Telegram Bot API Abused by TeleRAT Android Malware and Steal Sensitive Data from Android Phone

A Newly Discovered Andoird Malware called TeleRAT are abused Telegram Bot API that used to command and control the malicious Android applications.

TeleRAT is a Dubbed IRRAT Malware that steal information ranging from SMS and call history to file listings from infected Android devices.

“Telegram Bots are special accounts that do not require an additional phone number to set up and are generally used to enrich Telegram chats with content from external services or to get customized notifications and news.”

Old IRRAT once  launched into victims Android Phone, It works by making and after that populating the malicious files on the phone’s SD Card and sending them to the remote server.

TeleRAT Android Malware Leveraging Telegram’s Bot API  and it mainly targeting individual Iranian Users.

How Does Telegram Bot  API abuse by TeleRAT

Once it launched into the victim’s files as a post-Installation operation, it creates two files in the app’s internal directory

• telerat2.txt – containing a slew of information about the device – including the System Bootloader version number, total and available Internal and External memory size, and a number of cores.
• thisapk_slm.txt – mentioning a Telegram channel and a list of commands.

Later This TeleRAT inform to its author about the successful installation by sending a message to a Telegram bot via the Telegram Bot API along with current date and time of the infection.

According to paloaltonetworks, End of the operation it’s fetching updates from the Telegram bot API every 4.6 seconds.

TeleRAT listening various commands such as Get contacts, Get the clipboard, Get location, Receive (SMS) messages, Take a photo, Receive calls and Etc – Full List.

TeleRAT new future allowing for uploads exfiltrated data using sendDocument API and it eliminates the possibility of network-based detection.

Looking further in Source code, Malware authors don’t focus about to hide their identity and its advertising through a Telegram channel called ‘vahidmail67’   and also being sold on forums.

Also its distributed via several third-party Android application stores and shared via both legitimate and nefarious Iranian Telegram channels. Researchers said.