X-Industry

The Arid Viper group has a long history of using mobile malware, including at least four Android spyware families and one short-lived iOS implant, Phenakite.  The SpyC23 Android malware family has existed since at least 2019, though shared code between the Arid Viper spyware families dates back to 2017. It was first reported in 2020 by ESET in a campaign where the actor used a third-party app store to distribute weaponized Android packages (APK).  That campaign featured several apps that mimic Telegram and Android application update managers.[1]

Through 2022 and early 2023, Arid Viper developed several newer SpyC23 versions that share these themes: two apps mimic Telegram, while another is internally called APP-UPGRADE but is based on a romance-themed messaging app called Skipped Messenger. Cisco Talos recently reported on the history of Skipped Messenger, revealing that the once-benign dating application was likely passed from the original developer to the Arid Viper actor.

SentinelLabs compared these newer versions of SpyC23 to the earlier 2020 version, as well as several older Android spyware families associated with Arid Viper: GnatSpy, FrozenCell, and VAMP. Many changes have been made in SpyC23’s development; however, there are notable overlaps with these older families, and the taxonomy is less distinct.

App Analysis - The theme of these applications centers on messaging and communications. We identified two unique themes: one mimics Telegram, and the other mimics an apparent dating-themed app called Skipped Messenger. The group has previously relied on Telegram-themed messengers and romance-themed lures and apps.

Arid Viper often relies on social engineering to deliver malware with pretexts, allowing operators to engage closer to their intended victims. The social engineering approach is a boon for delivering Android malware, as there are many hurdles for the actor to overcome before a user successfully installs a malicious app. Working the installation flow into a social engineering pretext is likely more effective than expecting users to install spyware successfully without prompting.

There is a non-weaponized version of Skipped Messenger (SHA-1: 6e1867bd841f4dc16bef21b5a958eec7a6497c4e) that shares the same Firebase service hostname skippedtestinapp[.]firebaseio[.]com as the malicious version. As the Talos report noted, Skipped was originally a legitimate dating app. The Google Play store version was last updated in August 2021.
Skipped Messenger & Telegram app main screen

Like most malicious Android apps, these apps ask users to enable permissions that facilitate spyware activities.
Skipped Messenger screens prompting the user to enable Accessibility features

The application permissions give a high degree of control over the device, including:

• Accessing the phone’s location
• Making calls without user interaction
• Monitoring calls made by the user
• Recording with the microphone, capturing audio output
• Read & Write to storage
• Read & Write to the Contacts list
• Modifying network state
• Collecting a list of accounts used on the device
• Downloading files to the phone without user interaction
• Launching Java archive (JAR) files as a Service
• Reading notifications received on the device, as well as any connected wearables

The developer employed anti-decompilation and anti-virtualization techniques to complicate the analysis.  Each of these APKs contains application code that is obfuscated. On emulated Android devices, the apps flash and repeatedly cycle through prompts even after the requested permissions have been granted.

Comparing these new versions with older SpyC23 variants, there is a significant overlap in package names, which fortifies the relationship between the old and new versions.  In the image below, the older version on the left houses malicious activity in the update.BBM package, and the version we discovered on the right houses similar subpackages in the apps.sklite.pacJava package.
Java subpackage names: SpyC23 2020 (left) and APP-UPGRADE APK 2023 (right)

The overlaps continue in the class names. The actor frequently names classes after people’s names, as outlined in the rc_cola/tas_ran_rc_col package structure.
Java class names: SpyC23 2020 (left) and APP-UPGRADE APK 2023 (right)

These applications are quite large, making analysis of each class impractical. Instead, we will focus on several exciting classes and methods.

ACCAPPService - This class handles some communications to the C2.  The class contains code for the user to uninstall the application.  The SendToServerTask subclass logs when the user is in a ‘dangerous’ menu and parses input containing the active menu name for the English words ‘apps’ or ‘applications’ and the Arabic word for ‘Applications.’
“User In Dangerous Menu” logging messages

Brodie - This class is responsible for much of the app’s upload request handling, acting as an interface between the app and the C2 server. Brodie contains a method named isProbablyArabic, suggesting again that these apps are used against Arabic-speaking targets.
isProbablyArabic method from Brodie class

CallRecService - This service enables the spyware’s call recording feature. The class is imported from an external library, libcallrecfix.so, and runs as a service. The Unix library is based on at least two open-source Android call recording projects, though neither are actively maintained. This was implemented in 2020 and has been a staple of SpyC23 iterations. The library is a binary compiled for each app’s compatible architectures.

checkRaw - This Audio upload service has many of the same status logging strings and media recording parameters seen in older versions of Arid Viper’s Android toolsets, including FrozenCell, reported by Lookout in 2017, and VAMP, which was reported by Palo Alto in 2017 as well.

