# BusyGasper – the unfriendly spy

**securelist.com/busygasper-the-unfriendly-spy/87627/**

Authors

Alexey Firsh

In early 2018 our mobile intruder-detection technology was triggered by a suspicious Android sample
that, as it turned out, belonged to an unknown spyware family. Further investigation showed that the
malware, which we named BusyGasper, is not all that sophisticated, but demonstrates some unusual
features for this type of threat. From a technical point of view, the sample is a unique spy implant with
stand-out features such as device sensors listeners, including motion detectors that have been
implemented with a degree of originality. It has an incredibly wide-ranging protocol – about 100
commands – and an ability to bypass the Doze battery saver. As a modern Android spyware it is also
capable of exfiltrating data from messaging applications (WhatsApp, Viber, Facebook). Moreover,
BusyGasper boasts some keylogging tools – the malware processes every user tap, gathering its
coordinates and calculating characters by matching given values with hardcoded ones.

The sample has a multicomponent structure and can download a payload or updates from its C&C
server, which happens to be an FTP server belonging to the free Russian web hosting service Ucoz. It
is noteworthy that BusyGasper supports the IRC protocol which is rarely seen among Android
malware. In addition, the malware can log in to the attacker’s email inbox, parse emails in a special
folder for commands and save any payloads to a device from email attachments.

This particular operation has been active since approximately May 2016 up to the present time.


-----

## Infection vector and victims

While looking for the infection vector, we found no evidence of spear phishing or any of the other
common vectors. But some clues, such as the existence of a hidden menu for operator control, point
to a manual installation method – the attackers used physical access to a victim’s device to install the
malware. This would explain the number of victims – there are less than 10 of them and according to
our detection statistics, they are all located in the Russia.

Intrigued, we continued our search and found more interesting clues that could reveal some detailed
information about the owners of the infected devices. Several TXT files with commands on the
attacker’s FTP server contain a victim identifier in the names that was probably added by the
criminals:

CMDS10114-Sun1.txt

CMDS10134-Ju_ASUS.txt

CMDS10134-Tad.txt

CMDS10166-Jana.txt

CMDS10187-Sun2.txt

CMDS10194-SlavaAl.txt

CMDS10209-Nikusha.txt

Some of them sound like Russian names: Jana, SlavaAl, Nikusha.

As we know from the FTP dump analysis, there was a firmware component from ASUS firmware,
indicating the attacker’s interest in ASUS devices, which explains the victim file name that mentions
“ASUS”.

Information gathered from the email account provides a lot of the victims’ personal data, including
messages from IM applications.

**Gathered file** **Type** **Description**

lock Text Implant log

ldata sqlite3 Location data based on network (cell_id)

gdata sqlite3 Location data based on GPS coordinates

sdata sqlite3 SMS messages

f.db sqlite3 Facebook messages

v.db sqlite3 Viber messages

w.db sqlite3 WhatsApp messages


-----

Among the other data gathered were SMS banking messages that revealed an account with a
balance of more than US$10,000.But as far as we know, the attacker behind this campaign is not
interested in stealing the victims’ money.

We found no similarities to commercial spyware products or to other known spyware variants, which
suggests BusyGasper is self-developed and used by a single threat actor. At the same time, the lack
of encryption, use of a public FTP server and the low opsec level could indicate that less skilled
attackers are behind the malware.

## Technical details

Here is the meta information for the observed samples, certificates and hardcoded version stamps:

**Certificate** **MD5** **Module** **Version**


Serial Number: 0x76607c02

Issuer: CN=Ron

Validity: from = Tue Aug 30 13:01:30
MSK 2016

to = Sat Aug 24 13:01:30 MSK 2041

Subject: CN=Ron


9e005144ea1a583531f86663a5f14607 1 –


18abe28730c53de6d9e4786c7765c3d8 2 2.0


Serial Number: 0x6a0d1fec

Issuer: CN=Sun

Validity: from = Mon May 16 17:42:40
MSK 2016

to = Fri May 10 17:42:40 MSK 2041

Subject: CN=Sun


9ffc350ef94ef840728564846f2802b0 2 v2.51sun


6c246bbb40b7c6e75c60a55c0da9e2f2 2 v2.96s

7c8a12e56e3e03938788b26b84b80bd6 2 v3.09s

bde7847487125084f9e03f2b6b05adc3 2 v3.12s

2560942bb50ee6e6f55afc495d238a12 2 v3.18s

It’s interesting that the issuer “Sun” matches the “Sun1” and “Sun2” identifiers of infected devices from
the FTP server, suggesting they may be test devices.

