GravityRAT Mobile Threat Hides in Chat Apps
Researchers have discovered a recently updated version of Android GravityRAT spyware that is being circulated through messaging applications called BingeChat and Chatico. GravityRAT is a remote access tool that has been in use since at least 2015 and has previously been employed in targeted attacks against India. The availability of Windows, Android, and macOS versions of this spyware has been documented by various sources such as Cisco Talos, Kaspersky, and Cyble. The group responsible for GravityRAT, known internally as SpaceCobra, remains unidentified.
The BingeChat campaign, which likely started in August 2022, is still active, while the Chatico campaign is no longer operational. BingeChat is distributed through a website that advertises free messaging services. Notably, the latest campaign involving GravityRAT enables the spyware to extract WhatsApp backups and receive commands for file deletion. Moreover, the malicious apps offer legitimate chat functionality based on the open-source OMEMO Instant Messenger app.
The MalwareHunterTeam alerted researchers to this campaign by sharing the hash of a GravityRAT sample through a tweet. The malicious app, branded as BingeChat and claiming to provide messaging services, was identified based on the APK file name. The website bingechat[.]net, where this sample could have been downloaded, was discovered. However, accessing the app required logging in, and registration was closed. It is likely that registrations are opened only when the operators anticipate a specific victim's visit, potentially based on their IP address, geolocation, custom URL, or within a specific timeframe. Hence, researchers believe that potential victims are highly targeted.
Means of Distribution
Although researchers couldn't directly download the BingeChat app from the website, they found a URL on VirusTotal that contained the malicious BingeChat Android app and pointed to a BingeChat.zip file. This app had the same hash as the one mentioned in the aforementioned tweet, indicating that this URL serves as a distribution point for this specific GravityRAT sample.
Furthermore, the BingeChat app's code references the same domain name, bingechat[.]net, which suggests its usage for distribution purposes. It's worth noting that the malicious app has never been available on the Google Play store. Instead, it masquerades as a modified version of the legitimate open-source OMEMO Instant Messenger (IM) Android app, but is labeled as BingeChat. OMEMO IM is a reconstructed version of the Conversations Android Jabber client.
The HTML code of the malicious website was copied from the legitimate site preview.colorlib.com/theme/BingeChat/ on July 5th, 2022, using the automated tool HTTrack. Colorlib.com is a genuine website that provides downloadable WordPress themes, but the BingeChat theme appears to be unavailable there now. The bingechat[.]net domain was registered on August 18th, 2022.
Threat Actor Behind GravityRAT Still Unclear
Although Facebook researchers attribute GravityRAT to a group based in Pakistan, similar to previous speculation by Cisco Talos, the group behind the malware remains unidentified. Internally, researchers refer to this group as SpaceCobra and attribute both the BingeChat and Chatico campaigns to them.
The characteristic malicious functionality of GravityRAT is associated with a specific code segment that was previously linked to a group employing Windows variants of GravityRAT in 2020.
In 2021, Cyble published an analysis of another GravityRAT campaign that exhibited similar patterns to BingeChat. This included a comparable distribution method where the trojanized app posed as a legitimate chat application (SoSafe Chat in that case), the use of open-source OMEMO IM code, and identical malicious functionality. Figure 6 provides a comparison between the malicious classes in the GravityRAT sample analyzed by Cyble and the new sample found in BingeChat. Based on this analysis, it can be confidently stated that the malicious code in BingeChat belongs to the GravityRAT malware family.
