MoqHao evolution: New variants begin mechanically proper after set up

Authored by Dexter Shin 

MoqHao is a widely known Android malware household related to the Roaming Mantis menace actor group first found in 2015. McAfee Cellular Analysis Group has additionally posted a number of articles associated to this malware household that historically targets Asian international locations resembling Korea and Japan. 

 Not too long ago McAfee Cellular Analysis Group discovered that MoqHao started distributing variants utilizing very harmful approach. Principally, the distribution methodology is identical. They ship a hyperlink to obtain the malicious app by way of the SMS message. Typical MoqHao requires customers to put in and launch the app to get their desired objective, however this new variant requires no execution. Whereas the app is put in, their malicious exercise begins mechanically. This method was launched in a earlier put up however the distinction is that this harmful approach is now being abused by different well-known lively malware campaigns like MoqHao. We’ve already reported this method to Google and they’re already engaged on the implementation of mitigations to stop one of these auto-execution in a future Android model. Android customers are at present protected by Google Play Defend, which is on by default on Android gadgets with Google Play Companies. Google Play Defend can warn customers or block apps identified to exhibit malicious conduct, even when these apps come from sources outdoors of Play. McAfee Cellular Safety detects this menace as Android/MoqHao. 

How it’s distributed 

MoqHao is distributed by way of phishing SMS messages (also called Smishing). When a person receives an SMS message containing a malicious hyperlink and clicks it, the gadget downloads the malicious software. Phishing messages are nearly the identical as in earlier campaigns: 

Determine 1. Smishing message impersonating a notification from a courier service. 

 Japanese message: I went to the supply tackle, however nobody was there. So, I introduced it again. 

One noticeable change is that they now use URL shortener providers. If the malware authors use their very own area, it may be shortly blocked but when they use official URL shortener providers, it’s troublesome to dam the quick area as a result of it might have an effect on all of the URLs utilized by that service. When a person clicks on the hyperlink within the message, it will likely be redirected to the precise malicious website by the URL shortener service. 

What’s new on this variant 

As talked about in the beginning, this variant behaves in another way from earlier ones. Typical MoqHao should be launched manually by the person after it’s put in however this variant launches mechanically after set up with out person interplay: 

Determine 2. Variations between typical MoqHao and Fashionable MoqHao 

We defined this auto-execution approach intimately in a earlier put up however to briefly summarize it right here, Android is designed so when an app is put in and a particular worth utilized by the app is ready to be distinctive, the code runs to verify whether or not the worth is exclusive upon set up. This function is the one that’s being abused by the extremely lively Trojan household MoqHao to auto-execute itself with out person interplay. The distribution, set up, and auto-execution of this current MoqHao variant could be seen within the following video: 

On the opposite hand, this current MoqHao variant makes use of Unicode strings in app names in another way than earlier than. This approach makes some characters seem daring, however customers visually acknowledge it as “Chrome”. This may occasionally have an effect on app name-based detection methods that examine app identify (Chrome) and package deal identify (com.android.chrome): 

Determine 3. App identify utilizing Unicode strings. 

Moreover, in addition they use social engineering methods to set malicious apps because the default SMS app. Earlier than the settings window seems, they present a message telling you to arrange the app to stop spam, but this message is pretend: 

Determine 4. Faux message utilizing social engineering methods. 

Additionally, the totally different languages used within the textual content related to this conduct means that, along with Japan, they are additionally focusing on South Korea, France, Germany, and India: 

Determine 5. Faux messages designed to focus on totally different international locations. 

After the initialization of the malware is accomplished, it will create a notification channel that can be used to show phishing messages: 

Determine 6. Create a notification channel for the following phishing assault. 

The malware checks the gadget’s provider and makes use of this notification to ship phishing messages accordingly to trick customers into click oning on them. MoqHao will get the phishing message and the phishing URL from Pinterest profiles.  

Determine 7. Phishing message and URL in Pinterest profile 

If the phishing string is empty, MoqHao will use the phishing message within the code: 

Determine 8. Phishing notification code for every provider 

 This variant additionally connects to the C2 server by way of WebSocket. Nonetheless, it has been confirmed that a number of different instructions have been added along with the instructions launched in the earlier put up: 

 MoqHao malware household is an lively malware that has been round for years. Though a few years have handed, they’re utilizing an increasing number of other ways to cover and attain customers. We’re seeing a a lot greater variety of C2 instructions than in earlier, the lively use of official websites like Pinterest to retailer and replace phishing information, and code with the potential to focus on Asian international locations like Japan and South Korea, in addition to international locations like France, Germany, and India. Furthermore, we count on this new variant to be extremely impactful as a result of it infects gadgets just by being put in with out execution. 

 It’s troublesome for common customers to seek out pretend apps utilizing official icons and software names, so we advocate customers to put in safe software program to guard their gadgets. For extra info, go to McAfee Cellular Safety. 

Indicators of Compromise (IOCs)