TeleRAT: A New Type of Android Trojan Horse Using Telegram to Secretly Steal Data • Daily CyberSecurity

Recently, Palo Alto Networks security experts discovered a new Android Trojan called TeleRAT that uses Telegram’s Bot API to communicate with command and control (C&C) servers and steal data. Current security experts speculate that TeleRAT may be operated by several Iranian threat attackers.

In fact, another Android malware called IRRAT has similarities with TeleRAT because it also leverages Telegram’s bot API for C&C communication. IRRAT can steal contact information, a list of Google Accounts registered on the device, SMS history, and can also use the front camera and rear camera to take photos. These stolen data are stored in some files on the SD card of the mobile phone and sent by the IRRAT to the upload server. IRRAT reports these actions to the Telegram bot hides its icon from the phone’s application menu and runs waiting for commands in the background.

The TeleRAT Android malware runs differently: it creates two files on the device that contain the device information (ie, the system bootloader version number, available memory, and a number of processor cores), telerat2.txt, and The telegram channel and a series of commands thisapk_slm.txt.

Once TeleRAT is successfully installed, malicious code will notify the attacker by sending a message via the Telegram Bot API, and the malware also launches a background service to listen for changes made to the clipboard. In addition, TeleRAT takes updates every 4.6 seconds from the bot API to listen to several commands written in Persian. Here are two ways to get updates:

getUpdates method (public history of all commands sent to the bot, including the username initiated by the command)
Webhook methods (bot updates can be redirected to an HTTPS URL specified via Webhook).

Image: paloaltonetworks

The TeleRAT feature is extremely versatile, as follows:

Receive commands to grab the contents of a contact, location, application list, or clipboard;
Receive billing information, get file list or root file list;
Download files, create contacts, set wallpapers, receive or send text messages;
Take a photo, answer or make a call, mute or loud the phone;
Turn off the phone screen, delete applications, cause the phone to vibrate, and get photos from the gallery;
TeleRAT can also use telegraph’s sendDocument API method to upload stolen data, thus avoiding network-based detection.

TeleRAT spread

TeleRAT malware is also distributed through legal and malicious Iranian telegraphy channels, in addition to being distributed to third-party Android application stores through seemingly legitimate applications. According to statistics from Palo Alto Networks, a total of 2,293 users are currently infected, and most of them (82%) have Iranian phone numbers.

TeleRAT is considered to be an upgraded version of IRRAT because it eliminates the possibility of network detection based on known upload server traffic because all communications (including uploads) are done via the telegram bot API. Apart from some additional commands, the main difference between TeleRAT and IRRAT is that TeleRAT uses the telex sendDocument API method to upload stolen data.