Spyware Telegram mod distributed via Google Play

Researchers discovered trojanized Telegram mods on Google Play that include a nonstandard library (package com.wsys) which collects user metadata, contacts, messages and files. The malware stages and encrypts harvested data into a temporary file (tgsync.s3) and periodically uploads it to a command-and-control server (sg.telegrnm.org). #com.wsys #sg.telegrnm.org

Keypoints

Malicious Telegram mods were distributed via Google Play and embed a suspicious package named com.wsys that is not part of official Telegram builds.
The com.wsys code is invoked from the app start routine (connectSocket) to gather user name, user ID, and phone number, then connects to a command server.
An incoming-message hook calls uploadTextMessageToService to capture message contents, chat/channel titles and IDs, and sender metadata; data are encrypted and cached to tgsync.s3.
Contacts processing contains uploadFriendData which collects contact IDs, nicknames, names and phone numbers, sending them to the attackers in the same manner.
Files sent or received are copied, encrypted, and forwarded to attackers’ cloud storage accounts; exfiltration occurs at scheduled intervals to a C2 domain (sg.telegrnm.org).
Kaspersky published multiple MD5 hashes for the trojanized APKs and reported the C2 domain; Google later removed the apps from Play.

MITRE Techniques

[T1071] Application Layer Protocol – Used to communicate with the command server; the article states that “the app connects to the command server” (‘the app connects to the command server’).
[T1041] Exfiltration Over C2 Channel – Exfiltrated data is sent periodically to the command server: “The app sends this temporary file to the command server at certain intervals” (‘The app sends this temporary file to the command server at certain intervals’).
[T1567] Exfiltration Over Web Service – Stolen files are forwarded to attackers’ cloud accounts: “forwarded to the attackers’ account residing in one of the popular cloud storages” (‘forwarded to the attackers’ account residing in one of the popular cloud storages’).
[T1074] Data Staged – Harvested messages are encrypted and cached into a temporary file before exfiltration: “cached into a temporary file named tgsync.s3” (‘cached into a temporary file named tgsync.s3’).
[T1087] Account Discovery – The malware collects account and contact details (IDs, nicknames, names, phone numbers): “collect information about the user’s contacts: IDs, nicknames, names, and phone numbers” (‘collect information about the user’s contacts: IDs, nicknames, names, and phone numbers’).

Indicators of Compromise

[MD5 hashes] APK file hashes – 39df26099caf5d5edf264801a486e4ee, b9e9a29229a10deecc104654cb7c71ae, and 7 more hashes.
[C2 domain] Command-and-control server – sg[.]telegrnm[.]org (listed as the app’s command server).
[Package name] Malicious library/package – com.wsys (suspicious package embedded in Trojanized APKs).
[File name] Staged exfiltration file – tgsync.s3 (temporary encrypted cache used before upload).

The technical analysis revealed that the trojanized Telegram mods include an extra library package named com.wsys, which is invoked from the app’s main activity via a connectSocket() routine. That routine gathers user identifiers (name, user ID, phone number) and establishes a network connection to a command server, enabling remote control and data transfer.

Incoming-message handling was modified to call uploadTextMessageToService, which extracts message text, chat/channel titles and IDs, and sender metadata, encrypts the collected records and stages them in a temporary file named tgsync.s3. Contact-processing code calls uploadFriendData to harvest contact IDs, nicknames, names and phone numbers. The staged data file is sent to the attackers at intervals, and files sent or received by the user are copied, encrypted, and uploaded to attackers’ cloud storage accounts.

Indicators tied to these behaviors include multiple APK MD5 hashes published by the researcher, the C2 domain sg.telegrnm.org, the malicious package com.wsys, and the staged file tgsync.s3. The modifications to the original Telegram code were minimal and positioned to bypass store checks while enabling systematic collection and exfiltration of messages, contacts and files.