SPYWARE MALWARE ANALYSIS
Malicious code or behavior that secretly collects user data or sends it elsewhere without clear permission is considered spyware.
Examples of spyware include:
- Recording audio or phone calls, Messages without the user knowing or concern
- Stealing data from other apps
Common permissions: READ_CONTACTS, RECEIVE_SMS, READ_SMS, READ_EXTERNAL_STORAGE, READ_CALENDAR, RECORD_AUDIO, READ_CALL_LOG, INTERNET
Suspicious signals / APIs: ContactsContract, content://sms, content://mms, SendTextMessage, CallLog.Calls, Environment.getExternalStorageDirectory(), MediaRecorder/AudioRecord, MediaStore accesses, background services that exfiltrate.
SHA256: 3d811d32407a497093b941fa8304d51962c30bdbca44963e1f24242297c40ccb
After loading the file into Jadx for static analysis, it will appear as shown in the image below.
From here we can find the package name package=”phone.track.child2024” From the threat intel we found that phone. track.child2024 likely refers to an Android app (or package) designed for tracking or monitoring children on a mobile phone, potentially released or updated in 2024.
Then we need to check for the permission that has been declared in the Manifest file.
From the permission highlighted Permission are suspicious that are related to Spyware or Backdoor, so we need to check the flow for both.
So, we can check the spyware flow and with the respective keyword to follow the code.
Get Saravana’s stories in your inbox
Join Medium for free to get updates from this writer.
Calllog: No Flow
ContactsContract We got a flow so we can check the code from here highlighted.
And we got the Code where the contactscontract has been used. From there we need to check the data1 because it will have the number of the device.
And all data1 has been declared in the variable of str.
And here the number, str has been put into the jSONObject and it has been declared pun into the jSONArray.
And it has been returned so we need to the check the usage of this specific Method.
If we check the method usage it has been declared to the strB and it has been used in the and puting all data into map mentioned below.
StrB has been putting all data in map and map has been putting all data in some php file it's the back-end URL for the C2C server. This code is the exact exfiltration that happens.
And we need to find the exact base URL and check the map has been used in the b method declaration again .As followed the map as 2nd parameter.
From here we can check the a method to get the declaration of it .
From the function we can see some suspicious This line is accessing a string resource named my_url_other, and R refers to the class that holds all those resource IDs.
If you search for the my_url_path we can find the base URL.
So combined with the URL and the php backend URL it’s a full C2C server which is getting our Contacts number, so from the flow we can confirm the file is spyware.
Final C2C server: https [:]//mobile-tracker-free.com/scriptsV4/contacts/insertContactRefresh[.]php
Indicators of Compromise (IOCs)
SHA256 (sample): 3d811d32407a497093b941fa8304d51962c30bdbca44963e1f24242297c40ccb
Package name: phone.track.child2024
C2 URL / PHP backend: https://mobile-tracker-free.com/scriptsV4/contacts/insertContactRefresh.php
Suspicious permissions: READ_CONTACTS, RECEIVE_SMS, READ_SMS, READ_EXTERNAL_STORAGE, READ_CALENDAR, RECORD_AUDIO, READ_CALL_LOG, INTERNET
APIs / signals: ContactsContract, cursor queries selecting _id and data1, MediaRecorder/AudioRecord, CallLog.Calls, content://sms.
Why this is spyware (brief justification)
Access + intent: The application requests permissions that allow it to read contacts and then its code specifically queries ContactsContract and extracts phone numbers.
Aggregation + exfiltration: Extracted phone numbers are placed into a map and transmitted over HTTP(S) to a remote PHP endpoint controlled by the app author (C2). That is textbook data exfiltration.
No apparent legitimate reason: A legitimate parental-tracking app should disclose telemetry and obtain consent; this app performs the operation quietly and sends raw contacts off-device — behavior consistent with spyware/backdoor.
