A recently discovered Android Trojan, dubbed “MMRat,” poses a serious threat to mobile banking security. Unlike other forms of malware, this Trojan is designed to evade detection from traditional antivirus software.
The security experts at TrendMicro have identified the Trojan as AndroidOS_MMRat.HRX, warning users to be cautious when downloading new apps or accessing their banking information from their Android devices.
This group has been committing bank fraud by targeting mobile users in Southeast Asia since late June 2023.
The sophisticated malware, operating under the package name com.mm.user, is equipped with advanced capabilities, including capturing user input, remote device control, and data exfiltration.
MMRat utilizes deceptive phishing websites, posing as legitimate app stores, to distribute its payload.
These phishing sites are tailored to specific language demographics, suggesting a targeted approach to victim selection.
The exact mechanism of how these malicious links find their way to victims’ devices remains unclear. One notable aspect of MMRat’s infiltration is its complete evasion from detection.
Even on VirusTotal, the malware has remained undetected, underscoring the effectiveness of its tactics.
The sequence of events involving MMRat’s bank fraud operations unfolds as follows:
The threat actor can remotely wake up the device, unlock the screen, and initiate bank fraud. Additionally, they can visualize the device screen in real-time via screen capturing.
After accomplishing its fraudulent objectives, MMRat uninstalls itself, leaving minimal traces on the system.
Impersonation and Persistence MMRat disguises itself as an official app, presenting victims with phishing websites upon launch. It establishes a receiver for system events, ensuring persistence by launching a 1×1-sized pixel activity.
Network Communication MMRat communicates with a remote server through different ports, using a customized command-and-control (C&C) protocol based on protocol buffers (Protobuf). This unique approach enhances data transfer efficiency, which is particularly useful for transferring large data volumes.
User Terminal State MMRat employs Android Accessibility to capture user actions and screen content. This unconventional method focuses on text data and bypasses the FLAG_SECURE protection.
Screen Capturing MMRat captures real-time screen content via the MediaProjection API and the “user terminal state” approach. It can stream screen content to a remote server in real-time, providing the threat actor with a live view of the device.
Remote Control The malware uses the Accessibility service to remotely control the victim’s device remotely, performing actions like gestures and inputting text. This aids in bank fraud execution.
Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware
To safeguard against MMRat and similar threats, users are advised to:
Keep informed about the latest Cyber Security News by following us on Google News, Linkedin, Twitter, and Facebook.
A critical security flaw has been uncovered in certain TP-Link routers, potentially allowing malicious actors…
SilkSpecter, a Chinese financially motivated threat actor, launched a sophisticated phishing campaign targeting e-commerce shoppers…
The research revealed how threat actors exploit SEO poisoning to redirect unsuspecting users to malicious…
Black Basta, a prominent ransomware group, has rapidly gained notoriety since its emergence in 2022…
CVE-2024-52301 is a critical vulnerability identified in Laravel, a widely used PHP framework for building…
A critical vulnerability has been discovered in the popular "Really Simple Security" WordPress plugin, formerly…