{"id":107690,"date":"2022-10-12T08:00:16","date_gmt":"2022-10-12T08:00:16","guid":{"rendered":"https:\/\/kasperskycontenthub.com\/securelist\/?p=107690"},"modified":"2022-11-10T14:21:04","modified_gmt":"2022-11-10T14:21:04","slug":"malicious-whatsapp-mod-distributed-through-legitimate-apps","status":"publish","type":"post","link":"https:\/\/securelist.com\/malicious-whatsapp-mod-distributed-through-legitimate-apps\/107690\/","title":{"rendered":"Malicious WhatsApp mod distributed through legitimate apps"},"content":{"rendered":"

Last year, we wrote about the Triada Trojan inside FMWhatsApp, a modified WhatsApp build<\/a>. At that time, we discovered that a dropper was found inside the distribution, along with an advertising SDK. This year, the situation has repeated, but with a different modified build, YoWhatsApp version 2.22.11.75. Inside it, we found a malicious module that we detect as Trojan.AndroidOS.Triada.eq.<\/p>\n

\"Launching<\/a><\/p>\n

Launching a malware module built into the modification<\/em><\/strong><\/p>\n

The module decrypted and launched the Trojan.AndroidOS.Triada.ef main payload.<\/p>\n

\"Payload<\/a><\/p>\n

Payload decoding and launch<\/em><\/strong><\/p>\n

In addition, the malicious module stole various keys required for legitimate WhatsApp to work. We assume that to resolve this problem, the cybercriminals had to figure out all the intricacies of the messenger before writing the new version.<\/p>\n

\"The<\/a><\/p>\n

The Trojan reads WhatsApp keys…<\/em><\/strong><\/p>\n

\"...<\/a><\/p>\n

… and sends collected data to the control server<\/em><\/strong><\/p>\n

The keys of interest to the cybercriminals are typically used in open-source utilities<\/a> that allow the use of a WhatsApp account without the app. If the keys are stolen, a user of a malicious WhatsApp mod can lose control over their account.<\/p>\n

\"Registering<\/a><\/p>\n

Registering with yowsup requires the collected WhatsApp keys<\/em><\/strong><\/p>\n

We note that in other respects, the infected build of YoWhatsApp is a fully working messenger with some additional features, such as customizing interface or blocking access to individual chats. When installed, it asks for the same permissions as the original WhatsApp messenger, such as access to SMS. The same permissions are granted to the Triada Trojan. It, and similar malware, can use them to add paid subscriptions without the user’s knowledge, for example.<\/p>\n

How the malicious YoWhatsApp messenger is spread<\/h2>\n

After discovering a new malicious WhatsApp mod, we decided to find out where it was coming from. According to statistics, the source was ads in the popular Snaptube app. After a brief check, we confirmed that you can find YoWhatsApp ads in the official Snaptube app (MD5: C3B2982854814E537CD25D27E295CEFE), and when clicking on one, the user will be prompted to install the malicious build.<\/p>\n

\"\"<\/a><\/p>\n

This is not the first time we’ve encountered this kind of distribution method. Previously, for example, a similar situation occurred with the CamScanner app<\/a>, a version of which, posted on Google Play Market, contained an ad library with a malicious component. We warned the developers of Snaptube that the ads in their app were being used by cybercriminals.<\/p>\n

Our investigation did not end there. We later found a malicious version of the YoWhatsApp build in the popular Vidmate mobile app (MD5 CBA56F43C1EF32C43F7FC5E2AC368CDC) designed to save and watch videos from YouTube. Unlike Snaptube, the malicious build was uploaded in the internal store, which is part of Vidmate. The modification’s name is WhatsApp Plus, but its features, legitimate and malicious, are similar to those found on Snaptube. The YoWhatsApp build version is also the same.<\/p>\n

\"The<\/a><\/p>\n

The YoWhatsApp mod with a malicious module found in Vidmate is called WhatsApp Plus<\/em><\/strong><\/p>\n

Conclusion<\/h2>\n

Cybercriminals are increasingly using the power of legitimate software to distribute malicious apps. This means that users who choose popular apps and official installation sources, may still fall victim to them. In particular, malware like Triada can steal an IM account, and for example, use it to send unsolicited messages, including malicious spam. The user’s money is also at risk, as the malware can easily set up paid subscriptions for the victim.<\/p>\n

Update November 10, 2022<\/strong>:
\nWe have been in touch with the YoWhatsapp developer and the malicious module has been removed from the modification (MD5 of the new file: dcf8a43955b00d037cd6d7a784cbfe0b).<\/p>\n

IOCs<\/h2>\n

MD5<\/strong>
\nAC6C42D2F312FE8E5FB48FE91C83656B<\/a>
\nCAA640824B0E216FAB86402B14447953<\/a>
\n72645469B04AF2D89BC24ADDA2705B68<\/a>
\nDEAAFDD4B289443261E18B244EAFB577<\/a>
\nF67A1866C962F870571587B833ADD47B<\/a>
\n47674B2ADA8586ACAF34065FF4CF788A<\/a>
\n8EE2DF87E75CC8AB1B77C54288D7A2D9<\/a><\/p>\n

C&C<\/strong>
\nhxxps:\/\/wa.zcnewy[.]com
\nhxxp:\/\/av2wg.rt14v[.]com:13002
\nhxxps:\/\/g1790.rt14v[.]com:13001<\/p>\n","protected":false},"excerpt":{"rendered":"

The malicious version of YoWhatsApp messenger, containing Triada trojan, was spreading through ads in the popular Snaptube app and the Vidmate app’s internal store.<\/p>\n","protected":false},"author":5527,"featured_media":97649,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[24],"tags":[980,34,42,123,76,544,656],"banners":"","hreflang":[{"hreflang":"x-default","url":"https:\/\/securelist.com\/malicious-whatsapp-mod-distributed-through-legitimate-apps\/107690\/"},{"hreflang":"ru","url":"https:\/\/securelist.ru\/malicious-whatsapp-mod-distributed-through-legitimate-apps\/105994\/"}],"_links":{"self":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/107690"}],"collection":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/users\/5527"}],"replies":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/comments?post=107690"}],"version-history":[{"count":10,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/107690\/revisions"}],"predecessor-version":[{"id":107944,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/posts\/107690\/revisions\/107944"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media\/97649"}],"wp:attachment":[{"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/media?parent=107690"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/categories?post=107690"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/securelist.com\/wp-json\/wp\/v2\/tags?post=107690"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}