Super Mario Run Malware # 2 – DroidJack RAT Gamers love Mario and Pokemon , but so do malware authors .


A few days back , we wrote about an Android Marcher trojan variant posing as the Super Mario Run game for Android .


We have found another instance of malware posing as the Super Mario Run Android app , and this time it has taken the form of DroidJack RAT ( remote access trojan ) .


Proofpoint wrote about the DroidJack RAT side-loaded with the Pokemon GO app back in July 2016 ; the difference here is that there is no game included in the malicious package .


The authors are trying to latch onto the popularity of the Super Mario Run game to target eagerly waiting Android users .


Details : Name : Super Mario Run Package Name : net.droidjack.server MD5 : 69b4b32e4636f1981841cbbe3b927560 Technical Analysis : The malicious package claims to be the Super Mario Run game , as shown in the permissions screenshot below , but in reality this is a malicious RAT called DroidJack ( also known as SandroRAT ) that is getting installed .


Once installed , the RAT registers the infected device as shown below .


DroidJack RAT starts capturing sensitive information like call data , SMS data , videos , photos , etc .


Observe below the code routine for call recording .


This RAT records all the calls and stores the recording to an “ .amr ” file .


The following is the code routine for video capturing .


Here , the RAT stores all the captured videos in a “ video.3gp ” file .


It also harvests call details and SMS logs as shown below .


Upon further inspection , we have observed that this RAT extracts WhatsApp data too .


The RAT stores all the data in a database ( DB ) in order to send it to the Command & Control ( C & C ) server .


The following are the DBs created and maintained by the RAT .


We saw the following hardcoded C & C server location in the RAT package : Conclusion : The DroidJack RAT is another example of a growing trend in which malware authors seek to exploit public interest as a way to spread malware .


In this case , like others before , the event of a popular game release became an opportunity to trick unsuspecting users into downloading the RAT .


As a reminder , it is always a good practice to download apps only from trusted app stores such as Google Play .


This practice can be enforced by unchecking the " Unknown Sources '' option under the " Security '' settings of your device .


XLoader Disguises as Android Apps , Has FakeSpy Links This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices .


By : Hara Hiroaki , Lilang Wu , Lorin Wu April 02 , 2019 In previous attacks , XLoader posed as Facebook , Chrome and other legitimate applications to trick users into downloading its malicious app .


Trend Micro researchers found a new variant that uses a different way to lure users .


This new XLoader variant poses as a security app for Android devices , and uses a malicious iOS profile to affect iPhone and iPad devices .


Aside from a change in its deployment techniques , a few changes in its code set it apart from its previous versions .


This newest variant has been labeled XLoader version 6.0 ( detected as AndroidOS_XLoader.HRXD ) , following the last version discussed in a previous research on the malware family .


Infection chain The threat actors behind this version used several fake websites as their host — copying that of a Japanese mobile phone operator ’ s website in particular — to trick users into downloading the fake security Android application package ( APK ) .


Monitoring efforts on this new variant revealed that the malicious websites are spread through smishing .


The infection has not spread very widely at the time of writing , but we ’ ve seen that many users have already received its SMS content .


In the past , XLoader showed the ability to mine cryptocurrency on PCs and perform account phishing on iOS devices .


This new wave also presents unique attack vectors based on the kind of device it has accessed .


In the case of Android devices , accessing the malicious website or pressing any of the buttons will prompt the download of the APK .


However , successfully installing this malicious APK requires that the user has allowed the installation of such apps as controlled in the Unknown Sources settings .


If users allow such apps to be installed , then it can be actively installed on the victim ’ s device .


The infection chain is slightly more roundabout in the case of Apple devices .


Accessing the same malicious site would redirect its user to another malicious website ( hxxp : //apple-icloud [ .


] qwq-japan [ .


] com or hxxp : //apple-icloud [ .


] zqo-japan [ .


] com ) that prompts the user to install a malicious iOS configuration profile to solve a network issue preventing the site to load .


If the user installs the profile , the malicious website will open , revealing it to be an Apple phishing site , as seen in figure 2 .


Technical analysis Most of this new attack ’ s routines are similar to those of the previous XLoader versions .


However , as mentioned earlier , an analysis of this new variant showed some changes in its code in line with its new deployment method .


We discuss these changes and its effect on Android and Apple devices .


Malicious APK Like its previous versions , XLoader 6.0 abuses social media user profiles to hide its real C & C addresses , but this time its threat actors chose the social media platform Twitter , which was never used in previous attacks .


The real C & C address is encoded in the Twitter names , and can only be revealed once decoded .


This adds an extra layer against detection .


The code for this characteristic and the corresponding Twitter accounts can be seen in figures 3 and 4 respectively .


Version 6.0 also adds a command called “ getPhoneState ” , which collects unique identifiers of mobile devices such as IMSI , ICCID , Android ID , and device serial number .


This addition is seen in Figure 5 .


Considering the other malicious behaviors of XLoader , this added operation could be very dangerous as threat actors can use it to perform targeted attacks .


Malicious iOS profile In the case of Apple devices , the downloaded malicious iOS profile gathers the following : Unique device identifier ( UDID ) International Mobile Equipment Identity ( IMEI ) Integrated Circuit Card ID ( ICCID ) Mobile equipment identifier ( MEID ) Version number Product number The profile installations differ depending on the iOS .


For versions 11.0 and 11.4 , the installation is straightforward .


If a user visits the profile host website and allows the installer to download , the iOS system will go directly to the “ Install Profile ” page ( which shows a verified safety certificate ) , and then request the users ’ passcode for the last step of installation .


On later versions , specifically iOS 12.1.1 and iOS 12.2 , the process is different .


After the profile is downloaded , the iOS system will first ask users to review the profile in their settings if they want to install it .


Users can see a “ Profile Downloaded ” added in their settings ( this feature is in iOS 12.2 , but not on iOS 12.1.1 ) .


This gives users a chance to see details and better understand any changes made .


After the review , the process is the same as above .


After the profile is installed , the user will then be redirected to another Apple phishing site .


The phishing site uses the gathered information as its GET parameter , allowing the attacker to access the stolen information .


Ongoing activity While monitoring this particular threat , we found another XLoader variant posing as a pornography app aimed at South Korean users .


The " porn kr sex '' APK connects to a malicious website that runs XLoader in the background .


The website uses a different fixed twitter account ( https : //twitter.com/fdgoer343 ) .


This attack , however , seems exclusive to Android users , as it does not have the code to attack iOS devices .


Succeeding monitoring efforts revealed a newer variant that exploits the social media platforms Instagram and Tumblr instead of Twitter to hide its C & C address .


We labeled this new variant XLoader version 7.0 , because of the different deployment method and its use of the native code to load the payload and hide in Instagram and Tumblr profiles .


These more recent developments indicate that XLoader is still evolving .


Adding connections to FakeSpy We have been seeing activity from XLoader since 2018 , and have since followed up our initial findings with a detailed research revealing a wealth of activity dating back to as early as January 2015 , which outlined a major discovery—its connection to FakeSpy .


The emergence of XLoader 6.0 does not only indicate that the threat actors behind it remain active ; it also holds fresh evidence of its connection to FakeSpy .


One such immediately apparent connection was the similar deployment technique used by both XLoader 6.0 and FakeSpy .


It had again cloned a different legitimate Japanese website to host its malicious app , similar to what FakeSpy had also done before .


Their similarity is made more apparent by looking at their naming method for downloadable files , domain structure of fake websites and other details of their deployment techniques , exemplified in figure 10 .


XLoader 6.0 also mirrors the way FakeSpy hides its real C & C server .


When before it had used several different social media platforms , it now uses the Twitter platform , something FakeSpy has done in its past attacks .


Analysis of the malicious iOS profile also revealed further connections , as the profile can also be downloaded from a website that FakeSpy deployed early this year .


Conclusion and security recommendations The continued monitoring of XLoader showed how its operators continuously changed its features , such as its attack vector deployment infrastructure and deployment techniques .


This newest entry seems to indicate that these changes won ’ t be stopping soon .


Being aware of this fact can help create defensive strategies , as well as prepare for upcoming attacks .


In addition , just as uncovering new characteristics is important , finding ones we ’ ve also seen in a different malware family like FakeSpy also provides valuable insight .


Links between XLoader and FakeSpy can give clues to the much broader inner workings of the threat actors behind them .


Perhaps more information on XLoader will be known in the future .


For now , users can make the best of the knowledge they have now to significantly reduce the effectivity of such malware .


Users of iOS can remove the malicious profile using the Apple Configurator 2 , Apple ’ s official iOS helper app for managing Apple devices .


Following simple best practices , like strictly downloading applications or any files from trusted sources and being wary of unsolicited messages , can also prevent similar attacks from compromising devices .


Indicators of Compromise SHA256 Package App label 332e68d865009d627343b89a5744843e3fde4ae870193f36b82980363439a425 ufD.wykyx.vlhvh SEX kr porn 403401aa71df1830d294b78de0e5e867ee3738568369c48ffafe1b15f3145588 ufD.wyjyx.vahvh 佐川急便 466dafa82a4460dcad722d2ad9b8ca332e9a896fc59f06e16ebe981ad3838a6b


com.dhp.ozqh Facebook 5022495104c280286e65184e3164f3f248356d065ad76acef48ee2ce244ffdc8 ufD.wyjyx.vahvh Anshin Scan a0f3df39d20c4eaa410a61a527507dbc6b17c7f974f76e13181e98225bda0511 com.aqyh.xolo 佐川急便 cb412b9a26c1e51ece7a0e6f98f085e1c27aa0251172bf0a361eb5d1165307f7


jp.co.sagawa.SagawaOfficialApp 佐川急便 Malicious URLs : hxxp : //38 [ .


] 27 [ .


] 99 [ .


] 11/xvideo/ hxxp : //apple-icloud [ .


] qwe-japan [ .


] com hxxp : //apple-icloud [ .


] com/ hxxp : //apple-icloud [ .


] com/ hxxp : //files.spamo [ .


] jp/佐川急便.apk hxxp : //mailsa-qae [ .


] com hxxp : //mailsa-qaf [ .


