Full Report
Group-IB analyzes the evolution of Android malware in Uzbekistan, revealing advanced droppers, encrypted payload delivery, anti-analysis techniques, and Wonderland’s bidirectional SMS-stealing capabilities driving large-scale financial fraud.
Analysis Summary
# Tool/Technique: Wonderland Malware Family
## Overview
Wonderland is a sophisticated Android malware family identified by Group-IB, primarily targeting users in Uzbekistan. It is designed to facilitate large-scale financial fraud by intercepting and exfiltrating SMS messages, particularly those containing One-Time Passwords (OTPs) and transaction notifications. The malware is typically distributed through social engineering (smishing) as seemingly harmless files like PDF documents or wedding invitations.
## Technical Details
- **Type:** Malware Family (Android Trojan/SMS Stealer)
- **Platform:** Android
- **Capabilities:** SMS interception, bidirectional SMS stealing, anti-analysis (encryption/obfuscation), payload dropping, and exfiltration via Telegram/C2.
- **First Seen:** Active variants observed in late 2024 and early 2025.
## MITRE ATT&CK Mapping
- **[TA0037 - Command and Control]**
- [T1102 - Web Service] (Abuse of Telegram for C2)
- **[TA0035 - Collection]**
- [T1636.002 - SMS Messages] (Intercepting OTPs and incoming messages)
- **[TA0040 - Impact]**
- [T2034.001 - External Mule Account] (Facilitating fraudulent transfers to mule accounts)
- **[TA0005 - Defense Evasion]**
- [T1406 - Obfuscated Files or Information] (Use of encrypted payloads and droppers)
## Functionality
### Core Capabilities
- **Bidirectional SMS Stealing:** Intercepts both incoming and outgoing SMS messages to capture sensitive banking data and OTPs.
- **Payload Delivery:** Uses advanced droppers to fetch and execute secondary malicious stages, minimizing the initial footprint.
- **Exfiltration:** Leverages the Telegram Bot API to send stolen data to threat actor-controlled channels.
### Advanced Features
- **Encryption:** Uses encrypted payload delivery to bypass network-level security inspections and automated sandboxes.
- **Anti-Analysis:** Employs techniques to detect if it is running in a virtual environment or under a debugger, stalling execution if analyzed.
- **Social Engineering Lures:** Distributed via files named after local legal notices (*Sud Qarori*) or social events (*Toyga Taklifnoma*).
## Indicators of Compromise
### File Hashes (SHA-1)
- `db1d14d5246f2c8807c55084b74247dea6465285` (Sud Qarori.PDF (8).apk)
- `6f5502b0e2e99d5f9be4e5f9dcf3fa21b48a92e4` (Razdevator.apk)
- `516943e93a2bd8f7d91dc5d8b130073d60f4fe67` (Sud qarori26.08.2025.apk)
- `6ab99f2396f309647f1adabd290f711960d41696` (Siz bilan video (212).apk)
- `3343e72eb3f04244c7ebf464883cb120365e3a4e` (Toyga Taklifnoma (2).apk)
### File Names
- Sud Qarori.apk
- Toyga Taklifnoma.apk
- Razdevator.apk
### Network Indicators
- `api.telegram[.]org` (Abused for C2 communication)
## Associated Threat Actors
- While specific named groups were not assigned in the summary, the activity is attributed to financially motivated threat actors focusing on the **Uzbekistan** region.
## Detection Methods
- **Signature-based:** Detect the specific SHA-1 hashes listed in the IOC section.
- **Behavioral:** Monitor for Android applications requesting unnecessary SMS permissions or attempting to communicate with Telegram APIs immediately after installation.
- **YARA Rules:** (Not explicitly provided, but should target strings related to Telegram bot token patterns and SMS receiver classes).
## Mitigation Strategies
- **Prevention:** Disable "Install from Unknown Sources" on Android devices.
- **Hardening:** Use Mobile Threat Defense (MTD) solutions to identify and block malicious APKs.
- **Awareness:** Educate users not to open APK files sent via SMS or messaging apps (Telegram/WhatsApp), especially those masquerading as PDFs or invitations.
## Related Tools/Techniques
- **MidnightDat:** A related Android malware family sharing similar lures.
- **RoundRift:** Another variant mentioned in the IOCs targeting the same demographic.
- **Smishing (SMS Phishing):** The primary delivery vector.