Codearth

Here's The Future

Malicious App Written in Kotlin Language found on Google Play Store

Code Bytes: An open-source programming language, Kotlin is a fully-supported official programming language for Android which Google boasts contains safety features in order to make apps ‘healthy by default’. Kotlin became an official language for Android in May 2017 and it has proved popular — Twitter and Netflix are among the 17 percent of Android Studio projects using it.

However, researchers at Trend Micro have uncovered what they believe to the first example of malware developed using Kotlin. The malicious app posed as a utility tool for cleaning and optimising Android devices, and has been downloaded from the official Google Play store by between 1,000 and 5,000 users.

When the app is launched, information about the victim’s device is sent to a remote server, and the malware sends an SMS to a number provided by the command and control server. Once this message has been received, the remote server will begin URL forwarding for click ad fraud.

Using Kotlin to develop malware

Google announced Kotlin as a first-class language for writing Android apps in May 2017. Since Kotlin’s release, 17 percent of Android Studio projects started to use the programming language. Twitter, Pinterest, and Netflix are among the top apps that use Kotlin.

Kotlin is described as concise, drastically reducing the amount of boilerplate code; safe, because it avoids entire classes of errors such as null pointer exceptions; interoperable for leveraging existing libraries for JVM, Android, and the browser; and tool-friendly because of its capability to choose any Java IDE or build from the command line.

Its tooling support is also quite handy: Android Studio 3.0 provides tools for helping users with Kotlin. In addition, it can convert all Java files or code snippets on the fly when pasting Java code into a Kotlin file.However, it’s still unknown if the abovementioned features of Kotlin can make a difference when creating malware.Upon launching Swift Cleaner, the malware sends the victim’s device information to its remote server and starts the background service to get tasks from its remote C&C server. When the device gets infected the first time, the malware will send an SMS to a specified number provided by its C&C server.

Figure 3

Figure 3. Malicious app collects and sends victim’s device information via SMS

After the malware receives the SMS command, the remote server will execute URL forwarding and click ad fraud.

Figure 4

Figure 4. Left: C&C server sends task via network. Right: code snippet of the malware in process.

In its click ad fraud routine, the malware receives a remote command that executes the Wireless Application Protocol (WAP) task. WAP is a technical standard for accessing information over a mobile wireless network. After that, the injection of the malicious Javascript code will take place, followed by the replacement of regular expressions, which are a series of characters that define a search pattern. This will allow the malicious actor to parse the ads’ HTML code in a specific search string. Subsequently, it will silently open the device’s mobile data, parse the image base64 code, crack the CAPTCHA, and send the finished task to the remote server.

Figure 5


Figure 5. Malicious app uploading the finished task to the C&C Server

The malware can also upload the information of the user’s service provider, along with the login information and CAPTCHA images, to the C&C server. Once uploaded, the C&C server automatically processes the user’s premium SMS service subscription, which can cost the victim money.

Figure 6


Figure 6. The malicious app uploads the token that will be used to subscribe to a premium SMS service

Figure 7

Figure 7. The malicious app uploads the CAPTCHA image used to subscribe to a premium SMS service

Source:Trend Micro

Related articles