경찰청 폴 안티스파이 3.0 사칭 스미싱 악성코드-폴-안티스파이 3.0(2021.09.05)

오늘은 경찰청 폴 안티스파이 3.0 사칭 스미싱 악성코드인 폴-안티스파이 3.0(2021.09.05) 안드로이드 악성코드에 대해 글을 적어 보겠습니다.
안티스파이 이라는 안드로이드 앱은 경찰청에서 배포하는 스파이 앱을 찾아서 삭제할 수가 있게 만들어진 경찰청에서 만들어서 배포하는 스파이 앱 제거를 도와주고 있습니다. 일단 가짜 앱은 경찰, 검찰, 은행 등에 전화를 걸면 해당 기관이 아닌 범행 조직 콜센터로 연결되도록 하는 방식으로 해당 악성 앱을 설치를 하고 실행을 하면 보이스피싱 일당으로 개인정보가 넘어가서 보이스피싱 에 악용이 되며 앞서 이야기한 것처럼 경찰, 검찰, 은행 등에 공식적인 고객센터 및 신고 센터에 걸면 해당 기관이 아닌 범죄조직으로 넘어갈 수가 있습니다.
스파이앱은 사용자 모르게 통화내용, 문자메시지, 위치정보 등 개인정보를 실시간 수집하여 유출할 수 있고 음성녹음을 통한 도·감청, 데이터 삭제 및 접근 제한까지 가능한 기능의 앱을 말을 합니다. 일단 기본적으로 구글플레이 스토어 에서 제공을 하는 경찰청에서 제작한 안티스파이 3.0 내용을 보면 다음과 같은 내용을 볼 수가 있습니다.

폴 안티스파이 3.0 권한 허용

경찰청 폴-안티스파이 3.0
※ 폴-안티스파이 3.0은 공식 구글 스토어 및 통신사 통합 원스토어 에서만 배포되고 있습니다. 다른 인터넷 사이트에서 다운로드 받거나 개인적으로 파일을 전송해 설치하는 경우는 사칭 앱이므로 설치하지 마시길 당부드립니다.
최근 타인의 스마트폰의 음성, 문자 메시지, 사진 등을 훔쳐볼 수 있는 기능의 스파이앱이 유통되고 있습니다. 특정인의 개인 생활을 감시하고 개인정보를 수집하는 불법적인 용도로 사용되고 있어 심각한 피해를 가져오고 있습니다. 이에 경찰청 사이버안전국에서는 ‘경찰청 폴-안티스파이'를 개발하여 스파이앱 설치 여부를 판단하고 삭제 기능을 제공합니다.

경찰청 폴-안티스파이 3.0의 주요 기능
스마트폰에 설치된 스파이앱 검색
스파이앱 탐지 시 선택 삭제
탐지 이력 검색
탐지 가능 스파이앱 개수
약 280여종(2021.09.05 기준)

폴 안티스파이 3.0 실행 화면

※ 모든 종류의 스파이앱 혹은 악성코드를 탐지하지 않습니다. 지속적으로 탐지 가능한 스파이앱 대상을 추가해 나가고 있습니다. 스마트폰의 이상 상태나 악성코드 치료를 위해서는 전문 안티바이러스 제품을 함께 사용하기를 권장합니다. 또한 안드로이드 스마트폰의 업데이트를 늘 최신 상태로 유지하시길 권장합니다.
이라고 공식 구글 플레이 스토어 에서는 제공을 하고 있습니다.
일단 악성코드 해쉬값은 다음과 같습니다.
파일명:폴-안티스파이 3.0.apk
사이즈:37,470,853 Bytes
CRC32:f62cb80c
MD5 5c4b6e295fc86aca33a3ebd5d2cfa07f
SHA-1:57a46545d695b1f91ac6be2ba0cb5d057f81d6ee
SHA-256:f525aebcaffe6b32aed8096f114c66d8b81e830a7703c13dab0fc88f5be57423
SHA-512:9c355a3b6eb614a57dcce1100698570bbd519ab615535049d41b94a640f2950c3930d2c0fc41fd7aefbbeebecf098751b229ab1d70ce673cfe5036b7d759f286

