Android app breaking dangerous: From professional display screen recording to file exfiltration inside a 12 months

ESET researchers have found a trojanized Android app that had been accessible on the Google Play retailer with over 50,000 installs. The app, named iRecorder – Display Recorder, was initially uploaded to the shop with out malicious performance on September 19^th, 2021. Nonetheless, it seems that malicious performance was later carried out, almost certainly in model 1.3.8, which was made accessible in August 2022.

It’s uncommon for a developer to add a professional app, wait nearly a 12 months, after which replace it with malicious code. The malicious code that was added to the clear model of iRecorder is predicated on the open-source AhMyth Android RAT (distant entry trojan) and has been custom-made into what we named AhRat.

Moreover this one case, we now have not detected AhRat wherever else within the wild. Nonetheless, this isn’t the primary time that AhMyth-based Android malware has been accessible on Google Play; we beforehand printed our analysis on such a trojanized app in 2019. Again then, the spyware and adware, constructed on the foundations of AhMyth, circumvented Google’s app-vetting course of twice, as a malicious app offering radio streaming.

Overview of the app

Except for offering professional display screen recording performance, the malicious iRecorder can report surrounding audio from the gadget’s microphone and add it to the attacker’s command and management (C&C) server. It could additionally exfiltrate information with extensions representing saved internet pages, photographs, audio, video, and doc information, and file codecs used for compressing a number of information, from the gadget. The app’s particular malicious conduct – exfiltrating microphone recordings and stealing information with particular extensions – tends to counsel that it’s a part of an espionage marketing campaign. Nonetheless, we weren’t capable of attribute the app to any explicit malicious group.

As a Google App Protection Alliance accomplice, ESET recognized the newest model of the appliance as malicious and promptly shared its findings with Google. Following our alert, the app was faraway from the shop.

Distribution

The iRecorder utility was initially launched on the Google Play Retailer on September 19^th, 2021, providing display screen recording performance; at the moment, it contained no malicious options. Nonetheless, round August 2022 we detected that the app’s developer included malicious performance in model 1.3.8. As illustrated in Determine 1, by March 2023 the app had amassed over 50,000 installations.

Determine 1. The trojanized iRecorder app

Nonetheless, Android customers who had put in an earlier model of iRecorder (previous to model 1.3.8), which lacked any malicious options, would have unknowingly uncovered their units to AhRat, in the event that they subsequently up to date the app both manually or routinely, even with out granting any additional app permission approval.

Following our notification concerning iRecorder’s malicious conduct, the Google Play safety workforce eliminated it from the shop. Nonetheless, it is very important notice that the app can be discovered on different and unofficial Android markets. The iRecorder developer additionally offers different functions on Google Play, however they don’t comprise malicious code.

Attribution

Beforehand, the open-source AhMyth was employed by Clear Tribe, often known as APT36, a cyberespionage group identified for its in depth use of social engineering methods and focusing on authorities and army organizations in South Asia. Nonetheless, we can not ascribe the present samples to any particular group, and there aren’t any indications that they have been produced by a identified superior persistent menace (APT) group.

Evaluation

Throughout our evaluation, we recognized two variations of malicious code based mostly on AhMyth RAT. The primary malicious model of iRecorder contained components of AhMyth RAT’s malicious code, copied with none modifications. The second malicious model, which we named AhRat, was additionally accessible on Google Play, and its AhMyth code was custom-made, together with the code and communication between the C&C server and the backdoor. By the point of this publication, we now have not noticed AhRat in some other Google Play app or elsewhere within the wild, iRecorder being the one app that has contained this custom-made code.

AhMyth RAT is a potent instrument, able to varied malicious capabilities, together with exfiltrating name logs, contacts, and textual content messages, acquiring an inventory of information on the gadget, monitoring the gadget location, sending SMS messages, recording audio, and taking footage. Nonetheless, we noticed solely a restricted set of malicious options derived from the unique AhMyth RAT in each variations analyzed right here. These functionalities appeared to suit throughout the already outlined app permissions mannequin, which grants entry to information on the gadget and permits recording of audio. Notably, the malicious app offered video recording performance, so it was anticipated to ask for permission to report audio and retailer it on the gadget, as proven in Determine 2. Upon set up of the malicious app, it behaved as an ordinary app with none particular additional permission requests that may have revealed its malicious intentions.