] com hxxp : //mailsa-qau [ .


] com hxxp : //mailsa-qaw [ .


] com hxxp : //mailsa-wqe [ .


] com hxxp : //mailsa-wqo [ .


] com hxxp : //mailsa-wqp [ .


] com hxxp : //mailsa-wqq [ .


] com hxxp : //mailsa-wqu [ .


] com hxxp : //mailsa-wqw [ .


] com hxxp : //nttdocomo-qae [ .


] com hxxp : //nttdocomo-qaq [ .


] com/aa hxxp : //nttdocomo-qar [ .


] com hxxp : //nttdocomo-qat [ .


] com hxxp : //nttdocomo-qaw [ .


] com hxxp : //sagawa-reg [ .


] com/ hxxp : //www [ .


] 711231 [ .


] com hxxp : //www [ .


] 759383 [ .


] 923525 [ .


] 923915 [ .


] 975685 [ .


] com Malicious Twitter accounts : https : //twitter.com/lucky88755 https : //twitter.com/lucky98745 https : //twitter.com/lucky876543 https : //twitter.com/luckyone1232 https : //twitter.com/sadwqewqeqw https : //twitter.com/gyugyu87418490 https : //twitter.com/fdgoer343 https : //twitter.com/sdfghuio342 https : //twitter.com/asdqweqweqeqw https : //twitter.com/ukenivor3


Malicious Instagram account : https : //www.instagram.com/freedomguidepeople1830/ Malicious Tumblr accounts : https : //mainsheetgyam.tumblr.com/ https : //hormonaljgrj.tumblr.com/ https : //globalanab.tumblr.com/ C & C addresses : 104 [ .


] 160 [ .


] 191 [ .


] 190:8822 61 [ .


] 230 [ .


] 204 [ .


] 87:28833 61 [ .


] 87:28844 61 [ .


] 87:28855 61 [ .


] 205 [ .


] 122:28833 61 [ .


] 122:28844 61 [ .


] 122:28855 61 [ .


] 132:28833 61 [ .


] 132:28844 61 [ .


] 132:28855 GoldenCup : New Cyber Threat Targeting World Cup Fans As the World Cup launches , so does a new threat Officials from the Israeli Defense Force recently uncovered an Android Spyware campaign targeting Israeli soldiers and orchestrated by " Hamas .


'' The latest samples attributed to this campaign were discovered by security researchers from ClearSky .


In our research , we focus on the most recent sample , an application dubbed as " Golden Cup '' , launched just before the start of World Cup 2018 .


Distribution / Infection When this campaign started at the start of 2018 , the malware ( " GlanceLove '' , " WinkChat '' ) was distributed by the perpetrators mainly via fake Facebook profiles , attempting to seduce IDF soldiers to socialize on a different platform ( their malware ) .


As this approach was not a great success , their last attempt was to quickly create a World Cup app and this time distribute it to Israeli citizens , not just soldiers .


The official “ Golden Cup ” Facebook page .


The short URL redirects to the application page at Google Play .


We assume it was rushed because , unlike GlanceLove , it lacked any real obfuscation .


Even the C & C server side was mostly exposed with the file listing available for everyone to traverse through it .


It contained approximately 8GB of stolen data .


A recent whois of “ goldncup.com ” .


Creation date is a week before the start of the tournament .


How it Works In order to get into the Google Play Store , the malware uses a phased approach which is quite a common practice for malware authors these days .


The original app looks innocent , with most of its code aimed at implementing the real features that the app claims to provide .


In addition , it collects identifiers and some data from the device .


After getting a command from the C & C , the app is able to download a malicious payload in the form of a .dex file that is being dynamically loaded adding the additional malicious capabilities .


In this way , the malware authors can submit their app and add the malicious capabilities only after their app is live on the Play Store .


Communication with the C & C In order to communicate with its C & C , the app uses the MQTT ( Message Queuing Telemetry Transport ) protocol , which is transported over TCP port 1883 .


Initiating the MQTT client .


The app connects to the MQTT broker with hardcoded username and password and a unique device identifier generated for each device .


The MQTT connection to broker The MQTT connection to broker The MQTT communication is used primarily to update the device state and get commands from the C & C .


It uses different topics that include the unique device identifier , which side is sending the message , and whether it is information message or command .


HTTP Communication In addition to the MQTT communication , the app also uses plain text HTTP communication in order to download the .dex file and upload collected data .


All of the files that are being uploaded or downloaded are zip files encrypted by AES with ECB mode .


The key for each file is generated randomly and stored in the encrypted file with a fixed offset .


In order to upload the file , the app uses a basic REST communication with the server , checking if the file exists and uploading it if it isn ’ t .


The path that is used for the uploads is : http : // /apps/d/p/op.php The communication looks like this : First Phase The first phase of the app ’ s attack flow collects device information and a list of apps installed on the device .


These are then uploaded to the C & C HTTP server .


The collection of basic device information .


In addition , at this stage the app can process one of these commands : • Collect device info • Install app • Is online ?


• Change server domain Out of these , the most interesting command is the “ install app ” command that downloads an encrypted zip file containing the second phase dex file , unpacks and loads it .


Second Phase The second phase dex file contains 3 main services that are being used : • ConnManager - handles connections to the C & C • ReceiverManager - waits for incoming calls / app installations • TaskManager - manages the data collection tasks The C & C server address is different than the one that is used by the first phase , so the app reconnects to the new server as well as starts the periodic data collector tasks .


By analyzing the TaskManager class we can see the new commands that are supported at this stage : As can be seen in the code snippet above , there are quite a lot of data collection tasks that are now available : Collect device info Track location Upload contacts information Upload sent and received SMS messages Upload images Upload video files Send recursive dirlist of the external storage Upload specific files Record audio using the microphone Record calls Use the camera to capture bursts of snapshots Those tasks can either run periodically , on event ( such as incoming call ) or when getting


a command from the C & C server .


Mitigations Stay protected from mobile malware by taking these precautions : Do not download apps from unfamiliar sites Only install apps from trusted sources Pay close attention to the permissions requested by apps Install a suitable mobile security app , such as SEP Mobile or Norton , to protect your device and data Keep your operating system up to date Make frequent backups of important data Indicators of Compromise ( IoCs ) Package names : anew.football.cup.world.com.worldcup com.coder.glancelove com.winkchat APK SHA2 : 166f3a863bb2b66bda9c76dccf9529d5237f6394721f46635b053870eb2fcc5a


1664cb343ee830fa94725fed143b119f7e2351307ed0ce04724b23469b9002f2 Loaded DEX SHA2 : afaf446a337bf93301b1d72855ccdd76112595f6e4369d977bea6f9721edf37e Domain/IP : goldncup [ .


] com glancelove [ .


] com autoandroidup [ .


] website mobilestoreupdate [ .


] website updatemobapp [ .


] website 107 [ .


] 175 [ .


] 144 [ .


] 26 192 [ .


] 64 [ .


] 114 [ .


] 147 Red Alert 2.0 : Android Trojan targets security-seekers A malicious , counterfeit version of a VPN client for mobile devices targets security-minded victims with a RAT .


Written by Jagadeesh Chandraiah JULY 23 , 2018 SophosLabs has uncovered a mobile malware distribution campaign that uses advertising placement to distribute the Red Alert Trojan , linking counterfeit branding of well-known apps to Web pages that deliver an updated , 2.0 version of this bank credential thief .


The group distributing this family of malware decorates it in the branding and logos of well-known social media or media player apps , system update patches , or ( in its most recent campaign ) VPN client apps in an attempt to lure users into downloading , installing , and elevating the privileges of a Trojanized app hosted on a site not affiliated with any reputable app market or store .


Aside from the inescapable irony of disguising a security-reducing Trojan as an ostensibly security-enhancing app , and the righteous affront to the whole concept of a VPN ’ s purpose a Trojan so disguised inspires , this represents an escalation in the variety of app types targeted by this campaign of bankbots in disguise .


Red Alert Plays Dress-Up In the wild , we found Web pages designed to ( vaguely ) resemble legitimate app market pages , hosting files for download that have been disguised as a legitimate mobile application of moderately broad appeal , such as a media player or social media app .


But the categories targeted by this group seem to be broadening with the inclusion of VPN software .


The Web page shown here on the left is hosted on a domain that seems apt : free-vpn [ .


] download .


Investigation of this domain led to additional domains that appear to have been registered for use with the campaign , but are not in use yet .


( You can find additional IoCs at the end of this article ) As you can see , the Web page uses a similar colour scheme as , and the icon design from , a legitimate VPN application ( VPN Proxy Master ) found on the Google Play store .


The fake doesn ’ t quite nail the app name .


In addition to “ Free VPN Master Android , ” we ’ ve observed Red Alert 2.0 Trojans in the wild disguising themselves using names like : Flash Player or Update Flash Player Android Update or Android Antivirus Chrome Update or Google Update Update Google Market WhatsApp Viber OneCoin Wallet Pornhub Tactic FlashLight or PROFlashLight Finanzonline The vast majority of in-the-wild Red Alert 2.0 samples falsely present themselves as Adobe Flash player for Android , a utility that Adobe stopped supporting years ago .


Our logs show a number of simultaneous Red Alert 2.0 campaigns in operation , many ( but not all ) hosted on dynamic DNS domains .


The Red Alert Payload Once installed , the malware requests Device Administrator privileges .


If the malware obtains device administrator rights , it will be able to lock the screen by itself , expire the password , and resist being uninstalled through normal methods .


Device admin request from app that says it is WhatsApp The app then stays in the background listening to commands from the cybercrooks .


Within some of the first of those commands , the bot typically receives a list of banks it will target .


The Trojan works by creating an overlay whenever the user launches the banking application .


Currently Running Applications Banking Trojans that rely on the overlay mechanism to steal information need to know what application is in the foreground .


They do this not only to identify whether the use of a particular app may permit them to harvest another credential , but also because each targeted app needs to have an overlay mapped to its design , so the Trojan can intercept and steal user data .


This quest to determine the currently running application is a hallmark of overlay malware , so we thought we ’ d take a closer look at how it ’ s done .


