New Android SpyAgent Campaign Targets Crypto Wallets Using Image Recognition
McAfee Labs released a detailed report exposing a new strain of Android malware, dubbed "SpyAgent." This malicious campaign, first observed in early 2024, is designed to target cryptocurrency credentials through advanced image recognition techniques.
Introduction
On September 5, 2024, McAfee Labs released a detailed report exposing a new strain of Android malware, dubbed "SpyAgent." This malicious campaign, first observed in early 2024, is designed to target cryptocurrency credentials through advanced image recognition techniques. SpyAgent scans images on infected devices for mnemonic keys used to access crypto wallets, posing a significant threat to Android users in Korea and now expanding globally.
Report Overview
McAfee's Mobile Research Team first discovered SpyAgent while investigating suspicious Android applications that had been circulating in Korea. This malware disguises itself as legitimate apps, such as banking, government services, or even streaming platforms. Once installed, the malicious apps secretly collect a wide range of sensitive information, including text messages, contacts, and images, sending it to remote servers controlled by the attackers.
Since January 2024, over 280 fake apps have been identified as part of this campaign. SpyAgent uses various tactics to obscure its true purpose, including loading screens and blank screens to distract users. McAfee Mobile Security products now provide protection against this threat, but users must remain vigilant.
The malware primarily spreads through phishing campaigns, which leverage social media messages and SMS to deliver malicious links. These messages, disguised as trusted contacts or organizations, redirect victims to fake websites designed to mimic legitimate services. From there, users are prompted to download an APK file, which appears legitimate but installs the malware. Once installed, the app requests broad permissions, including access to SMS messages, contacts, and storage, which it uses to steal sensitive information.
After installation, SpyAgent begins its core operations, gathering a range of data, including:
- Contacts: The entire contact list is exfiltrated, likely used to propagate the malware further.
- SMS Messages: All incoming messages, including those used for two-factor authentication, are captured.
- Photos: Any images stored on the device are uploaded to the attackers' server.
- Device Information: System details such as the OS version and phone numbers are collected for tailored attacks.
The malware communicates with a command-and-control (C2) server, receiving instructions like:
- ‘ack_contact’: Confirms that contacts were successfully received.
- ‘send_sms’: Allows the malware to send phishing SMS messages to others.
Insights and Analysis
During the investigation, McAfee Labs found that several C2 servers were insecurely configured, exposing index pages and files without requiring credentials. This vulnerability allowed researchers to access the structure and data collected by the malware, revealing personal information such as images of victims and lists of infected devices.
Additionally, the malware's recent evolution to using WebSocket connections for C2 communication enhances its efficiency and makes detection more difficult. SpyAgent has also been spotted targeting users in the UK, suggesting the attackers are expanding their reach beyond Korea.
SpyAgent represents a sophisticated and evolving threat to Android users, particularly those involved in cryptocurrency. To protect against this malware, users should avoid downloading apps from untrusted sources, be cautious of phishing messages, and regularly review the permissions granted to installed apps. Keeping security software updated is crucial in identifying and blocking threats like SpyAgent.
