SonicSpy: Over a Thousand Spyware Apps Discovered, Some in Google Play

Personal holding card that says "Google Play" on it.

‍

Lookout researchers have identified over a thousand spyware apps related to a threat actor likely based in Iraq. Belonging to the family "SonicSpy," these samples have been aggressively deployed since February 2017, with several making their way onto the Google Play Store. Google removed at least one of the apps after Lookout alerted the company.

We discovered this threat after the Lookout Security Cloud analysis stack identified the spyware capabilities, flagging the app to our research team for manual review.

All Lookout customers are protected from this threat.

‍

What it does

The sample of SonicSpy most recently found on the Play Store, called Soniac, is marketed as a messaging app. While Soniac does provide this functionality through a customized version of the communications app Telegram, it also contains malicious capabilities that provide an attacker with significant control over a target device.

This includes the ability to silently record audio, take photos with the camera, make outbound calls, send text messages to attacker specified numbers, and retrieve information such as call logs, contacts, and information about Wi-Fi access points.

The overall SonicSpy family supports 73 different remote instructions, including those seen in the Soniac instance.

Upon first execution SonicSpy will remove its launcher icon to hide itself from the victim, establish a connection to C2 infrastructure (arshad93.ddns[.]net:2222), and attempt to install its own custom version of Telegram that is stored in the res/raw directory and titled su.apk.

‍

Determining the functionality

Testing SonicSpy's malicious functionality was a relatively straight forward process due to how client server communication has been implemented and can be quickly confirmed via DNS poisoning and running netcat.

‍

SonicSpy code snippet — Running netcat on port 2222 where the DNS record for arshad93.ddns[.]net has been locally poisoned allows us to interact directly with an infected device. Via the A0 command it is possible to retrieve basic device information, followed by call logs (A1), wifi access points (A7), clipboard data (A20), record surrounding audio (A29), before stopping audio recording and retrieving the audio as base64 encoded data (A30).

‍

Potential attribution

Analysed samples were found to contain many similarities to SpyNote, another malware family that was first reported on in mid 2016. There are many indicators that suggest the same actor is behind the development of both. For example, both families share code similarities, regularly make use of dynamic DNS services, and run on the non-standard 2222 port. In the case of SpyNote, the attacker used a custom-built desktop application to inject malicious code into specific apps so that a victim could still interact with the legitimate functionality of the trojanized apps. Due to the steady stream of SonicSpy apps it seems likely that the actors behind it are using a similar automated-build process, however their desktop tooling has not been recovered at this point in time.

The account behind Soniac, iraqwebservice, has also previously posted two other SonicSpy samples to the Play Store, although both samples are no longer live. It's unclear whether they were removed as a direct result of Google taking action or if the actor behind SonicSpy removed them in order to evade detection for as long as possible. Cached Play Store pages of these apps, Hulk Messenger and Troy Chat, confirm they were once live and our analysis found they contained the same functionality as other SonicSpy samples.

‍

Cached images of SonicSpy apps removed from Google Play — *Cached web content of hulk messenger and troy chat that were also live on the Play Store.*

‍

Anyone accessing sensitive information on their mobile device should be concerned about SonicSpy. The actors behind this family have shown that they're capable of getting their spyware into the official app store and as it's actively being developed, and its build process is automated, it's likely that SonicSpy will surface again in the future.

SHA-1s

96548a4054aa1c798a8318302ab416cdbbedd5bb
10d19575a7c34b416366283a2e84533c9b9c06dc
5a341606fc391d669f1c01c5dd7e93fc49dca0d7
08f85a19aa4fa7baa5be5ee957a6daa147e96df8
ca620dc143d41662181d638f54a6d38c02e7ab05
966dfc62d7b89ee41422550cd2c4d6de10ef1f8f
9d2aa0bcecaf564eb06238086c53ce56e8ca1bf4
3f33367040dc423ff97aab7196aa6748ff11cc45
ea9079c800cf8d77cccdc393de1d7366b00ba7ec
a8b3013c4998196672967028f5612f73c0be23ef
82bc64931d5e86d02792685141da0cfc5fcf147a
275b55b2addb08912d973a6e181fd70e6bbe5d90
29967d4afd2e11beb85e2f7eec5ce4c1778026a2
3528e219fd190445a9918065289738175d311def
b22f7611916ff2c57514bc40e59924268fb64452
7bd0f90e75941939671e430f960674c566f7167c
ed84300fb1ba7feef63351e49ddd2930f865bea9
9f69841f38501e4e527d4563d97838c21006083c
9a6b7418729d0b6dc22e8e4925006c6567b303a9
515453379a26d19c49e60edb8affd801b6001234

Authors

Michael Flossman

Head of Threat Intelligence

Michael is Head of Threat Intelligence at Lookout where he works on reverse engineering sophisticated mobile threats while tracking their evolution, the campaigns they are used in, and the actors behind them. He has hands-on experience in vulnerability research, incident response, security assessments, pen-testing, reverse engineering and the prototyping of automated analysis solutions. When not analysing malware there’s a good chance he’s off snowboarding, diving, or looking for flaws in popular mobile apps.