To prevent this , Android ’ s engineers regularly release updates that contain bug fixes designed to prevent apps from getting the list of currently running apps without explicit permission .


With every Android update , the malware authors are forced to come up with new tricks .


This particular case is not an exception .


The author ( s ) of this malware wrote separate subroutines that identify the operating system version and fire off methods to obtain a list of currently running applications known to work on that particular version of Android .


First , they use the built-in toolbox commands to determine what apps are running .


If that doesn ’ t work , they try to use queryUsageStats : When the malware invokes queryUsageStats , it asks for the list of applications that ran in the last 1 million milliseconds ( 16 minutes and 40 seconds ) .


String Resources Used to Store App Data Red Alert 2.0 stores its data in an atypical location ( inside the Strings.xml file embedded in the app ) to fetch its critical data , such as the C2 address .


The com.dsufabunfzs.dowiflubs strings in the screenshot above refer to the internal name this particular malware was given , which in this case was randomized into alphabet salad .


It ’ s been SophosLabs ’ observation that Red Alert Trojans usually have a randomized internal name like this .


The strings section of the app contains embedded command-and-control IP addresses , ports , and domain names in plaintext .


It is an invaluable source of intelligence about a given campaign .. The following snippet shows the location within the Trojan where it uses SQLite database commands to store and recall command-and-control addresses : Backdoor Commands The Red Alert code also contains an embedded list of commands the botmaster can send to the bot .


The malware can execute a variety of arbitrary commands , including ( for example ) intercepting or sending text messages without the user ’ s knowledge , obtaining a copy of the victim ’ s Address Book , or call or text message logs , or sending phone network feature codes ( also known as USSD codes ) .


C2 and Targeted Banks As described earlier , the C2 domain is kept in the app ’ s resources .


During the app execution , the malware contacts C2 domain for further instructions .


Most of the network traffic we ’ ve observed is HTTP .


The C2 address , as stored in samples we ’ ve seen , comprise both an IP address and port number ; So far , all the samples we ’ ve tested attempted to contact an IP address on port 7878/tcp .


If the main C2 domain is not responsive , the bot fetches a backup C2 domain from a Twitter account .


Static analysis of the code reveals that the malware downloads the overlay template to use against any of the bank ( s ) it is targeting .


The malware also sends regular telemetry back to its C2 server about the infected device in the form of an HTTP POST to its C2 server .


It uses the base Dalvik User-Agent string for the device it ’ s running on .


The content of the HTTP POST data is telemetry data in a json format about the device the malware is running on .


The list of banks targeted by Red Alert 2.0 includes NatWest , Barclays , Westpac , and Citibank .


Red Alert 2.0 is a banking bot that is currently very active online , and presents a risk to Android devices .


We expect to see more diversification in the social engineering lures this threat group employs as time goes on .


So far , legitimate app stores appear to be this malware ’ s Achilles heel ; disabling the installation of third-party apps has been an effective prevention measure .


Stick to Google Play and use VPN software from reputable vendors .


Sophos detects all the samples of this Trojan family as Andr/Banker-GWC and Andr/Spybot-A .


In the wild , these are only distributed as a direct download from unofficial Web pages ( “ third-party ” app ) and not through legitimate app stores .


Red Alert 2.0 IoCs list C2 addresses 103.239.30.126:7878 146.185.241.29:7878 146.185.241.42:7878 185.126.200.3:7878 185.126.200.12:7878 185.126.200.15:7878 185.126.200.18:7878 185.165.28.15:7878 185.243.243.241:7878 185.243.243.244:7878 185.243.243.245:7878 Domains Malware source Web hosts


on 167.99.176.61 : free-androidvpn.date free-androidvpn.download free-androidvpn.online free-vpn.date free-vpn.download free-vpn.online Hashes 22fcfce096392f085218c3a78dd0fa4be9e67ed725bce42b965a27725f671cf 55292a4dde8727faad1c40c914cf1be9dfdcf4e67b515aa593bcd8d86e824372


As a result of a lot of hard work done by our security research teams , we revealed today a new and alarming malware campaign .


The attack campaign , named Gooligan , breached the security of over one million Google accounts .


The number continues to rise at an additional 13,000 breached devices each day .


Our research exposes how the malware roots infected devices and steals authentication tokens that can be used to access data from Google Play , Gmail , Google Photos , Google Docs , G Suite , Google Drive , and more .


Gooligan is a new variant of the Android malware campaign found by our researchers in the SnapPea app last year .


Check Point reached out to the Google Security team immediately with information on this campaign .


Our researchers are working closely with Google to investigate the source of the Gooligan campaign .


“ We ’ re appreciative of both Check Point ’ s research and their partnership as we ’ ve worked together to understand these issues , ” said Adrian Ludwig , Google ’ s director of Android security .


“ As part of our ongoing efforts to protect users from the Ghost Push family of malware , we ’ ve taken numerous steps to protect our users and improve the security of the Android ecosystem overall. ” We are very encouraged by the statement Google shared with us addressing the issue .


We have chosen to join forces to continue the investigation around Gooligan .


Google also stated that they are taking numerous steps including proactively notifying affected accounts , revoking affected tokens and deploying SafetyNet improvements to protect users from these apps in the future .


Who is affected ?


Gooligan potentially affects devices on Android 4 ( Jelly Bean , KitKat ) and 5 ( Lollipop ) , which is over 74 % of in-market devices today .


About 57 % of these devices are located in Asia and about 9 % are in Europe .


In our research we identified tens of fake applications that were infected with this malware .


If you ’ ve downloaded one of the apps listed in Appendix A , below , you might be infected .


You may review your application list in “ Settings - > Apps ” , if you find one of this applications , please consider downloading an antivirus product such as Check Point ZoneAlarm to check if you are indeed infected .


We have noticed that hundreds of the email addresses are associated with enterprise accounts worldwide .


How do you know if your Google account is breached ?


You can check if your account is compromised by accessing the following web site that we created : https : //gooligan.checkpoint.com/ .


If your account has been breached , the following steps are required : A clean installation of an operating system on your mobile device is required ( a process called “ flashing ” ) .


As this is a complex process , we recommend powering off your device and approaching a certified technician , or your mobile service provider , to request that your device be “ re-flashed. ” Change your Google account passwords immediately after this process .


How do Android devices become infected ?


We found traces of the Gooligan malware code in dozens of legitimate-looking apps on third-party Android app stores .


These stores are an attractive alternative to Google Play because many of their apps are free , or offer free versions of paid apps .


However , the security of these stores and the apps they sell aren ’ t always verified .


Gooligan-infected apps can also be installed using phishing scams where attackers broadcast links to infected apps to unsuspecting users via SMS or other messaging services .


How did Gooligan emerge ?


Our researchers first encountered Gooligan ’ s code in the malicious SnapPea app last year .


At the time this malware was reported by several security vendors , and attributed to different malware families like Ghostpush , MonkeyTest , and Xinyinhe .


By late 2015 , the malware ’ s creators had gone mostly silent until the summer of 2016 when the malware reappeared with a more complex architecture that injects malicious code into Android system processes .


The change in the way the malware works today may be to help finance the campaign through fraudulent ad activity .


The malware simulates clicks on app advertisements provided by legitimate ad networks and forces the app to install on a device .


An attacker is paid by the network when one of these apps is installed successfully .


Logs collected by Check Point researchers show that every day Gooligan installs at least 30,000 apps fraudulently on breached devices or over 2 million apps since the campaign began .


How does Gooligan work ?


The infection begins when a user downloads and installs a Gooligan-infected app on a vulnerable Android device .


Our research team has found infected apps on third-party app stores , but they could also be downloaded by Android users directly by tapping malicious links in phishing attack messages .


After an infected app is installed , it sends data about the device to the campaign ’ s Command and Control ( C & C ) server .


Gooligan then downloads a rootkit from the C & C server that takes advantage of multiple Android 4 and 5 exploits including the well-known VROOT ( CVE-2013-6282 ) and Towelroot ( CVE-2014-3153 ) .


These exploits still plague many devices today because security patches that fix them may not be available for some versions of Android , or the patches were never installed by the user .


If rooting is successful , the attacker has full control of the device and can execute privileged commands remotely .


After achieving root access , Gooligan downloads a new , malicious module from the C & C server and installs it on the infected device .


This module injects code into running Google Play or GMS ( Google Mobile Services ) to mimic user behavior so Gooligan can avoid detection , a technique first seen with the mobile malware HummingBad .


The module allows Gooligan to : Steal a user ’ s Google email account and authentication token information Install apps from Google Play and rate them to raise their reputation Install adware to generate revenue Ad servers , which don ’ t know whether an app using its service is malicious or not , send Gooligan the names of the apps to download from Google Play .


After an app is installed , the ad service pays the attacker .


Then the malware leaves a positive review and a high rating on Google Play using content it receives from the C & C server .


Our research team was able to identify several instances of this activity by cross-referencing data from breached devices with Google Play app reviews .


This is another reminder of why users shouldn ’ t rely on ratings alone to decide whether to trust an app .


Similar to HummingBad , the malware also fakes device identification information , such as IMEI and IMSI , to download an app twice while seeming like the installation is happening on a different device , thereby doubling the potential revenue .


What are Google authorization tokens ?


A Google authorization token is a way to access the Google account and the related services of a user .


It is issued by Google once a user successfully logged into this account .


When an authorization token is stolen by a hacker , they can use this token to access all the Google services related to the user , including Google Play , Gmail , Google Docs , Google Drive , and Google Photos .


While Google implemented multiple mechanisms , like two-factor-authentication , to prevent hackers from compromising Google accounts , a stolen authorization token bypasses this mechanism and allows hackers the desired access as the user is perceived as already logged in .


Conclusion Gooligan has breached over a million Google accounts .


We believe that it is the largest Google account breach to date , and we are working with Google to continue the investigation .


We encourage Android users to validate whether their accounts have been breached .


Hacking Team Spying Tool Listens to Calls By : Trend Micro July 21 , 2015 Following news that iOS devices are at risk of spyware related to the Hacking Team , the saga continues into the Android sphere .