The analyzed implant has a complex structure, and for now we have observed two modules.

## First (start) module

The first module, which was installed on the targeted device, could be controlled over the IRC protocol
and enable deployment of other components by downloading a payload from the FTP server:


-----

_@install command_

As can be seen from the screenshot above, a new component was copied in the system path, though
that sort of operation is impossible without root privileges. At the time of writing we had no evidence of
an exploit being used to obtain root privileges, though it is possible that the attackers used some
unseen component to implement this feature.

Here is a full list of possible commands that can be executed by the first module:

**Command name** **Description**

@stop Stop IRC

@quit System.exit(0)

@start Start IRC

@server Set IRC server (default value is “irc.freenode.net”), port is always 6667

@boss Set IRC command and control nickname (default value is “ISeency”)

@nick Set IRC client nickname

@screen Report every time when screen is on (enable/disable)

@root Use root features (enable/disable)

@timer Set period of IRCService start

@hide Hide implant icon

@unhide Unhide implant icon

@run Execute specified shell


-----

@broadcast Send command to the second module

@echo Write specified message to log

@install Download and copy specified component to the system path

The implant uses a complex intent-based communication mechanism between its components to
broadcast commands:

_Approximate graph of relationships between BusyGasper components_

## Second (main) module

This module writes a log of the command execution history to the file named “lock”, which is later
exfiltrated. Below is a fragment of such a log:


-----

_Log with specified command_

Log files can be uploaded to the FTP server and sent to the attacker’s email inbox. It’s even possible
to send log messages via SMS to the attacker’s number.

As the screenshot above shows, the malware has its own command syntax that represents a
combination of characters while the “#” symbol is a delimiter. A full list of all possible commands with
descriptions can be found in Appendix II below.

The malware has all the popular capabilities of modern spyware. Below is a description of the most
noteworthy:

The implant is able to spy on all available device sensors and to log registered events.
Moreover, there is a special handler for the accelerometer that is able to calculate and log the
device’s speed:

This feature is used in particular by the command “tk0” that mutes the device, disables
keyguard, turns off the brightness, uses wakelock and listens to device sensors. This allows it to
silently execute any backdoor activity without the user knowing that the device is in an active
state. As soon as the user picks up the device, the implant will detect a motion event and
execute the “tk1” and “input keyevent 3” commands.

“tk1” will disable all the effects of the “tk0” command, while “input keyevent 3” is the shell
command that simulates the pressing of the ‘home’ button so all the current activities will be
minimized and the user won’t suspect anything.


-----

Location services to enable (GPS/network) tracking:

The email command and control protocol. The implant can log in to the attackers email inbox,
parse emails for commands in a special “Cmd” folder and save any payloads to a device from
email attachments.

_Accessing the “Cmd” folder in the attacker’s email box_

Moreover, it can send a specified file or all the gathered data from the victim device via email.

Emergency SMS commands. If an incoming SMS contains one of the following magic strings: ”
2736428734″ or ” 7238742800″ the malware will execute multiple initial commands:

## Keylogger implementation

Keylogging is implemented in an original manner.

Immediately after activation, the malware creates a textView element in a new window with the
following layout parameters:


-----

All these parameters ensure the element is hidden from the user.

Then it adds onTouchListener to this textView and is able to process every user tap.

Interestingly, there is an allowlist of tapped activities:

ui.ConversationActivity
ui.ConversationListActivity
SemcInCallScreen
Quadrapop
SocialPhonebookActivity

The listener can operate with only coordinates, so it calculates pressed characters by matching given
values with hardcoded ones:

Additionally, if there is a predefined command, the keylogger can make a screenshot of the tapped
display area:

## Manual access and operator menu


-----

There is a hidden menu (Activity) for controlling implant features that looks like it was created for
manual operator control. To activate this menu the operator needs to call the hardcoded number
“9909” from the infected device:

A hidden menu then instantly appears on the device display:


-----

The operator can use this interface to type any command for execution. It also shows a current
malware log.

