fakegumtree

KO | EN

gitlite — search

#typescript #ai-agents #ai #dsh-plugin #deepseek-harness #open-source #cli #claude-code #codex #developer-tools #react #windows

★ 79 Open GitHub ↗

Investigating an Android spyware and phishing application.

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# Fake Gumtree

## Introduction
This project is based on the video [A clever Gumtree scam](https://www.youtube.com/watch?v=i-Rl1WLMCE8) by the amazing Jim Browning. Before you read any further, be sure to check his channel out.

In the video, Jim presents sophisticated cyber-scam, based on a fake Gumtree page. During the process, the website asks the user to install an APK file; this project deals with that file.

## Used tools
To reproduce the files in this repository, a few common reverse engineering tools are needed:
- [dex2jar](https://github.com/pxb1988/dex2jar) to transform APK to JAR, and [JD-Gui](http://jd.benow.ca/) to decompile these JAR sources into readable Java code. Note that this Java code is not perfectly clean, so you cannot recompile it directly.
- [Apktool](https://ibotpeaches.github.io/Apktool/) to fully unpack the APK file. The sources generated by that are in the Smali format, which is a kind of Assembly language for Android's Dalvik VM. Applications decompiled by Apktool are often perfectly re-packable, i.e. you may slightly change the application's behavior through this.
- [Retargetable Decompiler](https://retdec.com/). The _RealTalk_ framework discussed below is not fully implemented in Java, but also depends on a JNI library, which was written C++. The Retargetable Decompiler can transform these shared libraries (.so files) into (more or less) readable C code.

## Basics
The application wants the user to login at http://web-gumtree.com/gumtree/login_mob.php. In its source, a tiny portion of JavaScript code has a comment in Russian language. Additionally, some [strings](/res/values/strings.xml) in the app are only available in Russian. Thus, the country of origin is rather obvious; some details in the _Realtalk_ framework support this fact even further.

Note that the app's [AndroidManifest](/src/AndroidManifest.xml#L2) grants it permission to virtually every single component of the device. The SMS [sending](/src/AndroidManifest.xml#L56) and [delivery](/src/AndroidManifest.xml#L72) services are registered here as well.

## The _Realtalk_ framework
It seems like a framework called _Realtalk_ is used by the fake Gumtree application. This framework provides functions for [getting all phone-specific information](/src/com/gumsis/checktls/CmndTls.java#L164) (like device ID, IMEI, phone numbers etc.), [sending](/src/com/gumsis/checktls/MsTls.java#L29) and [receiving](/src/com/gumsis/mess/service/receiver/SmsReceiver.java#L70) SMS, [getting all other applications installed on a device](/src/com/gumsis/checktls/CmndTls.java#L92) or [retrieving all contacts](/src/com/gumsis/checktls/CmndTls.java#L110) and a lot more.

I came to the conclusion that this is a general framework, because I found the malware report of [a similar application on Joe Sandbox](https://www.joesandbox.com/analysis/60843/0/html). The only real difference is the main package name: in this project it's `com.gumsis`, on Joe Sandbox it's `com.nikotin`. It's possible that _Realtalk_ is distributed and/or sold on a private forum, maybe even in the Tor network, so any further investigation in this direction is appreciated.

As stated above, _Realtalk_ is not fully implemented in Java, but also depends on a native JNI library. It was possible to tell that it was written in C++, as its decompiled source contained mangled GCC symbols. For example, using a [demangler](https://demangler.com/), you can tell that `_ZN7_JNIEnv13CallIntMethodEP8_jobjectP10_jmethodIDz` becomes the C++ function signature `_JNIEnv::CallIntMethod(_jobject*, _jmethodID*, ...)`, i.e. a variadic function in the `_JNIEnv` namespace.

The native _Realtalk_ library contains [several functions](/lib/armeabi-v7a/librealtalk-jni.so.c#L123) related to retrieving phone information as well. Sadly, the underlying C code is close to unreadable, so these functions will need further investigation.

Still, the C code contains [an interesting array of strings](/lib/armeabi-v7a/librealtalk-jni.so.c#L199). This array first contains the Android package IDs of several security apps, like `com.cleanmaster.mguard`, `com.antivirus` or `com.avira.android`. After that, there are other well-known apps like `com.ubercab`, `com.alibaba.aliexpresshd`, `com.whatsapp` or `com.instagram.android` and finally, some Russian banking apps like `ru.alfabank.mobile.android`, `ru.rosbank.android` or `ru.sberbankmobile`. At the very end of this array, there are two absolutely suspicious links: `http://backfround2.pw/2445d304/`, `http://web-gumtree.com/2445d304/` and `http://background1.xyz/2445d304/`. This format does not fit the other entries, so it seems like these URLs were added later and individually for this application.

## Behavior description
1. As every Android application, this one also starts at [`com.gumsis.MainActivity`](/src/com/gumsis/MainActivity.java#L30). It first gets the default SMS package using [`getDefaultSmsPackage`](https://developer.android.com/reference/android/provider/Telephony.Sms.html#getDefaultSmsPackage(android.content.Context)), and registers this information using _Realtalk_.
2. Next, the so-called [_command service_](/src/com/gumsis/checktls/IntTls.java#L301) is started. Apparently, it first generates an ID unique for each device, registers it at _Realtalk_ and eventually starts the [CmndSrs service](/src/com/gumsis/srs/CmndSrs.java#L847). Maybe this service processes responses and/or command by the main server, as a lot of `parse*` functions exist in this source file.
3. The main activity also starts the activity [`com.gumsis.wb.WbActivity`](/src/com/gumsis/wb/WbActivity.java#L77), where _wb_ seems to be short for _web browser_. This activity just initializes a WebView with the given URL, where `"?ID=" + Realtalk.getPsuedoID(this)` has been appended. Thus, the website shown in the app is directly linked to the user's phone. This is probably why it will only accept one specific phone number, as the server will know the connection between the pseudo ID and the user's phone number by now.
4. (...)

I'm not sure about the rest right now, as I haven't fully investigated the app's network communication yet.

## Notice
The code in this repository is malicious. Execute it on your own risk and only in a safe environment (like a virtual machine without any links to your identity)

fakegumtree

Explore Similar Repositories

Was this content helpful?

Recent Feedback

Download README