We found that among the leaked files is the code for Hacking Team ’ s open-source malware suite RCSAndroid ( Remote Control System Android ) , which was sold by the company as a tool for monitoring targets .


( Researchers have been aware of this suite as early as 2014 .


) The RCSAndroid code can be considered one of the most professionally developed and sophisticated Android malware ever exposed .


The leak of its code provides cybercriminals with a new weaponized resource for enhancing their surveillance operations .


Based on the leaked code , the RCSAndroid app can do the following intrusive routines to spy on targets : Capture screenshots using the “ screencap ” command and framebuffer direct reading Monitor clipboard content Collect passwords for Wi-Fi networks and online acco ; .unts , including Skype , Facebook , Twitter , Google , WhatsApp , Mail , and LinkedIn Record using the microphone Collect SMS , MMS , and Gmail messages Record location Gather device information Capture photos using the front and back cameras Collect contacts and decode


messages from IM accounts , including Facebook Messenger , WhatsApp , Skype , Viber , Line , WeChat , Hangouts , Telegram , and BlackBerry Messenger .


Capture real-time voice calls in any network or app by hooking into the “ mediaserver ” system service RCSAndroid in the Wild Our analysis reveals that this RCSAndroid ( AndroidOS_RCSAgent.HRX ) has been in the wild since 2012 .


Traces of its previous uses in the wild were found inside the configuration file : It was configured to use a Command-and-control ( C & C ) server in the United States ; however , the server was bought from a host service provider and is now unavailable .


It was configured to activate via SMS sent from a Czech Republic number .


Attackers can send SMS with certain messages to activate the agent and trigger corresponding action .


This can also define what kind of evidences to collect .


Based on emails leaked in the dump , a number of Czech firms appear to be in business with the Hacking team , including a major IT partner in the Olympic Games .


Dropping Cluster Bombs RCSAndroid is a threat that works like a cluster bomb in that it deploys multiple dangerous exploits and uses various techniques to easily infect Android devices .


While analyzing the code , we found that the whole system consists of four critical components , as follows : penetration solutions , ways to get inside the device , either via SMS/email or a legitimate app low-level native code , advanced exploits and spy tools beyond Android ’ s security framework high-level Java agent – the app ’ s malicious APK command-and-control ( C & C ) servers , used to remotely send/receive malicious commands Attackers use two methods to get targets to download RCSAndroid .


The first method is to send a specially crafted URL to the target via SMS or email .


The URL will trigger exploits for arbitrary memory read ( CVE-2012-2825 ) and heap buffer overflow ( CVE-2012-2871 ) vulnerabilities in the default browsers of Android versions 4.0 Ice Cream Sandwich to 4.3 Jelly Bean , allowing another local privilege escalation exploit to execute .


When root privilege is gained , a shell backdoor and malicious RCSAndroid agent APK file will be installed The second method is to use a stealthy backdoor app such as ANDROIDOS_HTBENEWS.A , which was designed to bypass Google Play .


The role of ANDROIDOS_HTBENEWS.A and the malicious APK mentioned in the first method is to exploit a local privilege escalation vulnerability in Android devices .


Hacking Team has been known to use both CVE-2014-3153 and CVE-2013-6282 in their attacks .


The said exploits will root the device and install a shell backdoor .


The shell backdoor then installs the RCSAndroid agent .


This agent has two core modules , the Evidence Collector and the Event Action Trigger .


The Evidence Collector module is responsible for the spying routines outlined above .


One of its most notable routines is capturing voice calls in real time by hooking into the “ mediaserver ” system service .


The basic idea is to hook the voice call process in mediaserver .


Take voice call playback process for example .


The mediaserver will first builds a new unique track , start to play the track , loop play all audio buffer , then finally stop the playback .


The raw wave audio buffer frame can be dumped in the getNextBuffer ( ) function .


With the help of the open-source Android Dynamic Binary Instrumentation Toolkit and root privilege , it is possible to intercept any function execution .


The Event Action Trigger module triggers malicious actions based on certain events .


These events can be based on time , charging or battery status , location , connectivity , running apps , focused app , SIM card status , SMS received with keywords , and screen turning on .


According to the configuration pattern , these actions are registered to certain events : Sync configuration data , upgrade modules , and download new payload ( This uses transport protocol ZProtocol encrypted by AES/CBC/PKCS5Padding algorithm to communicate with the C & C server .


) Upload and purge collected evidence Destroy device by resetting locking password Execute shell commands Send SMS with defined content or location Disable network Disable root Uninstall bot To avoid detection and removal of the agent app in the device memory , the RCSAndroid suite also detects emulators or sandboxes , obfuscates code using DexGuard , uses ELF string obfuscator , and adjusts the OOM ( out-of-memory ) value .


Interestingly , one unused feature of the app is its ability to manipulate data in the Android package manager to add and remove permissions and components as well as hide the app icon .


Recommendations Popular mobile platforms like Android are common targets for organized or commercialized monitoring operations .


Attackers know that rooting devices via malware exploits is an effective means to control devices and gather information from them .


In a root broken device , security is a fairy tale .


Take note of the following best practices to prevent this threat from getting in your device : Disable app installations from unknown , third-party sources .


Constantly update your Android devices to the latest version to help prevent exploits , especially in the case of RCSAndroid which can affect only up to version 4.4.4 KitKat .


Note , however , that based on the leak mail from a customer inquiry , Hacking Team was in the process of developing exploits for Android 5.0 Lollipop .


Install a mobile security solution to secure your device from threats .


The leaked RCSAndroid code is a commercial weapon now in the wild .


Mobile users are called on to be on top of this news and be on guard for signs of monitoring .


Some indicators may come in the form of peculiar behavior such as unexpected rebooting , finding unfamiliar apps installed , or instant messaging apps suddenly freezing .


Should a device become infected , this backdoor can not be removed without root privilege .


Users may be required the help of their device manufacturer to get support for firmware flashing .


Trend Micro offers security for Android mobile devices through Mobile Security for Android™ to protect against these types of attacks .


Find out more about the 7 Android Security Hacks You Need to Do Right Now to keep your mobile data safe .


Update as of July 23 , 2015 1:00 AM PDT ( UTC-7 ) We have added a link to a previous report discussing this threat .


Timeline of posts related to the Hacking Team DATE UPDATE July 5 The Italian company Hacking Team was hacked , with more than 400GB of confidential company data made available to the public .


July 7 Three exploits – two for Flash Player and one for the Windows kernel—were initially found in the information dump .


One of these [ CVE-2015-5119 ] was a Flash zero-day .


The Windows kernel vulnerability ( CVE-2015-2387 ) existed in the open type font manager module ( ATMFD.dll ) and can be exploited to bypass the sandbox mitigation mechanism .


The Flash zero-day exploit ( CVE-2015-5119 ) was added into the Angler Exploit Kit and Nuclear Exploit Pack .


It was also used in limited attacks in Korea and Japan .


July 11 Two new Flash zero-day vulnerabilities , CVE-2015-5122 and CVE-2015-5123 , were found in the hacking team dump .


July 13 Further analysis of the hacking team dump revealed that the company used UEFI BIOS rootkit to keep their Remote Control System ( RCS ) agent installed in their targets ’ systems .


July 14 A new zero-day vulnerability ( CVE-2015-2425 ) was found in Internet Explorer .


July 16 On the mobile front , a fake news app designed to bypass Google Play was discovered .


July 20 A new zero-day vulnerability ( CVE-2015-2426 ) was found in Windows , which Microsoft fixed in an out-of-band patch .


July 21 Analysis of the RCSAndroid spying tool revealed that Hacking Team can listen to calls and roots devices to get in .


July 28 A recent campaign compromised Taiwan and Hong Kong sites to deliver Flash exploits related to Hacking Team .


Android users warned of malware attack spreading via SMS FEB 16 , 2016 Security researchers are warning owners of Android smartphones about a new malware attack , spreading via SMS text messages .


As the team at Scandinavian security group CSIS describes , malware known as MazarBOT is being distributed via SMS in Denmark and is likely to also be encountered in other countries .


Victims ’ first encounter with the malware reportedly comes via an unsolicited text message that their Android smartphone receives .


The txt message uses social engineering to dupe unsuspecting users into clicking on a link to a downloadable Android application .


CSIS provided a ( sanitised ) version of a typical message to warn users what to look out for : “ You have received a multimedia message from + [ country code ] [ sender number ] Follow the link http : //www.mmsforyou [ .


] net/mms.apk to view the message ” Once the APK package is downloaded , potential victims are urged to grant the malicious app a wide range of permissions on their Android device : App permissions SEND_SMS RECEIVE_BOOT_COMPLETED INTERNET SYSTEM_ALERT_WINDOW WRITE_SMS ACCESS_NETWORK_STATE WAKE_LOCK GET_TASKS CALL_PHONE RECEIVE_SMS READ_PHONE_STATE READ_SMS ERASE_PHONE Once installed , MazarBOT downloads a copy of


Tor onto users ’ Android smartphones and uses it to connect anonymously to the net before sending a text message containing the victim ’ s location to an Iranian mobile phone number .


With the malware now in place , a number of actions can be performed , including allowing attackers to secretly monitor and control smartphones via a backdoor , send messages to premium-rate numbers , and intercept two-factor authentication codes sent by online banking apps and the like .


In fact , with full access to the compromised Android smartphone , the opportunities for criminals to wreak havoc are significant – such as erasing infected phones or launching man-in-the-middle ( MITM ) attacks .


In its analysis , CSIS notes that MazarBOT was reported by Recorded Future last November as being actively sold in Russian underground forums and intriguingly , the malware will not activate on Android devices configured with Russian language settings .


This , in itself , does not prove that the perpetrators of the malware campaign are based in Russia , but it certainly sounds as if that is a strong possibility .


Malware authors in the past have often coded a “ safety net ” into their malware to prevent them from accidentally infecting their own computers and devices .


For more detailed information about the threat , check out the blog post from CSIS .


And , of course , remember to always be wary of unsolicited , unusual text messages and installing apps from third-party sources on your Android smartphone .


