New Mandrake Spyware Undetected for 2 Years Hits 32K Android in Google Play

Absolutely! Here's a technical write-up leveraging SEO keywords from the provided text, enriched for authority and tactical detail, and formatted in markdown:

Executive Summary

After a two-year hiatus, the Mandrake Android spyware has re-emerged on the Google Play Store. This comprehensive technical analysis delves into the advanced obfuscation methods, sandbox evasion strategies, and anti-analysis techniques employed by the latest Mandrake variant. We unveil the evolution of this cyber-espionage platform and highlight the ongoing challenges faced by mobile security solutions in detecting and neutralizing such sophisticated threats.

Key Findings

Persistent Presence: Mandrake remained undetected on Google Play for two years, accumulating over 32,000 downloads across five applications.
Advanced Obfuscation: Core malicious functions migrated to OLLVM-obfuscated native libraries, hindering detection and analysis.
Certificate Pinning: Communication with C2 servers employs certificate pinning, making interception of SSL traffic difficult.
Sandbox Evasion Arsenal: A diverse range of sandbox evasion and anti-analysis techniques are deployed to avoid detection and analysis in controlled environments.
Detection: Kaspersky products identify this threat as HEUR:Trojan-Spy.AndroidOS.Mandrake.\*.

Technical Analysis

Infection Chain

The updated Mandrake infection chain involves a multi-stage approach:

Dropper (Native Library): The initial infection vector is a native library (libopencv_dnn.so) embedded in the application. This library decrypts and loads the second-stage loader.
Loader (DEX File): The loader establishes C2 communication, exfiltrates device information, and downloads the core component based on C2 instructions.
Core (Main Payload): The core module is responsible for the primary malicious activities, including credential theft, screen recording, remote access, and installation of additional modules.

Data Decryption Methods

Mandrake utilizes a complex data decryption scheme involving custom XOR encoding, AES encryption, and OpenSSL functions. The encryption keys and C2 domain information are embedded within the native library.

Sandbox Evasion and Anti-Analysis

The malware incorporates a variety of techniques to evade detection and analysis:

Frida Detection: Active detection of the Frida dynamic instrumentation framework, a popular tool for malware analysis.
Rooting and Environment Checks: The malware terminates execution on rooted devices or environments with developer tools or debugging capabilities.
Emulator Detection: Robust detection of emulated environments commonly used by analysts.

C2 Communication

Mandrake utilizes encrypted certificates for C2 communication, hindering interception of SSL traffic. A custom JSON-like serialization format is used for data exchange, with specific opcodes for various commands and responses.

Attribution and Victim Analysis

Based on similarities to previous campaigns and C2 infrastructure linked to Russia, the threat actor is likely the same as identified in past Mandrake activities. Victims are widespread across various countries, with a concentration in Canada, Germany, Italy, Mexico, Spain, Peru, and the UK.

Conclusion

The resurgence of Mandrake on Google Play underscores the evolving nature of mobile malware and the persistent challenges in maintaining mobile security. This analysis serves as a comprehensive resource for understanding the latest Mandrake variant and the techniques it employs to evade detection and compromise Android devices.