## Infrastructure

### FTP server

The attackers used ftp://213.174.157[.]151/ as a command and control server. The IP belongs to the
free Russian web hosting service Ucoz.


-----

**Files** **Description**

CMDS*.txt Text files with commands to execute

supersu.apk SuperSU (eu.chainfire.supersu,
https://play.google.com/store/apps/details?id=eu.chainfire.supersu)
tool


-----

246.us
us.x

supersu.cfg
supersu.cfg.ju
supersu.cfg.old


SuperSU ELF binaries

SuperSU configs with spyware implant mention


bb.txt BusyBox v1.26.2 ELF file

bdata.xml Config file for excluding malware components from Android battery
[saver feature Doze](https://android.stackexchange.com/a/143236)

bdatas.apk Main implant module

com.android.network.irc.apk Start implant module

MobileManagerService.apk ASUS firmware system component (clean)

mobilemanager.apk Corrupted archive

privapp.txt Looks like a list of system applications (including spyware
components) from the infected device


run-as.x
run-as.y


Run-as tool ELF file


SuperSU config fragment for implant components and the busybox tool supersu.cfg:

This config allows the implant to use all root features silently.

Content of bdata.xml file:

It can be added to the /system/etc/sysconfig/ path to allowlist specified implant components from the
battery saving system.


-----

### Email account

A Gmail account with password is mentioned in the sample’s code:

It contains the victim’s exfiltrated data and “cmd” directory with commands for victim devices.

## Appendix I: Indicators of compromise

### MD5

9E005144EA1A583531F86663A5F14607

18ABE28730C53DE6D9E4786C7765C3D8

2560942BB50EE6E6F55AFC495D238A12

6C246BBB40B7C6E75C60A55C0DA9E2F2

7C8A12E56E3E03938788B26B84B80BD6

9FFC350EF94EF840728564846F2802B0

BDE7847487125084F9E03F2B6B05ADC3

### C2

ftp://213.174.157[.]151/

## Appendix II: List of all possible commands

These values are valid for the most recently observed version (v3.18s).

**Decimal** **Char** **Description**

33 ! Interrupt previous command execution

36 $ Make a screenshot

48 0 Execute following shell: rm c/*; rm p/*; rm sdcard/Android/system/tmp/r/*
(wipe environment paths?)

63 ? Log device info and implant meta information

66(98) B(b) Broadcast specified command to another component


-----

67(99) C(c) Set specified command on timer to execute

Debug


Log last 10 tasks by getRecentTasks api

Log info about device sensors (motion, air temperature and pressure, etc.)

Log stack trace and thread information


68(100)
65(97)

68(100)
83(115)

68(100)
84(116)

GPS module


D(d)
A(a)

D(d)
S(s)

D(d)
T(t)


101 e Broadcast command to GPS-tracking external component

71(103) G(g) Location tracking GPS/network

Interaction
with operators


73(105) 102
114

73(105) 102
115

73(105)
73(105)

73(105)
76(108)

73(105)
77(109)

73(105)
82(114)

73(105)
83(115)

Network
geolocation


I(i) f r Get specified file from FTP (default – CMDS file with commands)


I(i) f
s

I(i)
I(i)

I(i)
L(l)

I(i)
M(m)

I(i)
R(r)

I(i)
S(s)


Upload exfiltrated data

Start/stop IRC service

Send current location to IRC

Push specified message to IRC

Read commands from the email inbox

Send specified file or all gathered data in email with UID as a subject


76(108) L(l) Get info on current cell_id

Camera
features


77(109) 99 M(m)
c

77(109) 108 M(m)
l


Capture photo

Log information about available cameras


-----

77(109) 114
97

77(109) 114
98

77(109) 114
44(114)

77(109) 114
115

77(109) 114
116


M(m)
r a

M(m)
r b

M(m)
r,(r)

M(m)
r s

M(m)
r t


Start/stop audio recording (default duration – 2 minutes)

Start/stop audio recording with specified duration

Start fully customizable recording (allow to choose specific mic etc.)

Stop previous recording

Set recording duration

Capture video with specified duration and quality

Hard stop of implant services, unregister receivers

Start main implant service with all components


77(109) 118 M(m)
v

Common

79(111) 102 O(o)
f

79(111) 110 O(o)
n


80(112) P(p) Find specified images and scale them with “inSampleSize” API

81(113) Q(q) Stop main implant service

82(114) R(r) Execute specified shell command

Shared
preferences
setup


83(115) 33 S(s)
!