Coronavirus Update App Leads to Project Spy Android and iOS Spyware We discovered a cyberespionage campaign we have named Project Spy infecting Android and iOS devices with spyware by using the coronavirus disease ( Covid-19 ) as a lure .


By : Tony Bao , Junzhi Lu April 14 , 2020 We discovered a potential cyberespionage campaign , which we have named Project Spy , that infects Android and iOS devices with spyware ( detected by Trend Micro as AndroidOS_ProjectSpy.HRX and IOS_ProjectSpy.A , respectively ) .


Project Spy uses the ongoing coronavirus pandemic as a lure , posing as an app called Coronavirus Updates .


We also found similarities in two older samples disguised as a Google service and , subsequently , as a music app after further investigation .


However , we have noted a significantly small number of downloads of the app in Pakistan , India , Afghanistan , Bangladesh , Iran , Saudi Arabia , Austria , Romania , Grenada , and Russia .


Project Spy routine At the end of March 2020 , we came across an app masquerading as a coronavirus update app , which we named Project Spy based on the login page of its backend server .


This app carries a number of the capabilities : Upload GSM , WhatsApp , Telegram , Facebook , and Threema messages Upload voice notes , contacts stored , accounts , call logs , location information , and images Upload the expanded list of collected device information ( e.g. , IMEI , product , board , manufacturer , tag , host , Android version , application version , name , model brand , user , serial , hardware , bootloader , and device ID ) Upload SIM information ( e.g.


, IMSI , operator code , country , MCC-mobile country , SIM serial , operator name , and mobile number ) Upload wifi information ( e.g. , SSID , wifi speed , and MAC address ) Upload other information ( e.g. , display , date , time , fingerprint , created at , and updated at ) The app is capable of stealing messages from popular messaging apps by abusing the notification permissions to read the notification content and saving it to the database .


It requests permission to access the additional storage .


Project Spy ’ s earlier versions Searching for the domain in our sample database , we found that the coronavirus update app appears to be the latest version of another sample that we detected in May 2019 .


The first version of Project Spy ( detected by Trend Micro as AndroidOS_SpyAgent.HRXB ) had the following capabilities : Collect device and system information ( i.e. , IMEI , device ID , manufacturer , model and phone number ) , location information , contacts stored , and call logs Collect and send SMS Take pictures via the camera Upload recorded MP4 files Monitor calls Searching further , we also found another sample that could be the second version of Project Spy .


This version appeared as Wabi Music , and copied a popular video-sharing social networking service as its backend login page .


In this second version , the developer ’ s name listed was “ concipit1248 ” in Google Play , and may have been active between May 2019 to February 2020 .


This app appears to have become unavailable on Google Play in March 2020 .


The second Project Spy version has similar capabilities to the first version , with the addition of the following : Stealing notification messages sent from WhatsApp , Facebook , and Telegram Abandoning the FTP mode of uploading the recorded images Aside from changing the app ’ s supposed function and look , the second and third versions ’ codes had little differences .


Potentially malicious iOS connection Using the codes and “ Concipit1248 ” to check for more versions , we found two other apps in the App Store .


Further analysis of the iOS app “ Concipit1248 ” showed that the server used , spy [ .


] cashnow [ .


] ee , is the same one used in the Android version of Project Spy .


However , although the “ Concipit1248 ” app requested permissions to open the device camera and read photos , the code only can upload a self-contained PNG file to a remote sever .


This may imply the “ Concipit1248 ” app is still incubating .


The other iOS app “ Concipit Shop ” from the same developer appeared normal and was last updated on November 2019 .


Apple has confirmed that the iOS apps are not functioning based on analysis of the codes , and stated that the sandbox is able to detect and block these malicious behaviors .


Conclusion The “ Corona Updates ” app had relatively low downloads in Pakistan , India , Afghanistan , Bangladesh , Iran , Saudi Arabia , Austria , Romania , Grenada , and Russia .


Perhaps the app ’ s false capabilities also fueled the low number of downloads .


It also appears the apps may still be in development or incubation , maybe waiting for a “ right time ” to inject the malicious codes .


It ’ s also possible that the apps are being used to test other possible techniques .


A possible indication for timing might be when the app reaches a specific number of downloads or infected devices .


The coding style suggests that the cybercriminals behind this campaign are amateurs .


The incomplete iOS codes used in this campaign may have been bought while other capabilities appear to have been added .


This may also explain the timing in between the apps becoming fully functional and “ incubation. ” As this is a group we have not observed before , we will continue monitoring this campaign for further developments .


Users are cautioned to research and check reviews before they download apps .


Observe and look at the app ’ s display and text , stated functions , reviews from other users , and requested permissions before downloading .


Make sure that all other apps installed and the device operating systems are updated to the latest version .


Indicators of Compromise ( IoCs ) SHA256 Detection e394e53e53cd9047d6cff184ac333ef7698a34b777ae3aac82c2c669ef661dfe AndroidOS_SpyAgent.HRXB e8d4713e43241ab09d40c2ae8814302f77de76650ccf3e7db83b3ac8ad41f9fa AndroidOS_ProjectSpy.HRX 29b0d86ae68d83f9578c3f36041df943195bc55a7f3f1d45a9c23f145d75af9d


AndroidOS_ProjectSpy.HRX 3a15e7b8f4e35e006329811a6a2bf291d449884a120332f24c7e3ca58d0fbbdb IOS_ProjectSpy.A URLs cashnow [ .


] ee Backend server ftp [ .


] XXXX [ .


] com Backend server spy [ .


] ee Backend server xyz [ .


] ee Backend server October 8 , 2020 Sophisticated new Android malware marks the latest evolution of mobile ransomware Attackers are persistent and motivated to continuously evolve – and no platform is immune .


That is why Microsoft has been working to extend its industry-leading endpoint protection capabilities beyond Windows .


The addition of mobile threat defense into these capabilities means that Microsoft Defender for Endpoint ( previously Microsoft Defender Advanced Threat Protection ) now delivers protection on all major platforms .


Microsoft ’ s mobile threat defense capabilities further enrich the visibility that organizations have on threats in their networks , as well as provide more tools to detect and respond to threats across domains and across platforms .


Like all of Microsoft ’ s security solutions , these new capabilities are likewise backed by a global network of threat researchers and security experts whose deep understanding of the threat landscape guide the continuous innovation of security features and ensure that customers are protected from ever-evolving threats .


For example , we found a piece of a particularly sophisticated Android ransomware with novel techniques and behavior , exemplifying the rapid evolution of mobile threats that we have also observed on other platforms .


The mobile ransomware , detected by Microsoft Defender for Endpoint as AndroidOS/MalLocker.B , is the latest variant of a ransomware family that ’ s been in the wild for a while but has been evolving non-stop .


This ransomware family is known for being hosted on arbitrary websites and circulated on online forums using various social engineering lures , including masquerading as popular apps , cracked games , or video players .


The new variant caught our attention because it ’ s an advanced malware with unmistakable malicious characteristic and behavior and yet manages to evade many available protections , registering a low detection rate against security solutions .


As with most Android ransomware , this new threat doesn ’ t actually block access to files by encrypting them .


Instead , it blocks access to devices by displaying a screen that appears over every other window , such that the user can ’ t do anything else .


The said screen is the ransom note , which contains threats and instructions to pay the ransom .


What ’ s innovative about this ransomware is how it displays its ransom note .


In this blog , we ’ ll detail the innovative ways in which this ransomware surfaces its ransom note using Android features we haven ’ t seen leveraged by malware before , as well as incorporating an open-source machine learning module designed for context-aware cropping of its ransom note .


New scheme , same goal In the past , Android ransomware used a special permission called “ SYSTEM_ALERT_WINDOW ” to display their ransom note .


Apps that have this permission can draw a window that belongs to the system group and can ’ t be dismissed .


No matter what button is pressed , the window stays on top of all other windows .


The notification was intended to be used for system alerts or errors , but Android threats misused it to force the attacker-controlled UI to fully occupy the screen , blocking access to the device .


Attackers create this scenario to persuade users to pay the ransom so they can gain back access to the device .


To catch these threats , security solutions used heuristics that focused on detecting this behavior .


Google later implemented platform-level changes that practically eliminated this attack surface .


These changes include : Removing the SYSTEM_ALERT_WINDOW error and alert window types , and introducing a few other types as replacement Elevating the permission status of SYSTEM_ALERT_WINDOW to special permission by putting it into the “ above dangerous ” category , which means that users have to go through many screens to approve apps that ask for permission , instead of just one click Introducing an overlay kill switch on Android 8.0 and later that users can activate anytime to deactivate a system alert window To adapt , Android malware evolved to misusing


other features , but these aren ’ t as effective .


For example , some strains of ransomware abuse accessibility features , a method that could easily alarm users because accessibility is a special permission that requires users to go through several screens and accept a warning that the app will be able to monitor activity via accessibility services .


Other ransomware families use infinite loops of drawing non-system windows , but in between drawing and redrawing , it ’ s possible for users to go to settings and uninstall the offending app .


The new Android ransomware variant overcomes these barriers by evolving further than any Android malware we ’ ve seen before .


To surface its ransom note , it uses a series of techniques that take advantage of the following components on Android : The “ call ” notification , among several categories of notifications that Android supports , which requires immediate user attention .


The “ onUserLeaveHint ( ) ” callback method of the Android Activity ( i.e. , the typical GUI screen the user sees ) is called as part of the activity lifecycle when the activity is about to go into the background as a result of user choice , for example , when the user presses the Home key .


The malware connects the dots and uses these two components to create a special type of notification that triggers the ransom screen via the callback .


As the code snippet shows , the malware creates a notification builder and then does the following : setCategory ( “ call ” ) – This means that the notification is built as a very important notification that needs special privilege .


setFullScreenIntent ( ) – This API wires the notification to a GUI so that it pops up when the user taps on it .


At this stage , half the job is done for the malware .


However , the malware wouldn ’ t want to depend on user interaction to trigger the ransomware screen , so , it adds another functionality of Android callback : As the code snippet shows , the malware overrides the onUserLeaveHint ( ) callback function of Activity class .


