Friday, March 29, 2024

Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

A new Android malware that contains the functionalities of Banking Trojan, call forwarding, audio recording, keylogging and Ransomware Activities. The malware targeted the popular banking apps such as HFC, ICICI, SBI, Axis Bank and other E-Wallets.

The malware operator needs more user interaction to be a successful attack, it continues to force the users in a continuous loop until the permission for AccessibilityService is granted. By having the AccessibilityService enabled it allows the malware to abuse any permission without user concern.

Quick Heal researchers spotted the malware that performs a number of activities based on the commands received from the C&C server.

Android malware

Android Malware Features

Once the targeted application is launched it displays an overlay phishing login form over its window and asks for confidential information such as the username and password. Overlay attacks allow an attacker to draw on top of other windows and apps running on the affected device.

Android malware

The main APK file is highly obfuscated and the strings are encrypted, it also adds junk data to make it difficult for reverse engineering.

It also uses to check whether the user has play protection enabled or not if it is not enabled it to display fake alerts “The system does not work correctly, disable Google Play Protect” and asks users to disable it.

Android malware

Also, researchers spotted that if the user’s trying to uninstall the application the malware shows an alert with “System Error 495” message.

Threat actors used Twitter accounts for C&C communication, attackers post the encrypted C&C server address in Twitter and the malware takes the encrypted address from Twitter account.

If the malware receives the command “cryptokey” it encrypts all the files in victim’s device and renames it with the extension “.AnubisCrypt”. Once the encryption is done it shows the ransom note and blocks windows screen by showing Window WebView.

Quick Heal Security Labs published a blog post with a complete list of targeted apps and Indicators of compromise.

Also Read

Trickbot Malware Re-emerging via MS Word Documents with Powerful Code-Injection Technique

PhishPoint – Hackers Uses New Phishing Technique To Steal User Credentials

16 Years Old Australian Teen Hacked into Apple’s Secure Network & Download the Sensitive Files

Website

Latest articles

IT and security Leaders Feel Ill-Equipped to Handle Emerging Threats: New Survey

A comprehensive survey conducted by Keeper Security, in partnership with TrendCandy Research, has shed...

How to Analyse .NET Malware? – Reverse Engineering Snake Keylogger

Utilizing sandbox analysis for behavioral, network, and process examination provides a foundation for reverse...

GoPlus’s Latest Report Highlights How Blockchain Communities Are Leveraging Critical API Security Data To Mitigate Web3 Threats

GoPlus Labs, the leading Web3 security infrastructure provider, has unveiled a groundbreaking report highlighting...

Wireshark 4.2.4 Released: What’s New!

Wireshark stands as the undisputed leader, offering unparalleled tools for troubleshooting, analysis, development, and...

Zoom Unveils AI-Powered All-In-One AI Work Workplace

Zoom has taken a monumental leap forward by introducing Zoom Workplace, an all-encompassing AI-powered...

iPhone Users Beware! Darcula Phishing Service Attacking Via iMessage

Phishing allows hackers to exploit human vulnerabilities and trick users into revealing sensitive information...
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Mitigating Vulnerability Types & 0-day Threats

Mitigating Vulnerability & 0-day Threats

Alert Fatigue that helps no one as security teams need to triage 100s of vulnerabilities.

  • The problem of vulnerability fatigue today
  • Difference between CVSS-specific vulnerability vs risk-based vulnerability
  • Evaluating vulnerabilities based on the business impact/risk
  • Automation to reduce alert fatigue and enhance security posture significantly

Related Articles