The new malware – MysteryBot

This new malware strain is still under development. However, it’s discovered recently by security researchers from ThreatFabric who happened to run across this new threat.

Security researchers said that the new malware seems to be related with the well-known malware strain LokiBot – a well-known Android banking Trojan.

According to the researchers of ThreatFabric, their code analysis of the new malware strain strongly suggests that there’re clear links between these two. It also clearly suggests that MysteryBot is based on LokiBot code.

Recent report on the new malware strain shows that the MysteryBot also communicates with the same C&C server that LokiBot campaign used. This also suggests that both malware is the product of the same hacker(s) or group.

The reason behind the development of this new malware is unknown. However, it’s assumable that because the source code of LokiBot was leaked online, other cyber-criminal groups are already using the code. That’s why a new malware strain will more likely attract the underground market. However, according to the ThreatFabric security researchers, MysteryBot is not publicized in those forums as it’s still under development.

MysteryBot operable on Android 7 and 8

According to ThreatFabric, the new malware – MysteryBot is unique in many ways than other malware strains like LokiBot, Anubis II, CryEye, DiseaseBot etc.

For example, MysteryBot seems to be the first one that can reliably show “overlay screens” on Android 7 and 8. These overlay screens are efficient in stealing passwords on top of the legitimate apps. Because of security features, no malware ever succeeded in using a proper overlay screens on Android 7 (Nougat) and Android 8 (Oreo).

Now, MysteryBot is able to perfectly show the overlay screen on proper timing – when a user is using banking app. Thanks to the misuse of Android feature “Usage Access permission”, it indirectly leaks the information what app the user is currently using.

Other components

MysteryBot also comes up with other modules like the keylogger and a faulty ransomware module. Let’s talk about these two.

The keylogger is an advanced one – not available in the current Android market. Instead of taking screenshots what users are typing, this advanced keylogger directly captures the location of a touch gesture instead. Then, using the touch positions, the malware tries to guess the password string from the virtual keyboard. This module is still not active.

The faulty ransomware isn’t so well-coded. According to ThreatFabric, instead of encrypting files on the system, the module creates password-protected ZIP archives of those files. The password strength isn’t strong enough to protect the archives from brute-force attacks. Moreover, the passwords can easily be overwritten from the control panel when a new victim with the same ID syncs with the MysteryBot backend.

How to stay secured

There are lots of ways this malware can make into your phone. That’s why it’s strongly recommended that you don’t use apps from any unauthenticated sources, even from the Google Store. There are several apps in the wild that downloads several payloads from a server and if the dev wishes, the payloads are easy to swap with such powerful malware that can collect important information for them.

The post NEW! AIO Android Malware – MysteryBot appeared first on Linux Windows and android Tutorials.

According to security researchers from Trustlook, the Trojan is quite simple in design but uses an advanced method to hide from the system and other defenses.

How the Android Trojan works

The Trojan gains access to boot persistence and executes itself at every boot. At first, the malware unpacks the malicious code from the app’s resources. Then, it tries to modify a bash file at “/system/etc/install-recovery.sh”. If the modification is successful, it allows the malware to run at every boot.

Then, its task is to extract the data from the IM clients. The most popular ones are already mentioned above. The complete list of vulnerable IM clients can be found here. After collecting the information, the malware sends the data to a remote server. The server’s IP address is loaded from a pre-configured file.

This malware was identified inside a Chinese app named “Cloud Module” (in Chinese). The package was named “com.android.boxa”.

Evasion techniques

According to the researchers of Trustlook, despite simple workflow of the Android Trojan (running persistently, extracting info and uploading to remote server), it’s quite efficient in hiding itself. For example, it implements anti-emulator & debugger detection that allows avoiding dynamic analysis. Moreover, it hides strings inside its source code for protection against thwart lackadaisical code reversing.

The method of workflow tells that the attacker is collecting personal information (chat, images or videos) for using later in extortion attempts or blackmailing from the high-profile victims. Researchers didn’t share any information how the malware spreads itself. However, as there’s no Play Store in China, the culprits are most likely spreading the malware via 3^rd-party app stores and Android app forums.

There are also other attempts from Chinese vendors that shipped Android smartphones with built-in Trojan! Learn more about the pre-installed Trojan on the Android smartphones.

The post Android Trojan Steals Info from Messenger, Skype, Twitter & More appeared first on Linux Windows and android Tutorials.

The company discovered the Trojan in mid-2017 and after an in-depth research, they found out that over 40 smartphone models are affected by it. These phones are from the low-end category including devices from Umi, Cubot, Doogee & Leagoo etc.

Dr. Web reported the issue to the companies and in one particular case, it was discovered that the culprit behind the Trojan was a partnership with a software developing company in Shanghai. The contract required the OEMs to pre-install one of their software in the operating system.

How “Android.Triada.231” works

This malware is extremely dangerous as it runs since the starting of the phone where there’re a few setup processes. This could lead to serious situations.

According to Dr. Web, the Trojan infect an important Android process named “Zygote”. This process launches all the apps in Android. Thus, once the Trojan is inside the module, it can get inside each and every application that runs on the system.

Thus, the Trojan obtains the ability to carry out any malicious activity without the user’s notice. It also cleverly downloads and launches additional software. The file “libandroid_runtime.so” is the home of “Android.Triada.231”, an important system library for the Android operating system. The main feature is, this Trojan isn’t distributed as an additional software and infects the system during manufacturing. The users who purchase the phone gets built-in Trojan in the way.

The number of possible infected devices can go even higher. However, the 40 designs are confirmed that those are compromised by the Trojan. There could be other phones having the same issue as well.

How to stay secured

This is not an easy process to remove the Trojan. The malware comes built-in; in other words, as system software. General antivirus and security apps can’t remove the Trojan even if that’s identified. Giving a system reset doesn’t work, as the system’s backup image is the source of the Trojan.

The best way to stay secure from this malware is to change the smartphone. If you’re an advanced user, you can try rooting the device and fix the problem with antivirus or install a custom ROM. The latest Galaxy S9 is also announced. Learn more about Galaxy S9.

Here’s the complete list of all the infected (confirmed) devices. Take quick actions if you own any of these.

• Leagoo M5
• Leagoo M5 Plus
• Leagoo M5 Edge
• Leagoo M8
• Leagoo M8 Pro
• Leagoo Z5C
• Leagoo T1 Plus
• Leagoo Z3C
• Leagoo Z1C
• Leagoo M9
• ARK Benefit M8
• Zopo Speed 7 Plus
• UHANS A101
• Doogee X5 Max
• Doogee X5 Max Pro
• Doogee Shoot 1
• Doogee Shoot 2
• Tecno W2
• Homtom HT16
• Umi London
• Kiano Elegance 5.1
• iLife Fivo Lite
• Mito A39
• Vertex Impress InTouch 4G
• Vertex Impress Genius
• myPhone Hammer Energy
• Advan S5E NXT
• Advan S4Z
• Advan i5E
• STF AERIAL PLUS
• STF JOY PRO
• Tesla SP6.2
• Cubot Rainbow
• EXTREME 7
• Haier T51
• Cherry Mobile Flare S5
• Cherry Mobile Flare J2S
• Cherry Mobile Flare P1
• NOA H6
• Pelitt T1 PLUS
• Prestigio Grace M5 LTE
• BQ 5510

source: Softpedia

The post Pre-installed Trojan in Android Smartphones appeared first on Linux Windows and android Tutorials.