Fleckpe- Android Subscription Trojans on Google’s Play Store

Google play store is the trusted place for Android users to download and install mobile apps safely, but what if the trusted source itself is spreading malicious applications? Every once in a while, we can find such kinds of malware lurking as harmless apps. The most popular service is the subscription trojans which steal money without user intervention. 

In this article, we will discuss what Fleckpe (Android Subscription Trojans) is and how Fleckpe affects Android users.

What is Fleckpe and How Does It Affect Android Users?

Kaspersky has reported the discovery of a new Android malware called ‘Fleckpe’ on the Google Play store. The malware disguises itself as legitimate apps and has been downloaded over 620,000 times. Fleckpe falls under the category of subscription malware that charges users for premium services without their consent.

It was observed that this malware has been active since 2022; a total of 11 trojan-infected apps were found and were successfully taken down by Google from the play store. However, we are not sure how many more of these malicious apps are still out in the wild, so the real number of installations can be higher.

The apps were distributed as image editors, premium wallpaper, etc. Below are the 11 apps.

Trojan App on play store (Kaspersky)

Trojan App on play store (Kaspersky)

Fleckpe – Technical Analysis

Upon launching the application, a complexly obscured native library is loaded, which contains a malevolent dropper that decrypts and executes a payload extracted from the application’s assets.

Upon execution, the payload establishes communication with the command-and-control (C&C) server belonging to the threat actors. The server receives various information about the compromised device, including its Mobile Country Code (MCC) and Mobile Network Code (MNC), which can be utilized to determine the user’s carrier and country of origin. In response, the C&C server provides a subscription page that requires payment. The Trojan then invisibly opens the page in a web browser and tries to subscribe on the user’s behalf. If the process demands a verification code, the malware retrieves it from the device’s notifications, to which it had obtained access during the initial launch.

After discovering the verification code, the Trojan inserts it into the corresponding field and finalizes the subscription procedure. The user, who remains oblivious to the fact, continues to utilize the application’s genuine features, such as editing photos or installing wallpapers. However, in reality, they are unknowingly enrolled in a paid service.

Entering confirmation code (Kaspersky)

The creators of the Trojan have made changes to make it harder to detect by security tools. They moved most of the subscription code to the native library and made the payload intercept notifications and view web pages, acting as a bridge between the native code and the Android components for subscription purchases. This makes the malware more complex to analyze. The payload doesn’t have much evasion capability, but the latest version has some code obfuscation.

MITRE ATT&CK Enterprise Identifiers

IOCs

MD5