meannn
Elite Member
- Apr 22, 2009
- 1,908
- 2,771
April 19, 2019
Research by: Avigayil Mechtinger, Andrey Polkovnichenko
Summary:
Checkpoint’s researchers, with the help of Craig Silverman at BuzzFeed, have uncovered a series of applications conducting fraudulent activities against Ad Agencies. Craig Silverman reached out to Check Point with the leads for the applications as a part of his story. The malware found from those leads, dubbed ‘PreAMo’, imitates the user by clicking on banners retrieved from three ad agencies – Presage, Admob, and Mopub.
In total, the malware was downloaded over 90 million times across 6 applications. Google was notified and removed the infected applications from Google Play.
Figure 1 – RAM Master Google Play Information
Inside ‘PreAMo’:
‘PreAMo’ is built from three distinctive parts of code, each dealing with another ad agency. They are not connected in terms of code as each is located in a separate package and have different triggers. What unifies these three code parts is the communication with the same C&C server (res.mnexuscdn[.]com), which is used to send statistics and receive configuration. Furthermore, the behavior of these parts is very similar; they register a listener on a banner being loaded by the ad network, and once the banner is loaded, ‘PreAMo’ uses the functionality of Android’s framework class ‘MotionEvent’ to imitate a click.
However, due to the difference in implementation by the ad libraries, the actor behind ‘PreAMo’ used different approaches dealing with every ad agency. This paper will describe the approach taken by the actor with each ad agency.
1. Ad Agency #1 – Admob:
‘PreAMo’ registers in the manifest a provider named ‘com.google.android.gms.ads.internal.tools.ConfigProvider’, with the sole purpose of initializing its own class ‘AdMobFixer’ at the start of the host application.
This class registers a dynamic receiver with a timer to periodically check for configuration updates from the C&C server.
Figure 2 – The registration of the receiver
‘PreAMo’ uses two different methods to detect if an ad banner is being displayed: the first uses reflection to interrupt into the internal structures and install a callback, while the second is based on activity lifecycle callbacks.
Figure 3 – Detection method #1
Figure 4 – Detection method #2
Android notifies this listener each time when a new activity is created inside the application. ‘PreAMo’ recursively searches for the specific Ad View, starting from the top-level window (Décor)
Figure 5 – Implementation of the OnAdActiviy
After successful detection of a banner, ‘PreAMo’ checks a set of conditions:
Figure 6 – Condition checks performed by ‘PreAMo’
Figure 7 – reading predetermined coordinates from ‘xdd’
Figure 8 – Using randomly generated coordinates
Ad Agency #2 – Presage:
The execution of this code part is originated from the ‘com.DianXinOS.OService’ class. In a method calls ‘onStartCommand’ ‘PreAMo’ starts a new thread which periodically showing interstitial ads from Presage (ogury) library.
Inside this thread, the malware communicate with the C&C server, and load the configuration from the URL ‘hxxps://res.mnexuscdn[.]com/dp/0845e0150308bcdf5ef03ba8295075f9’.
Figure 9 – Thread Creation
Figure 10 – Ad strategy (configuration)
‘PreAMo’ receives the configuration and checks period between ads (min_i_sec_limit) and maximum daily ads (max_p_ad). After a successful verification, ‘PreAMo’ shows activity with ads from the Presage library.
Figure 11 – checking ad configuration
Figure 12 – Interstitial Ads
In addition to showing ads from Presage, ‘PreAMo’ register its own activity manager for the host application, re-implementing the following methods (Figure 13) and replacing the default Presage web client to make it possible to click banners using randomly generated coordinates (Figure 14).
Figure 13 – Re-implemented methods from Presage
Figure 14 – Randomly generated coordinates
Ad Agency #3 – Mopub:
When ‘PreAMo’ deals with Mopub, the initialization part is located in the content provider. This provider is present in the class ‘com.android.stats.tools.InitProvider’, and on the start of the host application, inside the method ‘OnCreate’, it executes its code and setting up the configuration for a timer.
The timer periodically sends requests to a set of URLs, checking configuration updates:
Figure 15 – Fake package information
In the same manner, the actor has changed the code of Mraid controller, aimed to process link opened in WebView component. The controller contains an object that implements the ‘MraidListener’ interface, which contains a callback for the events triggered by javascript loaded into the banner. One of the callback methods is called ‘onOpen’ which reacts to URLs opened by javascript.
Figure 16 – Faking host information
Figure 17 – Implementation of MraidController
Originally, the implementation of the onOpen called class URLHandler, processing the URL corresponding to its scheme. The actor behind ‘PreAMo’ made its own changes into the process. Now, if the URL’s processed correctly, and it’s an HTML page, a click imitation will occur.
Figure 18 – Clicking Imitation #1
The same thing was done with HTMLWebViewClient. It contains the method ‘shouldOverrideUrlLoading’, giving the host application a chance to take control when a URL is about to be loaded in the current WebView. Originally Mopub had used it to check how to process the URL being loaded to the Webview, but malware developer injected its own code, performing a click on the page being loaded.
