A Banking Trojan called “Faketoken” Evolving with much more capabilities from Earlier Version that can steal the sensitive information and ability to Monitor and record the phone calls conversations that send it across the network.
An overlying Mechanism used around 2,000 financial apps also attacking apps for booking taxis and paying traffic tickets.
This Malware infection Spreading through bulk SMS that prompt to Download Picture and attack the Victims Smartphones.
Also Read : Beware – More than Thousand Spyware Apps from “SonicSpy,” Family Identified in Google Play
How Does Faketoken Malware Works
Faketoken Malware Consists of 2 parts with high obfuscated Techniques that help Evade the Detection and recent days Unpacked Malware’s are very rare.
Since File was fully Encrypted and obfuscated on the server side, First parts of File drops a Malware and verdicts Detected as Trojan-Banker.AndroidOS.Fyec.az .
This First Dropper helps to decrypts and launch the Second Part of Malware which is having the complete Futures of the Malware with DAT Extensions.
Decryption helps to view and see the entire code the File. once the Malware will be triggered, it used to hide its shortcut icon and starts to monitor all of the calls.
It keeps Monitoring the all the apps when it gets launched into the Target victims Mobiles.
According to Kaspersky, Upon receiving a call from (or making a call to) a certain phone number, the malware begins to record the conversation and sends it to evildoers shortly after the conversation ends.
Monitor and Record Function
This Malware contains overlaying Futures that helps to overlay many banking apps such as Android Pay, Google Play Store, and apps for paying traffic tickets and booking flights, hotel rooms, and taxis.
Faketoken Prompt Victims to enter their credentials by using fake UI and its keep Monitoring whenever a user launches a specific one apps and Fake UI will look like original UI.
It should be noted that all of the apps attacked by this malware sample have to support for linking bank cards in order to make payments.
Faketoken Malware Detected as Trojan-Banker.AndroidOS.Faketoken and Mainly Targeting Android Users.
However, the terms of some apps make it mandatory to link a bank card in order to use the service. As millions of Android users have these applications installed, the damage caused by Faketoken can be significant. Kaspersky said.
