From professional display screen recording to file exfiltration inside a 12 months

ESET researchers have found a trojanized Android app that had been obtainable on the Google Play retailer with over 50,000 installs. The app, named iRecorder – Display Recorder, was initially uploaded to the shop with out malicious performance on September 19th2021. Nonetheless, it seems that malicious performance was later applied, most certainly in model 1.3.8, which was made obtainable in August 2022.

Key factors of the blogpost:

  • As a Google App Protection Alliance companion, we detected a trojanized app obtainable on the Google Play Retailer; we named the AhMyth-based malware it contained AhRat.
  • Initially, the iRecorder app didn’t have any dangerous options. What is sort of unusual is that the applying obtained an replace containing malicious code fairly just a few months after its launch.
  • The applying’s particular malicious conduct, which entails extracting microphone recordings and stealing recordsdata with particular extensions, doubtlessly signifies its involvement in an espionage marketing campaign.
  • The malicious app with over 50,000 downloads was faraway from Google Play after our alert; we have now not detected AhRat anyplace else within the wild.

It’s uncommon for a developer to add a professional app, wait virtually a 12 months, after which replace it with malicious code. The malicious code that was added to the clear model of iRecorder is predicated on the open-source AhMyth Android RAT (distant entry trojan) and has been personalized into what we named AhRat.

Apart from this one case, we have now not detected AhRat anyplace else within the wild. Nonetheless, this isn’t the primary time that AhMyth-based Android malware has been obtainable on Google Play; we beforehand published our research on such a trojanized app in 2019. Again then, the adware, constructed on the foundations of AhMyth, circumvented Google’s app-vetting course of twice, as a malicious app offering radio streaming.

Overview of the app

Other than offering professional display screen recording performance, the malicious iRecorder can file surrounding audio from the system’s microphone and add it to the attacker’s command and management (C&C) server. It may possibly additionally exfiltrate recordsdata with extensions representing saved internet pages, photographs, audio, video, and doc recordsdata, and file codecs used for compressing a number of recordsdata, from the system. The app’s particular malicious conduct – exfiltrating microphone recordings and stealing recordsdata with particular extensions – tends to recommend that it’s a part of an espionage marketing campaign. Nonetheless, we weren’t capable of attribute the app to any specific malicious group.

As a Google App Protection Alliance companion, ESET recognized the latest model of the applying as malicious and promptly shared its findings with Google. Following our alert, the app was faraway from the shop.


The iRecorder software was initially launched on the Google Play Retailer on September 19th2021, providing display screen recording performance; at the moment, it contained no malicious options. Nonetheless, round August 2022 we detected that the app’s developer included malicious performance in model 1.3.8. As illustrated in Determine 1, by March 2023 the app had amassed over 50,000 installations.

Determine 1. The trojanized iRecorder app

Nonetheless, Android customers who had put in an earlier model of iRecorder (previous to model 1.3.8), which lacked any malicious options, would have unknowingly uncovered their units to AhRat, in the event that they subsequently up to date the app both manually or routinely, even with out granting any additional app permission approval.

Following our notification relating to iRecorder’s malicious conduct, the Google Play safety crew eliminated it from the shop. Nonetheless, it is very important be aware that the app can be discovered on different and unofficial Android markets. The iRecorder developer additionally gives different purposes on Google Play, however they don’t include malicious code.


Beforehand, the open-source AhMyth was employed by Transparent Tribealso called APT36, a cyberespionage group recognized for its extensive use of social engineering techniques and concentrating on authorities and navy organizations in South Asia. However, we can’t ascribe the present samples to any particular group, and there aren’t any indications that they have been produced by a recognized superior persistent risk (APT) group.


Throughout our evaluation, we recognized two variations of malicious code primarily based on AhMyth RAT. The primary malicious model of iRecorder contained elements of AhMyth RAT’s malicious code, copied with none modifications. The second malicious model, which we named AhRat, was additionally obtainable on Google Play, and its AhMyth code was personalized, together with the code and communication between the C&C server and the backdoor. By the point of this publication, we have now not noticed AhRat in another Google Play app or elsewhere within the wild, iRecorder being the one app that has contained this personalized code.

AhMyth RAT is a potent device, able to varied malicious capabilities, together with exfiltrating name logs, contacts, and textual content messages, acquiring an inventory of recordsdata on the system, monitoring the system location, sending SMS messages, recording audio, and taking footage. Nonetheless, we noticed solely a restricted set of malicious options derived from the unique AhMyth RAT in each variations analyzed right here. These functionalities appeared to suit inside the already outlined app permissions mannequin, which grants entry to recordsdata on the system and permits recording of audio. Notably, the malicious app offered video recording performance, so it was anticipated to ask for permission to file audio and retailer it on the system, as proven in Determine 2. Upon set up of the malicious app, it behaved as a typical app with none particular further permission requests which may have revealed its malicious intentions.

Determine 2. Permissions requested by the iRecorder app

After set up, AhRat begins speaking with the C&C server by sending fundamental system info and receiving encryption keys and an encrypted configuration file, as seen in Determine 3. These keys are used to encrypt and decrypt the configuration file and a few of the exfiltrated knowledge, such because the listing of recordsdata on the system.

Determine 3. AhRat’s preliminary C&C communication

After the preliminary communication, AhRat pings the C&C server each quarter-hour, requesting a brand new configuration file. This file incorporates a variety of instructions and configuration info to be executed and set on the focused system, together with the file system location from which to extract consumer knowledge, the file sorts with specific extensions to extract, a file dimension restrict, the length of microphone recordings (as set by the C&C server; throughout evaluation it was set to 60 seconds), and the interval of time to attend between recordings – quarter-hour – which can be when the brand new configuration file is obtained from the C&C server.

