Schoolyard Bully Trojan Facebook Credential Stealer

Zimperium zLabs has discovered a new Android threat campaign, the Schoolyard Bully Trojan, which has been active since 2018. The campaign has spread to over 300,000 victims and is specifically targeting Facebook credentials. The Schoolyard Bully Trojans have been found in numerous applications that were downloaded from the Google Play Store and third-party app stores.

Disguised as the good guy, these malicious apps known as the “Schoolyard Bully Trojan” are camouflaged as legitimate, educational applications with a wide range of books and topics for their victims to read. Malicious code was hidden within these apps, but in reality, they were capable of stealing Facebook credentials to upload to threat actors’ Firebase C&C. Even though these apps have now been removed from Google Play Store, they are still available on third-party app stores waiting to shake down their next student victim.

Disclosure: As a key member of the Google App Defense Alliance, Zimperium scans applications before publishing and provides an ongoing analysis of Android apps in the Google Play Store.

In this blog, we will:

• Cover the capabilities of this Trojan
• Discuss the technique used to steal Facebook credentials
• Explore the impact

What Can The Schoolyard Bully Trojan Do?

Facebook reaches nearly 2.96 billion monthly users and continues to be the number one social media platform. As attackers leverage the Schoolyard Bully Trojan to gain unauthorized access to credentials, they have far more success accessing financial accounts. Nearly 64% of individuals use the same password that was exposed in a previous breach. With the percentage of users recycling passwords, it is no surprise the Schoolyard Bully Trojan has been active for years.

The Schoolyard Bully Trojan can steal the following information from the Facebook account of their unsuspecting victims:

• Email / Phone Number
• Password
• ID
• Name

How Does The Schoolyard Bully Trojan Work?

The Schoolyard Bully Trojan is stealthy and disguises itself as educational applications, primarily targeting Vietnamese readers. Below are the screenshots of four such trojans. It is clear from the figure how the attackers are using non-suspicious applications to target their victims. The Facebook login activity is located in the chat (Trò Chuyện) option.

This trojan uses Javascript injection to steal the Facebook credentials. The Trojan opens the legitimate URL inside a WebView with the malicious javascript injected to extract the user’s phone number, email address and password, then sends it to the configured Firebase C&C.

Javascript is injected into the WebView using evaluateJavascript method as shown in Figure 3. The javascript code extracts the value of elements with ids m_login_email and m_login_password which are placeholders for phone number, email address, and password (Figure 4).

The malware uses native libraries to hide from the majority of antivirus and machine learning virus detections. This trojan uses the same technique with a native library named libabc.so to store the C&C data. The data is further encoded, to hide all the strings from any detection mechanisms. Apart from hiding its C&C details, these applications hide the educational data in a password protected zip. The password is also stored in libabc.so along with the C&C details.

Figure 5 shows the decoding function and Figure 6 shows the encoded data. To decode the data, it is simply split by 3 and the returned string is converted from binary to ASCII/UTF-8. The decoded data (Figure 7) is a JSON object which is then parsed.

After injecting and executing the Javascript, the credentials are stored in f480d and f481e (Figure 3). This data is then sent to ABC.f15496h which is SEVER_BIGDATA2 (Figure 7 and 8).

There is another function which sends some more information about the victim on the SEVER_BIGDATA C&C server:

• Name on Facebook Profile
• Facebook ID
• Facebook Email/Phone Number
• Facebook Password
• Device Name
• Device API
• Device RAM

The Threat Actors

Zimperium zLabs researchers previously covered a campaign dubbed FlyTrap that found several applications created and distributed by Vietnamese threat actors. The Schoolyard Bully Trojan campaign also reveals its common interest to be exploiting Vietnamese readers. However, our researchers have determined that the threat actors of the two campaigns are different and operate independently based on the differences found in the code samples.

The Victims of Schoolyard Bully Trojan

Although the primary victim group is Vietnamese users, the Zimperium zLabs mobile threat research team found over 300,000 victims across 71 countries, illustrating the broader-reaching geographic impact of this campaign. The actual number of countries could be more than what was accounted for because the applications are still being found in third-party app stores.

