Swearing Trojan Continues to Rage, Even After Authors’ Arrest

Researchers with Tencent Security recently disclosed details about Swearing Trojan, a mobile banking malware that attacked users in China. Swearing Trojan’s name comes from Chinese swear words found inside the malware’s code. The malware infected a wide spread of Android users in China, stealing their bank credentials and other sensitive personal information.

Similar to mobile banking Trojans discovered previously, Swearing Trojan can steal personal data and it can bypass 2-factory authentication (2FA) security. Banking apps use two-factor authentication as a way to secure access by sending a one-time code to the user via SMS in addition to having a user enter his or her password. By replacing the original Android SMS app with an altered version of its own, Swearing Trojan can intercept incoming SMS messages, rendering two-factor authentication useless.

Swearing Trojan spreads using two primary infection methods:

• Droppers download malicious payloads once a user installs an infected app on a device.
• Attackers operate fake base transceiver stations (BTSs) that send phishing SMS messages masquerading as ones coming from Chinese telecom service providers China Mobile and China Unicom.

Using a BTS to send fake messages is quite sophisticated, and the SMS content is very deceptive. The message tricks users into clicking a malicious URL which installs malware. Fake messages from people victims may be romantically involved with have also been seen in these attacks.

Once an infected app is installed it asks the user for only screen lock-related permissions to avoid suspicion. After installation, the malware spreads by sending automated phishing SMSs to a victims’ contacts.

There are more phishing scams Swearing Trojan uses to spread:

• Work related documents: A fake SMS message coming from a manager asks the user to download and open an important document right away, and to reply to comments inside.
• Photos or videos: A fake SMS message claims to include a picture of a memorable event, or to be of a cheating spouse.
• Trending events: A recent example posed as a MMS message including a video of a cheating celebrity wife caught in action.
• App update notifications: An SMS message claims to be from a bank or telecom provider, and asks the user to install critical updates.

The Swearing Trojan doesn’t communicate with remote C&C servers. Instead it sends data back to an attacker using SMS or email. This provides the malware with good cover for its communications and hinders attempts to trace any malicious activity.

Although Tencent reports the attackers are in custody following a police raid, Check Point researchers detected additional activity made by the malware. So it’s possible that the attackers in custody were only part of a larger operation to spread the malware.

Since September 1, 2016, the Chinese government enforced real ID registration for all mobile numbers. If owners fail to submit real ID information to the telecomm service providers before the deadline, the mobile number is terminated. This new regulation should significantly reduce Swearing Trojan’s ability to spread using fake mobile numbers. However, phishing by email will still be an available attack vector for the malware.

In the original Tencent report, only 21cn.com email addresses were used. Check Point researchers have already seen the malware use other popular Chinese email service providers, such as 163.com, sina.cn and qq.com.

By March 2017, we still observe new Swearing Trojan variants in the wild. We also see the trend of making use of Aliyun and other cloud service hosted email accounts (e.g. qwewa.com, Shanghai Meicheng Technology Information Development Co., LTD.)

Some of these email addresses are using a mobile number as their user name. Judging from the inconsistency between the numbers in the email addresses and the actual mobile number used in SMS, we believe Swearing Trojan variants are repackaged at least twice.

Many mobile malware discovered in the Chinese market in the past, such as HummingBad, turned out to be early birds which continued to spread worldwide. The widespread of the Swearing Trojan was achieved by using fake BTSs and automated phishing SMSs. Both of these threats can be adopted by western malware as well. To protect your organization against these tactics, and many others, you should implement advanced solutions, such as the Check Point Mobile Threat Prevention.

Appendix 1 – list of SHAs of notable variants