Pierluigi Paganini
December 14, 2014
Security experts at Zscaler discovered a trojanized and pirated version of the popular Assassin Creed application for Android platform.
Assassin Creed is one of the most popular paid video games, available for almost every gaming platform, including Sony Playstation, Xbox, PC and mobile OSs like Android.
The Android malware disguising itself as the Assassins Creed app will install a pirated version of the game that apparently works normally, but that is able to perform malicious activities in background.
Once downloaded, the trojanized copy of the Assassin Creed application has the ability to send multipart text messages, harvest information (i.e. mobile number and Subscriber ID information) from victim devices and send stolen data to a remote command and control server, exactly as any other data stealer malware. The experts at Zscaler analyzing the malicious code discovered that the references to the C&C servers used by the authors are hard-coded into the applications, they are bnk7ihekqxp[.]net and googleapiserver[.]net.
“We were able to locate phone numbers belonging to Russian bank Volga-Vyatka Bank of Sberbank of Russia in the malicious application code for which SMS messages are being intercepted to steal sensitive information,” Zscaler researchers wrote. “Another interesting feature we saw is the usage of AES encryption for all the C2 communication. It also harvests the mobile number and Subscriber ID information from the victim device for tracking purposes.”
The researchers highlighted the use of encryption for the protection of communications with the C&C servers.
The trojanized version of Assassin Creed uses the AES encryption for all the C2 communication, in the image below is shown
the AES crypto library configurations used by the malware.
“All the sensitive harvested data and C2 communication is encrypted and decrypted using this configuration.”
The malicious version of Assassin Creed requests a number of permissions, including the ability to access the Internet, access network state, get accounts, read/write and send SMS, manage outgoing calls, read and write external storage, read phone state, received boot completed, wake lock.
The detection rate for the Assassin Creed Android malware (assassins_creed. apk) is still low, 12/56 according VirusTotal that provides also further information on malicious agent, including MD5 and SHA.
As usual, my suggestion is to avoid the rotting of the mobile device and to download mobile apps only from the official Google Play store, pirated apps may hide a lot of threats for the users.
(Security Affairs – Android, Assassin Creed malicious app)
