text: Stels Android Trojan Malware AnalysisBy: Dell SecureWorks Counter Threat Unit Threat Intelligence
  - Author: Brett Stone-Gross, Ph.D., Dell SecureWorks Counter Threat Unit(TM) Threat Intelligence
  - Date: 22 March 2013
  Overview
  The Stels malware is a multi-purpose Android Trojan horse that can harvest a victim's contact list, send and intercept SMS (text) messages, make phone calls (including calls to premium numbers), and install additional malware packages. The Dell SecureWorks Counter Threat Unit(TM) (CTU) research team has observed the malware being spread by the same spam campaigns delivered by the Cutwail botnet, which also distribute the peer-to-peer (P2P) Gameover Zeus banking trojan. These spam campaigns normally entice users into clicking links that redirect to a Blackhole exploit kit, which targets vulnerabilities in web browsers and plugins on the Windows operating system. However, because Blackhole is currently unable to exploit an Android device, the attackers are using a fake Adobe Flash Player update to trick victims into downloading and executing the Stels trojan.
  Malware distribution
  The CTU research team has observed a shift away from Android malware being distributed through alternative marketplaces (i.e., outside of the official Google Play app store). In particular, attackers have been orchestrating spam campaigns to distribute Android malware such as the NotCompatible and Stels trojans. Stels uses lures such as fake email messages from the U.S. Internal Revenue Service (IRS) and recommendations from a "friend."
  The Stels sample analyzed by CTU researchers has the following characteristics:
  - Filename: flashplayer.android.update.apk
  - MD5: b226a66a2796e922302b96ae81540d5c
  - SHA1: 670503ed863397d64bfe24ca0940be9c23682ae4
  A Stels sample was uploaded to VirusTotal on March 12, 2013, and was not detected by any of the 44 antivirus products. The CTU research team has discovered similar SMS stealers that share a common codebase with the Stels trojan, which likely indicates that Stels originates from the same malware author or Android crimeware kit.
  Many of the campaigns have used the IRS as a lure due to the March 15 corporate tax return deadline and the April 15 individual tax return filing deadline. Table 1 lists subject lines for these spam campaigns.
  Table 1. Subject lines used in Stels IRS spam campaigns.
  Figure 1 shows an example of a spam email impersonating the IRS.
  Figure 1. Cutwail spam campaign leading to a Blackhole exploit kit, Stels malware, and a work from home scam.
  The URL in the email links to a compromised website that fingerprints the victim's web browser and operating system using a PHP script uploaded by the attackers. If the victim's device is running the Google Android operating system, the hacked site displays a fake Adobe Flash Player update page as shown in Figure 2.
  Figure 2. Fake Flash Player update page that provides a link to the Stels trojan APK executable.
  When the victim clicks the Update Flash Player link, their Android device downloads the Stels APK executable and prompts the victim to install the malware. Thus, user interaction is required to infect the Android device as shown in Figure 3. In addition, because the application does not originate from the official Google Play app store, a user has to enable the "Unknown Sources (Allow installation of non-Market applications)" option in the Security settings. Figure 10 in the Appendix shows the location of this setting on an Android 4.2 device.
  Figure 3. Android installation permissions for the Stels trojan.
  After Stels has been installed, it places a Flash icon in the apps menu with the name APPNAME (shown in the left image in Figure 7). Upon launch, the Stels trojan displays a fake error message: "Your Android version does not support this update! Setup is canceled" and deletes the Flash icon from the apps menu.
  If the victim is using the Microsoft Internet Explorer, Mozilla Firefox, or Opera web browser, then the PHP script displays a fake IRS website shown in Figure 4.
  Figure 4. Fake IRS page that loads a Blackhole exploit kit contained in an iFrame. The links on the page have also been changed to point to a malicious PDF file.
  This fake site contains an embedded 1x1 pixel HTML iFrame that redirects victims to a Blackhole exploit kit (see Figure 5). A successful redirect downloads and installs the P2P Gameover Zeus trojan.
  Figure 5. HTML containing iFrame to Blackhole exploit kit.
  In addition, the attackers modified the URLs on the fake IRS website to link to a malicious PDF file (MD5: aef5a0dbc3e52cadb5b5a7cbda743a90) that exploits CVE-2010-0188, a vulnerability in Adobe Reader and Adobe Acrobat. Despite the age of this exploit, only 2 out of 46 antivirus vendors flagged the PDF as malicious when it was initially uploaded to the VirusTotal analysis service on March 5, 2013.
  If the victim's device is not running Android or any of the targeted browsers, then the PHP script on the compromised site redirects the web browser to a work from home affiliate scam shown in Figure 6.
  Figure 6. Work from home scam located at hxxp://finance-reports.com-adnnews.net.
  Capabilities
  The Stels trojan operates on nearly all versions of Android. The trojan cannot root (jailbreak) the device; however, it can perform the following tasks:
  - Download and execute files
  - Steal contacts list
  - Report system information
  - International Mobile Equipment Identity (IMEI)
  - Subscriber ID
  - Installed applications
  - Phone number
  - Phone model
  - Phone manufacturer
  - Operating system
  - Make phone calls
  - Send SMS messages
  - Monitor and record SMS messages
  - Show notifications
  - Uninstall applications
  Host indicators
  The Stels trojan maintains a low profile on the device. However, there are a few methods to identify an infection. In particular, the malware installs an icon in the apps menu called APPNAME (before it is executed for the first time). Stels also configures itself to run as a service, which can be viewed in the running process list (see Figure 7).
  Figure 7. Stels Flash icon appearing in the installed apps and in the running process list. The icon is removed from the installed apps menu after it is launched for the first time, but still appears in the running process list.
