SonicWall Capture Labs Threat Research Team Spots Fake Aarogya Setu App Carrying Spyware Components
By MYBRANDBOOK
As the world is battling against the Covid-19 pandemic, a number of Covid-19 tracking apps have been developed over the last few months. Various countries have taken the initiative of developing their own apps. Consequently, we witnessed the introduction of Aarogya Setu, the Indian Covid-19 tracking mobile application. The app gained immense popularity in India and crossed five million downloads within the first three days from its launch and consequently, became a target for malware creators.
SonicWall Labs Threats research team found fake Aarogya Setu apps holding spyware components. The team has found multiple scenarios in the way this cyber-scam functions:
There are a number of fake apps with the package name cmf0.c3b5bm90zq.patch. The same code is used for a majority of these apps. The malware author unrolls them by re-branding the icon and application name. In this case, the app is shown as the legitimate Aarogya Setu App, but with an imperfect copy. The icon appears stretched and can be identified when kept along-side the legitimate app.
Upon execution, we do not see any activity on the screen. However, after some time, the app icon disappears from the app drawer. This contains reference to a domain - johnnj2-37916.portmap.io - in the patch_preferences.xml file. During an analysis, the malware did not try to communicate with this domain, however this domain is connected to malicious apps.
Similar to case 1, a number of fake apps have been found with the package name yps.eton.application. In this case, the app has been shown as an Aarogya Setu Add-on app, which is not an official app. As the user installs and executes the app, it requests for the Device-Admin privileges and permission for installation from this source. To look less suspicious to the user, it also installs the official, legitimate Aarogya Setu App from its resource folder.
In this case, the malware author has successfully duplicated the official Aarogya Setu icon. Basis the icon, identification of this malicious app is difficult.
There was no network activity witnessed during our analysis session but there was a record of a domain – 204.48.26.131:29491 – within an xml file belonging to the app. This domain is related to another malicious Android app.
In all the three cases, the common element was the containment of spyware capabilities. All these apps contain code that is like the Android spyware SpyNote. This spyware can make phone calls, recording audio, send SMS, take pictures and record videos from the camera, and start the spyware every time the device reboots.
SonicWall Labs threats research team observed that some of these malicious apps are piggybacked on the legitimate Aarogya Setu app in the resources folder. These malicious apps install the legitimate app in the background, a technique used to fool the user into believing that the user installed the legitimate app. In reality, the malicious app executes its criminal functions in the background.
If the user deletes Aarogya Setu app from the device by long pressing the icon > uninstall method, only the legitimate app is removed, while the malicious app would still be available on the device. The only way to remove the malicious app is to remove it from settings > apps > uninstall. This trick has the potential to fool several users who are not vigilant.
Debasish Mukherjee as VP, Regional Sales - APAC at SonicWall says, “As the Aarogya Setu App gained popularity in India, it became a target for malware creators. The outbreak of Covid-19 has created new avenues for cyberattackers to explore, innovate and strike in every malicious way. With increasing cyberthreats it appears that cybercriminals are working overtime to create dissonance among mass app users. We advise Android users to exercise maximum caution while downloading and using the Aarogya Setu App.”
BHIM to join e-commerce, competing with PhonePe and Google Pay
The government-supported payment software BHIM is getting ready to join t...
The latest version of X helps prevent deepfakes on social medi
To combat deepfakes and shallowfakes, Elon Musk revealed a new update t...
India and Namibia collaborate on a payment system similar to U
Once operational, the platform will enable digital transactions in Namibia,...
Sebi issues show-cause notices to six Adani group firms
Sebi issued show-cause notices to six Adani Group firms, including Adani ...
ATRIE TECHNOLOGY PVT. LTD.
AMARA RAJA POWER SYSTEMS LTD.
HP INDIA SALES PVT. LTD.
AGGRESSIVE ELECTRONICS MANUFACTURING SERVICES PVT. LTD.
Technology Icons Of India 2023: Amit Chadha
. An influential leader in the engineering services industry for over ...
Technology Icons Of India 2023: C P Gurnani
CP Gurnani (popularly known as ‘CP’ within his peer group), is the...
Technology Icons Of India 2023: Vijay Shekhar Sharma
Vijay Shekhar Sharma is an Indian technology entrepreneur and billiona...
BEL leveraging next generation technologies to keep the country ahead in Defence space
Bharat Electronics Limited (BEL) is a Navratna PSU under the Ministry ...
BSE provides highly secure, efficient and transparent market for trading
BSE (formerly known as Bombay Stock Exchange Ltd.) is Asia's first & t...
STPI encouraging software exports from India
Software Technology Parks of India (STPI) is an S&T organization under...
INTEGRA MICRO SYSTEMS PVT. LTD.
Integra is a leading provider of innovative hi-technology products an...
Crayon Software Experts India Pvt Ltd
Crayon helps its customers build the commercial and technical foundati...
REDINGTON INDIA LIMITED
Redington (India) Limited operates in the IT product distribution busi...