RcNewService class from FrozenCell (left) and check raw class from the 2023 APP-UPGRADE version of SpyC23 (right)

Some elements of this audio recording code are present in GitHub repositories described as a teardown of the Telegram Android app.  While this is potentially an adaptation of open-source software, the similarities between the SpyC23 APKs are consistent, and the external versions do not have the same variables or logging messages.

Moller - This class is notable because it contains code that spans back to earlier versions of Arid Viper’s Android spyware.  We identified a 2017 GnatSpy sample from Trend Micro’s Arid Viper reporting that shares the same upload functionality through a subclass JsDirService.

Panda - This class loads methods from external libraries libRoams.so and lib-uoil.so. The code imports several functions related to manufacturer-specific implementations, including Huawei, Oppo, and Xiaomi.  The Panda class imports methods from the open-source Gotev Android Upload Service, which was also used by the older versions of SpyC23.  Panda imports methods from the OKhttp library to craft HTTP requests. When the OnCreate method runs, it initializes the Gotev service, parses the C2 configuration values, and registers GarciaReceiver. This receiver monitors for a connection state change, which was also present in older versions.

onCreate method inside the Panda class

Like older versions of SpyC23, this class has logic to parse and decode the C2 server details from strings stored inside the lib-uoil.so and related binaries. The strings are encoded partially in Base64, with an additional layer likely on top to parse the correct C2 server URIs. The previous technique of dropping the strings before and after the hyphen remains, and further substitution removes spaces and underscores, replacing them with hyphens.

C2 Infrastructure - The C2 servers used by these apps continue the longstanding Arid Viper domain naming scheme of a hyphenated hostname that uses Western-sounding peoples’ names. The primary C2 servers are:

• luis-dubuque[.]in– C2 domain used by APP-UPGRADE Skipped Messenger APK
• danny-cartwright[.]firm[.]in– C2 domain used by com.teleram.app APK
• conner-margie[.]com– C2 domain used by com.alied.santafi

Analysts have included additional network indicators associated with app features unique to the APKs analyzed, including Google Cloud project hostnames and Firebase messaging hostnames.

Conclusion- The discovery of these APKs demonstrates that Arid Viper continues to thrive in the mobile malware space.  The dedication to anti-analysis and obfuscation suggests that the developers are aware of research analysis and have applied measures to deter them and remain under the radar.  The presence of code from other Arid Viper Android spyware families in SpyC23 fortifies the connection between this group’s various iterations of tools.  The resulting bloat from carrying over older versions of the spyware aids attribution in the complex mobile malware landscape that pervades the Middle East.

Arid Viper has historically targeted military personnel in the Middle East, as well as journalists and dissidents.  The most recent versions of SpyC23 highlight the actor’s focus on Arabic speakers, which is an exciting development given the actor’s historical penchant for targeting Israeli military personnel with Android spyware.

Those at risk of being targeted by this group should avoid installing applications from outside the Google Play Store.  Everyone should remain wary when installing new apps from any source: does this app need the permissions it requests? In the case of SpyC23 apps, there is a lengthy walkthrough with images guiding the user to accept an inordinate number of permissions.

SentinelLabs would like to thank the research team at Cisco Talos for their collaboration on this research.

Indicators of Compromise

This article is presented at no charge for educational and informational purposes only.

Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization.  We thank our colleagues at Sentinel Labs for sharing this great collection and analysis.  By sharing, we all will be cyber-safe.  For questions, comments, a demo, or assistance, please get in touch with the office directly at 1-844-492-7225 or feedback@redskyalliance.com    

Weekly Cyber Intelligence Briefings:

• Reporting: https://www.redskyalliance.org/
• Website: https://www.redskyalliance.com/
• LinkedIn: https://www.linkedin.com/company/64265941 

Weekly Cyber Intelligence Briefings:

REDSHORTS - Weekly Cyber Intelligence Briefings

https://attendee.gotowebinar.com/register/5993554863383553632

[1] https://www.sentinelone.com/labs/arid-viper-apts-nest-of-spyc23-malware-continues-to-target-android-devices/