Figure 19 – Click imitation #2
The C&C Server:
The C&C ‘res.mnexuscdn.com’ is registered via anonymous service, first seen at 12.12.18 according to passive total’s RiskIQ.
Figure 20 – WhoIS data from RiskIQ
Receive configuration for AdMob clicks:
‘https://res.mnexuscdn[.]com/dp/4456476a30e111ba1b3ee299c279d51a’
Receive configuration for Mopub clicks:
‘https://res.mnexuscdn[.]com/dp/a79a2d1b9a8252fcc6917d6c46211199’
‘https://res.mnexuscdn[.]com/dp/dd87a43132f3ce443d1e50b29019de3b’
‘https://res.mnexuscdn[.]com/dp/8c7d12b8c28d8e573439c59627df9092’
‘https://res.mnexuscdn[.]com/dp/cdaef0b66c347591bffd32260d76c6cc’
‘https://res.mnexuscdn[.]com/dp/9a641c69cf5186982e8ac8c4e06e80f4’
‘https://res.mnexuscdn[.]com/dp/f61f3f92d0dbcebe26d47dea3af1492a’
Receive configuration for presage/ogury clicks:
‘https://res.mnexuscdn[.]com/dp/0845e0150308bcdf5ef03ba8295075f9’
Conclusion:
In a world where ad revenue can produce a very high income, it’s not surprising why malicious actors are after fraudulent activities against ad agencies. “Follow the money” is a good rule of thumb while investigating a malicious campaign.
The research on how to deal with every ad agency, different code segments and a logging activity show us the amount of effort this actor has invested in this operation. With applications reaching 50,000,000+ downloads, we can only speculate the amount of money generated by this fraudulent activity.
How can you protect yourself:
With a few simple steps, you can also protect your device from malicious activities:
Package name Estimated downloads from Google Play
com.pic.mycamera 57M
com.omni.cleaner 48M
com.speedbooster.optimizer 24M
com.rambooster.totalcleaner 15M
com.cooler.smartcooler 12M
com.flashlight.torch.screenlight.party 3.4M
Research by: Avigayil Mechtinger, Andrey Polkovnichenko
Summary:
Checkpoint’s researchers, with the help of Craig Silverman at BuzzFeed, have uncovered a series of applications conducting fraudulent activities against Ad Agencies. Craig Silverman reached out to Check Point with the leads for the applications as a part of his story. The malware found from those leads, dubbed ‘PreAMo’, imitates the user by clicking on banners retrieved from three ad agencies – Presage, Admob, and Mopub.
In total, the malware was downloaded over 90 million times across 6 applications. Google was notified and removed the infected applications from Google Play.
Figure 1 – RAM Master Google Play Information
Inside ‘PreAMo’:
‘PreAMo’ is built from three distinctive parts of code, each dealing with another ad agency. They are not connected in terms of code as each is located in a separate package and have different triggers. What unifies these three code parts is the communication with the same C&C server (res.mnexuscdn[.]com), which is used to send statistics and receive configuration. Furthermore, the behavior of these parts is very similar; they register a listener on a banner being loaded by the ad network, and once the banner is loaded, ‘PreAMo’ uses the functionality of Android’s framework class ‘MotionEvent’ to imitate a click.
However, due to the difference in implementation by the ad libraries, the actor behind ‘PreAMo’ used different approaches dealing with every ad agency. This paper will describe the approach taken by the actor with each ad agency.
1. Ad Agency #1 – Admob:
‘PreAMo’ registers in the manifest a provider named ‘com.google.android.gms.ads.internal.tools.ConfigProvider’, with the sole purpose of initializing its own class ‘AdMobFixer’ at the start of the host application.
This class registers a dynamic receiver with a timer to periodically check for configuration updates from the C&C server.
Figure 2 – The registration of the receiver
‘PreAMo’ uses two different methods to detect if an ad banner is being displayed: the first uses reflection to interrupt into the internal structures and install a callback, while the second is based on activity lifecycle callbacks.
Figure 3 – Detection method #1
Figure 4 – Detection method #2
Android notifies this listener each time when a new activity is created inside the application. ‘PreAMo’ recursively searches for the specific Ad View, starting from the top-level window (Décor)
Figure 5 – Implementation of the OnAdActiviy
After successful detection of a banner, ‘PreAMo’ checks a set of conditions:
- Is the user ‘organic’. This flag is the part of the ‘com.DianXinOS’ library and set depending on intent received by the listener of the ‘INSTALL_REFERRER’ If the content contains the word ‘organic’, meaning the application was installed after a search in Google Play, the value is set to True, Otherwise set to False. The Autoclicking will only work if the value is False. However, in some versions of ‘PreAMo’ this value can be received from the C&C server.
- User didn’t click on the ad banner yet.
- Clicking Interval and a daily maximum of clicks are lower than the predefined limit.
- Check for a random value.
Figure 6 – Condition checks performed by ‘PreAMo’
Figure 7 – reading predetermined coordinates from ‘xdd’
Figure 8 – Using randomly generated coordinates
Ad Agency #2 – Presage:
The execution of this code part is originated from the ‘com.DianXinOS.OService’ class. In a method calls ‘onStartCommand’ ‘PreAMo’ starts a new thread which periodically showing interstitial ads from Presage (ogury) library.