폴-안티스파이 3.0 안드로이드 악성코드 안드로이드 권한

입니다.그리고 폴-안티스파이 3.0.apk 악성코드 안드로이드 권한은 다음과 같습니다.
<uses-sdk android:minSdkVersion="19" android:targetSdkVersion="21"/>
<uses-feature android:name="android.hardware.camera"/>
<uses-feature android:name="android.hardware.camera.autofocus"/>
<uses-permission android:name="android.permission.READ_CALL_LOG"/>
<uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
<uses-permission android:name="android.permission.BOOT_COMPLETED"/>
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.MOUNT_UNMOUNT_FILESYSTEMS"/>
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
<uses-permission android:name="android.permission.WAKE_LOCK"/>
<uses-permission android:name="android.permission.GET_TASKS"/>
<uses-permission android:name="android.permission.BROADCAST_STICKY"/>
<uses-permission android:name="android.permission.CHANGE_WIFI_STATE"/>
<uses-permission android:name="android.permission.PROCESS_OUTGOING_CALLS"/>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.VIBRATE"/<uses-permission android:name="android.permission.RECEIVE_USER_PRESENT"/>
<uses-permission android:name="android.permission.READ_CONTACTS"/>
<uses-permission android:name="android.permission.WRITE_CONTACTS"/>
<uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS"/>
<uses-permission android:name="android.permission.READ_SMS"/>
<uses-permission android:name="android.permission.CALL_PHONE"/>
<uses-permission android:name="android.permission.RECEIVE_SMS"/>
<uses-permission android:name="android.permission.RECORD_AUDIO"/>
<uses-permission android:name="android.permission.CAMERA"/>
<uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"/>
<uses-permission android:name="android.permission.ACCESS_FINE_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_COARSE_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_COARSE_UPDATES"/>
<uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
<uses-permission android:name="android.permission.BLUETOOTH"/>
<uses-permission android:name="android.permission.BLUETOOTH_ADMIN"/>
<uses-permission android:name="android.permission.SYSTEM_OVERLAY_WINDOW"/>
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
<uses-permission android:name="android.permission.RECEIVE_MMS"/>
<uses-permission android:name="android.permission.ACCESS_BACKGROUND_LOCATION"/>
<uses-permission android:name="android.permission.ACCESS_LOCATION_EXTRA_COMMANDS"/>
<uses-permission android:name="android.permission.CHANGE_NETWORK_STATE"/>
<uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
<uses-permission android:name="android.permission.REQUEST_DELETE_PACKAGES"/>
<uses-permission android:name="android.permission.REQUEST_IGNORE_BATTERY_OPTIMIZATIONS"/>
<uses-permission android:name="android.permission.DEVICE_POWER"/>
<uses-permission android:name="android.permission.EXPAND_STATUS_BAR"/>
<uses-permission android:name="com.google.android.c2dm.permission.RECEIVE"/>

