Firescam: Android Malware Posing as Telegram Premium

What is FireScam Malware?

FireScam Malware is a sophisticated Android malware posing as Telegram Premium. Distributed via phishing sites mimicking RuStore, it requests extensive permissions post-installation. FireScam can monitor notifications, messages, app data, clipboard content, and USSD responses, potentially exposing sensitive information like account balances. The stolen data is sent to a Firebase Realtime Database, allowing remote access by attackers. FireScam cleverly uses legitimate services like Firebase for data exfiltration and command-and-control, making it hard to detect.

This video helps us understand FireScam Malware and its Dangers

How is FireScam Malware Distributed?

FireScam Malware, which is actually an android Trojan Horse is distributed primarily through phishing websites hosted on GitHub. These websites mimic the appearance of the legitimate RuStore app store and trick users into downloading a malicious APK file disguised as the Telegram Premium app. Here's a step-by-step breakdown of its distribution method:

1. Phishing Website: Users are lured to a GitHub.io-hosted phishing site that looks like the RuStore app store.

2. Dropper APK: The site prompts users to download a file named GetAppsRu.apk, which appears legitimate but is actually a dropper.

3. Installation: Once the dropper is installed, it silently installs the main payload, Telegram Premium.apk, which is the actual FireScam malware.

4. Permissions: The malware requests extensive permissions to access and modify device data.

5. Data Exfiltration: FireScam monitors and exfiltrates sensitive information to a Firebase Realtime Database.

How FireScam Malware Steals Sensitive Data?

FireScam Malware employs several methods to steal data from infected devices. Here's how it works:

1. Notification Monitoring: FireScam intercepts notifications from various apps, including messaging apps like Telegram and WhatsApp, to extract private information.

2. Clipboard Spying: It captures copied content, such as passwords and financial data, from the device's clipboard.

3. E-commerce Surveillance: FireScam tracks purchases and refunds to gather sensitive transaction details.

4. USSD Monitoring: It can monitor USSD responses, potentially exposing account balances and transaction details.

5. Data Exfiltration: The stolen data is sent to a Firebase Realtime Database, allowing attackers to remotely access the information.

By using these methods, FireScam can covertly gather a wide range of sensitive information from the infected device

FireScam Android Malware: How to Protect Yourself

To protect yourself from FireScam Android Malware, follow these essential tips:

1. Download Apps from Official Sources: Only install apps from trusted sources like the Google Play Store or Apple App Store.

2. Keep Your Device Updated: Regularly update your Android OS and apps to benefit from the latest security patches.

3. Be Cautious with Links: Avoid clicking on unfamiliar links or downloading files from unknown websites.

4. Check Permissions: Review app permissions carefully before installation and be wary of apps requesting excessive access.

5. Use Security Software: Install and maintain reputable Software like Virpre Anti-Virus or an industry standard anti-malware software like Malwarebytes Anti-Malware on your device.

   Vipre antivirus does all the core function of an Antivirus Software without pinching your pocket and Malwarebytes is the most popular anti-malware software in the world today.

6. Enable Two-Factor Authentication (2FA): Use 2FA for added security on your accounts to protect against unauthorized access.

By following these steps, you can significantly reduce the risk of falling victim to FireScam and other similar threats. Stay vigilant and prioritize your device's security!

Visit VIPRE Home Page

Visit Malwarebytes Home Page