New Malware Campaign Targets Russia

Falcon Android Malware goes after VTB Bank Users

During our routine threat hunting exercise, Cyble Research Labs came across a Twitter post wherein researchers mentioned an Android malware variant targeting Russian bank users by mirroring the “VTB” bank app. Researchers claim this attack is retaliation for the “Anatsa” campaign targeting Ukraine and named it “Falcon,” based on the C&C panel name.

While analyzing the malicious application, we observed that it has the name ВТБ (Russian), which means VTB in English. This application doesn’t have any user interface (UI) and hides its icon after installation.

Once the user grants the requested Accessibility Services permission to the malicious application, it sends a list of applications installed on the victim’s device to the C&C server. Accordingly, the Threat Actors (TAs) provide injection modules to target specific applications installed on the victim’s device, the VTB bank application being one notable example.

We identified several sophisticated features in this malicious app. By leveraging these features, the app can steal device info, SMSs, notification data, etc. The application can also send spam messages to device contacts and make financial transactions using the Unstructured Supplementary Service Data (USSD) e-service.

Technical Analysis

APK Metadata Information

• App Name:  ВТБ
• Package Name: com.uivhspbweh.qbilykvlf
• SHA256 Hash: 4a9851b10361d4efc9657233aedfa3b0a0040ee016cc9891252d838b4e9ce0f2

Figure 1 shows the metadata information of the application.

While trying to install the application on an Android device, Google Play Protect warns the users by identifying it as a fake app and information stealer, thereby blocking the installation.

Upon installing the application on the testing device post disabling Google Play Protect, we observed that the application with the name ВТБ requests for Accessibility Service access.

Manifest Description

The malware requests 20 different permissions from the user, of which it abuses at least 10. These dangerous permissions are listed below.

Permissions	Description
CALL_PHONE	Allows an application to initiate a phone call without going through the Dialer user interface to confirm the call.
REQUEST_DELETE_PACKAGES	Allows an application to request deleting packages
ACCESS_NETWORK_STATE	Allows the app to view information about network connections
READ_PHONE_NUMBERS	Allows read access to the device’s phone number(s)
READ_PHONE_STATE	Allows access to phone state, including the current cellular network information, the phone number and the serial number of this phone, the status of any ongoing calls, and a list of any Phone Accounts registered on the device.
READ_SMS	Access phone messages.
RECEIVE_SMS	Allows an application to receive SMS messages.
SEND_SMS	Allows an application to send SMS messages.
WRITE_SMS	Allows the app to modify or delete SMS.
READ_CONTACTS	Access phone contacts.

Source Code Review

Our static analysis indicated that the malware steals the information from the infected device based on the commands received from the TA’s Command and Control (C&C) server.

While launching the application for the first time, it hides its icon from the device screen and runs silently in the background. The below code snippet is used to hide the app icon.

After execution, the malware uses telephone services to gather the device information, such as device country code, so that the attack can be carried out in the desired region.

The below image contains the code through which malware can download injection modules from the below C&C URL to target installed applications on the victim’s device:

hxxps://vtbsu[.]club/sweden/api/api.php?get_lend=

Upon receiving the bot_sms command from the TA’s C&C Server, the malware intercepts the incoming SMSs and sends the SMS data to the TA’s C&C server.

The malware uses the below code to collect the victim’s SMS data. The attackers can use the stolen SMS data to perform various malicious activities such as stealing contact details, bypassing two-factor authentication, etc.

The below code snippet depicts the malware’s ability to read incoming app notifications on the victim’s device based on the command need_interepting_push received from the TA’s C&C server.

It gathers information such as notification title and text and the application’s package name from which the notification originates.

The malware using the below code reads the contacts data saved on the victim device and sends SPAM messages; these spam messages can contain malicious app links or links to perform financial fraud.

The malware collects the victim device information such as android_version, phone_manufacturer, phone_model, mobile_operator, device’s IP address, play_protect_status, etc., based on commands from TA’s C&C server.