  Network indicators
  The network traffic generated by Stels is easy to identify based on the phone-home traffic, shown in Figure 8. The phone-home traffic contains a detailed list of system information extracted from the Android device and a unique multipart boundary AaB03x. Stels sends the traffic to the command and control (C2) server using a non-encrypted HTTP POST request to the domain hxxp://ynfdbdybdd1.freeiz.com. The domain is associated with a free web hosting provider that allows users to register various subdomains under the domain freeiz.com. As of this analysis, the IP address of the C2 server is 31.170.161.216, which is hosted in the U.S. The freeiz.com domain uses wildcard DNS for all subdomains, so legitimate websites may share the same IP address. The CTU has also observed commands to change the location of the C2 server on March 21, 2013 to hxxp://, located at the IP address 95.211.216.148 in the Netherlands.
  Figure 8. Stels phone-home request.
  The C2 domain is defined in a configuration file that is loaded by Stels. This variable is Base64-encoded and encrypted with a custom algorithm represented in Python:
  import struct import base64 def decrypt(param): keysize = struct.unpack("B", param[0])[0] + 1 key = param[0:keysize] tmp = "" j = 1 for i in range(keysize, len(param)): tmp += chr( ord(param[i]) ^ ord(key[ j % keysize ] ) ) j += 1 if j % keysize == 0: j = 1 return tmp def main(): urls = [ "mYbprPQCTjqqKPplOit0tCoWN6idvkRrNZsWYElyA0RQchxU3PhePYYB6XQNjnkiNcqi/Cg87jtBfnZY6+3vN yW1FcYOH9Yxt/khnNTPXqUh8yp9zwUcFILfE16BBVCYELFOV3mxExbycEUtGlJmcSDPN/bCcmcfmQBDLgx3rrG oiIsigAcsbuATiV6/7fkweaA+sM1Z1J1JL+6d2IQ4YRXTRpwBWE8N1k5yBob7zCEOXOE4AyYfLCAxBn16rJAu" , "FGRmaZ2awotthYxMJtobJOLUSAw2DBId7aDtpAzr4yJft3RRkbFmY0QDSQr68+/pBOujLUi1dQmHuSllWkoFD vQ=" ] for url in urls: print decrypt( base64.decodestring(url) ) if __name__ == "__main__": main()
  After Base64 decoding, the first byte specifies the size of the encryption key, followed by the encryption key and encrypted content. Each encrypted byte is bitwise-XORed with the encryption key.
  Malware operation
  The Stels trojan checks in with its C2 server at regular intervals and accepts the commands listed in Table 2. The malware also registers event handlers for receiving SMS messages, system boot, and two custom actions: custom.alarm and custom.alarm.info.
  Table 2. Stels command list.
  Commands from the C2 server are encoded in a JSON format as shown in Figure 9.
  Figure 9. Stels C2 commands.
  The filter commands allow the attackers to only capture SMS messages that match specific patterns or phone numbers (e.g., mobile TAN numbers). This feature may be used with additional malware such as the Zeus banking trojan to bypass some two-factor authentication schemes. Stels captures SMS messages by registering an event handler and creating a listener thread for all incoming SMS messages. The listener thread checks the content and sender phone number, and reports matches to the C2 server.
  The Stels trojan also contains code to send emails, although the sample analyzed by CTU researchers did not contain any commands that enabled this functionality. The code does not send email through the Simple Mail Transfer Protocol (SMTP), but rather issues an HTTP POST request to (this URL is also encrypted in the configuration with the encryption algorithm discussed above), a website that allows users to anonymously send emails using the website's HTML form.
  Recommendations
  - Do not allow installation of applications that are not distributed through the official Google Play marketplace on the device. If this feature is unchecked in the Settings menu of the device as shown in Figure 10 of the Appendix, then only applications that are delivered from Google Play may be installed on the device.
  - Prior to installing applications on an Android device, be wary of the application-level permissions an application requests. Be critical of applications that request sensitive permissions such as INTERNET and READ_LOGS.
  - Depending on the type and purpose of an application, some permissions should raise suspicion for security-conscious users. For example, a Flash application should not need permissions to make phone calls, send/receive text messages, or require the ability to install/uninstall applications.
  - Educate end users on the threats posed by attachments and links contained in SMS, emails, and instant messages.
  Removal
  Unlike malware that obtains root access to the device, this malware can be removed relatively easily. To remove a Stels infection:
  - Stop the service by clicking the service panel found under Settings on the infected device.
  - Navigate to the Manage Applications menu under Settings and select "FLASHPLAYER.UPDATE" from the list.
  - Click the "Uninstall" button as shown in Figure 11 in the Appendix.
  The exact menu names may vary slightly on different devices. For instance, "Manage Applications" is called "Apps" in Android 4.0.
  Conclusion
  The distribution of the Stels trojan through a spam campaign is unusual for Android malware, which is typically distributed through third-party marketplaces outside of the Google Play app store. Stels appears to leverage an existing Android crimeware kit to steal sensitive information from a device and can be monetized by sending SMS messages and making phone calls to premium phone numbers. In addition, Stels may be used in conjunction with traditional banking trojans including Zeus to bypass two-factor authentication systems that rely on mobile TAN numbers (sent via SMS) to complete fraudulent Automated Clearing House (ACH) and wire transfers from victim accounts.
  As mobile devices increase in popularity, they become a lucrative target for cybercriminals..
  Threat indicators
  The threat indicators in Table 4 can be used to detect activity related to the Stels Android trojan.
  Table 4. Threat indicators for the Stels malware.
  Appendix
  Figure 10. This option must be enabled to install apps outside of the official Google Play marketplace.
  Figure 11. The Stels trojan can be removed by selecting the app in the applications menu and clicking the uninstall button.