Researchers discovered a new malware campaign called ViceLeaker that specifically targeting the Android users with sophisticated backdoor capabilities to Hijack camera, delete files, record audio and more.
Some of the Malware samples discovered by Kaspersky researchers are modified versions of an open source Jabber/XMPP client called “Conversations” a legitimate version of the Android app available in Google Play.
Threat actors using Smali injection technique to backdoor legitimate applications and this technique more often used by attackers to disassemble the code of the original legitimate app with the help of Baksmali tool, Once they have added the malicious code then they assemble it with Smali.
During the APK analysis phase, researchers uncovered that the malware employed some of the common spyware features and in additional, it capable of upload, download, delete files, take over the camera and record surrounding audio.
Modified Version of Conversations Samples
Newly discovered samples that are modified version of conversations app and the app sharing code with ViceLeaker malware with similar characters.
According to Kaspersky research, The Conversations modified samples differ from the original one in the getKnownHosts method that was modified to replace the main XMPP host with the attackers’ C2 server.
There are many modifications was applied with the app and the attackers were using a specific C2 for the use of that app.
The malware uses HTTP for communication with the C2 server for command handling and data exfiltration.
In addition, attackers also changed the icon and package name that mimics Telegram messenger to adding the code and it might be one of the way attackers to hide their origin, researchers believe.
Even though, its a backdoor version of Conversations app, there wasn’t any malicious activities uncovered. but this modified version might be used by threat actors for their internal communication.
Attackers using “185.51.201[.]133” as a main C2 address for a backdoored version of Conversations app.
Researcher name this operation as “ViceLeaker”, because of strings and variables in its code.
“The operation of ViceLeaker is still ongoing, as is our research. The attackers have taken down their communication channels and are probably looking for ways to assemble their tools in a different manner, Kaspersky said.”
You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity updates also you can take the Best Cybersecurity course online to keep yourself updated.
