This post is also available in: 日本語 (Japanese)
A recent post from EST Security revealed the use of Android spyware in spear phishing email attachments linked to the North Korean Reaper group (also known as APT37, Scarcruft, Group 123 or Red Eyes), highlighting a new mobile vector added to the threat group’s toolkit.
Unit 42 has looked further into EST’s findings and found a more advanced variant of the Trojan mentioned in their original article. Talos has written on this variant and named it KevDroid.
This post provides our analysis of KevDroid., as well as details on the discovery of previously unknown trojanized versions of a Bitcoin Ticker Widget and a PyeongChang Winter Games application, that are downloaders for the spyware variants.
The post by EST Security detailed an Android spyware disguising itself as an Anti-Virus app from Naver (the largest search and web portal service provider in South Korea). While hunting for similar samples, I came across two more versions of the same variant. One of those called home to cgalim[.]com, a domain that Palo Alto Networks had already observed being used by the Reaper group in non-mobile attacks (IOCs in Appendix).
|Google Defender Update
Table 1: Additional samples found for the original Android spyware variant linked to the Reaper group
Pivoting on artefacts from the original variant led to the discovery of a more advanced variant of the same spyware, which is described in detail further below. In addition, I also stumbled upon two Android applications that serve as downloaders for each of the two variants. They are discussed next.
While investigating the Reaper group’s Android spyware variants, I found two applications that have the ability to download and install an application from hxxp://cgalim.com/admin/hr/1[.]apk. I also observed the same URL serving the advanced variant of the Android spyware, confirming that these two applications served as downloaders for the Reaper group’s Android spyware. The two applications are trojanized versions of popular applications available on the Google Play Store. The two trojanized versions were not posted on Google Play.
While both downloaders contacted the same URL to download their payloads, looking further into their code I found that they were each written to respectively download and drop one specific variant of Reaper’s Android spyware.
|PyeongChang Winter Games
|Bitcoin Ticker Widget
Table 2: Android downloaders used to drop spyware variants linked to the Reaper group
Both applications are signed with the same certificate thereby confirming their origins from the same author(s)
Owner: CN=Jhon Phalccon, OU=Google Chrome, O=Google Chrome, L=Washington, ST=US, C=US
Issuer: CN=Jhon Phalccon, OU=Google Chrome, O=Google Chrome, L=Washington, ST=US, C=US
Serial number: 7b320fab
Valid from: Wed Jan 24 10:22:50 GMT 2018 until: Sun Jun 11 10:22:50 GMT 2045
Once these downloaders are installed, they display a message prompting the user to update the application. If the user follows the prompts, the downloader retrieves the payload and saves it to the external device memory as AppName.apk. The payload is then loaded prompting the user again to confirm its installation before it is finally installed on the device. The next section provides an analysis of the newer, more advanced variant of these payloads.
Advanced Variant Analysis
The following sample was used for this analysis
Table 3: New Android spyware variant discovered, linked to the Reaper group
This sample has the following abilities:
- Record video (default duration is 10 mins)
- Record audio (default duration is 5 mins, saved as 48_d[TS].amr)
- Capture screenshots (saved as 96_d[TS].jpg)
- Grab the phone’s file listing (saved as 128_d[TS].txt)
- Fetch specific files
- Download a list of commands
- Get device info - 64-bit Android ID, Phone number, System Properties etc (saved as 208_d[TS].json)
- Rooting the device, using a binary called ‘poc’ in the package assets
Additionally, this advanced variant is capable of exfiltrating:
- Voice recordings from incoming and outgoing calls (saved as _p[Ph]_in_[D].amr or _p[Ph]_out_[D].amr)
- Call logs (saved as 16_d[TS].json)
- SMS history (saved as 32_d[TS].json)
- Contact lists (saved as 144_d[TS].json)
- Information on registered accounts on the phone (saved as 160_d[TS].json),
In each of these cases, [TS] is the current timestamp in the format yyyyMMddkkmmss, [Ph] is the source or destination phone number for a call, and [D] is the call duration.
While these exfiltration capabilities are shared in common with the original variant, this new variant writes its own call recording library as opposed to using the open source library that was used by its predecessor.
All exfiltrated information is written to the directory /sdcard/_pu on the phone and sent to hxxp://hakproperty.com/new/plat/pu[.]php?do=upload.
Before transmission, the files are AES-encrypted using the key “08D03B0B6BE7FBCD”. This encryption scheme and key is consistent across the two variants.
Post-encryption the files are renamed with the addition of a suffix ‘x’. All created files are deleted after they are sent to the upload server.
When commanded to fetch a list of commands, the list is fetched from
hxxp://hakproperty.com/new/plat/pu[.]php?do=download_rc&aid=" + [64-bit android_id]
The emergence of a new attack vector, followed by the appearance of new variants disguising themselves as currently relevant applications like the Winter Olympics, indicates expanding operations of the Reaper group that are actively in development.
Palo Alto Networks customers benefit from the following protections against these attacks:
- AutoFocus customers can track the group’s activity using the Reaper tag.
- WildFire detects all related samples with malicious verdicts.
- Traps blocks all malicious files associated with this group.
|Reaper Downloader APK samples
|Advanced Variant sample
|Non-APK Reaper-related samples making use of cgalim[.]com