Apparently, the decrypted configuration file incorporates extra instructions than AhRat is able to executing, as sure malicious performance has not been applied. This may occasionally point out that AhRat is a light-weight model much like the preliminary model that contained solely unmodified malicious code from the AhMyth RAT. Regardless of this, AhRat continues to be able to exfiltrating recordsdata from the system and recording audio utilizing the system’s microphone.

Based mostly on the instructions obtained within the configuration from the C&C server, AhRat must be able to executing 18 instructions. Nonetheless, the RAT can execute solely the six instructions from the listing under marked in daring and with an asterisk:

  • SMS
  • OTT
  • WIFI

The implementation for many of those instructions shouldn’t be included within the app’s code, however most of their names are self-explanatory, as proven additionally in Determine 4.

Determine 4. Decrypted configuration file with an inventory of instructions

Throughout our evaluation, AhRat obtained instructions to exfiltrate recordsdata with extensions representing internet pages, photographs, audio, video, and doc recordsdata, and file codecs used for compressing a number of recordsdata. The file extensions are as follows: zip, rar, jpg, jpeg, jpe, jif, jfif, jfi, png, mp3, mp4, mkv, 3gp, m4v, mov, avi, gif, webp, tiff, tif, heif, heic, bmp, dib, svg, ai, eps, pdf, doc, docx, html, htm, odt, pdf, xls, xlsx, ods, ppt, pptx, and txt.

These recordsdata have been restricted to a dimension of 20 MB and have been situated within the Obtain listing /storage/emulated/0/Obtain.

Positioned recordsdata have been then uploaded to the C&C server, as seen in Determine 5.

Determine 5. File exfiltration to C&C server


The AhRat analysis serves as a great instance of how an initially professional software can remodel right into a malicious one, even after many months, spying on its customers and compromising their privateness. Whereas it’s doable that the app developer had supposed to construct up a consumer base earlier than compromising their Android units by an replace or {that a} malicious actor launched this transformation within the app; to date, we have now no proof for both of those hypotheses.

Happily, preventative measures towards such malicious actions have already been applied in Android 11 and better variations within the type of App hibernation. This function successfully locations apps which were dormant for a number of months right into a hibernation state, thereby resetting their runtime permissions and stopping malicious apps from functioning as supposed. The malicious app was faraway from Google Play after our alert, which confirms that the necessity for defense to be offered by a number of layers, similar to ESET Cellular Safety, stays important for safeguarding units towards potential safety breaches.

The remotely managed AhRat is a customization of the open-source AhMyth RAT, which signifies that the authors of the malicious app invested important effort into understanding the code of each the app and the again finish, in the end adapting it to go well with their very own wants.

AhRat’s malicious conduct, which incorporates recording audio utilizing the system’s microphone and stealing recordsdata with particular extensions, would possibly point out that it was a part of an espionage marketing campaign. Nonetheless, we have now but to seek out any concrete proof that may allow us to attribute this exercise to a specific marketing campaign or APT group.



SHA-1 Bundle identify ESET detection identify Description
C73AFFA6A9372C12D995843CC98E2ABC219F162 Android/Spy.AhRat.A AhRat backdoor.
E97C7AC722D30CCE5B6CC64885B1FFB43DE5F2DA Android/Spy.AhRat.A AhRat backdoor.
C0EBCC9A10459497F5E74AC5097C8BD364D93430 Android/Spy.Android.CKN AhMyth‑primarily based backdoor.
0E7F5E043043A57AC07F2E6BA9C5AEE1399AAD30 Android/Spy.Android.CKN AhMyth‑primarily based backdoor.


IP Supplier First seen Particulars
34.87.78[.]222 Namecheap 2022-12-10 order.80876dd5[.]store C&C server.
13.228.247[.]118 Namecheap 2021-10-05 80876dd5[.]store:22222 C&C server.

MITER ATT&CK Strategies

This desk was constructed utilizing version 12 of the MITRE ATT&CK framework.

Tactic ID Identify Description
Persistence T1398 Boot or Logon Initialization Scripts AhRat receives the BOOT_COMPLETED broadcast intent to activate at system startup.
T1624.001 Occasion Triggered Execution: Broadcast Receivers AhRat performance is triggered if considered one of these occasions happens: CONNECTIVITY_CHANGEor WIFI_STATE_CHANGED.
Discovery T1420 File and Listing Discovery AhRat can listing obtainable recordsdata on exterior storage.
T1426 System Info Discovery AhRat can extract details about the system, together with system ID, nation, system producer and mode, and customary system info.
Assortment T1533 Information from Native System AhRat can exfiltrate recordsdata with specific extensions from a tool.
T1429 Audio Seize AhRat can file surrounding audio.
Command and Management T1437.001 Utility Layer Protocol: Net Protocols AhRat makes use of HTTPS to speak with its C&C server.
Exfiltration T1646 Exfiltration Over C2 Channel AhRat exfiltrates stolen knowledge over its C&C channel.

Date: 2023-05-23 07:30:12

Source link



Related articles

Alina A, Toronto
Alina A, Toronto
Alina A, an UofT graduate & Google Certified Cyber Security analyst, currently based in Toronto, Canada. She is passionate for Research and to write about Cyber-security related issues, trends and concerns in an emerging digital world.


Please enter your comment!
Please enter your name here