Indicators of Compromise (IOCs)
| Indicator | Type | Description |
|---|---|---|
| 5b634ac2eecc2bb83c0403edba30a42cc4b564a3b5f7777fe9dada3cd87fd761 | File Hash | Hash of malicious APK file used in the campaign |
| 4cf35835637e3a16da8e285c1b531b3f56e1cc1d8f6586a7e6d26dd333b89fcf | File Hash | Hash of malicious APK file used in the campaign |
| 3d69eab1d8ce85d405c194b30ac9cc01f093a0d5a6098fe47e82ec99509f930d | File Hash | Hash of malicious APK file used in the campaign |
| 789374c325b1c687c42c8a2ac64186c31755bfbdd2f247995d3aa2d4b6c1190a | File Hash | Hash of malicious APK file used in the campaign |
| 34c2a314dcbb5230bf79e85beaf03c8cee1db2b784adf77237ec425a533ec634 | File Hash | Hash of malicious APK file used in the campaign |
| f7c4c6ecbad94af8638b0b350faff54cb7345cf06716797769c3c8da8babaaeb | File Hash | Hash of malicious APK file used in the campaign |
| 94aea07f38e5dfe861c28d005d019edd69887bc30dcc3387b7ded76938827528 | File Hash | Hash of malicious APK file used in the campaign |
| 1d9afa23f9d2ab95e3c2aecbb6ce431980da50ab9dea0d7698799b177192c798 | File Hash | Hash of malicious APK file used in the campaign |
| 19060263a9d3401e6f537b5d9e6991af637e1acb5684dbb9e55d2d9de66450f2 | File Hash | Hash of malicious APK file used in the campaign |
| 0ca26d6ed1505712b454719cb062c7fbdc5ae626191112eb306240d705e9ed23 | File Hash | Hash of malicious APK file used in the campaign |
| d340829ed4fe3c5b9e0b998b8a1afda92ca257732266e3ca91ef4f4b4dc719f8 | File Hash | Hash of malicious APK file used in the campaign |
| 149bd232175659434bbeed9f12c8dd369d888b22afaf2faabc684c8ff2096f8c | File Hash | Hash of malicious APK file used in the campaign |
| f9509e5e48744ccef5bfd805938bf900128af4e03aeb7ec21c1e5a78943c72e7 | File Hash | Hash of malicious APK file used in the campaign |
| 26d761fac1bd819a609654910bfe6537f42f646df5fc9a06a186bbf685eef05b | File Hash | Hash of malicious APK file used in the campaign |
| 0e778b6d334e8d114e959227b4424efe5bc7ffe5e943c71bce8aa577e2ab7cdb | File Hash | Hash of malicious APK file used in the campaign |
| 8bbcfe8555d61a9c033811892c563f250480ee6809856933121a3e475dd50c18 | File Hash | Hash of malicious APK file used in the campaign |
| 373e5a2ee916a13ff3fc192fb59dcd1d4e84567475311f05f83ad6d0313c1b3b | File Hash | Hash of malicious APK file used in the campaign |
| 7d346bc965d45764a95c43e616658d487a042d4573b2fdae2be32a0b114ecee6 | File Hash | Hash of malicious APK file used in the campaign |
| 1bff1823805d95a517863854dd26bbeaa7f7f83c423454e9abd74612899c4484 | File Hash | Hash of malicious APK file used in the campaign |
| 020c51ca238439080ec12f7d4bc4ddbdcf79664428cd0fb5e7f75337eff11d8a | File Hash | Hash of malicious APK file used in the campaign |
| ahd.lat | Domain | Domain used for command-and-control and distribution of malicious APKs |
| allsdy999.org | Domain | Domain used for command-and-control and phishing campaigns |
| etr.lat | Domain | Domain used for command-and-control and distribution of malicious APKs |
| gf79.org | Domain | Domain associated with malware distribution |
| goodapps.top | Domain | Domain associated with fake app distribution |
| gov24.me | Domain | Domain associated with fake government apps |
| gov24.top | Domain | Domain associated with fake government apps |
| krgoodapp.top | Domain | Domain associated with phishing campaigns |
| krgov24.top | Domain | Domain associated with fake government apps |
| like1902.xyz | Domain | Domain used in phishing attacks |
| make69.info | Domain | Domain used in malware distribution |
| messtube999.info | Domain | Domain associated with phishing and malware |
| mtube888.info | Domain | Domain used for distributing malware |
| mylove777.org | Domain | Domain used for phishing attacks |
| oktube999.info | Domain | Domain associated with phishing campaigns |
| top1114.online | Domain | Domain associated with malware distribution |
| ytube888.info | Domain | Domain used in phishing and malware campaigns |
MITRE ATT&CK Techniques
| Tactic | Technique | ID | Description |
|---|---|---|---|
| Initial Access | Phishing | T1566 | The malware is delivered via phishing campaigns through SMS and social media messages. |
| Execution | User Execution | T1204 | The malware requires the user to download and install a malicious APK file. |
| Persistence | Boot or Logon Autostart Execution | T1547 | The malicious app requests permission to run in the background upon installation. |
| Collection | Input Capture | T1056 | The malware captures SMS messages, contacts, and device information from infected devices. |
| Command and Control | Application Layer Protocol | T1071 | The malware communicates with a command-and-control server using HTTP and WebSocket. |
Comments ()