The function onUserLeaveHint ( ) is called whenever the malware screen is pushed to background , causing the in-call Activity to be automatically brought to the foreground .


Recall that the malware hooked the RansomActivity intent with the notification that was created as a “ call ” type notification .


This creates a chain of events that triggers the automatic pop-up of the ransomware screen without doing infinite redraw or posing as system window .


Machine learning module indicates continuous evolution As mentioned , this ransomware is the latest variant of a malware family that has undergone several stages of evolution .


The knowledge graph below shows the various techniques this ransomware family has been seen using , including abusing the system alert window , abusing accessibility features , and , more recently , abusing notification services .


This ransomware family ’ s long history tells us that its evolution is far from over .


We expect it to churn out new variants with even more sophisticated techniques .


In fact , recent variants contain code forked from an open-source machine learning module used by developers to automatically resize and crop images based on screen size , a valuable function given the variety of Android devices .


The frozen TinyML model is useful for making sure images fit the screen without distortion .


In the case of this ransomware , using the model would ensure that its ransom note—typically fake police notice or explicit images supposedly found on the device—would appear less contrived and more believable , increasing the chances of the user paying for the ransom .


The library that uses tinyML is not yet wired to the malware ’ s functionalities , but its presence in the malware code indicates the intention to do so in future variants .


We will continue to monitor this ransomware family to ensure customers are protected and to share our findings and insights to the community for broad protection against these evolving mobile threats .


Protecting organizations from threats across domains and platforms Mobile threats continue to rapidly evolve , with attackers continuously attempting to sidestep technological barriers and creatively find ways to accomplish their goal , whether financial gain or finding an entry point to broader network compromise .


This new mobile ransomware variant is an important discovery because the malware exhibits behaviors that have not been seen before and could open doors for other malware to follow .


It reinforces the need for comprehensive defense powered by broad visibility into attack surfaces as well as domain experts who track the threat landscape and uncover notable threats that might be hiding amidst massive threat data and signals .


Microsoft Defender for Endpoint on Android , now generally available , extends Microsoft ’ s industry-leading endpoint protection to Android .


It detects this ransomware ( AndroidOS/MalLocker.B ) , as well as other malicious apps and files using cloud-based protection powered by deep learning and heuristics , in addition to content-based detection .


It also protects users and organizations from other mobile threats , such as mobile phishing , unsafe network connections , and unauthorized access to sensitive data .


Learn more about our mobile threat defense capabilities in Microsoft Defender for Endpoint on Android .


Malware , phishing , and other threats detected by Microsoft Defender for Endpoint are reported to the Microsoft Defender Security Center , allowing SecOps to investigate mobile threats along with endpoint signals from Windows and other platforms using Microsoft Defender for Endpoint ’ s rich set of tools for detection , investigation , and response .


Threat data from endpoints are combined with signals from email and data , identities , and apps in Microsoft 365 Defender ( previously Microsoft Threat Protection ) , which orchestrates detection , prevention , investigation , and response across domains , providing coordinated defense .


Microsoft Defender for Endpoint on Android further enriches organizations ’ visibility into malicious activity , empowering them to comprehensively prevent , detect , and respond to against attack sprawl and cross-domain incidents .


Technical analysis Obfuscation On top of recreating ransomware behavior in ways we haven ’ t seen before , the Android malware variant uses a new obfuscation technique unique to the Android platform .


One of the tell-tale signs of an obfuscated malware is the absence of code that defines the classes declared in the manifest file .


The classes.dex has implementation for only two classes : The main application class gCHotRrgEruDv , which is involved when the application opens A helper class that has definition for custom encryption and decryption This means that there ’ s no code corresponding to the services declared in the manifest file : Main Activity , Broadcast Receivers , and Background .


How does the malware work without code for these key components ?


As is characteristic for obfuscated threats , the malware has encrypted binary code stored in the Assets folder : When the malware runs for the first time , the static block of the main class is run .


The code is heavily obfuscated and made unreadable through name mangling and use of meaningless variable names : Decryption with a twist The malware uses an interesting decryption routine : the string values passed to the decryption function do not correspond to the decrypted value , they correspond to junk code to simply hinder analysis .


On Android , an Intent is a software mechanism that allows users to coordinate the functions of different Activities to achieve a task .


It ’ s a messaging object that can be used to request an action from another app component .


The Intent object carries a string value as “ action ” parameter .


The malware creates an Intent inside the decryption function using the string value passed as the name for the Intent .


It then decrypts a hardcoded encrypted value and sets the “ action ” parameter of the Intent using the setAction API .


Once this Intent object is generated with the action value pointing to the decrypted content , the decryption function returns the Intent object to the callee .


The callee then invokes the getAction method to get the decrypted content .


Payload deployment Once the static block execution is complete , the Android Lifecycle callback transfers the control to the OnCreate method of the main class .


Malware code showing onCreate method Figure 9. onCreate method of the main class decrypting the payload Next , the malware-defined function decryptAssetToDex ( a meaningful name we assigned during analysis ) receives the string “ CuffGmrQRT ” as the first argument , which is the name of the encrypted file stored in the Assets folder .


Malware code showing decryption of assets Figure 10 .


Decrypting the assets After being decrypted , the asset turns into the .dex file .


This is a notable behavior that is characteristic of this ransomware family .


Comparison of code of Asset file before and after decryption Figure 11 .


Asset file before and after decryption Once the encrypted executable is decrypted and dropped in the storage , the malware has the definitions for all the components it declared in the manifest file .


It then starts the final detonator function to load the dropped .dex file into memory and triggers the main payload .


Malware code showing loading of decrypted dex file Figure 12 .


Loading the decrypted .dex file into memory and triggering the main payload Main payload When the main payload is loaded into memory , the initial detonator hands over the control to the main payload by invoking the method XoqF ( which we renamed to triggerInfection during analysis ) from the gvmthHtyN class ( renamed to PayloadEntry ) .


Malware code showing handover from initial module to main payload Figure 13 .


Handover from initial module to the main payload As mentioned , the initial handover component called triggerInfection with an instance of appObj and a method that returns the value for the variable config .


Malware code showing definition of populateConfigMap Figure 14 .


Definition of populateConfigMap , which loads the map with values Correlating the last two steps , one can observe that the malware payload receives the configuration for the following properties : number – The default number to be send to the server ( in case the number is not available from the device ) api – The API key url – The URL to be used in WebView to display on the ransom note The malware saves this configuration to the shared preferences of the app data and then it sets up all the Broadcast Receivers .


This action registers code components to get notified when certain system events happen .


This is done in the function initComponents .


Malware code showing initializing broadcast receiver Figure 15 .


Initializing the BroadcastReceiver against system events From this point on , the malware execution is driven by callback functions that are triggered on system events like connectivity change , unlocking the phone , elapsed time interval , and others .


Lookout researchers have identified a new , highly targeted surveillanceware family known as Desert Scorpion in the Google Play Store .


Lookout notified Google of the finding and Google removed the app immediately while also taking action on it in Google Play Protect .


The app ties together two malware families - Desert Scorpion and another targeted surveillanceware family named FrozenCell - that we believe are being developed by a single , evolving surveillanceware actor called APT-C-23 targeting individuals in the Middle East .


We 've seen this actor rely heavily on phishing campaigns to trick victims into downloading their malicious apps , specifically on Facebook .


Even sophisticated actors are using lower cost , less technologically impressive means like phishing to spread their malware because it 's cheap and very effective , especially on mobile devices where there are more ways to interact with a victim ( messaging apps , social media apps , etc .


) , and less screen real estate for victims to identify potential indicators of a threat .


Lookout customers are protected against this threat and additionally we have included a list of IOCs at the end of this report .


The potential actor and who they target Our current analysis strongly suggests Desert Scorpion is being deployed in targeted attacks against Middle Eastern individuals of interest specifically those in Palestine and has also been highlighted by other researchers .


We have been able to tie the malware to a long-running Facebook profile that we observed promoting the first stage of this family , a malicious chat application called Dardesh via links to Google Play .


The Lookout Threat Intelligence team identified that this same Facebook profile has also posted Google Drive links to Android malware belonging to the FrozenCell family attributed to APT-C-27 .


These factors , in combination with the fact that the command and control infrastructure used by Frozen Cell and Desert Scorpion resides in similar IP blocks , supports the theory that the same actor is responsible for operating , if not developing , both families .


What it does The surveillance functionality of Desert Scorpion resides in a second stage payload that can only be downloaded if the victim has downloaded , installed , and interacted with the first-stage chat application .


The chat application acts as a dropper for this second-stage payload app .


At the time of writing Lookout has observed two updates to the Dardesh application , the first on February 26 and the second on March 28 .


The malicious capabilities observed in the second stage include the following : Upload attacker-specified files to C2 servers Get list of installed applications Get device metadata Inspect itself to get a list of launchable activities Retrieves PDF , txt , doc , xls , xlsx , ppt , pptx files found on external storage Send SMS Retrieve text messages Track device location Handle limited attacker commands via out of band text messages Record surrounding audio Record calls Record video Retrieve account information such as email addresses Retrieve contacts Removes copies of itself if


any additional APKs are downloaded to external storage .


Call an attacker-specified number Uninstall apps Check if a device is rooted Hide its icon Retrieve list of files on external storage If running on a Huawei device it will attempt to add itself to the protected list of apps able to run with the screen off Encrypts some exfiltrated data Desert Scorpion 's second stage masquerades as a generic " settings '' application .


Curiously , several of these have included the world " Fateh '' in their package name , which may be referring to the Fatah political party .


Such references would be in line with FrozenCell 's phishing tactics in which they used file names to lure people associated with the political party to open malicious documents .


Desert Scorpion 's second stage is capable of installing another non-malicious application ( included in the second stage ) which is highly specific to the Fatah political party and supports the targeting theory .


The Lookout Threat Intelligence team is increasingly seeing the same tradecraft , tactics , and procedures that APT-C-23 favors being used by other actors .


The approach of separating malicious functionality out into separate stages that are later downloaded during execution and not present in the initial app published to the Google Play Store , combined with social engineering delivered via social media platforms like Facebook , requires minimal investment in comparison to premium tooling like Pegasus or FinFisher .


