How we hack their C2s.
Our presentation will have three parts.
First, we will introduce ourselves, our work and basic knowledge about Android.
Second, we will introduce Android malware scenes and analysis of some families.
Third, we will look at how we exploit C2s.
I am Kursat and my co-speaker is Mert.
We both security engineers at Trendule and Blackbox Security.
We are finding Android malware samples and analyze them.
We find IOCs and hack them to purge stolen data.
Now let's look at Google Play Store.
To fight Android malware, Google introduced Bonsur as an anti-malware tool.
But it has distinct feature and you can easily detect it.
When you upload your APK file, it uploads it to an emulator.
This emulator has only one contact to photos.
You can also detect Bonsur IP range while it's running your APK with you.
You can also use it to evade Bonsur.
Because you can detect its feature, you can use different techniques to bypass it.
Implementing anti-analyze and anti-emulator techniques is just some examples of it.
You can also download your malicious text file separately and load into your APK.
With this, Bonsur can't even see your malicious code.
Android was by design not that secure back then.
But nowadays, they are implementing new features to harden it.
With Android P, battery encryption, process isolation, and authentication is implemented.
Not just that.
But Google Play Store changed its rules to prevent SMS and call log permission to be used in apps.
With Android Q, even more hardening is introduced.
Android Q removed clipboard monitoring, background activity, and limited screen recording.
It also restricts Bubble's API, which is commonly used for phishing by its adapters.
Also, Google introduced AppDefense Alliance to combat malware in Google Play Store.
Alliance itself includes companies which specialize in mobile malware.
Let's look at Android malware scene.
There are five types of malware common in Android.
First is AdWare.
It shows your open advertisement in a hidden manner.
Second is Spyware.
Spyware commonly steals personal information in order to sell it.
Third is Trojan.
They are commonly used to steal banking information.
Fourth is Ransomware.
They are commonly used as a feature in bank bots nowadays.
When you try to remove malware, it activates Ransomware feature.
And lastly, Crypto Miners.
They were common back then, but nowadays, due to some restrictions, like background activities,
are no longer a thing in Android's operating system.
They are decreasing.
Threat actors usually tip companies through social media advertisements to separate malware.
There is also malware as a service malware.
At first, there was GMBot, which espies Marcher.
After Marcher, Exabot emerges and it evolves into a Red Alert.
Red Alert has distinct features which also carry on to anomalies.
Nowadays, serverless malware is active and popular as a service scene.
They evolve in time as threat actors change.
They all use anti-techniques and droppers.
Exabot uses dropper to distribute itself in Google Play Store.
It also uses root detection and anti-monitor with checking device ID,
country, and operator in device.
It also tries to run shell command to find sub-binary which is present when the device is rooted.
You can see what Exabot looks for in settings.
You can bypass anti-monitor with filter like this.
And root detection like this.
Red Alert uses Twitter for C2.
The last tweet contains IP of C2.
It fakes last tweet to find out current C2 and upload the data it stolen there.
It asks for device admin permission to take over poll.
It also checks Linux apps to look for specific apps.
Anubis is a good bankbot example.
It operates as a service.
It has multiple versions which legend has multiple different developers.
It uses fake apps and phishing campaigns to distribute samples.
These are all Turkish bank or popular applications.
It also uses dropper.
And uses obfuscation in dropper sample.
Dropper Anubis samples is encrypted.
Once you decrypt it, you can see it uses call forwarding for bank numbers.
And it uses overlay attack to steal banking credentials.
If you try remove it, ransomware feature activates.
Anubis decrypts inside memory and writes decrypted code to a jar file.
After that, it loads jar file into inside which contains malicious function.
This FIRA script changes delete function so that you can fetch decrypted file from device.
You can fetch decrypted code like this.
And like this if native code is used.
Hydra Hydra is another service.
It imitates government apps to distribute itself.
Once you create Hydra sample in panel, it has time limit to activate.
Like some step to finish time.
It uses overlay attack to steal banking and other personal information.
You can bypass time limitation like this.
And like this if native code is used.
Cerberus is most updated and dangerous one among them.
They are highly active on Twitter and regularly updates Cerberus malware.
Which commonly bypass sponsor and can be found in Google Play Store.
It uses sensor data to detect emulator.
You can imitate sensor movement and bypass this check.
C2s are mainly used to distribute samples and manage both.
And they contain stolen information.
You can use this script to automate C2 extraction for some samples.
Not every sample has automated C2 extraction decryptor or unpacker.
But you can find some useful ones in the GitHub page that helps you to analyze samples faster.
Now let's look at some vulnerabilities we found C2s.
Note that most of the C2s are a part of SSRS.
So if you find vulnerability in one panel,
it's highly present on the other panels using the same malware.
Red Alert panels has direct-to-realistic vulnerability.
You can fetch infected device information from panels.
You can find all infected phone data and stolen information.
And also find encryption keys.
Let's look at another panel.
One of custom malware panel had password in page source.
Using this, you could log into panel.
It has many effective hosts and functions to control.
It also had file upload feature.
Exploiting file upload, we got shell.
We purge all data and shut down its operation.
Some other custom panel had SQL injection.
We log in as admin with it and take over the panel.
All Twitter phishing campaigns and malware distribution campaigns
had stored XSS vulnerability.
With this, you can sniff admin token to log in
and see all stolen information.
And all stolen credit card data.
And social security numbers.
We set up a cron job to delete them daily.
Main takeaways for our presentation are
we identified malware as a service users
and hacked their sites to purge stolen data.
We also shared our findings with task force
and had 13 threat actors got arrested.
If you have any questions, we will be on Discord to answer them.
Don't forget to check your downloaded apps from Google Play Store.
Never trust any application.
Thank you all for listening.
It was a pleasure to be here today.
