Sneaky Konfety Malware Evades Detection Through APK Manipulation

Cybersecurity researchers have uncovered a sophisticated new variant of the Konfety Android malware that manipulates the APK’s structure to bypass detection and frustrate analysis tools. By abusing ZIP format quirks and dynamic code loading, the strain evades scanning, complicates reverse engineering, and continues to fuel ad fraud campaigns.

Key Takeaways

• Threat actors use the “evil twin” approach, matching package names of legitimate Play Store apps.

• Malformed APKs trigger false password prompts and crash popular analyzers.

• Dynamic code loading decrypts and injects the main payload in memory at runtime.

APK Structure Tampering For Evasion

The latest Konfety variant alters the APK’s ZIP layout to block static inspection:

1. It sets the general-purpose bit flag to “Bit 0,” marking files as encrypted and causing a bogus password prompt in tools.

2. It falsely declares BZIP compression in AndroidManifest.xml, leading to parser failures and crashes in APKTool and JADX.

These tactics thwart analysts and automated scanners, allowing malicious APKs to slip past security checks.

Dynamic Code Loading And Runtime Decryption

Rather than unpacking its payload upfront, the malware:

• Embeds an encrypted DEX payload off-screen.

• At launch, decrypts this payload directly into memory.

• Executes without leaving traces on disk or in decompiled code.

Technique	Description	Impact
ZIP Bit-Flag Encryption	Sets encryption flag on ZIP entries	Password prompts halt analysis
Fake BZIP Compression	Mislabels compression method in manifest	Crashes APKTool, JADX
Dynamic In-Memory DEX Loading	Decrypts and loads code at runtime	Evades static scanners

Ad Fraud And Command & Control Mechanisms

Konfety continues to abuse the CaramelAds SDK to fetch ads, deliver payloads, and communicate with attacker-controlled servers. Its capabilities include:

• Redirecting users to malicious websites.

• Prompting unwanted app installs.

• Triggering persistent spam notifications.

Additional stealth features:

• Hides its app icon after installation.

• Uses geofencing to modify functionality by region.

Emerging Threat Landscape

Recent findings highlight similar evasion: the Ducex packer conceals payloads in fake Telegram apps, leveraging RC4 encryption, signature checks, and anti-debugging. Separately, the TapTrap technique abuses Android’s animation system to hijack taps and bypass permissions, underscoring the need for vigilant defense.

Mitigation And Defenses

To protect against these advanced Android threats:

• Employ dynamic analysis sandboxes capable of handling malformed APKs.

• Monitor network traffic for suspicious C2 communication.

• Enforce strict Play Store policies and side-source app warnings.

• Update Android devices promptly; Google has pledged fixes in upcoming releases.

Staying ahead of evolving APK manipulation tactics is critical to maintaining mobile security. As cyber threats become increasingly sophisticated, your security strategy must evolve to keep pace. BetterWorld Technology offers adaptive cybersecurity solutions that grow with the threat landscape, helping your business stay secure while continuing to innovate. Reach out today to schedule your personalized consultation.

Sources

• New Konfety Malware Variant Evades Detection by Manipulating APKs and Dynamic Code, The Hacker News.