Pierluigi Paganini June 19, 2018

Malware researchers from ESET have discovered a new strain of Android RAT, tracked as HeroRat, that leverages Telegram protocol for command and control, and data exfiltration.

HeroRat isn’t the first malware abusing Telegram protocol, past investigation reported similar threats like TeleRAT and IRRAT.

The new RAT has been in the wild at least since August 2017 and in March 2018 its source code was released for free on Telegram hacking channels allowing various threat actors to create their own variant.

HeroRat is born in this way, but it appears quite different from other variants that borrowed the source code. HeroRat is the first Telegram-based malware developed from scratch in C# using the Xamarin framework, previous ones were written in Java.

The RAT leverages Telesharp library for creating Telegram bots with C#.

“One of these variants is different from the rest – despite the freely available source code, it is offered for sale on a dedicated Telegram channel, marketed under the name HeroRat.” reads the analysis published by ESET. 

“It is available in three pricing models according to functionality, and comes with a support video channel. It is unclear whether this variant was created from the leaked source code, or if it is the “original” whose source code was leaked.”

The malware is spread through different channels, it is spread third-party app stores through disguised as social media and messaging apps.

Researchers observed the largest number of infection in Iran where malicious apps are offered promising free bitcoins, free internet connections, and additional followers on social media.

The apps analyzed by ESET shows a strange behavior, after the malware is installed and launched on the victim’s device, it displays a small popup claiming the application can’t run on the device and for this reason, it will be uninstalled.

Once the uninstallation is seemingly completed, the icon associated with the app disappears, unfortunately, the attacker has already obtained the control of the victim’s device.

The attacker leverages the Telegram bot functionality to control the infected device, the malware is able to execute a broad range of commands such as data exfiltration and audio/video recording.

“The malware has a wide array of spying and file exfiltration capabilities, including intercepting text messages and contacts, sending text messages and making calls, audio and screen recording, obtaining device location, and controlling the device’s settings.“continues the analysis.

The source code of the HeroRat is offered for sale for 650 USD, the authors offer three packages of the malware depending on the features implemented., bronze, silver, and gold that go for 25, 50, and 100 USD, respectively.

The malware’s capabilities are accessible in the form of clickable buttons in the Telegram bot interface. Attackers can control victimized devices by simply tapping the buttons available in the version of the malware they are operating.

The availability of the source code online will push new versions, the best way to check if your mobile has been infected is to scan it using a reliable mobile security solution.

Pierluigi Paganini

(Security Affairs – HeroRat, Telegram)

[adrotate banner=”5″]

[adrotate banner=”13″]