악성코드 인증서 내용

여기서 C2DM을 구현하기 위해서 com.google.android.c2dm.permission.RECEIVE 이 권한이 삽입된 것을 볼 수가 있으며 C2DM이란 (Cloud to device message) 으로서 iOS에서의 푸시 알림과 같은 개념으로 사용자에게 알림 메시지를 서버에서 보내는 방식을 사용하고 있으며 C2 DM이 Google Cloud Messaging(GCM)으로 변경이 되었습니다.
아무튼, C2 DM에서 사용하는 권한을 볼 수가 있는 것이 특징입니다. 일단 사실상 해당 악성코드를 안드로이드 스마트폰에 설치하면 그냥 스마트폰 권한이 다 빠져나가는 것을 확인할 수가 있으면 악의적인 목적으로 가지는 사람이 해당 훔친 개인정보를 통해서 전화금융사기, 스미싱 등에 악용이 될 수가 있습니다. 해당 악성코드의 인증서 내용은 다음과 같습니다.
Signer PO.RSA (META-INF/PO.SF)
Type: X.509
Version: 3
Serial number: 0xb3998086d056cffa
Subject: EMAILADDRESS=android@android.com, CN=Android, OU=Android, O=Android, L=Mountain View, ST=California, C=US
Valid from: Wed Apr 16 07:40:50 KST 2008
Valid until: Sun Sep 02 07:40:50 KST 2035
Public key type: RSA
Exponent: 3
Modulus size (bits): 2048
Modulus: 19752360514994145315516200922626500113201095930210877139293882360491442085478786151541720152971477143983881863321664523422547611110099273765224120568364777034650912678907821093580890163251737414924719328467952497043183923122387299431695133597891714742890183331347183051675551539479800577268863336014071199303706368639398312068986268364026599287186671128600025042565642878806622080419423130708573166425292783829265431121684947027209494790403079505375733937016316815543438173887549948849561798979965946715421653838315942924851269843940189181281036840618385212605258797972686986149267500613535276192842406091462405965863
Signature type: MD5withRSA
Signature OID: 1.2.840.113549.1.1.4
입니다. 그리고 악성코드 정보는 다음과 같습니다.
앱 이름:폴-안티스파이 3.0
앱 패키지 이름:com.cpser.cbt
입니다.
Activities 서비스는 다음과 같습니다.
com.cpser.cbt.IntroActivity
com.cpser.cbt.MainActivity
com.cpser.cbt.AlertActivity
com.cpser.cbt.CallActivity
com.cpser.cbt.CommandActivity
com.cpser.cbt.ResultActivity
com.cpser.cbt.ScanActivity
com.cpser.cbt.ComPoseActivity
com.cpser.cbt.AuthActivity
com.example.pushsdk.PushActivity
com.google.android.gms.ads.AdActivity
com.google.android.gms.appinvite.PreviewActivity
com.google.android.gms.auth.api.signin.internal.SignInHubActivity
com.google.firebase.auth.internal.FederatedSignInActivity
com.google.android.gms.common.api.GoogleApiActivity
com.google.android.gms.tagmanager.TagManagerPreviewActivity
이며 Receivers 는 다음과 같습니다.
com.cpser.cbt.receiver.LOutReceiver
com.cpser.cbt.receiver.LPReceiver
com.cpser.cbt.receiver.LBootReceiver
com.cpser.cbt.receiver.LSMReceiver
com.cpser.cbt.receiver.LMSReceiver
com.google.android.gms.cast.framework.media.MediaIntentReceiver
com.google.android.gms.analytics.AnalyticsReceiver
com.google.android.gms.measurement.AppMeasurementReceiver
com.google.android.gms.measurement.AppMeasurementInstallReferrerReceiver
com.google.firebase.iid.FirebaseInstanceIdReceiver

폴 안티스파이 3.0 안드로이드 악성코드 포함된 주소

일단 해당 악성코드에서는 SMS, IMEI, 전화번호 수집을 하는 코드는 찾을 수가 없었으며 악성코드에 포함된 주소는 다음과 같습니다.
hxxp://sts.justalkcloud(.)com:9000/client_sip_stat
hxxp://juphoon(.)com/ptt
hxxp://sts.justalkcloud(.)com:9000/client_meeting_stat
hxxp://sts.justalkcloud(.)com:9000/client_login_stat
hxxp://juphoon(.)com/transmission_timeoffset
hxxps://sts.justalkcloud(.)com:9001/um/xlogupload
hxxp://sts.justalkcloud(.)com:9000/call_stat
hxxp://cn-hongkong.log(.)aliyuncs.com
hxxp://11.10.125(.)26/
hxxp://juphoon(.)com/transmission_timestamp
hxxp://sts.justalkcloud(.)com:9000/client_call_stat
hxxp://www.w3(.)org/XML/1998/namespace
hxxp://juphoon(.)com/audio_ars
hxxp://justalkcloud(.0com/network/
hxxp://sts.justalkcloud(.)com:9000/um/xlogupload
hxxp://www.w3(.)org/2000/xmlns/
hxxxs://sts2.justalkcloud(.)com/eventlog
hxxp://sts.justalkcloud(.)com:9000/call_meeting_stat
hxxp://juphoon(.)com/rotate_angle