The malware can also perform financial fraud using USSD calls payment service (Calling number example *99#). This service allows attackers to perform mobile banking transactions by calling a number such as *99# without requiring internet access on the victim’s device.

We have listed the commands used by the TAs to control the infected device below:

• bot_country_code
• bot_logs
• bot_injects
• bot_sms
• bot_commands
• need_interepting_sms
• need_interepting_push
• injs_open_app
• interval_tuk_tuk
• injs_or_urls_open_app
• auto_injs_after_isntall
• auto_injs
• auto_injs_tag
• push_injs
• auto_del_apps
• track_apps
• ask_apps_sms
• auto_sms
• app_opened_inj_url
• auto_injs_after_istall_key_inj
• auto_injs_key_pckg_time
• auto_injs_tag_key_pckg_time
• push_injs_pckg_time
• auto_del_apps_time
• all_sms_was_set
• installed_apps_was_set
• all_granted
• notif_perms_miui_clicked
• perms_miui_clicked

Conclusion

Throughout the conflict between Russia & Ukraine, we have observed a marked increase in the volume of cyberattacks on Android users. This malware campaign is an example of an Android application masquerading as a legitimate VTB banking app to target Russian users. 2

According to our research, this type of malware is only distributed via sources other than Google Play Store. As a result, practicing basic cyber hygiene across mobile devices and online banking applications is a good way to prevent such malware from compromising your devices.

Our Recommendations

We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:  

How to prevent malware infection?

• Download and install software only from official app stores like Google Play Store or the iOS App Store.
• Use a reputed anti-virus and internet security software package on your connected devices, such as PCs, laptops, and mobile devices.
• Use strong passwords and enforce multi-factor authentication wherever possible.
• Enable biometric security features such as fingerprint or facial recognition for unlocking the mobile device where possible.
• Be wary of opening any links received via SMS or emails delivered to your phone.
• Ensure that Google Play Protect is enabled on Android devices.
• Be careful while enabling any permissions.
• Keep your devices, operating systems, and applications updated.

How to identify whether you are infected?

• Regularly check the Mobile/Wi-Fi data usage of applications installed on mobile devices.
• Keep an eye on the alerts provided by Anti-viruses and Android OS and take necessary actions accordingly.

What to do when you are infected?

• Disable Wi-Fi/Mobile data and remove SIM card – as in some cases, the malware can re-enable the Mobile Data.
• Perform a factory reset.
• Remove the application in case a factory reset is not possible.
• Take a backup of personal media Files (excluding mobile applications) and perform a device reset.

What to do in case of any fraudulent transaction?

• In case of a fraudulent transaction, immediately report it to the concerned bank.

What should banks do to protect their customers?

• Banks and other financial entities should educate customers on safeguarding themselves from malware attacks via telephone, SMS, or emails.

MITRE ATT&CK® Techniques

Tactic	Technique ID	Technique Name
Initial Access	T1476	Deliver Malicious App via Other Mean.
Initial Access	T1444	Masquerade as Legitimate Application
Execution	T1575	Native Code
Collection	T1412	Capture SMS Messages
Command and Control	T1436	Commonly Used Por

Indicators of Compromise (IOCs)

Indicators	Indicator Type	Description
e3da8e3778dea984dd62337297a1f6a1	MD5	Falcon APK
22b468f3b11f000512e5ffafd326e12f8951e070	SHA-1	Falcon APK
4a9851b10361d4efc9657233aedfa3b0a0040ee016cc9891252d838b4e9ce0f2	SHA-256	Falcon APK
7ef608bf48d6de1f69a34e813643e551	MD5	Falcon APK
cba24332b10f755ded13f6f79fd65a702e094243	SHA-1	Falcon APK
6f475db05055d2ff4c12568b09bca5d272eaf157edde90fd7755c04d87b4f215	SHA-256	Falcon APK
hxxps://vtbsu[.]club/sweden/api/api.php?get_lend=	URL	C&C URL