.browgames.stepkeepereasymeter | Step Keeper: Straightforward Pedometer | 500 |
| com.shvetsStudio.trackYourSleep | Observe Your Sleep | 500 |
| com.devapps.soundvolumebooster | Sound Quantity Booster | 100 |
| com.Osinko.HoroscopeTaro | Astrological Navigator: Every day Horoscope & Tarot | 100 |
| com.Potap64.universalcalculator | Common Calculator | 100 |
Indicators of Compromise
|