As we 've seen with actors like Dark Caracal , this low cost , low sophistication approach that relies heavily upon social engineering has still been shown to be highly successful for those operating such campaigns .


Given previous operational security errors from this actor in the past which resulted in exfiltrated content being publicly accessible Lookout Threat Intelligence is continuing to map out infrastructure and closely monitor their continued evolution .


Virulent Android malware returns , gets > 2 million downloads on Google Play HummingWhale is back with new tricks , including a way to gin user ratings .


DAN GOODIN - 1/23/2017 , 4:39 PM A virulent family of malware that infected more than 10 million Android devices last year has made a comeback , this time hiding inside Google Play apps that have been downloaded by as many as 12 million unsuspecting users .


HummingWhale , as the professionally developed malware has been dubbed , is a variant of HummingBad , the name given to a family of malicious apps researchers documented in July invading non-Google app markets .


HummingBad attempted to override security protections by exploiting unpatched vulnerabilities that gave the malware root privileges in older versions of Android .


Before Google shut it down , it installed more than 50,000 fraudulent apps each day , displayed 20 million malicious advertisements , and generated more than $ 300,000 per month in revenue .


Of the 10 million people who downloaded HummingBad-contaminated apps , an estimated 286,000 of them were located in the US .


HummingWhale , by contrast , managed to sneak its way into about 20 Google Play apps that were downloaded from 2 million to 12 million times , according to researchers from Check Point , the security company that has been closely following the malware family for almost a year .


Rather than rooting devices , the latest variant includes new virtual machine techniques that allow the malware to perform ad fraud better than ever , company researchers said in a blog post published Monday .


" Users must realize that they can no longer trust in installing only apps with a high reputation from official app stores as their sole defense , '' the researchers wrote in an e-mail to Ars .


" This malware employs several tactics to keep its activity hidden , meaning users might be unaware of its existence on their device .


'' As was the case with HummingBad , the purpose of HummingWhale is to generate revenue by displaying fraudulent ads and automatically installing apps .


When users try to close the ads , the new functionality causes already downloaded apps to run in a virtual machine .


That creates a fake ID that allows the perpetrators to generate referral revenues .


Use of the virtual machine brings many technical benefits to the operators , chief among them allowing the malware to install apps without requiring users to approve a list of elevated permissions .


Advertisement The VM also disguises the malicious activity , making it easier for the apps to infiltrate Google Play .


It has the added benefit of installing a nearly unlimited number of fraudulent apps without overloading the infected device .


Until now , Android malware that wanted advanced capabilities typically had to trick users into approving sometimes scary-sounding permissions or exploit rooting vulnerabilities .


Ginning the ratings FURTHER READING 1 million Google accounts compromised by Android malware called Gooligan To implement the VM feature , the malicious APK installation dropper used by HummingWhale uses DroidPlugin , an extension originally developed by developers from China-based company Qihoo 360 , Check Point said .


HummingWhale has also been observed hiding the original malicious app once it 's installed and trying to improve its Google Play reputation by automatically generating posts disguised as positive user comments and ratings .


Gooligan , a family of Android malware that came to light in November after it compromised more than 1 million Google accounts , contained similar abilities to tamper with Google Play ratings .


People who want to know if their Android devices are infected can download the Check Point app here .


A separate app from Check Point competitor Lookout also detects the threat as a variant of the Shedun malware family .


More technically inclined people can detect infections by seeing if a device connects to a control server located at app.blinkingcamera.com .


Package names for infected apps typically contain a common naming structure that includes com.XXXXXXXXX.camera , for example com.bird.sky.whale.camera ( app name : Whale Camera ) , com.color.rainbow.camera ( Rainbow Camera ) , and com.fishing.when.orangecamera ( Orange Camera ) .


Google officials removed the malicious apps from the Play market after receiving a private report of their existence .


A company representative declined to comment for this post .


BusyGasper – the unfriendly spy 29 AUG 2018 In early 2018 our mobile intruder-detection technology was triggered by a suspicious Android sample that , as it turned out , belonged to an unknown spyware family .


Further investigation showed that the malware , which we named BusyGasper , is not all that sophisticated , but demonstrates some unusual features for this type of threat .


From a technical point of view , the sample is a unique spy implant with stand-out features such as device sensors listeners , including motion detectors that have been implemented with a degree of originality .


It has an incredibly wide-ranging protocol – about 100 commands – and an ability to bypass the Doze battery saver .


As a modern Android spyware it is also capable of exfiltrating data from messaging applications ( WhatsApp , Viber , Facebook ) .


Moreover , BusyGasper boasts some keylogging tools – the malware processes every user tap , gathering its coordinates and calculating characters by matching given values with hardcoded ones .


The sample has a multicomponent structure and can download a payload or updates from its C & C server , which happens to be an FTP server belonging to the free Russian web hosting service Ucoz .


It is noteworthy that BusyGasper supports the IRC protocol which is rarely seen among Android malware .


In addition , the malware can log in to the attacker ’ s email inbox , parse emails in a special folder for commands and save any payloads to a device from email attachments .


This particular operation has been active since approximately May 2016 up to the present time .


Infection vector and victims While looking for the infection vector , we found no evidence of spear phishing or any of the other common vectors .


But some clues , such as the existence of a hidden menu for operator control , point to a manual installation method – the attackers used physical access to a victim ’ s device to install the malware .


This would explain the number of victims – there are less than 10 of them and according to our detection statistics , they are all located in the Russia .


Intrigued , we continued our search and found more interesting clues that could reveal some detailed information about the owners of the infected devices .


Several TXT files with commands on the attacker ’ s FTP server contain a victim identifier in the names that was probably added by the criminals : CMDS10114-Sun1.txt CMDS10134-Ju_ASUS.txt CMDS10134-Tad.txt CMDS10166-Jana.txt CMDS10187-Sun2.txt CMDS10194-SlavaAl.txt CMDS10209-Nikusha.txt Some of them sound like Russian names : Jana , SlavaAl , Nikusha .


As we know from the FTP dump analysis , there was a firmware component from ASUS firmware , indicating the attacker ’ s interest in ASUS devices , which explains the victim file name that mentions “ ASUS ” .


Information gathered from the email account provides a lot of the victims ’ personal data , including messages from IM applications .


Gathered file Type Description lock Text Implant log ldata sqlite3 Location data based on network ( cell_id ) gdata sqlite3 Location data based on GPS coordinates sdata sqlite3 SMS messages f.db sqlite3 Facebook messages v.db sqlite3 Viber messages w.db sqlite3 WhatsApp messages Among the other data gathered were SMS banking messages that revealed an account with a balance of more than US $ 10,000.But as far as we know , the attacker behind this campaign is not interested in stealing the victims ’ money


We found no similarities to commercial spyware products or to other known spyware variants , which suggests BusyGasper is self-developed and used by a single threat actor .


At the same time , the lack of encryption , use of a public FTP server and the low opsec level could indicate that less skilled attackers are behind the malware .


Technical details Here is the meta information for the observed samples , certificates and hardcoded version stamps : Certificate MD5 Module Version Serial Number : 0x76607c02 Issuer : CN=Ron Validity : from = Tue Aug 30 13:01:30 MSK 2016 to = Sat Aug 24 13:01:30 MSK 2041 Subject : CN=Ron 9e005144ea1a583531f86663a5f14607 1 – 18abe28730c53de6d9e4786c7765c3d8 2 2.0


Serial Number : 0x6a0d1fec Issuer : CN=Sun Validity : from = Mon May 16 17:42:40 MSK 2016 to = Fri May 10 17:42:40 MSK 2041 Subject : CN=Sun 9ffc350ef94ef840728564846f2802b0 2 v2.51sun 6c246bbb40b7c6e75c60a55c0da9e2f2 2 v2.96s 7c8a12e56e3e03938788b26b84b80bd6 2 v3.09s


bde7847487125084f9e03f2b6b05adc3 2 v3.12s 2560942bb50ee6e6f55afc495d238a12 2 v3.18s It ’ s interesting that the issuer “ Sun ” matches the “ Sun1 ” and “ Sun2 ” identifiers of infected devices from the FTP server , suggesting they may be test devices .


The analyzed implant has a complex structure , and for now we have observed two modules .


First ( start ) module The first module , which was installed on the targeted device , could be controlled over the IRC protocol and enable deployment of other components by downloading a payload from the FTP server : @ install command As can be seen from the screenshot above , a new component was copied in the system path , though that sort of operation is impossible without root privileges .


At the time of writing we had no evidence of an exploit being used to obtain root privileges , though it is possible that the attackers used some unseen component to implement this feature .


Here is a full list of possible commands that can be executed by the first module : Command name Description @ stop Stop IRC @ quit System.exit ( 0 ) @ start Start IRC @ server Set IRC server ( default value is “ irc.freenode.net ” ) , port is always 6667 @ boss Set IRC command and control nickname ( default value is “ ISeency ” ) @ nick Set IRC client nickname @ screen Report every time when screen is on ( enable/disable ) @ root Use root features ( enable/disable ) @ timer Set


period of IRCService start @ hide Hide implant icon @ unhide Unhide implant icon @ run Execute specified shell @ broadcast Send command to the second module @ echo Write specified message to log @ install Download and copy specified component to the system path The implant uses a complex intent-based communication mechanism between its components to broadcast commands : Approximate graph of relationships between BusyGasper components Second ( main ) module This module writes a log of the command execution history to the file named “ lock ” , which is later exfiltrated


Below is a fragment of such a log : Log with specified command Log files can be uploaded to the FTP server and sent to the attacker ’ s email inbox .


It ’ s even possible to send log messages via SMS to the attacker ’ s number .


As the screenshot above shows , the malware has its own command syntax that represents a combination of characters while the “ # ” symbol is a delimiter .


A full list of all possible commands with descriptions can be found in Appendix II below .


The malware has all the popular capabilities of modern spyware .


Below is a description of the most noteworthy : The implant is able to spy on all available device sensors and to log registered events .


