Malicious apps piggybacking on legitimate Aarogya Setu, warns SonicWall

Aarogya Setu, the mobile application developed by the Government of India to connect essential health services to the people of India in a combined fight against COVID-19, clocked more than 10 crore downloads in just 41 days of its launch.

The App is aimed at augmenting the initiatives of the Government of India, particularly the Department of Health, in proactively reaching out to and informing the users of the app on COVID-19 disease and in contact tracing of positive cases.

As days went by, the App was not only in the news for breaking download records, but it caused a huge outrage on social media platforms around privacy concerns and questions around the architecture of the App.

Now there is yet another problem identified with the App.  It has become the favourite target for malware creators.

SonicWall Labs Threats' research team found fake Aarogya Setu apps holding spyware components.

SonicWall Labs threats research team observed that some of these malicious apps are piggybacked on the legitimate Aarogya Setu app in the resources folder.

The team said that these malicious apps install the legitimate app in the background, a technique used to fool the user into believing that the user installed the legitimate app. In reality, the malicious app executes its criminal functions in the background.

Debasish Mukherjee as VP, Regional Sales - APAC at SonicWall warns that the outbreak of Covid-19 has created new avenues for cyberattackers to explore, innovate, and strike in every malicious way. "With increasing cyber threats it appears that cybercriminals are working overtime to create dissonance among mass app users. We advise Android users to exercise maximum caution while downloading and using the Aarogya Setu App," says Mukherjee.

Mukherjee's team has found multiple scenarios in the way this cyber-scam functions:

1. There are a number of fake apps with the package name cmf0.c3b5bm90zq.patch.  The same code is used for a majority of these apps. The malware author unrolls them by re-branding the icon and application name. In this case, the app is shown as the legitimate Aarogya Setu App, but with an imperfect copy. The icon appears stretched and can be identified when kept alongside the legitimate app. Upon execution, we do not see any activity on the screen. However, after some time, the app icon disappears from the app drawer. This contains a reference to a domain – johnnj2-37916.portmap.io – in the patch_preferences.xml file. During an analysis, the malware did not try to communicate with this domain, however, this domain is connected to malicious apps.
   

   2. Similar to case 1, a number of fake apps have been found with the package name yps.eton.application. In this case, the app has been shown as an Aarogya Setu Add-on app, which is not an official app. As the user installs and executes the app, it requests for the Device-Admin privileges and permission for installation from this source. To look less suspicious to the user, it also installs the official, legitimate Aarogya Setu App from its resource folder.

   3. In this case, the malware author has successfully duplicated the official Aarogya Setu icon. Basis the icon, identification of this malicious app is difficult.

There was no network activity witnessed during our analysis session, but there was a record of a domain – 204.48.26.131:29491 – within an xml file belonging to the app. This domain is related to another malicious Android app.

In all three cases, the common element was the containment of spyware capabilities. All these apps contain code that is like the Android spyware SpyNote. This spyware can make phone calls, recording audio, send SMS, take pictures and record videos from the camera, and start the spyware every time the device reboots.

If the user deletes Aarogya Setu app from the device by long-pressing the icon > uninstall method, only the legitimate app is removed, while the malicious app would continue to remain on the device. The only way to remove the malicious app is to remove it from settings > apps > uninstall. This trick has the potential to fool several users who are not vigilant.