83(115) 61 S(s)
=

83(115) 98 S(s)
b

83(115) 99 S(s)
c

83(115) 100 S(s)
d

83(115) 101 S(s)
e

83(115) 102 S(s)
f


On/off hidden operator activity

Shared preferences control (set/remove specified value)

On/off sending SMS message after device boot

Put boolean value in shared preference “cpyl”

Put boolean value in shared preference “dconn”

On/off periodically reenabling data connectivity

Set GPS location update period


-----

83(115) 105 S(s) i Put boolean value in shared preference “imsg”


83(115) 108
97

83(115) 108
99

83(115) 108
102

83(115) 108
108

83(115) 108
116

83(115) 108
118

83(115) 108
119


S(s) l
a

S(s) l
c

S(s) l
f

S(s) l
l

S(s) l
t

S(s) l
v

S(s) l
w


On/off foreground process activity logging

Start watching on captured photos and videos

Start watching on Facebook messenger database changes

On/off browser history logging

Start watching on Telegram messenger cache database changes

Start watching on Viber messenger database changes

Start watching on WhatsApp messenger database changes

On/off sending log SMS messages

Set operator telephone number (for SMS logging)

Set implant stop-mode (full or only main service)

On/off execution shell as root

On/off screen state logging

On/off screen touches logging and number of related screenshots

On/off debug logging mode with system thread info

Use FTP connection via busybox or default Socket API

On/off screen brightness

On/off network data (internet)


83(115) 109 S(s)
m


83(115)
110(112)


S(s)
o(p)


83(115) 113 S(s)
q

83(115) 114 S(s)
r

83(115) 115 S(s)
s

83(115) 116 S(s)
t

83(115) 117 S(s)
u

83(115) 120 S(s)
x

Sensor and
display control

84(116) 98 T(t)
b

84(116) 100 T(t)
d


-----

84(116)
75(107) 48

84(116)
75(107) 49

84(116)
75(107) 50

84(116)
75(107) 51

84(116) 115
48

84(116) 115
49

84(116) 115
108

84(116) 119
48

84(116) 119
49

84(116) 119
108

Common
backdoor
commands


T(t)
K(k)
0

T(t)
K(k)
1

T(t)
K(k)
2

T(t)
K(k)
3

T(t) s
0

T(t) s
1

T(t) s
l

T(t)
w 0

T(t)
w 1

T(t)
w l


Mute, turn off brightness, disable keyguard, use wakelock and listen on
device sensors.

Disable features from previous command

Disable Keyguard instance

Write “userActivity” to log

Disable sensor listener

Register listener for specified sensor

Log int value from file /dev/lightsensor

Turn WiFi off

Turn WiFi on

Control WiFi lock


85(117) U(u) Download payload, remount “system” path and push payload there. Based
on the code commentaries, this feature might be used to update implant
components

87(119) W(w) Send SMS with specified text and number

Updates from
the newest
version

122 33 z ! Reboot device

122 99 z c Dump call logs

122 102 z f p Send gathered data to FTP

122 102 z f g Get CMDS* text file and execute contained commands

122 103 z g Get GPS location (without log, only intent broadcasting)


-----

122 108 102 z l f Dump Facebook messages during specified period

122 108 116 z l t Dump Telegram cache

122 108 118 z l v Dump Viber messages during specified period

122 108 119 z l w Dump WhatsApp messages during specified period

122 110 z n Get number of all SMS messages

122 111 z o Set ringer mode to silent

122 112 z p Open specified URL in webview

122 114 z r Delete all raw SMS messages

122 116 z t Set all internal service timers

122 122 z z Remove shared preferences and restart the main service

126 ~ On/off advanced logging mode with SMS and UI activity

[Google Android](https://securelist.com/tag/google-android/)
[Keyloggers](https://securelist.com/tag/keyloggers/)
[Malware Descriptions](https://securelist.com/tag/malware-descriptions/)
[Mobile Malware](https://securelist.com/tag/mobile-malware/)
[Spyware](https://securelist.com/tag/spyware/)
[Targeted attacks](https://securelist.com/tag/targeted-attacks/)

Authors

Alexey Firsh

BusyGasper – the unfriendly spy

Your email address will not be published. Required fields are marked *


-----