Analysis of Malware Inserted in APK Files in the Case of “Undangan Nikah.apk” Using Reverse Engineering

WhatsApp is one of the most widely used social media platforms for communication due to its ease of use, simplicity, and diverse features. However, hackers often exploit its convenience for phishing attacks. Recently, there have been cases of hackers sending wedding invitation messages in APK format containing Android malware to WhatsApp users. Unaware of the hacker’s tactics, some users click on these messages, inadvertently granting access to the APK file containing malware on their smartphones. This paper aims to explore how the embedded malware in the APK file operates after being installed on Android devices, using reverse engineering. Examination of the Java source code obtained through reverse engineering exposes that the malware integrated into the code aims to obtain authorization for handling (receiving and sending) SMS messages from the targeted smartphone to the hacker. This poses a significant risk, especially given the widespread use of SMS for transactions or banking authentication, such as SMS banking, transmission of OTP codes, or other authentication methods. The findings of this study are to offer insights to individuals who may lack awareness regarding different file types on their Android devices, thereby contributing to the prevention of scams employing similar tactics.

I. Introduction

The convenient utilization of WhatsApp as a communication tool is occasionally exploited by hackers to initiate phishing attacks, like sending files containing malware to WhatsApp users. In a case that occurred in July 2023, a WhatsApp user in Malang, East Java admitted that he had become a victim of phishing. He received a message in the form of a wedding invitation in APK format from an unknown number. The day following the receipt of the message, the victim’s account balance of 1.4 billion rupiah vanished. This incident occurred due to the victim’s lack of awareness regarding the scam orchestrated through the Undangan Nikah.apk (wedding invitation.apk) or similar message format.