Telegram Bot API Abused by TeleRAT Android Malware and Steal Sensitive Data from Android Phone

A Newly Discovered Andoird Malware called TeleRAT are abused Telegram Bot API that used to command and control the malicious Android applications.

TeleRAT is a Dubbed IRRAT Malware that steal information ranging from SMS and call history to file listings from infected Android devices.

“Telegram Bots are special accounts that do not require an additional phone number to set up and are generally used to enrich Telegram chats with content from external services or to get customized notifications and news.”

Old IRRAT once  launched into victims Android Phone, It works by making and after that populating the malicious files on the phone’s SD Card and sending them to the remote server.

TeleRAT Android Malware Leveraging Telegram’s Bot API  and it mainly targeting individual Iranian Users.

How Does Telegram Bot  API abuse by TeleRAT

Once it launched into the victim’s files as a post-Installation operation, it creates two files in the app’s internal directory

  • telerat2.txt – containing a slew of information about the device – including the System Bootloader version number, total and available Internal and External memory size, and a number of cores.
  • thisapk_slm.txt – mentioning a Telegram channel and a list of commands.

Later This TeleRAT inform to its author about the successful installation by sending a message to a Telegram bot via the Telegram Bot API along with current date and time of the infection.

According to paloaltonetworks, End of the operation it’s fetching updates from the Telegram bot API every 4.6 seconds.

TeleRAT listening various commands such as Get contacts, Get the clipboard, Get location, Receive (SMS) messages, Take a photo, Receive calls and Etc – Full List.

TeleRAT new future allowing for uploads exfiltrated data using sendDocument API and it eliminates the possibility of network-based detection.

Looking further in Source code, Malware authors don’t focus about to hide their identity and its advertising through a Telegram channel called ‘vahidmail67’   and also being sold on forums.

Also its distributed via several third-party Android application stores and shared via both legitimate and nefarious Iranian Telegram channels. Researchers said.


Recent Posts

Dell, HP, & Lenovo System Found Using Outdated OpenSSL Cryptographic Library

The cybersecurity researchers at Binarly recently discovered that outdated versions of the OpenSSL cryptographic library…

1 day ago

Chrome Zero-Day Bug Actively Exploited in the Wild – Google Emergency Update!

The eighth zero-day vulnerability used in attacks this year has been fixed by Google in…

2 days ago

Operation HAECHI III – INTERPOL Arrested 1000 Cyber Criminals & Seized $130 Million

Recently, there have been almost 1000 arrests made as a result of a police operation…

4 days ago

Hackers Rewritten The RansomExx Ransomware in Rust Language To Evade Detection

There has recently been a discovery made by IBM Security X-Force Threat Researchers regarding a…

4 days ago

Web Application Penetration Testing Checklist – A Detailed Cheat Sheet

Web Application Pentesting is a method of identifying, analyzing and Report the vulnerabilities which are…

6 days ago

Chrome Extension Deploy Windows Malware to Steal Cryptocurrency and Clipboard Contents

In order to steal cryptocurrency and clipboard contents, ViperSoftX was detected by the security analysts…

7 days ago