caption - Attack Flow Diagram

2.1. Malicious App Distribution Path

We confirmed that the malicious application was distributed from 27.102.137[.]181, leveraging a QR code that impersonated a legitimate package delivery service. Among the four malicious applications discovered during the investigation, two masqueraded as delivery service apps. A previous report by ESTSecurity documented similar cases where the threat actor transmitted URLs hosting malicious apps via smishing texts that impersonated delivery companies. Consequently, we assess with high confidence that the threat actor employed smishing or phishing emails for initial access, consistent with historical TTPs. The identified URLs are listed below.

• hxxps://27.102.137[.]181/store/tracking.php?id=[base64 encoded email address]

• hxxps://27.102.137[.]181/store/delivery.html

caption - QR-based mobile redirection

When a user accesses the URL from a PC, the page displays the message “보안상의 이유로 PC에서는 조회할 수 없습니다.” (“For security reasons, you cannot view this page from a PC.”) and prompts the user to switch to a mobile device by scanning a QR code. During analysis, the server returned 404 Not Found for the path linked from the QR code, so the QR-based redirection was unsuccessfull. The QR code URL is listed below.

• hxxps://delivery.cjlogistics[.]kro[.]kr/loing/tracking.php?id=dGVzdEBuYXZlci5jb20=

Accessing the URL with an Android User-Agent string reveals the distribution workflow designed by the threat actor. The ”tracking.php” script appears to implement server-side logic that serves different content based on the client's User-Agent. The screenshots below illustrate the observed distribution screens.

caption - Fake security scan

caption - Security app install button

When the victim clicks the “보안앱 설치하기” (“Install security app”) button, the browser connects to a Base64-encoded URL and downloads the APK. The decoded URL is shown below.

• hxxps://27.102.137[.]181/store/SecDelivery.APK

caption - Security app install routine

As soon as the APK download starts, the application sends a POST request to ”downcat.php”, logging the access time and APK URL path. Within this routine, the code contains a Korean comment “버튼 클릭시 로그 남기기” (“leave log when button is clicked”) and a Korean error message “로그 전송 실패” (“log transmission failed”).

caption - Logging routine

2.2. Malicious App Analysis

2.2.1. SecDelivery.apk

caption - SecDelivery.apk app icon

“SecDelivery.apk” is an APK file that decrypts and loads an encrypted APK file from its internal resources, subsequently creating a malicious RAT service. The APK signature's validity period begins on May 20, 2025, and we assess that the threat actor likely developed, tested, or deployed the malicious application around this time. The APK signature information is provided in the table below.

| **DN** | C=US, ST=bitapp, L=bitapp, O=bitapp, OU=bitapp, CN=bitapp |
| --- | --- |
| MD5 | 7d00a43872dcdd1174d3713e6bbf01ba |
| Certificate Validity Period | Tue May 20 18:41:34 KST 2025

caption - APK Signature Information

2.2.2. Resource decryption & service creation

The AndroidManifest.xml file defines SplashActivity as the MAIN activity. When the app runs, SplashActivity loads the encrypted resources embedded in the APK, obtains the various permissions required for malicious behavior, and then registers the malicious service.

caption - AndoridManifest.xml MAIN activity

The encrypted APK file resides in the resource section as security.dat. In past “DOCSWAP” variants, the code performed XOR decryption in Java when loading the internal APK, whereas in this case the threat actor uses an additional native library.

The loadPluginAPK method stores the encrypted APK file security.dat in internal storage as security.dat_copy and then decrypts it by calling the decryptFile function in the “native-lib” library.

caption - Embedded APK loading routine

The “libnative-lib.so” file in the resource section defines the decryptFile function. Within decryptFile, the xorDecrypt function performs the actual decryption. Unlike previous samples that only applied XOR decryption with a 4-byte key, this variant adds several bitwise operations. The xorDecrypt function operates as follows.

1. Invert the bits of each 1-byte value.

2. Apply a 5-bit ROL.

3. XOR with a 4-byte key.

caption - Embedded APK decryption routine

The 4-byte key used for XOR is as follows.

