Thursday, December 5, 2024
HomeCyber Security NewsSharkBot - New Generation Malware on Google Play Distributed as Android Antivirus...

SharkBot – New Generation Malware on Google Play Distributed as Android Antivirus App

Published on

SIEM as a Service

While malware distributors may have a harder time getting their malicious apps through Google’s automatic scanning and flagging system, but, SharkBot shows that they can easily bypass the company’s security barriers and even human or manual verifications. 

Although the app was unpopular, its presence in Google Play Store shows that nobody but the distribution platform itself should have control over what gets published on the store.

While this new generation of SharkBot malware was distributed as an Android antivirus application on the Google Play Store.

- Advertisement - SIEM as a Service

This new generation of SharkBot has been discovered by the cybersecurity analysts at the NCC Group in Google Play Store.

Abilities of SharkBot

In October 2021, Cleafy security firm first discovered this malware, and it differed from previous banking trojans not only by transferring money in a previously unseen way but also by targeting Automatic Transfer Systems (ATS). 

Moreover, it was able to carry out this scheme initially by simulating touches and clicks on the user’s device – until eventually, the user moved into carrying out physical button-presses on the affected devices.

While the cybersecurity firm, NCC has claimed that the new version of SharkBot also offers the money transfer feature but, in this case, this feature is used in advanced attacks only.

Here below we have mentioned all the key features of SharkBot’s latest version:-

  • Injections (overlay attack): SharkBot can steal credentials by showing a WebView with a fake login website (phishing) as soon as it detects the official banking app has been opened.
  • Keylogging: Sharkbot can steal credentials by logging accessibility events (related to text fields changes and buttons clicked) and sending these logs to the command and control server (C2).
  • SMS intercept: Sharkbot has the ability to intercept/hide SMS messages.
  • Remote control/ATS: Sharkbot has the ability to obtain full remote control of an Android device through Accessibility Services. 

To abuse, all these features, SharkBot exploits the Accessibility permission on Android through which in the later period, it grants all the additional permissions as required.

Commands Received from the C2 server

Here below we have listed all the commands that are received from the C2 server along with their respective actions:-

  • smsSend: used to send a text message.
  • updateLib: used to request the malware downloads a new JAR file from the specified URL.
  • updateSQL: used to send the SQL query to be executed in the SQLite database.
  • stopAll: used to reset/stop the ATS feature.
  • updateConfig: used to send an updated config to the malware.
  • uninstallApp: used to uninstall the specified app.
  • changeSmsAdmin: used to change the SMS manager app.
  • getDoze: used to check if the permissions to ignore battery optimization are enabled or not.
  • sendInject: used to show an overlay to steal user’s credentials
  • getNotify: used to show the Notification Listener settings if they are not enabled for the malware.
  • APP_STOP_VIEW: used to close the specified app.
  • downloadFile: used to download one file from the specified URL.
  • updateTimeKnock: used to update the last request timestamp for the bot.
  • localATS: used to enable ATS attacks.

One of the remarkable differences between SharkBot and other Android banking trojans is its improved capabilities.

An interesting new update from SharkBot was its integration of an Android framework function known as “Direct Reply” that enables app developers to create replies for notifications straight from the C2.

By leveraging this relatively new framework feature, bank-fraud applications such as SharkBot have been able to intercept incoming notifications and then automatically reply to them with messages coming directly from their Command & Control servers.

By replying with a shortened Bit.ly URL, the operators of SharkBot uses this feature to drop the feature-rich payloads on the compromised system.

Here to make the detection more complex, the C2 relies on a DGA system and also blocks the command-issuing domains of SharkBot.

Recommendation

However, to remain protected, the security experts at NCC has strongly recommended users to follow some basic security rules:-

  • Do not blindly trust any apps on the Play Store.
  • Always try to keep installed minimum apps on your device.
  • Must use robust and trusted Antivirus tools.

You can follow us on Linkedin, Twitter, Facebook for daily Cybersecurity and hacking news updates.

Gurubaran
Gurubaran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Latest articles

One Identity Named Winner of the Coveted Top InfoSec Innovator Awards for 2024

One Identity named Hot Company: Privileged Access Management (PAM) in 12th Cyber Defense Magazine’s...

HCL DevOps Deploy / Launch Vulnerability Let Embed arbitrary HTML tags

Recently identified by security researchers, a new vulnerability in HCL DevOps Deploy and HCL...

CISA Warns of Zyxel Firewalls, CyberPanel, North Grid, & ProjectSend Flaws Exploited in Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about several vulnerabilities being...

HackSynth : Autonomous Pentesting Framework For Simulating Cyberattacks

HackSynth is an autonomous penetration testing agent that leverages Large Language Models (LLMs) to...

API Security Webinar

72 Hours to Audit-Ready API Security

APIs present a unique challenge in this landscape, as risk assessment and mitigation are often hindered by incomplete API inventories and insufficient documentation.

Join Vivek Gopalan, VP of Products at Indusface, in this insightful webinar as he unveils a practical framework for discovering, assessing, and addressing open API vulnerabilities within just 72 hours.

Discussion points

API Discovery: Techniques to identify and map your public APIs comprehensively.
Vulnerability Scanning: Best practices for API vulnerability analysis and penetration testing.
Clean Reporting: Steps to generate a clean, audit-ready vulnerability report within 72 hours.

More like this

One Identity Named Winner of the Coveted Top InfoSec Innovator Awards for 2024

One Identity named Hot Company: Privileged Access Management (PAM) in 12th Cyber Defense Magazine’s...

HCL DevOps Deploy / Launch Vulnerability Let Embed arbitrary HTML tags

Recently identified by security researchers, a new vulnerability in HCL DevOps Deploy and HCL...

CISA Warns of Zyxel Firewalls, CyberPanel, North Grid, & ProjectSend Flaws Exploited in Wild

The Cybersecurity and Infrastructure Security Agency (CISA) has issued warnings about several vulnerabilities being...