- Home
- Techniques
- Mobile
- Masquerade as Legitimate Application
Masquerade as Legitimate Application
An adversary could distribute developed malware by masquerading the malware as a legitimate application. This can be done in two different ways: by embedding the malware in a legitimate application, or by pretending to be a legitimate application.
Embedding the malware in a legitimate application is done by downloading the application, disassembling it, adding the malicious code, and then re-assembling it.[1] The app would appear to be the original app, but would contain additional malicious functionality. The adversary could then publish the malicious application to app stores or use another delivery method.
Pretending to be a legitimate application relies heavily on lack of scrutinization by the user. Typically, a malicious app pretending to be a legitimate one will have many similar details as the legitimate one, such as name, icon, and description.[2]
Malicious applications may also masquerade as legitimate applications when requesting access to the accessibility service in order to appear as legitimate to the user, increasing the likelihood that the access will be granted.
Procedure Examples
| Name | Description |
|---|---|
| Agent Smith |
Agent Smith can impersonate any popular application on an infected device, and the core malware disguises itself as a legitimate Google application. Agent Smith's dropper is a weaponized legitimate Feng Shui Bundle.[9] |
| Anubis |
Anubis requests accessibility service privileges while masquerading as "Google Play Protect".[7] |
| Bouncing Golf |
Bouncing Golf distributed malware as repackaged legitimate applications, with the malicious code in the |
| Cerberus |
Cerberus has pretended to be an Adobe Flash Player installer.[11] |
| DroidJack |
DroidJack included code from the legitimate Pokemon GO app in order to appear identical to the user, but it also included additional malicious code.[4] |
| EventBot | |
| Ginp |
Ginp has masqueraded as "Adobe Flash Player" and "Google Play Verificator".[8] |
| SimBad | |
| ViceLeaker |
ViceLeaker was embedded into legitimate applications using Smali injection.[5] |
| X-Agent for Android |
X-Agent for Android was placed in a repackaged version of an application used by Ukrainian artillery forces.[3] |
Mitigations
| Mitigation | Description |
|---|---|
| User Guidance |
Users should be encouraged to only install apps from authorized app stores, which are less likely to contain malicious repackaged apps. |
Detection
Users can detect malicious applications by watching for nuances that could indicate the application is not the intended one when it is being installed.
References
- Yajin Zhou and Xuxian Jiang. (2012, May). Dissecting Android Malware: Characterization and Evolution. Retrieved December 9, 2016.
- A. Hinchliffe, M. Harbison, J. Miller-Osborn, et al. (2018, March 13). HenBox: The Chickens Come Home to Roost. Retrieved September 9, 2019.
- CrowdStrike Global Intelligence Team. (2016). Use of Fancy Bear Android Malware in Tracking of Ukrainian FIeld Artillery Units. Retrieved February 6, 2017.
- Proofpoint. (2016, July 7). DroidJack Uses Side-Load…It's Super Effective! Backdoored Pokemon GO Android App Found. Retrieved January 20, 2017.
- GReAT. (2019, June 26). ViceLeaker Operation: mobile espionage targeting Middle East. Retrieved November 21, 2019.
- Elena Root, Andrey Polkovnichenko. (2019, March 13). SimBad: A Rogue Adware Campaign On Google Play. Retrieved November 21, 2019.
- M. Feller. (2020, February 5). Infostealer, Keylogger, and Ransomware in One: Anubis Targets More than 250 Android Applications. Retrieved April 8, 2020.
- ThreatFabric. (2019, November). Ginp - A malware patchwork borrowing from Anubis. Retrieved April 8, 2020.
- A. Hazum, F. He, I. Marom, B. Melnykov, A. Polkovnichenko. (2019, July 10). Agent Smith: A New Species of Mobile Malware. Retrieved May 7, 2020.
- D. Frank, L. Rochberger, Y. Rimmer, A. Dahan. (2020, April 30). EventBot: A New Mobile Banking Trojan is Born. Retrieved June 26, 2020.
- Z. Doffman. (2019, August 16). Warning As Devious New Android Malware Hides In Fake Adobe Flash Player Installations (Updated). Retrieved June 26, 2020.
- E. Xu, G. Guo. (2019, June 28). Mobile Cyberespionage Campaign ‘Bouncing Golf’ Affects Middle East. Retrieved January 27, 2020.