Mobile

11/15/2017
04:45 PM
50%
50%

Stealthy Android Malware Found in Google Play

Eight apps found infected with a new Trojan family that ups the ante in obfuscation with four payload stages.

A sneaky new Android Trojan family employs four payload stages in its attack rather than the more typical two stages, researchers say.

The Android/TrojanDropper.Agent.BKY family was found in at least eight apps in Google Play so far, but the damage has been limited. Each of the apps only had a few hundred downloads before Google pulled them from the store, according to ESET, which discovered the malware family and notified Google.

The attack's use of four payload stages before delivering its final nastiness, a mobile banking Trojan, is rare. "Two-stage payloads are really common in the Android ecosystem. Four-stage malware on Google Play isn't so common," observes Lukas Stefanko, an ESET malware researcher.

With more payload stages, attackers are able to deeply hide the true intent of their payload.

"This one added some extra obfuscating layers - dropper and decryptor, plus a downloader - to hide its malicious purpose," Stefanko explains.

The Attack

Once a user launches the app, it initially behaves like a legitimate app by mimicking its advertised functions and withholding suspicious permission requests. The first stage calls for the malicious app to decrypt and execute the second-stage payload. Both steps are invisible to users.

Inside the second-stage payload is a hardcoded URL, which then downloads another malicious app or third payload. App users are prompted to install this bogus but legitimate-looking app. In some cases, it's disguised as an Adobe Flash Player or Android update.

"Once they see a request to install the third stage payload, it should become a bit suspicious for users," Stefanko notes.

After the third payload, or app, has all its requested permissions granted, it will decrypt and execute the fourth and final payload – a mobile banking Trojan. The malicious app will take users to a bogus login form to steal their credentials or credit card details, according to ESET's report.

One of the malicious apps ESET reviewed had 3,000 downloaded links, with the vast majority of the victims coming from the Netherlands.

Although the Android/TrojanDropper.Agent.BKY samples ESET came across were banking Trojans or spyware, the downloader could be any nefarious piece of code that the attacker wants, the researchers say.

ESET came across the Android/TrojanDropper.Agent.BKY family in late September when its systems detected the apps dropping payloads in an unusual way. For now, it is not clear who is behind these attacks, Stefanko says.

Related Content:

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
kevinsmart051
50%
50%
kevinsmart051,
User Rank: Apprentice
11/21/2017 | 6:38:55 AM
Permissions...
Is there any way to make sure revoke access to the vulnerable parts of my smartphone (like calendar, contacts, msg, email/sms sending etc.)? Because nearly every app asks for those permissions and I'm not comfortable with granting them to each and every Candy Crush clone...

Regards,

Mark
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14633
PUBLISHED: 2018-09-25
A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The at...
CVE-2018-14647
PUBLISHED: 2018-09-25
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming larg...
CVE-2018-10502
PUBLISHED: 2018-09-24
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exist...
CVE-2018-11614
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists wit...
CVE-2018-14318
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is required to exploit this vulnerability in that the target must have their cellular radios enabled. The specific flaw exists within the handling of ...