Zimperium vs. Schoolyard Bully Trojan

Zimperium zIPS customers are protected against the Schoolyard Bully Trojan with our on-device z9 Mobile Threat Defense machine learning engine. Zimperium’s patented on-device detection provides advanced security and protection against device, network, network, app, and web threats, keeping both personal and enterprise data private and secure.

To ensure your Android users are protected from the trojan malware, we recommend a quick risk assessment. Any application with the trojan will be flagged as a “Suspicious App Threat” inside zConsole. Admins can also review which apps are sideloaded onto the device that could be increasing the attack surface and leaving data and users at risk.

Indicators of Compromise

Command and Control Servers

• https://bigdata-habn.firebaseio.com
• https://bigdata2-habn.firebaseio.com
• https://bigdata3-habn.firebaseio.com

Package Names And Application Names

SHA256 Hashes

• 28ed05126595cf80bffc652708f5e27031afe4f403cc0a30fff2ba3da7c58edd
• 34ae7cdbfa560481649a072dd6123b7cf1d78a3e5b644da87b4e400c8e729f44
• c7cdcd093b0aaf68cc75e54dd386688b4b8d5528a008504ab6deefb861569319
• 81e3501a2154670941b8f173d7fb8cc7ea84a8e807851e9229ee39a763640ba2
• 8753e75790adacf50c00262c757358efaaae5b6ee03fb317ed445a68da18572c
• fd39986b567a2983dc9d11709af3d314d59453bad5688ad16b27741829e7bced
• 17979aeb52165f5287a0d95f9eb91b73a061c81ac4725b9545609d20fe7203a5
• ca4355c0de893dc7b773f6a5fdaf14c3a2dea5c30f2ca23a9efeacdb0a06555f
• 0cf5f5089cd3d0cc38a9713d0ff6bac1cb4db28c45b827aa88849b729538aa33
• 42c5a8cb4bc4d4e6179ee80b33e3e74bdfbb0c6b8a090241eaa2c5037d764375
• 6dc1c6e803f25d2eb581184921f1df30210b75cb509b9f44af66d3f17e1acd3a
• 508315503c6bfae850fbdb4ab5ebd1e5f53e76eec3cf243601f2774130f49ffe
• bd8972bfe8c63dc96481d80a6192bfe9d4b917111151336673358588e1984cdd
• 7554cfbd45b1964bac115462004d31370a189c5162b3eb9194c4e374a5860c98
• 578f6818cdabb0c9e31dffc453fc0f5b82024ee92ef1439f2840fc7aa9a95dd6
• 2c867ed7ac1bace137c390b2aa19cde011ed997bc69d9f71700d9e099babcfc8
• 0fa1630b69031806ec3798379efdec3a4b3bede49c14547305443d19142066f9
• bbe3d70f7b6df6eb6b58c14b5e487b5320b4f049a524ae47e833152cdb578cec
• 6c683f2c95d01927f09e619961d68ea2379150190113ecb79aefa2541f984095
• 9730ba9539f259cfdb2f1268ba6780e80d4f610aec544044931246bbde71bd02
• c36a408234ccd757e575032ad60e2e62f23f4bd3bb898423a2d65121671e36f5
• 648bd86656cc7994df155e4a68c267de51bc9d59ff05859c5fcc208e413021ed
• a904df0968501d2ea3b225424ac8b05fd70571bbc17aead275715da5dfbbb641
• 90108e6518986d5d837a85dec14cf549e3b637c8ee32b79da47c2832051d3a53
