Unofficial Telegram App Secretly Loads Infinite Malicious Sites

We recently found a malicious app named MobonoGram 2019 (detected as Android.Fakeyouwon) advertising itself as an unofficial version of the Telegram messaging app and claiming to provide even more features than both the official and other unofficial versions in the market. While the app does provide basic messaging functionality, we found it was also secretly running a few services on the device without the user’s consent, as well as loading and browsing an endless stream of malicious websites in the background.

The app was available to mobile users even in regions that have banned Telegram, such as Iran and Russia, and was also downloadable by U.S. users. It allowed users to toggle between English or the Persian language (Farsi). The app seemed to have used the open-source code of the legitimate Telegram app. Its developers appeared to have injected their malicious code into the app before publishing it on the Play store.

The app was available on Google Play for a time and downloaded more than 100,000 times before it was removed from the store. The developer, RamKal Developers, is believed to have published at least five updates for the app on the Play store before it was taken down.

Persistence mechanism

From the malware's manifest file, we spotted a class named Autostart (android.support.translations.english.autostart) which implements a broadcast receiver. This receiver responds to three events on the device: whenever it is booted up, when an app is being installed, or when any app is being updated (BOOT_COMPLETED, PACKAGE_ADDED, PACKAGE_REPLACED, respectively).

When the broadcast receiver class receives the said events, the AddService class will be summoned, then initiates a few other services, namely AndroidAF, AndroidAL, AndroidPA, AndroidPC, AndroidSH—all without the user's knowledge.

To ensure the service would run persistently, the developer added two methods in the AddService class: Firstly, to start the service as a foreground service in AddService class. According to Android, a foreground service is rarely killed, even when memory is low. 

Secondly, in the event that the service is killed, the malware sets an alarm that initializes the AddService class to reboot itself 7,200,000 milliseconds, or two hours, after it was destroyed. With such tactics, the malware will be able to execute itself indefinitely.

With the services up and running, it starts to access a few designated servers, which will respond with JSON-formatted content consisting of three main parts: a URL (denoted as Link in the response), a user agent (denoted as Agent in the response), and three JavaScript codes (denoted as S1, S2, S3 in the response).

Infinite requests

With the given URL (see "Link" in Figure 4), the malware tries to access and load the page. A fraudulent user agent is also added to the URL's request header to disguise the source of the request. From our research, we believe that the user agent generated is at least semi-random, since no two same user agents are generated from querying the same server.

We found that the URL changes based on the geographical location of the device's IP address. For example, when we used an IP address originating from the U.S., a fraud website similar to Fakeyouwon was returned. When we used an IP address from Singapore, the server responded with a Fakeyouwon, pornography, or gaming website. We cannot say how many different URLs can be returned by the server—for all we know, what we've seen was only a drop in the bucket.

We have also seen the URL making a request to itself, causing an infinite loop of requests to the website. Such activity not only exhausts the device’s battery, but also leads to an unpleasant user experience and may even cause the device to crash. 

Three JavaScript codes

Looking at the three JavaScript codes, we initially believed that the app was originally designed to simulate clicking behind the scenes in order to generate ad revenues and increase web traffic (click fraud). However, the clicking events were not seen in action, even though all JavaScript codes were indeed loaded. Nonetheless, we cannot entirely dismiss the possibility of the malware being used for click fraud or some other malicious end.

From the source code, we can see that the contents of the JavaScript were indeed executed in the code, and they are entirely controlled by the server, which implies that the content can be easily changed as and when desired.

Upon obtaining the server's response, the code will first load the "Link" URL, followed by loading the "S1" JavaScript after 1,000 milliseconds (1 second), then the "S2" script after 15,000 milliseconds (15 seconds), and finally the "S3" script after 35,000 milliseconds (35 seconds).

Different apps, same behavior

During our research, we also came across another social messaging app named Whatsgram on the Play store. Not only does this app exhibit similar malicious behavior described in this blog, it was also published by the same developer (RamKal Developers). 

On many third-party Android app stores, we found four other apps that were published by a developer known as PhoenixAppsIR. These apps also contain similar malicious code that accesses malicious and/or phishing websites using the victim device unbeknownst to the user. We believe that either these two developers belong to one and the same organization, or the code was being copied from one to the other.

Prevalence

From January through May 2019, Symantec detected and blocked 1,235 infections related to the Android.Fakeyouwon malware family (Figure 9), with the highest number of infections located in the U.S., Iran, India, and the UAE (Figure 10).

Meanwhile, the highest number of devices infected by the particular Fakeyouwon variant described in this blog since January 2019 were located in Iran, the U.S., UAE, and Germany.

Mitigation

Such code structure is usually hard to spot via static code analysis, making it extremely easy for the attacker to sneak its way into Google Play. Additionally, these attacks can become really nasty quickly as it can load and execute any dynamic malicious contents that are sent by the server.

We advise users to take the following precautions:

• Keep your software up to date.
• Do not download apps from unfamiliar sites.
• Only install apps from trusted sources.
• Pay close attention to the permissions requested by apps.
• Install a suitable mobile security app, such as Norton or Symantec Endpoint Protection Mobile, to protect your device and data.
• Make frequent backups of important data.

Protection

Symantec and Norton products detect the malicious app as Android.Fakeyouwon.

Indicators of Compromise

Note: *The list shown is by no means exhaustive.