Dangerous Android Malware that Steals Banking Credentials, Call Forwarding, Keylogging, and Ransomware Activities

A new Android malware that contains the functionalities of Banking Trojan, call forwarding, audio recording, keylogging and Ransomware Activities. The malware targeted the popular banking apps such as HFC, ICICI, SBI, Axis Bank and other E-Wallets.

The malware operator needs more user interaction to be a successful attack, it continues to force the users in a continuous loop until the permission for AccessibilityService is granted. By having the AccessibilityService enabled it allows the malware to abuse any permission without user concern.

Quick Heal researchers spotted the malware that performs a number of activities based on the commands received from the C&C server.

Android Malware Features

Once the targeted application is launched it displays an overlay phishing login form over its window and asks for confidential information such as the username and password. Overlay attacks allow an attacker to draw on top of other windows and apps running on the affected device.

The main APK file is highly obfuscated and the strings are encrypted, it also adds junk data to make it difficult for reverse engineering.

It also uses to check whether the user has play protection enabled or not if it is not enabled it to display fake alerts “The system does not work correctly, disable Google Play Protect” and asks users to disable it.

Also, researchers spotted that if the user’s trying to uninstall the application the malware shows an alert with “System Error 495” message.

Threat actors used Twitter accounts for C&C communication, attackers post the encrypted C&C server address in Twitter and the malware takes the encrypted address from Twitter account.

If the malware receives the command “cryptokey” it encrypts all the files in victim’s device and renames it with the extension “.AnubisCrypt”. Once the encryption is done it shows the ransom note and blocks windows screen by showing Window WebView.

Quick Heal Security Labs published a blog post with a complete list of targeted apps and Indicators of compromise.

Also Read

Trickbot Malware Re-emerging via MS Word Documents with Powerful Code-Injection Technique

PhishPoint – Hackers Uses New Phishing Technique To Steal User Credentials

16 Years Old Australian Teen Hacked into Apple’s Secure Network & Download the Sensitive Files