• 00bb1ced41de00aec0a87fa581e66befaf85c7ebfdab4b58426ce7089a0819eb
• d059273dcbcd2aae8b1c3a2910c1d8a03f4f971e40501a2fdf65538f7a84a1a0
• b02d679004b0489d6a2fe0278dc7488385249d9654a1fffbec9fa3eebbabe239
• 03dc3c64b8bd0bbbc9eab77c449609410f679eaeb5ddb3692d8c49648aea9bba
• 3de827f69478621be3bc90b0e7bae29372cda50031cc9f2d58db7764b08308db
• 5844c6b518db1d08c64118a22a759b75939a2ec474d0115cbd2c4356fbf69a0f
• 82e188324ebcbb08cce4245032b0cf4cc1a9d9cbeb77c0715d8b2777ad288bf3
• 7895e5a562dbac11e545cac27cf9b5d7c18a12742b50563f6fe228dbe00dd54f
• 3e61272d250061be418ade0d42983d5711462fdd4fb658ee348ea5bc987f28a5
• aa59ec49971f8e7d4da6cdd2b0107318c3f1f7a9187eee327aff4049b7aa65f5
• 05435ac64cefc1657c646591cb402768c531fb81bb9c38c47e82bbad522cb768
• 19cb5fc1bdb9cb1559ae2d64a0a3c36198e1a1088ce6988f18978b66b1587195
• 42d381996040ea279eab7e894026a5c4d533bf94fd95d5a164ba663763f5798f
• 8952e8b6fa64b4e4ac67005113121bd00bd76a6bb3d5aa93b42cfb786aebb40f
• 5f8d0005746189a9f0680de9bf0dab24148a2336757987fe6ee6e371efe128a0
• ccd011049de0dd3b86a5b9d1339d22ca6d6570e65f5531f0b9d6e61b94e2ed50
• 04556c878265777b5fbebca34c23ceb206a8946a917c397a7655b2388069eb9a
• f553b0db217fe6a8a88c5452a3674b73b24b3f46c945fcb7981f500b5b417a99
• 48176c5d416142a02a69740f0eed9b6d20d0e480e775e4dd065e1cb457d7fbe0
• 0c76a859cb4a55d38643544767fa8609d94ed6d7925e04ef9a3faffb9cbe409c
• fe9467ef5c5c963541155b0a6f6ff8091250c14fb00cc59ccdadd0b03071629e
• fb148eaeb73828bc19a57ba42d28c7faba4dbf344bb1e2a5c3f28c73c12b71f5
• 21d8687f7bae725a8833759606bf93efaabf492bc70e39bc3059d8b8a796994e
• ec856f1b94fa9e7e85da9c87262feda662c586d9f86c3f62371ca122f32fd7f3
• 3f10cd101912f166558ac647c985cb8d09c5a5aec91d6ac5c4323a27bce3be29
• f71f13a21b5168e88f8b6e3dc280fdbda46e36ebd956560766322575843ee8b8
• 3e76fb47db900603942f1e2c23915f5089386c5efcce10b57cb59ebea5e65ca2
• c92d085805c8f50aed9ae446d784715e304666286f037d50115be7f865fd7f90
• 1c208c5baa65d751692a25e850640e60478be7bda93173ee3714fb9dee09c1da
• 177deb64af8a4405a92085ee9fe8a5091610252d7f58935071ab157f9c9eee0f
• 8e61e9cb928a874014475a5d26c2ac7ae21a5bdedc634aff5cfadd50d1524b69
• 39df7849a7f328c50fd29ad796aabaf1dede554d156c0f6bd1e558c8fe16e4ba
• 3fe0f24ae7f41311dbf8df3ce19fa1ecdb42d1809a4a7910b5ca777af2b0e69b
• 17723aefb0e7636fb210e473af9da0ee9dfe361d1bce867ae156b6f992d409b3
• 4cfd83e40138bd655d950b93b1b981be141797b1e4bbb881c811909aa76797e3
• f9cfeb41184c1a6812ae155ea55a1cbf1b88595bb5a0f07f4c4eb9cff711c7a4
• 72608c1a2f6d50de07da71f17ff39f8bdd1f780d3ccf518600bd7b82dad8c15d