Inside this thread, the malware communicate with the C&C server, and load the configuration from the URL ‘hxxps://res.mnexuscdn[.]com/dp/0845e0150308bcdf5ef03ba8295075f9’.
Figure 9 – Thread Creation
Figure 10 – Ad strategy (configuration)
‘PreAMo’ receives the configuration and checks period between ads (min_i_sec_limit) and maximum daily ads (max_p_ad). After a successful verification, ‘PreAMo’ shows activity with ads from the Presage library.
Figure 11 – checking ad configuration
Figure 12 – Interstitial Ads
In addition to showing ads from Presage, ‘PreAMo’ register its own activity manager for the host application, re-implementing the following methods (Figure 13) and replacing the default Presage web client to make it possible to click banners using randomly generated coordinates (Figure 14).
Figure 13 – Re-implemented methods from Presage
Figure 14 – Randomly generated coordinates
Ad Agency #3 – Mopub:
When ‘PreAMo’ deals with Mopub, the initialization part is located in the content provider. This provider is present in the class ‘com.android.stats.tools.InitProvider’, and on the start of the host application, inside the method ‘OnCreate’, it executes its code and setting up the configuration for a timer.
The timer periodically sends requests to a set of URLs, checking configuration updates:
- ‘hxxps://res.mnexuscdn[.]com/dp/a79a2d1b9a8252fcc6917d6c46211199’
- ‘hxxps://res.mnexuscdn[.]com/dp/75d109e54ce75b05064374ae0b77a359’
- ‘hxxps://res.mnexuscdn[.]com/dp/dd87a43132f3ce443d1e50b29019de3b’
- ‘hxxps://res.mnexuscdn[.]com/dp/8c7d12b8c28d8e573439c59627df9092’
Figure 15 – Fake package information
In the same manner, the actor has changed the code of Mraid controller, aimed to process link opened in WebView component. The controller contains an object that implements the ‘MraidListener’ interface, which contains a callback for the events triggered by javascript loaded into the banner. One of the callback methods is called ‘onOpen’ which reacts to URLs opened by javascript.
Figure 16 – Faking host information
Figure 17 – Implementation of MraidController
Originally, the implementation of the onOpen called class URLHandler, processing the URL corresponding to its scheme. The actor behind ‘PreAMo’ made its own changes into the process. Now, if the URL’s processed correctly, and it’s an HTML page, a click imitation will occur.
Figure 18 – Clicking Imitation #1
The same thing was done with HTMLWebViewClient. It contains the method ‘shouldOverrideUrlLoading’, giving the host application a chance to take control when a URL is about to be loaded in the current WebView. Originally Mopub had used it to check how to process the URL being loaded to the Webview, but malware developer injected its own code, performing a click on the page being loaded.
Figure 19 – Click imitation #2
The C&C Server:
The C&C ‘res.mnexuscdn.com’ is registered via anonymous service, first seen at 12.12.18 according to passive total’s RiskIQ.
Figure 20 – WhoIS data from RiskIQ
Receive configuration for AdMob clicks:
‘https://res.mnexuscdn[.]com/dp/4456476a30e111ba1b3ee299c279d51a’
Receive configuration for Mopub clicks:
‘https://res.mnexuscdn[.]com/dp/a79a2d1b9a8252fcc6917d6c46211199’
‘https://res.mnexuscdn[.]com/dp/dd87a43132f3ce443d1e50b29019de3b’
‘https://res.mnexuscdn[.]com/dp/8c7d12b8c28d8e573439c59627df9092’
‘https://res.mnexuscdn[.]com/dp/cdaef0b66c347591bffd32260d76c6cc’
‘https://res.mnexuscdn[.]com/dp/9a641c69cf5186982e8ac8c4e06e80f4’
‘https://res.mnexuscdn[.]com/dp/f61f3f92d0dbcebe26d47dea3af1492a’
Receive configuration for presage/ogury clicks:
‘https://res.mnexuscdn[.]com/dp/0845e0150308bcdf5ef03ba8295075f9’
Conclusion:
In a world where ad revenue can produce a very high income, it’s not surprising why malicious actors are after fraudulent activities against ad agencies. “Follow the money” is a good rule of thumb while investigating a malicious campaign.
The research on how to deal with every ad agency, different code segments and a logging activity show us the amount of effort this actor has invested in this operation. With applications reaching 50,000,000+ downloads, we can only speculate the amount of money generated by this fraudulent activity.
How can you protect yourself:
With a few simple steps, you can also protect your device from malicious activities:
- Install application from an official market, such as Google Play.
- Always check the rating, comments, and download count of an application before installing.
- Install a security solution from a well-known vendor.
- Don’t connect to networks that you don’t fully trust.
- Always check links before clicking or sending personal information.
Package name Estimated downloads from Google Play
com.pic.mycamera 57M
com.omni.cleaner 48M
com.speedbooster.optimizer 24M
com.rambooster.totalcleaner 15M
com.cooler.smartcooler 12M
com.flashlight.torch.screenlight.party 3.4M