Welcome to our presentation.
We will talk about Android malware and how we hacked their C2S.
Our presentation will have three parts.
First, we will introduce ourselves, our work and basic knowledge about Android.
Second, we will introduce Android malware scenes and analysis of some families.
Third, we will look at how we exploit C2S.
I am Kursat and my co-speaker is Mert.
We both security engineers at Trendule and Blackbox Security.
We are finding Android malware samples and analyze them.
We find IOCs and hack them to purge stolen data.
Now, let's look at Google Play Store.
To fight Android malware, Google introduced Bonsur as an anti-malware tool.
But it has distinct feature and you can easily detect it.
When you upload your APK file, it uploads it to an emulator.
This emulator has only one contact to photos.
You can also detect Bonsur IP range while it's running your APK
can also use it to evade Bonsur.
Because you can detect its feature, you can use different techniques to bypass it.
Implementing anti-analysis and anti-emulator techniques is just some examples of it.
You can also download your malicious text file separately and load into your APK.
With this, Bonsur can't even see your malicious code.
Android was by design not that secure back then.
But nowadays, they are implementing new features to harden it.
With Android P, battery encryption, process isolation, and authentication is implemented.
Not just that, but Google Play Store changed its rules
to prevent SMS and call log permission to be used in apps.
With Android Q, even more hardening is introduced.
Android Q removed clipboard monitoring, background activity, and limited screen recording.
It's also Restrict Bubbles API which is commonly used for phishing by its editors.
Also, Google introduced AppDefense Alliance to combat malware in Google Play Store.
Alliance itself includes companies which specialize in mobile malware.
Let's look at Android malware scene.
There are five types of malware common in Android.
First is Adware. It shows your open advertisement in a hidden manner.
Second is Spyware. Spyware commonly steals personal information in order to sell it.
Third is Trojan. They are commonly used to steal banking information.
Fourth is Ransomware. They are commonly used as a feature in bank bots nowadays.
When you try to remove malware, it activates ransomware feature.
And lastly, Cryptominers. They were common back then but nowadays due to some restrictions
like background activities are no longer a thing in Android operation system.
They are decreasing.
Threats occur usually to companies through social media advertisements to separate malware.
There is also malware as a service malware.
At first, there was GMBot which inspires Marcher.
After Marcher, Exabot emerges and it evolves into a Red Alert.
Red Alert has distinct feature which also carried on to Anubis.
Nowadays, serverless malware is active and popular in as-a-service scene.
They evolve in time as the threat actors change.
They all use anti-techniques and droppers.
Exabot uses dropper to distribute itself in Google Play Store.
It also uses root detection and anti-monitor with checking device ID, country and operator in device.
It also tries to run shell command to find sub-binary which is present when the device is rooted.
You can see what Exabot looks for in strings.
You can bypass anti-monitor with filter like this.
And root detection like this.
Red Alert uses Twitter for C2.
The last tweet contains IP of C2.
It fakes last tweet to find out current C2 and upload the data it stolen there.
It asks for device admin permission to take over poll.
It also checks Linux apps to look for specific apps.
Anubis is a good bankbot example.
It operates as-a-service.
It has multiple versions which legend has multiple different developers.
It uses fake apps and phishing campaigns to distribute samples.
These are all Turkish bank or popular applications.
It also uses dropper.
And uses obfuscation in dropper sample.
Dropper Anubis samples is encrypted.
Once you decrypt it, you can see it uses call forwarding for bank numbers.
And it uses overlay attack to still banking credentials.
If you try remove it, ransomware feature activates.
Anubis decrypts insert memory and writes decrypted code to a jar file.
After that, it loads jar file into insert which contains myUse function.
This filter script changes delete function so that you can fetch decrypted file from device.
You can fetch decrypted code like this.
And like this if native code is used.
Hydra Hydra is another service.
It imitates government apps to distribute itself.
Once you create Hydra sample in panel, it has time limit to activate.
Like some start to finish time.
It uses overlay attack to still banking and other personal information.
You can bypass time limitation like this.
And like this if native code is used.
Cerberus is most updated and dangerous one among them.
They are highly active on Twitter and regularly updates Cerberus malware.
Which commonly bypass sponsor and can be found in Google Play Store.
It uses sensor data to detect emulator.
You can imitate sensor movement and bypass this check.
C2s are mainly used to distribute samples and manage both.
And they contain stolen information.
You can use this script to automate C2 extraction for some samples.
Not every samples has automate C2 extraction decryptor or unpacker.
But you can find some useful ones in the GitHub page.
They helps you to analyze samples faster.
Now let's look at some vulnerabilities we found C2s.
Note that most of the C2s are a part of SSRs.
So if you find vulnerability in one panel,
it's highly present on the other panels using the same malware.
Red Alert panels has direct-releasing vulnerability.
You can fetch infected device information from panels.
You can find all infected phone data and stolen information.
And also find encryption keys.
Let's look at another panel.
One of custom malware panel had password in page source.
Using this, you could login to panel.
It has many effective host and functions to control.
It also had file upload feature.
Exploiting file upload, we got shell.
We purge all data and shut down its operation.
Some other custom panel had SQL injection.
We log in as admin with it and take over the panel.
All Twitter phishing campaigns and malware distribution campaigns
had Statoroot XSS vulnerability.
With this, you can sniff admin token to login
and see all stolen information.
And all stolen credit card data.
And social security numbers.
We set up a cron job to delete them daily.
Main takeaways for our presentation are
we identified malware as a service users
and hacked their sites to purge stolen data.
We also shared our findings with task force
and had 13 threat actors got arrested.
If you have any questions, we will be on Discord to answer them.
Don't forget to check your downloaded apps from Google Play Store.
Never trust any application.
Thank you all for listening.