Static and Dynamic Analysis of “Pandemi Desteğini aktif et” App.
Few hours ago , on Twitter “Malware Hunter Team” had shared the link to app called “Pandemi Desteğini aktif et — 1.0". We decided to take a look on reversing it.
Analysis of “Pandemi Desteğini aktif et”
It’s the Fake App/Anubis Malware CopyCat of “ e-Devlet Kapısı ” which is the e-Government Gateway services Android App of Turkish Government.
Information about app :
Obfuscation and Anti-VM Code:
App logs into the sensitive information of user which should never be logged. It also has ability to read and write into the external storage and also uses the insecure RNG [Random Number Generator ] and SSL. Moreover , it has weak hash’s and also stores the sensitive information of user in temp file and discloses the IP address of device.
Services run by App:
Running app dynamically on emulator [ android VM ] .it popup with this sending the SMS using rare.ethics.across.kldqwysgkfcrmq.onHandleIntent.
Threat Actors are being continuously targeting the citizens of Turkey and committing fake Apps relating to Turkish Government with in-build Anubis malware in malicious Apps.
0x00 blog of Anubis Malware Internal can be read from here:
Anubis Malware Internals
Static and Dynamic Analysis of Pandemi Destek App. [ Anubis Malware ]
That’s all for today.