Smali Code Injection Code Of The

Our observations shows that Kazuar was used together with Turla tools during multiple breaches in past years.

Kaspersky spyware sensors caught the signal of an attack from the device of one of the victims; and a hash of the APK involved (Android application) was tagged in our sample feed for inspection.

Smali Code Injection Code Of The

Once we looked into the file, we quickly found out that the inner-workings of the APK included a malicious payload, embedded in the original code of the application.

This was an original spyware program, designed to exfiltrate almost all accessible information.

Researchers from Bitdefender also released an analysis of one of the samples in a blogpost.

Although something had already been published, we decided to do something different with the data we acquired.

The following month, we released a private report on our Threat Intelligence Portal to alert our clients about this newly discovered operation and began writing YARA rules in order to catch more samples.

We decided to call the operation ViceLeaker, because of strings and variables in its code.

As a result, due to such an unusual compilation process, there were signs in the dex file that point to dexlib, a library used by the Smali tool to assemble dex files.

However, in addition to the traditional functionality, there were also backdoor capabilities such as upload, download, delete files, camera takeover and record surrounding audio.

There are the following relevant detection paths (the last one is an alternative Telegram client Telegram X ).

Even when a false flag might also be a possibility, we consider this to be unlikely.

Another important modification is in the message transfer process.

In this case we found traces of dxdexmerge compilers, which means that, this time, the attackers just imported the original source code into an Android IDE (such as Android Studio, for instance) and compiled it with their own modifications.

We do not know why, but we suspect that it was an attempt to hide the origin of the application.

This brought to us the hypothesis that this might be a version used by the group behind ViceLeaker for internal communication or for other, unclear purposes.

All the detections of this backdoored app were geolocated in Iran.

It uses 185.51.201.133 as a main C2 address, and there is only one domain that is hosted on this dedicated server iliageram.ir.

Note that we later found versions that used the domain as a C2 directly instead of the IP address.

A quick search produced results about a personal page and, what is more interesting, a GitHub account that contains a forked Conversation repository.

The attackers have taken down their communication channels and are probably looking for ways to assemble their tools in a different manner.

Even when this would not be directly related to the Android malware described in this blogpost, it would be an indicator of wider capabilities and objectives of this actor.

I understand that I can withdraw this consent at any time via e-mail by clicking the unsubscribe link that I find at the bottom of any e-mail sent to me for the purposes mentioned above.

Most of the discovered malware families are fileless malware and they have not been seen before.