Sunday, July 14, 2024

Telegram Bot API Abused by TeleRAT Android Malware and Steal Sensitive Data from Android Phone

A Newly Discovered Andoird Malware called TeleRAT are abused Telegram Bot API that used to command and control the malicious Android applications.

TeleRAT is a Dubbed IRRAT Malware that steal information ranging from SMS and call history to file listings from infected Android devices.

“Telegram Bots are special accounts that do not require an additional phone number to set up and are generally used to enrich Telegram chats with content from external services or to get customized notifications and news.”

Old IRRAT once  launched into victims Android Phone, It works by making and after that populating the malicious files on the phone’s SD Card and sending them to the remote server.

TeleRAT Android Malware Leveraging Telegram’s Bot API  and it mainly targeting individual Iranian Users.

How Does Telegram Bot  API abuse by TeleRAT

Once it launched into the victim’s files as a post-Installation operation, it creates two files in the app’s internal directory

  • telerat2.txt – containing a slew of information about the device – including the System Bootloader version number, total and available Internal and External memory size, and a number of cores.
  • thisapk_slm.txt – mentioning a Telegram channel and a list of commands.

Later This TeleRAT inform to its author about the successful installation by sending a message to a Telegram bot via the Telegram Bot API along with current date and time of the infection.

According to paloaltonetworks, End of the operation it’s fetching updates from the Telegram bot API every 4.6 seconds.

TeleRAT listening various commands such as Get contacts, Get the clipboard, Get location, Receive (SMS) messages, Take a photo, Receive calls and Etc – Full List.

TeleRAT new future allowing for uploads exfiltrated data using sendDocument API and it eliminates the possibility of network-based detection.

Looking further in Source code, Malware authors don’t focus about to hide their identity and its advertising through a Telegram channel called ‘vahidmail67’   and also being sold on forums.

Also its distributed via several third-party Android application stores and shared via both legitimate and nefarious Iranian Telegram channels. Researchers said.


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles