{"id":108464,"date":"2023-01-19T10:00:06","date_gmt":"2023-01-19T10:00:06","guid":{"rendered":"https:\/\/kasperskycontenthub.com\/securelist\/?p=108464"},"modified":"2023-01-18T14:57:00","modified_gmt":"2023-01-18T14:57:00","slug":"roaming-mantis-dns-changer-in-malicious-mobile-app","status":"publish","type":"post","link":"https:\/\/securelist.com\/roaming-mantis-dns-changer-in-malicious-mobile-app\/108464\/","title":{"rendered":"Roaming Mantis implements new DNS changer in its malicious mobile app in 2022"},"content":{"rendered":"

Roaming Mantis (a.k.a Shaoye) is well-known as a long-term cyberattack campaign that uses malicious Android package (APK) files to control infected Android devices and steal device information; it also uses phishing pages to steal user credentials, with a strong financial motivation.<\/p>\n

Kaspersky has been investigating the actor’s activity throughout 2022, and we observed a DNS changer function used for getting into Wi-Fi routers and undertaking DNS hijacking. This was newly implemented in the known Android malware Wroba.o\/Agent.eq (a.k.a Moqhao, XLoader), which was the main malware used in this campaign.<\/p>\n

DNS changer via malicious mobile app<\/h2>\n

Back in 2018, Kaspersky first saw Roaming Mantis activities<\/a> targeting the Asian region, including Japan, South Korea and Taiwan. At that time, the criminals compromised Wi-Fi routers for use in DNS hijacking, which is a very effective technique. It was identified as a serious issue in both Japan<\/a> and South Korea<\/a>. Through rogue DNS servers, all users accessing a compromised router were redirected to a malicious landing page. From mid-2019 until 2022, the criminals mainly used smishing instead of DNS hijacking to deliver a malicious URL as their landing page. The landing page identified the user’s device platform to provide malicious APK files for Android or redirect to phishing pages for iOS.<\/p>\n

\"Infection<\/a><\/p>\n

Infection flow with DNS hijacking<\/em><\/strong><\/p>\n

In September 2022, we carried out a deep analysis of Wroba.o (MD5 f9e43cc73f040438243183e1faf46581) and discovered the DNS changer was implemented to target specific Wi-Fi routers. It obtains the default gateway IP address as the connected Wi-Fi router IP, and checks the device model from the router’s admin web interface.<\/p>\n

\"Code<\/a><\/p>\n

Code for checking Wi-Fi router model<\/em><\/strong><\/p>\n

The following strings are hardcoded for checking the Wi-Fi router model:<\/p>\n\n\n\n
\n
    \n
  • ipTIME N3-i<\/li>\n
  • ipTIME N604plus-i<\/li>\n
  • EFM Networks ipTIME N604plus-i<\/li>\n
  • EFM Networks – ipTIME Q104<\/li>\n
  • EFM Networks ipTIME Q104<\/li>\n
  • EFM Networks – ipTIME Q204<\/li>\n
  • EFM Networks ipTIME Q204<\/li>\n
  • EFM Networks ipTIME V108<\/li>\n
  • EFM Networks ipTIME Q604<\/li>\n
  • EFM Networks ipTIME Q604 PINKMOD<\/li>\n
  • EFM Networks ipTIME N104R<\/li>\n
  • EFM Networks ipTIME N604R<\/li>\n
  • EFM Networks ipTIME Q504<\/li>\n
  • EFM Networks ipTIME N5<\/li>\n
  • EFM Networks ipTIME N604V<\/li>\n
  • EFM Networks ipTIME N104T<\/li>\n
  • EFM Networks – ipTIME G301<\/li>\n
  • title.n704bcm<\/li>\n
  • title.a8004t<\/li>\n
  • title.a2004sr<\/li>\n
  • title.n804r<\/li>\n
  • title.n104e<\/li>\n
  • title.n104pk<\/li>\n
  • title.a1004ns<\/li>\n
  • title.a604m<\/li>\n
  • title.n104pi<\/li>\n
  • title.a2008<\/li>\n
  • title.ax2004b<\/li>\n
  • title.n104q<\/li>\n
  • title.n604e<\/li>\n
  • title.n704e<\/li>\n
  • title.n704v3<\/li>\n
  • title.n704v5<\/li>\n
  • title.t5004<\/li>\n
  • title.t5008<\/li>\n
  • title.a1004<\/li>\n
  • title.a2003nm<\/li>\n
  • title.a2004sr<\/li>\n
  • title.a5004nm<\/li>\n
  • title.a604sky<\/li>\n
  • title.n2pi<\/li>\n
  • title.n604pi<\/li>\n
  • title.a2004m<\/li>\n
  • title.a3004nm<\/li>\n
  • title.a7ns<\/li>\n
  • title.a8txr<\/li>\n
  • title.ew302nr<\/li>\n
  • title.n602e<\/li>\n
  • title.t16000<\/li>\n
  • title.a3003ns<\/li>\n
  • title.a6004nm<\/li>\n
  • title.n1e<\/li>\n
  • title.n3i<\/li>\n
  • title.n6<\/li>\n
  • title.a2004ns<\/li>\n
  • title.n1pi<\/li>\n
  • title.a2004r<\/li>\n<\/ul>\n<\/td>\n
\n