• b535bf37383a34eee9b0d9397877d3cff6d5ab49b112fef888105b43bfe5f76d
• 6b8f7ec5cbf0e3e403d3c83790701fabd5536d8b4ef1acf3b1d62c89968d36bf
• 30a69a0d8f26d5a2d02d389aa221434219a8198260c647931e6c04bf829dc850
• 89a9dfa5ea1be3a82cdecf218e67d4b316fbfea0632aac3fb97fff7e3c4b49ca
• 809086a338f74ccf85b3b7d8c4b444130013744ef7a19c350fc99cf31a90d0e2
• 61da7c5f39fc8c328bccecfb7f4519b93184c9f0d326d6a24bbf65e4efca77ee
• 8f752fc5636624a64064fa3198e635c40ec57fb29f56cc80f0b6a0df1f727dc2
• 4e6db03c79874f5210dc8fb69d1bc7605d8cbf9aaf1628e158def5449326d139
• beb27d383b56a5c6b734ce1b9b1a24b5e2e9e72d1be656671a834e3f7a290061
• 7b358dcaf2abe7c604b3e59b10cdd4579e0a37440437bd2b537aa79ef52f1faa
• 96990db70be840b150efd8af24267ccaa731b54a83fb78cd1fd02393fcd71a98
• d086498a2ef0624ea35210c0ce83af7c17be92483dcd54bc97348b4d3f3f8f51
• 2990deb89f8f7896c810bdf2e4fe97bbe328b96d9f5eedce798a984aa7ab3af4
• 8a2b5b532ae19235a230113b9e1126aea8e2c5ac3f7329d75fa76e7c6443497e
• ff94a1c15cb91597d57ad8a30e8b5b2bfdb3dde5bc176f10403dd19ea4d3c6dc
• 7e748c8048d214247ab77958dca58065d40c0fd2d69b4eb64002a5412930eec4
• fe4a08d836280dc72180900582951b32067b94a5c40e3c72653d9e5d9d1059f4
• 525baf96b92bebdd868a87a5a2acf1b2d53c0db316558e2840925e13753ce002
• 8766e9618ce34f7729e5502e51fe6ced982be0279c3d06ff12f0bc0c2ff3e0f1
• 9d6f999f8c39d961ee6d90975e4ca88b741411515bb1752f4d8d1838e57c2fb1
• b5a508093b30d5200f53d86bb2d6dc0d8f40b507321e520b8c2333ca6399d6c9
• d97641007c9c45defaf7c12799d599c9db480cbea0bfa6be42c6d04fd93b9781
• 0ed276129f7e792b848351a456aff3062fa3d288a505ae4a4751853351310e04
• 4c0d00c513dd3f70d030e6056aa32a540fea78eec53448cf161a580ae2033bd2
• 5e9985925da5d28804f97784ac357a0dbae0b078542d623118a454edbd962fee
• dfcc279893369c8b1eebb2fa160253719c39bd989fa67522fcbddc708f88d460
• 2b071229c60e327aab42f91e2acbdbc7c0ef46fa2b5ad8007a0aa54da5bed788
• 2117ff48ffc34e0dc89d242dfa5d73095407f0c9f94114d66e89269958f407f2
• 48d1b5d86bff3eca0667c0f675cf81a17b76b58cdd73966fdd0b7f2662e6d464
• 121d44f2a4781d5c20ecc075549cb413a56e618b3caf7b53a9c6b2daf4c2fbeb
• f694bc992dabfa6c5dda4066b72ea4892ed58eae38e2055162dda5eb61c7e1bd
• a9823713b0c24a4160821640fa530353e57147e04129cac6b6177e91a9cfb9d3
• 52d91fadab1322b62ede9e3f3b5de5e16133f8357942fb4f7e3bc9dafaef39d0
• 720dfadd86293b4b335c01796f307ae8947715ad85ab4da89c003d6d6bf41ad9
• b7354ee83ac6a531e61b3d10e52669839bd2965e055b4566275dc4bc729bb8b4
• c82bfa7688a738846ec9400d8940133e0eca5d5ba7cf6d91568fcc058c478894
• 83bccfb335bda735a721dffcf5308723af685a50ea5f4ebfb62ad15c3c88f1d2
• 4d76ce3efaef5ffb59834f48a2e5fe3f8f093ad038e7fab6cabac34d1eff7437
