We observed a series of domains luring people to download a flash update or a Clash of Clans game trick for mobile phones running the Android platform.

We downloaded the same malicious apk file from both websites. The file name is flash_update.apk and SHA1 is dc42fcd427054227a6ee2dd92b8356e57f9ead77.

The malicious application requires the following permissions:

android.permission.CHANGE_NETWORK_STATE (change network connectivity)
android.permission.SEND_SMS (send SMS messages)
android.permission.USES_POLICY_FORCE_LOCK (Unknown permission from android
reference)
android.permission.RECEIVE_BOOT_COMPLETED (automatically start at boot)
android.permission.INTERNET (full Internet access)
android.permission.VIBRATE (control vibrator)
android.permission.WRITE_SMS (edit SMS or MMS)
android.permission.ACCESS_WIFI_STATE (view Wi-Fi status)
android.permission.WAKE_LOCK (prevent phone from sleeping)
android.permission.GET_TASKS (retrieve running applications)
android.permission.CALL_PHONE (directly call phone numbers)
android.permission.WRITE_SETTINGS (modify global system settings)
android.permission.ACCESS_NETWORK_STATE (view network status)
android.permission.READ_PHONE_STATE (read phone state and identity)
android.permission.CHANGE_WIFI_STATE (change Wi-Fi status)
android.permission.READ_SMS (read SMS or MMS)
android.permission.READ_CONTACTS (read contact data)
android.permission.RECEIVE_SMS (receive SMS)

We’ve found three malicious URL the application tries to beacon to:

 

 

hxxps://playsstore[.]net/QUESTIONROADFAR/
hxxps://secure-ingdirect[.]top/QUESTIONROADFAR/
hxxps://playsstore[.]mobi/QUESTIONROADFAR/

The domains all use the same registration information as follow. We have verified the information, and we can confirm that the address and phone number don’t exist.

Registrant Name: joi frey
Registrant Organization:
Registrant Street: 12 mondo
Registrant City: paris
Registrant State/Province: Paris
Registrant Postal Code: 75014
Registrant Country: FR
Registrant
Phone: +33.0101256325
Registrant Phone Ext:
Registrant Fax:
Registrant Fax Ext:
Registrant Email: benoit.parene@laposte[.]net

The email address benoit.parene@laposte[.]net was used to register several domains related to the same threat:

Domain	Contact Email	Create Date	IP Address	ASN	Country
cest-sure.com	benoit.parene@laposte.net	12/17/16	146.0.79.171	57043	NL
clahs-clans-crack.com	benoit.parene@laposte.net	12/18/16	185.70.184.176	57043	NL
clash-of-clans-crack.net	benoit.parene@laposte.net	12/16/16	146.0.79.179	57043	NL
clashclanscrack.com	benoit.parene@laposte.net	12/20/16	185.70.187.212	57043	NL
clashclanscrack.net	benoit.parene@laposte.net	12/20/16	185.70.187.212	57043	NL
crackclashofclans.com	benoit.parene@laposte.net	12/20/16	185.70.187.212	57043	NL
crackclashofclans.net	benoit.parene@laposte.net	12/20/16	185.70.187.212	57043	NL
flash-play.com	benoit.parene@laposte.net	12/18/16	146.0.79.226	57043	NL
hdi-porn.com	benoit.parene@laposte.net	12/18/16	185.70.184.176	57043	NL
playsstore.mobi	benoit.parene@laposte.net	11/24/16	5.188.228.253	48693	RU
playsstore.net	benoit.parene@laposte.net	11/24/16	5.188.228.253	48693	RU
playystore.com	benoit.parene@laposte.net	12/15/16	146.0.79.161	57043	NL

From the listed IP addresses, we were able to expand on your investigation and find more domains related to android Marche malware. The IP address 185.70.187[.]212 where a few of the Clash of Clans domains are hosted revealed another domain adkjah34[.]com.  This domain has been registered using the following details:

Registrant Name: JOSE NILSON ALVES PAMPLONA
Registrant Organization: JOSE NILSON ALVES PAMPLONA
Registrant Street: RUA DULCE TORRES BROCHADO  2441
Registrant City: UNAI
Registrant State/Province: MG
Registrant Postal Code: 38610000
Registrant Country: BR
Registrant Phone: +55.11943534986
Registrant Email: jose.nilsonalves@yahoo.com[.]br

Several other domains were registered with the same details, and at least 5 domains are known Banload C2s. Banload is a Brazilian banking Trojan. The domains are:

madimbu[.]com
alabeutum[.]com
babcxx22tu[.]com
alabeutres[.]com
baeroodum[.]com

Sample of forged websites – hxxp://flash-play[.]com

 

 

Sample of forged websites – hxxp://clashclanscrack[.]com

 

 

IOCs:
SHA1(flash_mise_a_jour.apk)= d3ebdb1d4f73ed20d16489ef1a477a843d382edc
SHA1(flash_update.apk)= dc42fcd427054227a6ee2dd92b8356e57f9ead77
SHA1(myfile.apk)= da39a3ee5e6b4b0d3255bfef956018
SHA1(classes.dex)= 8af9b4e9b443a4668da6e715fa8a4e1e58fcff77