• 541161FE (hex)

After loading the data, the application checks if the necessary permissions are secured. Once it confirms all permissions, it immediately registers the MainService of the newly loaded APK as “com.delivery.security.MainService”. The permissions listed in AndroidManifest.xml are as follows.

    <uses-permission android:name="android.permission.LOCAL_MAC_ADDRESS"/>
    <uses-permission android:name="android.permission.FOREGROUND_SERVICE"/>
    <uses-permission android:name="android.permission.POST_NOTIFICATIONS"/>
    <uses-permission android:name="android.permission.READ_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.MANAGE_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
    <uses-permission android:name="android.permission.READ_PRIVILEGED_PHONE_STATE"/>
    <uses-permission android:name="android.permission.SET_WALLPAPER"/>
    <uses-permission android:name="android.permission.START_FOREGROUND_SERVICES_FROM_BACKGROUND"/>
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
    <uses-permission android:name="android.permission.KILL_BACKGROUND_PROCESSES"/>
    <uses-permission android:name="android.permission.READ_SMS"/>
    <uses-permission android:name="android.permission.RECEIVE_SMS"/>
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
    <uses-permission android:name="android.permission.CHANGE_WIFI_STATE"/>
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.REQUEST_INSTALL_PACKAGES"

Simultaneously with service registration, the base application launches AuthActivity. This activity masquerades as an OTP authentication screen and verifies the user's identity using a delivery number. This delivery number is hardcoded within the APK as “742938128549”, and we assess the threat actor likely delivered it alongside the malicious URL during the initial access phase. Upon entering the delivery number, the application displays a notification with a 6-digit verification code calculated as ((int) (Math.random() * 900000.0d)) + 100000.

caption - Fake authentication screen

Entering the generated verification code executes MainActivity. MainActivity shows the official delivery tracking website using a webview.

caption - Official site redirection routine

2.2.3. Embedded APK & Malicious Service

The decrypted APK utilizes a signature distinct from that of SecDelivery.apk. The signature validity period begins on April 22, 2025, indicating that the threat actor employed this malicious APK in attacks prior to developing SecDelivery.apk. The APK signature details follow below.

| **DN** | C=US, O=Android, CN=Android Debug |
| --- | --- |
| MD5 | afb708faf1a66892a6e6cae9e63c6c2b |
| Certificate Validity Period | Tue Apr 22 15:57:54 KST 2025

caption - APK Signature Information

SplashActivity registers the MainService contained within the decrypted ”security.dat”, allowing it to operate persistently. Furthermore, the application configures an intent filter for the actions listed below to automatically execute MainService upon system reboot.

• android.intent.action.BOOT_COMPLETED

• android.intent.action.ACTION_POWER_CONNECTED

• android.intent.action.ACTION_POWER_DISCONNECTED

MainService connects to the C&C server to function as an infostealer and RAT. The RAT supports a total of 57 commands; we have attached the specific behaviors associated with each command in the "Command List".

The malware configures the initial C&C server to 27.102.137[.]181:50005, matching the IP of the distribution server. During communication, the client and server exchange data using the format [ Length | \x00 | Gzip compressed payload ].

caption - Data transmission routine

Upon receiving data, the service isolates the command using the structure [ Length | \x00 | Command ], parses command, and executes the corresponding action. The parsing logic uses the string “10249” as a delimiter.

• “10256” | “10249” | “arg1” | “10249” | “arg2” → StartAudioRecord(arg1 , arg2 )

caption - Command parsing routine

Additionally, the application executes keylogging logic via the Accessibility Service. When an accessibility event occurs, the keylogger records the target app's icon, package name, event text, and timestamp. It compresses the app icon as a PNG file and Base64 encodes it before including it in the keylog.

caption - App icon storage routine

By default, the malware saves the captured keylogs to the internal storage path /Security/download_[day-month-year].dat. If a command sets the isOnelineKeylogger variable to True, the service transmits the keylog to the server before saving it locally.

caption - Real-time keylogging and keylog storage routine