Wednesday, November 13, 2024
HomeMalwareTelegram Bot API Abused by TeleRAT Android Malware and Steal Sensitive Data...

Telegram Bot API Abused by TeleRAT Android Malware and Steal Sensitive Data from Android Phone

Published on

Malware protection

A Newly Discovered Andoird Malware called TeleRAT are abused Telegram Bot API that used to command and control the malicious Android applications.

TeleRAT is a Dubbed IRRAT Malware that steal information ranging from SMS and call history to file listings from infected Android devices.

“Telegram Bots are special accounts that do not require an additional phone number to set up and are generally used to enrich Telegram chats with content from external services or to get customized notifications and news.”

- Advertisement - SIEM as a Service

Old IRRAT once  launched into victims Android Phone, It works by making and after that populating the malicious files on the phone’s SD Card and sending them to the remote server.

TeleRAT Android Malware Leveraging Telegram’s Bot API  and it mainly targeting individual Iranian Users.

How Does Telegram Bot  API abuse by TeleRAT

Once it launched into the victim’s files as a post-Installation operation, it creates two files in the app’s internal directory

  • telerat2.txt – containing a slew of information about the device – including the System Bootloader version number, total and available Internal and External memory size, and a number of cores.
  • thisapk_slm.txt – mentioning a Telegram channel and a list of commands.

Later This TeleRAT inform to its author about the successful installation by sending a message to a Telegram bot via the Telegram Bot API along with current date and time of the infection.

According to paloaltonetworks, End of the operation it’s fetching updates from the Telegram bot API every 4.6 seconds.

TeleRAT listening various commands such as Get contacts, Get the clipboard, Get location, Receive (SMS) messages, Take a photo, Receive calls and Etc – Full List.

TeleRAT new future allowing for uploads exfiltrated data using sendDocument API and it eliminates the possibility of network-based detection.

Looking further in Source code, Malware authors don’t focus about to hide their identity and its advertising through a Telegram channel called ‘vahidmail67’   and also being sold on forums.

Also its distributed via several third-party Android application stores and shared via both legitimate and nefarious Iranian Telegram channels. Researchers said.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

Automating Identity and Access Management for Modern Enterprises

Keeping track of who has access and managing their permissions has gotten a lot...

Finding The Right E-Commerce Platform – Comparing Reselling Solutions

If you’re looking to make some extra cash or to start a business, you...

Fortinet Patches Critical Flaws That Affected Multiple Products

Fortinet, a leading cybersecurity provider, has issued patches for several critical vulnerabilities impacting multiple...

China-Nexus Actors Hijack Websites to Deliver Cobalt Strike malware

A Chinese state-sponsored threat group, identified as TAG-112, has been discovered hijacking Tibetan community...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

China-Nexus Actors Hijack Websites to Deliver Cobalt Strike malware

A Chinese state-sponsored threat group, identified as TAG-112, has been discovered hijacking Tibetan community...

New Android Malware SpyAgent Taking Screenshots Of User’s Devices

SpyAgent, a newly discovered Android malware, leverages OCR technology to extract cryptocurrency recovery phrases...

HookBot Malware Use Overlay Attacks Impersonate As Popular Brands To Steal Data

The HookBot malware family employs overlay attacks to trick users into revealing sensitive information...