TASPEN-Impersonating Android Malware Targets Indonesian Pensioners
Summary
A technical analysis describes an Android malware campaign impersonating Indonesia’s TASPEN pension fund to steal credentials, SMS OTPs, contacts and facial video. The malware uses phishing, encrypted C2 and anti-analysis techniques.
Key points
- A phishing site impersonating TASPEN promoted a malicious Android APK, reportedly using SEO to attract pensioners and civil servants.
- The app uses DPT-Shell packing to conceal its payload until runtime and detects Frida instrumentation to hinder analysis.
- Its spyware capabilities include SMS interception, screen recording, facial video capture, and collection of contacts and call history.
- The malware sends encrypted credentials to rpc[.]syids[.]top and uses a WebSocket channel for persistent command and control.
- Chinese-language error messages and developer artifacts suggest Chinese-speaking operators; the article does not establish a specific group.
- The report says the campaign’s financial losses have not been publicly quantified and recommends app-store-only downloads, customer warnings, and coordinated infrastructure takedowns.
Article Details
- Attack Vectors
- A phishing website impersonating TASPEN distributed a malicious Android APK, with the download promoted by SEO.
- The malicious app used DPT-Shell packing to conceal its executable code and extract a ZIP payload at runtime.
- The malware intercepted SMS messages and credentials, recorded screens and facial video, collected contact data, and exfiltrated information through HTTP POST and WebSocket C2 channels.
- Defensive Notes
- Download applications only from official app stores and verify app authenticity through official channels.
- Treat requests for broad or unnecessary permissions, especially SMS, Accessibility Services, or camera access, with suspicion.
- Use reputable mobile security software and behavior-based fraud detection; consider device attestation to identify compromised devices.
- The article recommends coordinated takedowns of malicious domains and C2 infrastructure, security standards for public apps, and digital-literacy outreach aimed at seniors.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rpc[.]syids[.]top | C2 domain used for credential exfiltration and WebSocket command communications. |
| DOMAIN | taspen[.]ahngo[.]cc | Phishing domain used to distribute the malicious TASPEN-impersonating APK. |
| IPV4 | 38[.]47[.]53[.]168 | C2 IP address identified as used for beaconing or backup C2 over TLS. |
| SHA256 | 1963b78a98c24e106ba93168f69ad12914e339a155b797a4d6fb6e8ff88819ea | SHA-256 hash of classes.dex from the malicious APK. |
| SHA256 | 3ddefbacd77de58c226a388ad92125e1333a7211fc0b1d636dea778923190c4f | SHA-256 hash of the malicious APK. |
| SHA256 | 5b9bd063360912a57a1cde5c1980594703ab301161c9a91197bff76352410df0 | SHA-256 hash of classes3.dex from the malicious APK. |
| SHA256 | c4a4c485660abe8286c58d2f6c8bb7e2e698db305761e703987efc6653c2ec25 | SHA-256 hash of classes2.dex from the malicious APK. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationDPT-Shell concealed the app's executable code, which was decrypted and extracted at runtime.T1041 · Exfiltration Over C2 ChannelThe malware exfiltrated stolen credentials and other victim data to its C2 infrastructure.T1056.004 · Credential API HookingThe malware intercepted incoming SMS messages to obtain one-time passwords.T1113 · Screen CaptureA background service recorded the victim's screen to capture activity in banking apps and other sensitive interactions.T1204.002 · Malicious FileVictims were induced to download and install the malicious Android application.T1417.001The malware intercepted SMS messages, including OTPs, without user interaction.T1432The malware collected the victim's address book, including names, phone numbers, email addresses, and call history.T1566.002 · Spearphishing LinkThe campaign used a phishing website impersonating TASPEN to lure victims into downloading the malicious APK.T1622 · Debugger EvasionThe app detected Frida instrumentation hooks and terminated, obstructing runtime analysis.T1627.001The Android malware used DPT-Shell packing to conceal its payload from static analysis.