Reversing Malicious Undangan Pernikahan
Welcome back to yet another of my articles. This time, I’d like to share my experience of tinkering with a malicious file provided by a kind soul. I’ll give you a bit of background first.
A Little Background
So, one lovely, sunny day, my mum received a message from a stranger on WhatsApp. The message essentially invited her to attend their child’s wedding. The message also included an attachment in the form of a file named ‘Buku Undangan.PDF’. My mum was suspicious because something didn’t add up — she didn’t know the person, and at that time there was a spate of phishing scams involving invitation files or parcel delivery notifications — so she took a screenshot of the conversation and sent it to me.
Realising this, my immense curiosity got the better of me and I was filled with excitement. I immediately asked my mum to forward the message to me, and I finally received the PDF sample. Let’s dive deeper to find out what this ‘Undangan’ sent by a kind-hearted person is all about. Notes: I will redact certain snippets and details for everyone’s safety. 👌
Identifying File
Once the APK had been successfully downloaded, I moved the file to my favourite virtual machine. First, I ran the `file` command to find out what type of file I had received. Here, it can be seen that the file is a ZIP archive. If the file sent had actually been a PDF, the output should have looked like this. In fact, even the WhatsApp app shows that the file sent was an APK 😊.
Realising that the output was a ZIP archive, I tried to extract it using the `unzip` command, and this revealed several extracted files.
The extract clearly shows the names of the files and folders that appear. From these file names, it is clear that the files obtained are APK files and not PDF files. At this point, I immediately decompiled the files using a tool called jadx.
AndroidManifest — BUKA UNDANGAN
The first thing I checked was the AndroidManifest.xml file. This file contains the configuration for every Android application. It includes settings such as identity, components, permissions and more. In this section, I noticed a package named `droppe3`. I assumed that this was a `dropper`-type piece of malware, the name of which was derived from slang or versioning (the number signifying that this was the third version of the dropper payload created), hence `droppe3`.
String — BUKA UNDANGAN
Next, I attempted to analyse the strings used in this application. These string files contain the text content and constant strings stored within the application. Usually, this is where we can find secrets that have been hard-coded by the developer. However, in this case, I did not find anything of use.
MainActivity — BUKA UNDANGAN
I’ll continue my analysis of MainActivity. MainActivity contains the initial flow (setting what is displayed and what is processed) of the application, which will run when you tap the app icon on your mobile. Let’s look at the onCreate method first. The onCreate method is the first piece of code to be executed when a screen (Activity) is opened.
It can be seen in the `onCreate` function that this function calls a function named `installApkFromAssets()`. From the source code within that function, it is clear that the application will attempt to install a file from the Assets directory. On line 20, the file’s location is retrieved from the ‘assets’ directory, and here it can be seen that the file is named `.apk`. After that, the application displays a pop-up window requesting permission for the victim to allow this application to install other applications.
Get mbuhkeder’s stories in your inbox
Join Medium for free to get updates from this writer.
Are you aware that this app is NOT the main app? This proves that my assumption was correct: this app is a dropper. A dropper is a type of malware designed to secretly install or download other malware onto the target device. This type of malware usually appears ‘clean’ so that it can evade detection by antivirus software and other security measures.
AndroidManifest — PAYLOAD APK
In this apk’s androidmanifest.xml file, I realised that this app has 7 permissions:
- android.permission.RECEIVE_SMS: Allows the app to receive and monitor incoming SMS messages in real time.
- android.permission.INTERNET: Allows the app to access the internet.
- android.permission.READ_SMS: Allows the app to read all SMS messages stored on the device.
- android.permission.WAKE_LOCK: Allows the app to keep the device on or the processor active whilst the screen is off.
- android.permission.ACCESS_NETWORK_STATE: Allows the app to check the connection status (whether Wi-Fi or mobile data is active or not).
- android.permission.RECEIVE_BOOT_COMPLETED: Allows the app to run automatically once the device has finished rebooting.
