Letscall Android Malware Combines Spyware with Vishing and Call Redirection
Summary
ThreatFabric describes Letscall, a three-stage Android malware toolset targeting South Koreans. It steals personal data, enables spyware and call interception, and connects victims with criminal call operators through VoIP.
Key points
- Researchers say Letscall campaigns target individuals in South Korea, using phishing pages that mimic Google Play and financial or loan services to deliver the first-stage downloader.
- The downloader installs a second-stage Android spyware app that collects personal and device data, tracks location, accesses messages and media, and can record audio or use the camera.
- The malware uses ZEGOCLOUD and WebRTC for voice, video, and command communications, alongside web sockets and HTTP; it can connect victims to criminal call-centre operators.
- A third-stage app intercepts and redirects calls, using prerecorded bank-style messages and configurable phone-number filters to help operators impersonate bank staff.
- The researchers describe evasion methods including code packing, XOR-encrypted DEX files, APK path and manifest manipulation, and accessibility services to deliver the third stage.
- ThreatFabric recommends denying accessibility access to suspicious applications as a way to make the attackers’ actions harder.
Article Details
- Attack Vectors
- Victims are directed to Korean-language phishing pages that mimic Google Play and prompt them to download a first-stage Android downloader.
- The downloader obtains permissions, opens a hardcoded phishing page, and downloads and installs the second-stage malware from a control server.
- Phishing pages impersonate loan-comparison services and collect personal and financial details, which are sent to the attackers.
- Operators use vishing and social engineering, including impersonating bank employees and playing prerecorded bank messages, to persuade victims to disclose information or take actions.
- The second stage uses ZEGOCLOUD-based P2P voice/video communications and WebSocket and HTTP channels for operator communications and data transfer.
- The malware abuses accessibility services to manipulate Chrome’s interface and deliver the third-stage application.
- The third stage intercepts and reroutes incoming and outgoing calls, including calls to banks, using attacker-configured number filters.
- Defensive Notes
- Deny accessibility-service access to suspicious applications; the article says this makes it harder for criminals to operate on the device.
- Analyze WebRTC traffic for suspicious activity, including when Google or private STUN servers are used.
- Caller-identification applications and awareness of fraudster tactics may help defend against vishing.
- Financial organizations should report suspected malicious applications to support investigation and reporting.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | finda-dl[.]finda[.]buzz | Listed as Letscall campaign infrastructure; the article describes downloader applications fetching payloads from campaign control infrastructure. |
| DOMAIN | finda-h5[.]letscall[.]ltd | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | finda-msg[.]letscall[.]ltd | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | finda[.]letscall[.]fyi | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | finda[.]letscall[.]ltd | Listed as Letscall campaign infrastructure in the article’s domain and IP table, following analysis of the C2 servers. |
| DOMAIN | kics-h5[.]letscall[.]fyi | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | konan-h5[.]finda[.]buzz | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | konan[.]nicetv[.]live | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | lets-dl[.]finda[.]buzz | Listed as Letscall campaign infrastructure; the article describes downloader applications fetching payloads from campaign control infrastructure. |
| DOMAIN | letscall[.]39nat[.]com | Reported in the article’s indicators-of-compromise section under domains and IPs. |
| DOMAIN | letscall[.]fss-app[.]live | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | org-fin19[.]letscall[.]ltd | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | salad-3[.]letscall[.]today | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | salad-h5[.]letscall[.]today | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| DOMAIN | salad-msg[.]letscall[.]today | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 137[.]220[.]142[.]149 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 137[.]220[.]142[.]160 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 137[.]220[.]179[.]112 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 143[.]92[.]34[.]22 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 143[.]92[.]34[.]44 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 143[.]92[.]34[.]8 | Listed as Letscall campaign infrastructure in the article’s domain and IP table, following analysis of the C2 servers. |
| IPV4 | 154[.]215[.]238[.]195 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 35[.]243[.]122[.]211 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 45[.]43[.]215[.]106 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| IPV4 | 45[.]43[.]215[.]98 | Listed as Letscall campaign infrastructure in the article’s domain and IP table. |
| SHA256 | 22109901f8290dc2319bd9b49e6bf71f9ddc1af482ddb67fc6e1c3b09ecad9c8 | SHA-256 hash of a Letscall downloader file, listed in the article’s indicators-of-compromise section. |
| SHA256 | a522a039ec619a60618c2c8a9e65adb0ff6105b655c1f9b3796e52e0d25958cb | SHA-256 hash of a Letscall downloader file, listed in the article’s indicators-of-compromise section. |
| SHA256 | bf5259bf53e3747d37d21dbf43b54ff8fa3c57fc991b53fcd320658b6cf34db9 | SHA-256 hash of a Letscall downloader file, listed in the article’s indicators-of-compromise section. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe malware sends victim data, including images and recordings, to attacker infrastructure over its communications channels.T1056.003 · Web Portal CapturePhishing pages impersonating loan-comparison services collect victim details and send the entered data to the attackers.T1204.002 · Malicious FileThe victim downloads and installs the first-stage malicious application from a phishing page.T1406The malware uses obfuscated code, XOR-encrypted DEX files, packing, and APK file-manipulation techniques.T1407The downloader obtains and installs the second-stage application from a control server.T1429Commands can start microphone recording and upload the resulting recording to the C2.T1430The malware can track the victim’s location and retrieve location-tracking logs.T1437.001The malware uses HTTP and WebSocket communications for command exchange and data transfer.T1512Commands can capture images or video using the victim device’s front or back camera.T1516The malware abuses accessibility services to insert interface elements into Chrome and deliver the third-stage application.T1636.002The third stage can retrieve and delete the victim’s call logs.T1636.003The third stage can retrieve and manipulate the victim’s address book.T1636.004The malware can access, intercept, search, send, and delete SMS messages.