Moreover , there is a special handler for the accelerometer that is able to calculate and log the device ’ s speed : This feature is used in particular by the command “ tk0 ” that mutes the device , disables keyguard , turns off the brightness , uses wakelock and listens to device sensors .


This allows it to silently execute any backdoor activity without the user knowing that the device is in an active state .


As soon as the user picks up the device , the implant will detect a motion event and execute the “ tk1 ” and “ input keyevent 3 ” commands .


“ tk1 ” will disable all the effects of the “ tk0 ” command , while “ input keyevent 3 ” is the shell command that simulates the pressing of the ‘ home ’ button so all the current activities will be minimized and the user won ’ t suspect anything .


Location services to enable ( GPS/network ) tracking : The email command and control protocol .


The implant can log in to the attackers email inbox , parse emails for commands in a special “ Cmd ” folder and save any payloads to a device from email attachments .


Accessing the “ Cmd ” folder in the attacker ’ s email box Moreover , it can send a specified file or all the gathered data from the victim device via email .


Emergency SMS commands .


If an incoming SMS contains one of the following magic strings : ” 2736428734″ or ” 7238742800″ the malware will execute multiple initial commands : Keylogger implementation Keylogging is implemented in an original manner .


Immediately after activation , the malware creates a textView element in a new window with the following layout parameters : All these parameters ensure the element is hidden from the user .


Then it adds onTouchListener to this textView and is able to process every user tap .


Interestingly , there is an allowlist of tapped activities : ui.ConversationActivity ui.ConversationListActivity SemcInCallScreen Quadrapop SocialPhonebookActivity The listener can operate with only coordinates , so it calculates pressed characters by matching given values with hardcoded ones : Additionally , if there is a predefined command , the keylogger can make a screenshot of the tapped display area : Manual access and operator menu There is a hidden menu ( Activity ) for controlling implant features that


looks like it was created for manual operator control .


To activate this menu the operator needs to call the hardcoded number “ 9909 ” from the infected device : A hidden menu then instantly appears on the device display : The operator can use this interface to type any command for execution .


It also shows a current malware log .


Infrastructure FTP server The attackers used ftp : //213.174.157 [ .


] 151/ as a command and control server .


The IP belongs to the free Russian web hosting service Ucoz .


Files Description CMDS * .txt Text files with commands to execute supersu.apk SuperSU ( eu.chainfire.supersu , https : //play.google.com/store/apps/details ?


id=eu.chainfire.supersu ) tool 246.us us.x SuperSU ELF binaries supersu.cfg supersu.cfg.ju supersu.cfg.old SuperSU configs with spyware implant mention bb.txt BusyBox v1.26.2 ELF file bdata.xml Config file for excluding malware components from Android battery saver feature Doze bdatas.apk Main implant module com.android.network.irc.apk Start implant module MobileManagerService.apk ASUS firmware system component ( clean ) mobilemanager.apk


Corrupted archive privapp.txt Looks like a list of system applications ( including spyware components ) from the infected device run-as.x run-as.y Run-as tool ELF file SuperSU config fragment for implant components and the busybox tool supersu.cfg : This config allows the implant to use all root features silently .


Content of bdata.xml file : It can be added to the /system/etc/sysconfig/ path to allowlist specified implant components from the battery saving system .


Email account A Gmail account with password is mentioned in the sample ’ s code : It contains the victim ’ s exfiltrated data and “ cmd ” directory with commands for victim devices .


10 million Android phones infected by all-powerful auto-rooting apps First detected in November , Shedun/HummingBad infections are surging .


7/7/2016 , 1:50 PM Security experts have documented a disturbing spike in a particularly virulent family of Android malware , with more than 10 million handsets infected and more than 286,000 of them in the US .


FURTHER READING New type of auto-rooting Android adware is nearly impossible to remove Researchers from security firm Check Point Software said the malware installs more than 50,000 fraudulent apps each day , displays 20 million malicious advertisements , and generates more than $ 300,000 per month in revenue .


The success is largely the result of the malware 's ability to silently root a large percentage of the phones it infects by exploiting vulnerabilities that remain unfixed in older versions of Android .


The Check Point researchers have dubbed the malware family " HummingBad , '' but researchers from mobile security company Lookout say HummingBad is in fact Shedun , a family of auto-rooting malware that came to light last November and had already infected a large number of devices .


Update Jul 11 2016 8:32 : On Monday , a Checkpoint representative disputed Lookout 's contention and pointed to this blog post from security firm Eleven Paths as support .


The blog post said HummingBad " uses a completely different infrastructure with little in common '' with Shedun .


In an e-mail , a Lookout representative stood by its analysis and said company researchers planned to publish an in-depth response in the coming days .


For the past five months , Check Point researchers have quietly observed the China-based advertising company behind HummingBad in several ways , including by infiltrating the command and control servers it uses .


The researchers say the malware uses the unusually tight control it gains over infected devices to create windfall profits and steadily increase its numbers .


HummingBad does this by silently installing promoted apps on infected phones , defrauding legitimate mobile advertisers , and creating fraudulent statistics inside the official Google Play Store .


" Accessing these devices and their sensitive data creates a new and steady stream of revenue for cybercriminals , '' Check Point researchers wrote in a recently published report .


" Emboldened by financial and technological independence , their skillsets will advance–putting end users , enterprises , and government agencies at risk .


'' The report said HummingBad apps are developed by Yingmob , a Chinese mobile ad server company that other researchers claim is behind the Yinspector iOS malware .


HummingBad sends notifications to Umeng , a tracking and analytics service attackers use to manage their campaign .


Check Point analyzed Yingmob ’ s Umeng account to gain further insights into the HummingBad campaign and found that beyond the 10 million devices under the control of malicious apps , Yingmob has non-malicious apps installed on another 75 million or so devices .


The researchers wrote : While profit is powerful motivation for any attacker , Yingmob ’ s apparent self-sufficiency and organizational structure make it well-positioned to expand into new business ventures , including productizing the access to the 85 million Android devices it controls .


This alone would attract a whole new audience–and a new stream of revenue–for Yingmob .


Quick , easy access to sensitive data on mobile devices connected to enterprises and government agencies around the globe is extremely attractive to cybercriminals and hacktivists .


Drive-by downloads and multiple rooting exploits The malware uses a variety of methods to infect devices .


One involves drive-by downloads , possibly on booby-trapped porn sites .


The attacks use multiple exploits in an attempt to gain root access on a device .


When rooting fails , a second component delivers a fake system update notification in hopes of tricking users into granting HummingBad system-level permissions .


Whether or not rooting succeeds , HummingBad downloads a large number of apps .


In some cases , malicious components are dynamically downloaded onto a device after an infected app is installed .


From there , infected phones display illegitimate ads and install fraudulent apps after certain events , such as rebooting , the screen turning on or off , a detection that the user is present , or a change in Internet connectivity .


HummingBad also has the ability to inject code into Google Play to tamper with its ratings and statistics .


It does this by using infected devices to imitate clicks on the install , buy , and accept buttons .


Many of the 10 million infected phones are running old versions of Android and reside in China ( 1.6 million ) and India ( 1.35 million ) .


Still , US-based infected phones total almost 287,000 .


The most widely infected major Android versions are KitKat with 50 percent , followed by Jelly Bean with 40 percent .


Lollipop has 7 percent , Ice Cream Sandwich has 2 percent , and Marshmallow has 1 percent .


It 's often hard for average users to know if their phones have been rooted , and Shedun apps often wait some period of time before displaying obtrusive ads or installing apps .


The best bet for Readers who want to make sure their phone is n't infected is to scan their phones using the free version of the Lookout Security and Antivirus app .


Android malware has drastically lower rates of success when app installations outside of Google Play are barred .


Readers should carefully think through the risks before changing this default setting .


Top 20 countries targeted by Hummingbad/Shedun .


Enlarge / Top 20 countries targeted by Hummingbad/Shedun .


Check Point Software Hummingbad/Shedun infections by Android version .


Enlarge / Hummingbad/Shedun infections by Android version .


Check Point Software So far , HummingBad has been observed using its highly privileged status only to engage in click fraud , display pop-up ads , tamper with Google Play , and install additional apps that do more of the same .


But there 's little stopping it from doing much worse .


That 's because the malware roots most of the phones it infects , a process that subverts key security mechanisms built into Android .


Under a model known as sandboxing , most Android apps are n't permitted to access passwords or other data available to most other apps .


System applications with root , by contrast , have super-user permissions that allow them to break out of such sandboxes .


From there , root-level apps can read or modify data and resources that would be off-limits to normal apps .


As Lookout first reported more than eight months ago , the problem with Shedun/HummingBad and similar malicious app families that silently exploit Android rooting vulnerabilities is that the infections can survive normal factory resets .


Lookout said in its own blog post published Wednesday that its threat detection network has recently observed a surge of Shedun attacks , indicating the scourge wo n't be going away any time soon .


An investigation of Chrysaor Malware on Android 03 April 2017 Google is constantly working to improve our systems that protect users from Potentially Harmful Applications ( PHAs ) .


Usually , PHA authors attempt to install their harmful apps on as many devices as possible .


However , a few PHA authors spend substantial effort , time , and money to create and install their harmful app on one or a very small number of devices .


This is known as a targeted attack .


In this blog post , we describe Chrysaor , a newly discovered family of spyware that was used in a targeted attack on a small number of Android devices , and how investigations like this help Google protect Android users from a variety of threats .


What is Chrysaor ?


Chrysaor is spyware believed to be created by NSO Group Technologies , specializing in the creation and sale of software and infrastructure for targeted attacks .


Chrysaor is believed to be related to the Pegasus spyware that was first identified on iOS and analyzed by Citizen Lab and Lookout .


Late last year , after receiving a list of suspicious package names from Lookout , we discovered that a few dozen Android devices may have installed an application related to Pegasus , which we named Chrysaor .


Although the applications were never available in Google Play , we immediately identified the scope of the problem by using Verify Apps .


We gathered information from affected devices , and concurrently , attempted to acquire Chrysaor apps to better understand its impact on users .


We 've contacted the potentially affected users , disabled the applications on affected devices , and implemented changes in Verify Apps to protect all users .


What is the scope of Chrysaor ?