Android InfoStealer Threats Continue to Evolve

The SonicWall Capture Labs Threat Research team identified an Android-based threat that combines remote device management with multiple information-stealing capabilities. Once active on a device, the malware can collect SMS messages, contacts, call logs, location information, device details, and accounts registered on the device. It can also communicate with remote infrastructure, allowing attackers to manage certain operations and receive collected information. These activities could lead to privacy violations, data theft, and further exploitation.

Technical Analysis :

The malware is distributed under the application name VirusSecurity. As shown in the figure below, the application uses this name during installation, which may make it appear like a security-related application to users.The malware is distributed under the application name VirusSecurity. As shown in the figure below, the application uses this name during installation, which may lead users to believe it is a security-related application.

After installation, the application requests several sensitive permissions to access different features and data on the Android device. These include access to location, contacts, notifications, and other device-related information.After installation, the application requests several sensitive permissions to access features and data on the Android device. These include access to location, contacts, notifications, and other device-related information.

Some of these permission requests are shown in the figures below.

At the time of installation, the application requests the following sensitive permissions:During installation, the application requests the following sensitive permissions:

 

The malware uses Firebase services as C&C to exchange information between the infected device and its remote infrastructure. This allows threat actors to manage certain malware operations and access information collected from compromised devices.The malware uses Firebase services as a C&C to exchange information between the infected device and its remote infrastructure. This enables threat actors to manage certain malware operations and access data collected from compromised devices.

The malware collects device-related information, including the application name, package name, and IP address, and sends these details to Firebase Realtime Database, as shown in the figures below.The malware collects device-related information, including the application name, package name, and IP address, and sends this information to Firebase Realtime Database, as shown in the figures below.

 

The malware uses Android's AccountManager API to retrieve registered accounts on the device. It validates the retrieved account names against Patterns.EMAIL_ADDRESS and stores valid email addresses in a list. The malware initialises the account index variables f667ak to 0 and f674n1 to 1, then assigns sequential identifiers such as Gmail1, Gmail2, and so on.

Malware authors can use the collected Gmail IDs for targeted phishing, password attacks, account-recovery abuse, and user identification.

As shown in the figure below, the malware collects user and device details, stores them as key-value pairs in a HashMap, and transmits them to Firebase.

SonicWall Protections

SonicWall Capture Labs provides protection against this threat via the following signature:

• GAV: AndroidInfoStealer.A (Trojan)

This file is detected by SonicWall Capture ATP w/RTDMI and SonicWall Endpoint Security.

Indicators of Compromise (IOCs)APK file’s SHA-256:

• 8f60cd1d5681f1e0a95012c96e49fbdc7c7e39b6b75d2daf132dfc4907717d51
• 52661aefe5235999027d4bfb715df9fe7f7a7dbd781efb95c10eac7027b3ab07
• 71332fb12d8a8c628cd78c87476f86a33aff84dc80a2b80684ef08d00f7f129b
• e6c18021b9d1d07579f0eb67deccf4a00da5f9c6bf69d6c9f6f5b96eca253887