• 86d91f1c4ff5698002fd2ae627d8f22a2399cafede71a4fa0db045743d53013a
• 7950225f948b9c9755e8f56fe609dd021098c6e24f8b0fa9e08fb7b4a81972c9
• f396794dacdb55e0fb40521f4d177445a94095b81452332d171229631cb64bb0
• d28b448f399b45ef97337d25731f1d78d34609091df345402365ab6641acf88f
• 24c29b93fc25b88ee24051cc615cbf1ad90c49d5217cc7e79b8145d09d3bbf06
• 27afb7ac366867d327e6062cce7b05d568516aa0af6988363848a4118306584d
• 94c627e4d2d127087fccacce353ca374eaec8ffe67d549a315ff4a3e8878f1df
• 0f2227d0c53f28d5301b1438761006b688248e5fc09c23cca2430c0ee4f29746
• d00d6505682ff8676c91f02027984c522630ff5bccb070712628aab47400753b
• 626561481eacd02471253642c98f06f5ef296180f2bdfbbcca107580faa8c7b3
• 11e2be66a9482c65015de9135188a62ebb16e3b3d12b43b007f48c46dd120d75
• b37f5ede534d4b77b7856d860c8fa24f393df02a7ad1c99f9777d096d802ee72
• c0ef915ce28d874cba6725bd164a3f064b425da4badbd7aedd107077f5d8bb57
• c5f2c12264cc64174880b63d4408ecf992cda96b11d9553ec557616b7c07aac4
• cdbe068510d331f78d2597bc5c1e0b7b48f9b606be60c0e0b716ebc7e708dfa0
• 1d2f3800a33062e8189b18c1758bf4a6f32ad49240aa483f1d9369a6429278cb
• 127624793f77665847c0ca9da37ccf157066cf71e075f16117d05bee9a9881c0
• 8c245197d68cd7ed466076091e98fa3521fc19848af78b0dc4d7532a6165e54d
• 9522df8e669d381c695210c9f003f31c81e6624e55db693624bbd7184789e148
• 11a902004451e5c568fc1d215dfb1b651153dbc86b7424d7fff19db2ec558fe2
• b806c1878faef78eefa8373d8843dac9de83cf407e247ce709213bde5bc52ef1
• b9854f7a9fb15cbf3d42889bc5bf7e45d99a9995b47600037cbd3bfc1c26f873
• 97f63fe0f57943f9fca23b53e8b0b9edff8531705ea9417c0ee889ec330bb0dd
• 01e7faf9ecb938add527bf3675f34f2cd399049ff4820722b9b12c5e6cedd9d2
• ded21897681b260b461d2164dad1ba0ef566e128491674d4de3975dc33e0249a
• c1b9bb0da72a5a043bf7351fcfd52682fd27627cd80a0c4f39351401fc68e055
• 1ef22e429ffd77997410e77b5ed770ba1a918c77a32a786464469d4180477826
• e2967ac1e786351223abbce18c8034c04cf5644d56e3352ffc7085fc1329e6d0
• 52bc9aa0165bb92427e3b5b1cfd6d60df7e921d90ed6af4e4a6327d72c5663e2
• c4be5c5c3f953c935b3c13c0be18646678a7bc2c2deaf9e8c7620f3e531d8bf3
• da004fbe911fc71ff0910045f00e323a8bc7f0fe593d3b6b9ebc402ffc4b848e
• 4ae54853f939fe8dcdb56fb4703ca897aff698a2753bfaefce6c2425f002644f
• 679cb4016278c3b7cf15ea7fddc61b24ec68937193db6ddcc1de00968a7ed8fe
• 9eeaa3bf7f275f8048cba9975ec13ca4fdae28c7cffb1faa0d32a3f63c41fcc4
• 32bf601229c1edad1df5deeea24eb3423d10d2e88b2d70269c9cda1fb484ec5c
• 243b7012cea2991aa8c98feac264baca97912bd8d241a8912fe1455e5bedba31
• 266ed4124f393c588c6fba800bb2167805fdd8b729b271ef93feb7467bcd5385
• 898086692f44b5f66ae358869e006184e8add8f14ec3318ef9b0e04367559b26