- android.permission.FOREGROUND_SERVICE: Allows the app to run a service in the foreground, indicated by a notification.
Given the nature of these permissions, I am increasingly convinced that this is malware, due to the large number of permissions it utilises and the excessive privileges it requires. Based on the permissions in question, I assume that this malware is an information stealer, whereby the threat actor can steal incoming text messages and send them to their exfiltration server.
Although this permission sounds like malware, it is POSSIBLE that a legitimate app might also have the same permission. That is why we need to understand the context by reading the source code of the app itself.
OnCreate Function — PAYLOAD APK
Let’s focus on the onCreate function. In lines 76 to 82, we can see that the app attempts to display a WebView page where the JavaScript setting is set to true to run JavaScript. After that, the app checks the SDK build version of the device running the app. Then, on line 89, the application checks again whether it is running on an older version of Android or whether permission to send or receive SMS messages has already been granted. If any one of these three conditions is met, the function stops here. If none of the conditions are met, the application will display a pop-up dialogue requesting permission to send and receive SMS messages.
OnRequest Function— PAYLOAD APK
In the main activity, apart from onCreate, there are two other functions: onRequest and onNotice. When the application is launched, it displays a pop-up asking whether the application is granted permission to receive/send SMS messages via the requestPermission() call made in the onCreate function. The onRequest function handles the victim’s response to this permission request (whether it is granted or denied). It can be seen that this function contains a URL leading to the Telegram bot. A telephone number, believed to belong to the threat actor, is also visible here.
There is a check here: first, the function checks whether the received identifier is 1000 or not. If the identifier is 1000, then the ‘requestpermission’ is a request created by a threat actor to request permission for READ/RECEIVE SMS.
On line 99, the application checks whether permission has been granted or not. If the value returned is 0, the application is granted permission to receive/send SMS messages. Conversely, if the value received is -1, permission has not been granted and the text “Permission Not Granted!” will appear on the page. The application then makes an HTTP request using OkHttp. This request sends information confirming that the application has been successfully installed on the victim’s device, after which the application closes.
If the victim grants permission to the app, the app will make another HTTP request with the same message as before. It doesn’t stop there; the app then attempts to send an SMS to the threat actor’s number with the message “sempurnaaaa”, and if this fails, the app sends the error to the Telegram bot via an HTTP request. After that, the app registers a receiver, which is subsequently handled by the onNotice function.
OnNotice Function — PAYLOAD APK
The purpose of the `onNotice` function is to retrieve the notification intent data and then forward it to the threat actor’s Telegram bot. Lines 46–48 contain variable declarations that store information regarding the package, title and text of the notification that appears. Next, lines 50–55 generate text, but this text is not displayed on the screen so that the victim cannot see what is happening in the background. Lines 56–67 are the most crucial, as this is where the data is retrieved and sent via an HTTP request to the Telegram bot specified by the threat actor. Based on this code, the output received by the threat actor is approximately as follows:
com.whatsapp
From : Syibalsekiya
Message : Your OTP Code is 123456
As well as being used to monitor notifications, this malware also extracts information relating to text messages on the victim’s device due to the presence of the ‘Receive’ and ‘SendSMS’ classes.
Conclusion
From the decompilation results we carried out above, it has been revealed that the file sent is a DROPPER-type MALWARE file, whereby the first APK contains no malicious code and is responsible for installing the main malicious payload. In phase 2, the malware acts as an INFO STEALER, with the application harvesting SMS messages and notifications, which are subsequently sent to the threat actor’s Telegram bot exfiltration server. A shout-out to NamaLu, who helped me analyse this malware and take revenge by sending spam messages😹.
The key takeaway from this article is to always be wary of what strangers offer and not to be too trusting, panic, give in or act on impulse. Give yourself time to think. Thank you for reading my article today, and please accept my apologies for the numerous redacted images; this is because the author does not want others to create similar applications. I hope you find this useful, and stay safe!
