Friday, June 14, 2024

New Android Remote Access Trojan(RAT) Steals Photos, Contacts, SMS & Recording Phone Calls

Newly Discovered two new Android RAT Compromising Victims Mobile and steals various sensitive information such as  Photos, Contacts, SMS and it can also record the user’s phone call conversations.

Both variants have the same functionality in terms of stealing the sensitive data from victims and the researchers named this as KevDroid.

One Variant of this Android RAT using the Android exploit (CVE-2015-3636) to gain the root access from the compromised victims mobile.

Researchers believe that  EST Security discovered an Android malware that there could be a link between this Android malware and Group 123.

KevDroid using open source tool that available on GitHub to record the phone calls from the compromised users mobile.

Also Read: Advanced Android Malware Steal Users Facebook, Twitter, Telegram,Skype Messenger Data

First Variant of KevDroid Android RAT

The first Android RAT variant has similar functionality that was explained by the EST Security researchers and it was named as  KevDroid due to the Android author tag reading as “Kevin”.

Main Purpose of this variant has distributed to record the phone calls and steal the phone call history.

This  Android RAT variant contains a library to record phone calls made on Android devices and the malware author used his original name for this malware.

According to Cisco, The purpose of the application is to steal information stored on the device. Here is the list of stolen information:

  • Installed applications
  • Phone number
  • Phone Unique ID
  • Location (the application tries to switch on the GPS), this information is collected every 10 seconds, which is aggressive for this kind of spying tool
  • Stored contacts information (name, phone numbers, emails, photos, etc.)
  • Stored SMS
  • Call logs
  • Stored emails
  • Photos
  • Recording calls

Complete successful infection of this Kevdroid will perform to steal sensitive data, such as photographs, passwords, banking information or social engineering.

Second Variant of KevDroid 

The second Android RAT is quite larger than the first variant and it contains a lot of changes such as this variant using  SQLite databases to store data.

This variant contains the additional future than the previous version.

  • Camera recording
  • Audio recording
  • Web history stealing
  • File stealing
  • Root access on the device

“Researchers said this Android RAT attempts to exploit the device using CVE-2015-3636 with the code available on GitHub. The purpose is to obtain the root permission on the compromised device. By obtaining root permissions on the device.”

Stole sensitive data such as phone call history, images, and personal videos by this Android RAT will be used to blackmail the victims and demand the money else it leads to the kidnapping of a loved one and abuse the financial transaction to steal money.


Latest articles

Sleepy Pickle Exploit Let Attackers Exploit ML Models And Attack End-Users

Hackers are targeting, attacking, and exploiting ML models. They want to hack into these...

SolarWinds Serv-U Vulnerability Let Attackers Access sensitive files

SolarWinds released a security advisory for addressing a Directory Traversal vulnerability which allows a...

Smishing Triad Hackers Attacking Online Banking, E-Commerce AND Payment Systems Customers

Hackers often attack online banking platforms, e-commerce portals, and payment systems for illicit purposes.Resecurity...

Threat Actor Claiming Leak Of 5 Million Ecuador’s Citizen Database

A threat actor has claimed responsibility for leaking the personal data of 5 million...

Ascension Hack Caused By an Employee Who Downloaded a Malicious File

Ascension, a leading healthcare provider, has made significant strides in its investigation and recovery...

AWS Announced Malware Detection Tool For S3 Buckets

Amazon Web Services (AWS) has announced the general availability of Amazon GuardDuty Malware Protection...

Hackers Exploiting MS Office Editor Vulnerability to Deploy Keylogger

Researchers have identified a sophisticated cyberattack orchestrated by the notorious Kimsuky threat group.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

API Vulnerability Scanning

71% of the internet traffic comes from APIs so APIs have become soft targets for hackers.Securing APIs is a simple workflow provided you find API specific vulnerabilities and protect them.In the upcoming webinar, join Vivek Gopalan, VP of Products at Indusface as he takes you through the fundamentals of API vulnerability scanning..
Key takeaways include:

  • Scan API endpoints for OWASP API Top 10 vulnerabilities
  • Perform API penetration testing for business logic vulnerabilities
  • Prioritize the most critical vulnerabilities with AcuRisQ
  • Workflow automation for this entire process

Related Articles