• 0979ce73ed0e565377808ffa27096d6612ffa9c07f35cfe2889445949e42255d
• 944ffa654838f7e904483e2c441ac72c7e38aeda1758b520ed4d2be39c647d80
• 17a727b860ca713d6b31ae30306db61619836e7bb548c79c3ab49f773b19ac25
• a0f1f95a7cb07db82ce233058c0477e7f18907cb48abecac954121c42077647c
• 4f48793e746af4bcc900ccc5e234aa3bc57b589f0199a1ebe44c9acd1a40deb2
• 187c1f9890341654d948428d527ef6f85661b15c7637ee6f467096899dec004c
• ea00c7ab0167cb944d203740dee7215b6f038310ef93672b9035ef37ea32a4f5
• 790d70c25a0340736e836fce7b2bfe798fedde01e3219faacab200fa831263ee
• 8fa8b0c589740d324068099948c814e77f921c2fec8719718cc455e3e817aa10
• ea93efff15d8c86c758547dc9e6fe0da33699af39652480168085c9a99b3976d
• 829126667ad9737be0b43f589cab3ffc5bd0f1c32a45404156c9c646d7ee88f0
• f5ebee5c86620512ff1a5cf7c12e6b5bf4e4840f48b04d4b968d674a64ae9012
• a5b20a19c356ea5e978c3d07441ae6e376cc43dc0f1a3afdac8fe8ba47dac143
• cc5a1c59a54424dcd66b272536b2c1de671f04cdb038cbf131cfc464032271f2
• 2a958a0caa3f0868e20ef75dab6bd792172158b62d0efbfe7e07084b76ae7fa6
• c7239454fd63c6520563e8627a92c703cfec878c02a61a6199e8850fd3257955
• f7405deb16b5c82b03447d69dc9147542daa370cd5e1cd6929123887b67324eb
• a4f47e70fd7ec2543511267da9d22f82a50b54f997b792b51f68f511ce29e5f5
• 8ba4864eed767f977066f2e5d8370b8620bb9f040dfec3b8b4343f231e987531
• dffd0792b33b27cb2d52c1f2f22cbeb8876c5dee2ed7059f366470a7a502ba39
• 53e795b14b2e4af8ce13eabf0d28d76b23333d6e42d7ef9407a0d3a28b28a4ff
• 449e8b097ec1b2cdf89706a235a920ba1a8e12e9cd38c6b7cc511b486f8bc845
• f1940d77aa8c99a8fbf15389c1e9583c2b809f6d2f46be5ee22dbfa147574ab8
• 34ee6c6ea26b6d644af66b4e8516401ae43e84fb59ca3f0a8f9f06b6c2b8db64
• 5d8f48802e22b66209b6069bae5f4a78758d19aad9b0cef0b4c631b795a4817e
• 3f32844326a40cd81f6477b77751c862747183bcbe8b21e34e7830d701bcd3eb
• 8e1a7c27658cfe4ef4d6514ac47d19fedb3b2ceda21852dc15bdef2aabad80d9
• b17f61b95d8281dab2f3e7d850093dad8cd4ad0c8c77a358ef5a8485d438c637
• 8da3a3086941a733ccca75552b3a30235c2eba87204b0ea1fc4a434f6dcc4525
• 455d5c56bd7c98c48ff70da1d3bd0652b389bac0c6563bce24b6a70f30567d8f
• 4723549cda66970035f3ceb8a4ca447b94d579373206c171e3eceb49ab1881fa
• 491d5ecbb76f3e873d25b84967b6b3afeddd99e9f655c87ba8f44e6369d11318
• 0375aec6be49e2abe3a02e6da9377a12c26b35dc777165d4a8180dd3faed21e7
• 19fc4f33e99b8caa0f3595f4709a31969274a0cf94b0c839e444ff6ebc7461b0
• ff6d585e71cfbf651b556bced3be238361142cf617f72e2c445b1fb768fed5a6
• 9d36caa1e78bbb3a4248bd010c241d9abc98ee116dbd50d8a990b59b7958a7a4
• 1bb40fc528c6fe6143a95a66c59039c75ca42bdec09451f513cb9ce1d5981a74
• a52cb7399661d76fb3dc252dcd6b2004438cb4d20f2961edaa0755b4a71da372