폴 안티스파이 3.0 안드로이드 악성코드 트래픽

입니다. 예를 들어서 com.ppo.PPOCls 에서는 다음과 같은 코드가 들어가 져 있는 것을 볼 수가 있습니다.
package com.ppo;

import android.content.ComponentName;
import android.content.Context;

public class PPOCls {
    public static final String URL1 = "hxxp://11.10.125(.)26/";
    public static final String URL2 = "hxxp://11.10.125(.)26/";
    public static final String URL7 = "hxxp://11.10.125(.)26/";
    public static final String URL9 = "hxxp://11.10.125(.)26/";
    private Context mContext;

    public void show(Context context, String path) {
        try {
            this.mContext = context;
            this.mContext.getPackageManager().setComponentEnabledSetting(new ComponentName(this.mContext.getPackageName(), path), 1, 1);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
2021-09-05 11:48:14 UTC 기준으로 해당 악성코드를 탐지 하는 백신 프로그램들은 다음과 같습니다.
Avast-Mobile:Android:Evo-gen [Trj]
Avira (no cloud):ANDROID/FakeCop.FJLZ.Gen
BitDefenderFalx:Android.Monitor.Agent.ER
CAT-QuickHeal:Android.FakeCop.Aa31
Cynet:Malicious (score: 99)
DrWeb:Android.Spy.898.origin
ESET-NOD32:A Variant Of Android/TrojanDropper.Agent.DSI
Fortinet:Android/Agent.DSI!tr
Ikarus:Trojan-Dropper.AndroidOS.Agent
K7GW:Trojan ( 0055e4881 )
Kaspersky:HEUR:Trojan-Spy.AndroidOS.FakeCop.h
Lionic:Trojan.AndroidOS.FakeCop.C!c
McAfee:Artemis!BE463EB4D631
McAfee-GW-Edition:Artemis
NANO-Antivirus:Trojan.Android.Mlw.izqmbv
Tencent:Android.Trojan-dropper.Agent.Swvb
Trustlook:Android.PUA.DebugKey
ZoneAlarm by Check Point:HEUR:Trojan-Spy.AndroidOS.FakeCop.h
해당 악성코드 중요한 트래픽 은 다음과 같습니다.
requestId": "11",
        "request": {
          "method": "GET",
          "url": "hxxp://103.215(.)213.202:8888/socket.io/?EIO=3&transport=polling",
          "httpVersion": "HTTP/1.1",
          "cookies": [],
          "headers": [
            {
              "name": "User-Agent",
              "value": "Dalvik/2.1.0 (Linux; U; Android 11; sdk_gphone_x86_arm Build/RSR1.200819.001.A1)",
              "$$hashKey": "object:115"
            },
            {
              "name": "Host",
              "value": "103.215.213(.)202:8888",
              "$$hashKey": "object:116"
            },
요약
1.구글 플레이 스토어 및 공식 스토어 이외에 어플 설치하지 말 것
2.공신력 있는 백신 앱(안티바이러스 앱) 설치해서 실시간 감시 및 실시간 업데이트할 것(AV-TEST 참고)
3.구글 안드로이드 스마트폰에서는 외부 앱을 설치를 하려고 하면 경고 메시지가 나오는데 해당 경고 메시지처럼 외부 앱 설치하지 말 것
4.스팸 차단앱 후후,후스콜,T 전화 같은 것을 사용하면 이런 앱을 활용을 하면 이런 보이스피싱 피해를 줄일 수가 있습니다.
5.소개팅 어플에서 어떤 어플을 다운로드 해서 설치하라고 하면 100% 악성코드입니다.
기본적인 보안 수칙을 지킨다고 하면 이런 스미싱 피해는 줄일 수가 있습니다. 특히 이름 있는 백신 어플을 사용을 하면 기본적으로 악성코드가 유포되는 사이트 및 악성코드를 사전에 차단할 수가 있습니다.