Phishing Android Malware Targets Taxpayers in India | McAfee Blogs

Authored by ChanUng Pak  

McAfee’s Cell Analysis staff just lately discovered a brand new Android malware, Elibomi, concentrating on taxpayers in India. The malware steals delicate monetary and personal info by way of phishing by pretending to be a tax-filing utility. We’ve recognized two foremost campaigns that used completely different faux app themes to lure in taxpayers. The primary marketing campaign from November 2020 pretended to be a faux IT certificates utility whereas the second marketing campaign, first seen in Could 2021, used the faux tax-filing theme. With this discovery, the McAfee Cell Analysis staff has been capable of replace McAfee Cell Safety in order that it detects this menace as Android/Elibomi and alerts cellular customers if this malware is current of their gadgets. 

Throughout our investigation, we discovered that within the newest marketing campaign the malware is delivered utilizing an SMS textual content phishing assault. The SMS message pretends to be from the Earnings Tax Division in India and makes use of the identify of the focused person to make the SMS phishing assault extra credible and improve the probabilities of infecting the system. The faux app used on this marketing campaign is designed to seize and steal the sufferer’s delicate private and monetary info by tricking the person into believing that it’s a official tax-filing app. 

We additionally discovered that Elibomi exposes the stolen delicate info to anybody on the Web. The stolen information contains e-mail addresses, cellphone numbers, SMS/MMS messages amongst different monetary and private identifiable info. McAfee has reported the servers exposing the information and on the time of publication of this weblog the uncovered info is not obtainable. 

Pretending to be an app from the Earnings Tax Division in India 

The most recent and most up-to-date Elibomi marketing campaign makes use of a faux tax-filing app theme and pretends to be from the Earnings Tax Division from the Indian authorities. They even use the unique emblem to trick the customers into putting in the app. The package deal names (distinctive app identifiers) of those faux apps encompass a random phrase + one other random string + imobile (e.g. “direct.uujgiq.imobile” and “olayan.aznohomqlq.imobile”). As talked about earlier than this marketing campaign has been energetic since at the least Could 2021. 

Determine 1. Pretend iMobile app pretending to be from the Earnings Tax Division and asking SMS permissions 

After all of the required permissions are granted, Elibomi makes an attempt to gather private info like e-mail tackle, cellphone quantity and SMS/MMS messages saved within the contaminated system: 

Determine 2. Elibomi stealing SMS messages 

Prevention and protection 

Listed below are our suggestions to keep away from being affected by this and different Android threats that use social engineering to persuade customers to put in malware disguised as official apps: 

• Have a dependable and up to date safety utility like McAfee Cell Safety put in in your cellular gadgets to guard you towards this and different malicious functions. 
• Don’t click on on suspicious hyperlinks acquired from textual content messages or social media, notably from unknown sources. At all times double examine by different means if a contact that sends a hyperlink with out context was actually despatched by that particular person as a result of it might result in the obtain of a malicious utility. 

Conclusion 

Android/Elibomi is simply one other instance of the effectiveness of personalised phishing assaults to trick customers into putting in a malicious utility even when Android itself prevents that from taking place. By pretending to be an “Earnings Tax” app from the Indian authorities, Android/Elibomi has been capable of collect very delicate and personal private and monetary info from affected customers which could possibly be used to carry out determine and/or monetary fraud. Much more worryingly, the knowledge was not solely in cybercriminals’ palms, but it surely was additionally unexpectedly uncovered on the Web which might have a higher impression on the victims. So long as social engineering assaults stay efficient, we anticipate that cybercriminals will proceed to evolve their campaigns to trick much more customers with completely different faux apps together with ones associated to monetary and tax providers. 

McAfee Cell Safety detects this menace as Android/Elibomi and alerts cellular customers whether it is current. For extra details about McAfee Cell Safety, go to https://www.mcafeemobilesecurity.com 

For these focused on a deeper dive into our analysis… 

Distribution technique and stolen information uncovered on the Web 

Throughout our investigation, we discovered the primary distribution technique of the most recent marketing campaign in one of many stolen SMS messages uncovered in one of many C2 servers. The SMS physique discipline within the screenshot under exhibits the Smishing assault used to ship the malware. Apparently, the message contains the sufferer’s identify with the intention to make the message extra private and due to this fact extra credible. It additionally urges the person to click on on a suspicious hyperlink with the excuse of checking an pressing replace concerning the sufferer’s Earnings Tax return: 

Determine 3. Uncovered info contains the SMS phishing assault used to initially ship the malware 

Elibomi not solely exposes stolen SMS messages, but it surely additionally captures and exposes the listing of all accounts logged within the contaminated gadgets: 

Determine 4. Instance of account info uncovered in one of many C2 servers

If the focused person clicks on the hyperlink within the textual content message, a phishing web page can be proven pretending to be from the Earnings Tax Division from the Indian authorities which addresses the person by its identify to make the phishing assault extra credible: 

Determine 5. Pretend e-Submitting phishing web page pretending to be from the Earnings Tax Division in India 

Every focused person has a unique utility. For instance within the screenshot under we’ve the app “cisco.uemoveqlg.imobile” on the left and “komatsu.mjeqls.imobile” on the precise: 

Determine 6. Completely different malicious functions for various customers

Throughout our investigation, we discovered that there are a number of variants of Elibomi for a similar iMobile faux Earnings tax app. For instance, some iMobile apps solely have the login web page whereas in others have the choice to “register” and request a faux tax refund: 

Determine 7. Pretend iMobile screens designed to seize private and monetary info 

The delicate monetary info supplied by the tricked person can be uncovered on the Web: 

Determine 8. Instance of uncovered monetary info stolen by Elibomi utilizing a faux tax filling app 

Associated Pretend IT Certificates functions 

The primary Elibomi marketing campaign pretended to be a faux “IT Certificates” app was discovered to be distributed in November 2020.  Within the following determine we are able to see the similarities within the code between the 2 malware campaigns: 

Determine 9. Code similarity between Elibomi campaigns 

The malicious utility impersonated an IT certificates administration module that’s purposedly used to validate the system in a non-existent verification server. Identical to the newest model of Elibomi, this faux ITCertificate app requests SMS permissions but it surely additionally requests system administrator privileges, in all probability to make extra troublesome its elimination. The malicious utility additionally simulates a “Safety Scan” however in actuality what it’s doing within the background is stealing private info like e-mail, cellphone quantity and SMS/MMS messages saved within the contaminated system: 

Determine 10. Pretend ITCertificate app pretending to do a safety scan whereas it steals private information within the background 

Identical to with the most up-to-date “iMobile” marketing campaign, this faux “ITCertificate” additionally exposes the stolen information in one of many C2 servers. Right here’s an instance of a stolen SMS message that makes use of the identical log fields and construction because the “iMobile” marketing campaign: 

Determine 11. SMS message is stolen by the faux “ITCertificate” utilizing the identical log construction as “iMobile” 

Attention-grabbing string obfuscation method 

The cybercriminals behind these two items of malware designed a easy however fascinating string obfuscation method. All strings are decoded by calling completely different courses and every class has a totally completely different desk worth

Determine 12. Calling the de-obfuscation technique with completely different parameters 

Determine 13. String de-obfuscation technique 

Determine 14. String de-obfuscation desk 

The algorithm is an easy substitution cipher. For instance, 35 is changed with ‘h’ and 80 is changed with ‘t’ to obfuscate the string. 

Appendix – Technical Knowledge and IOCs