Determine 2. Permissions requested by the iRecorder app

After set up, AhRat begins speaking with the C&C server by sending primary gadget info and receiving encryption keys and an encrypted configuration file, as seen in Determine 3. These keys are used to encrypt and decrypt the configuration file and a few of the exfiltrated information, such because the checklist of information on the gadget.

Determine 3. AhRat’s preliminary C&C communication

After the preliminary communication, AhRat pings the C&C server each quarter-hour, requesting a brand new configuration file. This file incorporates a variety of instructions and configuration info to be executed and set on the focused gadget, together with the file system location from which to extract consumer information, the file varieties with explicit extensions to extract, a file dimension restrict, the length of microphone recordings (as set by the C&C server; throughout evaluation it was set to 60 seconds), and the interval of time to attend between recordings – quarter-hour – which can be when the brand new configuration file is obtained from the C&C server.

Apparently, the decrypted configuration file incorporates extra instructions than AhRat is able to executing, as sure malicious performance has not been carried out. This may occasionally point out that AhRat is a light-weight model just like the preliminary model that contained solely unmodified malicious code from the AhMyth RAT. Regardless of this, AhRat remains to be able to exfiltrating information from the gadget and recording audio utilizing the gadget’s microphone.

Based mostly on the instructions obtained within the configuration from the C&C server, AhRat ought to be able to executing 18 instructions. Nonetheless, the RAT can execute solely the six instructions from the checklist beneath marked in daring and with an asterisk:

• RECORD_MIC*
• CAPTURE_SCREEN
• LOCATION
• CALL_LOG
• KEYLOG
• NOTIFICATION
• SMS
• OTT
• WIFI
• APP_LIST
• PERMISSION
• CONTACT
• FILE_LIST*
• UPLOAD_FILE_AFTER_DATE*
• LIMIT_UPLOAD_FILE_SIZE*
• UPLOAD_FILE_TYPE*
• UPLOAD_FILE_FOLDER*
• SCHEDULE_INTERVAL

The implementation for many of those instructions shouldn’t be included within the app’s code, however most of their names are self-explanatory, as proven additionally in Determine 4.

Determine 4. Decrypted configuration file with an inventory of instructions

Throughout our evaluation, AhRat obtained instructions to exfiltrate information with extensions representing internet pages, photographs, audio, video, and doc information, and file codecs used for compressing a number of information. The file extensions are as follows: zip, rar, jpg, jpeg, jpe, jif, jfif, jfi, png, mp3, mp4, mkv, 3gp, m4v, mov, avi, gif, webp, tiff, tif, heif, heic, bmp, dib, svg, ai, eps, pdf, doc, docx, html, htm, odt, pdf, xls, xlsx, ods, ppt, pptx, and txt.

These information have been restricted to a dimension of 20 MB and have been situated within the Obtain listing /storage/emulated/0/Obtain.

Situated information have been then uploaded to the C&C server, as seen in Determine 5.

Determine 5. File exfiltration to C&C server

Conclusion

The AhRat analysis serves as a very good instance of how an initially professional utility can remodel right into a malicious one, even after many months, spying on its customers and compromising their privateness. Whereas it’s doable that the app developer had meant to construct up a consumer base earlier than compromising their Android units via an replace or {that a} malicious actor launched this variation within the app; thus far, we now have no proof for both of those hypotheses.

Thankfully, preventative measures towards such malicious actions have already been carried out in Android 11 and better variations within the type of App hibernation. This function successfully locations apps which were dormant for a number of months right into a hibernation state, thereby resetting their runtime permissions and stopping malicious apps from functioning as meant. The malicious app was faraway from Google Play after our alert, which confirms that the necessity for cover to be offered via a number of layers, resembling ESET Cellular Safety, stays important for safeguarding units towards potential safety breaches.

The remotely managed AhRat is a customization of the open-source AhMyth RAT, which implies that the authors of the malicious app invested important effort into understanding the code of each the app and the again finish, finally adapting it to swimsuit their very own wants.

AhRat’s malicious conduct, which incorporates recording audio utilizing the gadget’s microphone and stealing information with particular extensions, may point out that it was a part of an espionage marketing campaign. Nonetheless, we now have but to search out any concrete proof that might allow us to attribute this exercise to a selected marketing campaign or APT group.

IoCS

Recordsdata

Community

MITRE ATT&CK Methods

This desk was constructed utilizing model 12 of the MITRE ATT&CK framework.