Stealthy Android Malware Attacking Mobile Users Via Fake App Stores

A recently discovered Android Trojan, dubbed “MMRat,” poses a serious threat to mobile banking security. Unlike other forms of malware, this Trojan is designed to evade detection from traditional antivirus software.

The security experts at TrendMicro have identified the Trojan as AndroidOS_MMRat.HRX, warning users to be cautious when downloading new apps or accessing their banking information from their Android devices.

This group has been committing bank fraud by targeting mobile users in Southeast Asia since late June 2023.

The sophisticated malware, operating under the package name com.mm.user, is equipped with advanced capabilities, including capturing user input, remote device control, and data exfiltration.

Infiltration and Distribution

MMRat utilizes deceptive phishing websites, posing as legitimate app stores, to distribute its payload. 

These phishing sites are tailored to specific language demographics, suggesting a targeted approach to victim selection. 

The exact mechanism of how these malicious links find their way to victims’ devices remains unclear. One notable aspect of MMRat’s infiltration is its complete evasion from detection. 

Even on VirusTotal, the malware has remained undetected, underscoring the effectiveness of its tactics.

The sequence of events involving MMRat’s bank fraud operations unfolds as follows:

1. Victim downloads and installs MMRat.
2. Victim grants necessary permissions.
3. MMRat establishes communication with a remote server, sending substantial amounts of data, including personal and device-related information.

The threat actor can remotely wake up the device, unlock the screen, and initiate bank fraud. Additionally, they can visualize the device screen in real-time via screen capturing.

After accomplishing its fraudulent objectives, MMRat uninstalls itself, leaving minimal traces on the system.

Key Features of MMRat

Impersonation and Persistence MMRat disguises itself as an official app, presenting victims with phishing websites upon launch. It establishes a receiver for system events, ensuring persistence by launching a 1×1-sized pixel activity.

Network Communication MMRat communicates with a remote server through different ports, using a customized command-and-control (C&C) protocol based on protocol buffers (Protobuf). This unique approach enhances data transfer efficiency, which is particularly useful for transferring large data volumes.

User Terminal State MMRat employs Android Accessibility to capture user actions and screen content. This unconventional method focuses on text data and bypasses the FLAG_SECURE protection.

Screen Capturing MMRat captures real-time screen content via the MediaProjection API and the “user terminal state” approach. It can stream screen content to a remote server in real-time, providing the threat actor with a live view of the device.

Remote Control The malware uses the Accessibility service to remotely control the victim’s device remotely, performing actions like gestures and inputting text. This aids in bank fraud execution.

Preventive Measures

To safeguard against MMRat and similar threats, users are advised to:

1. Download apps only from official sources, such as Google Play Store or Apple App Store.
2. Regularly update device software to benefit from security enhancements.
3. Exercise caution while granting accessibility permissions and scrutinize app permissions.
4. Install reputable security solutions on their devices.
5. Be vigilant with personal and banking information shared online.

Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.