Vulnerabilities / Threats

2/19/2016
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trojan Xbot A Swiss-Army Knife Of Malicious Features

Malware can steal banking and card info, encrypt SD cards, intercept messages and more, say researchers at Palo Alto Networks

The creators of a new Android Trojan dubbed Xbot that has begun targeting victims in Australia and Russia appear to have throw in everything but the kitchen sink into the malware.

Security vendor Palo Alto Networks, which sounded the alert on it this week, described Xbot as capable of taking a variety of malicious actions, including stealing banking credentials and credit card data, remotely locking Android devices, encrypting data on external storage, and asking for ransom.

Xbot can also steal SMS messages and contact information from Android devices that it infects, intercept SMS messages before they hit the device, and extract the mobile transaction authentication numbers that banks sometimes require when logging into accounts.

So far, the malware appears to be targeting only Android users in Australia and Russia. The phishing pages that Xbot uses to try and trick victims into sharing bank account information and credit card data are designed to spoof the login pages of mobile apps belonging to seven major banks, six of which are based in Australia.

But the manner in which it is designed and the fact that new features are still being added to the malware suggest that Xbot can be easily repurposed to attack other targets, Palo Alto said. According to security researchers at the company, the malware could soon pose a problem for Android users everywhere.

Once installed on a system, Xbot connects with a command-and-control server and launches phishing attacks when a user interacts with Google Play or any of the banking apps on its target list. The pages are very convincing-looking fakes of the real Google Play interface for collecting card information and of the login pages of the banks.

The remote command-and-control server is designed to send a variety of instructions to Xbot, including those that ask the malware to turn the device into silent mode to change its password and to encrypt data on the phone’s external storage devices, like an SD card. The malware can serve up a ransom note and prevent users from exiting the screen. Though the note claims the encryption is unbreakable, in reality it can be easily overcome, the Palo Alto researchers said.

Like many other malware samples floating in the wild, Xbot too borrows its design and behavior from previous malware tools. The security researchers believe that Xbot is a successor to Aulrin, an equally nasty piece of malware that first surfaced in 2014 and featured many of the same capabilities present in Xbot. “The earliest sample of Xbot we found was compiled in May 2015 and while comparing Xbot to Aulrin, it seemed to us the author re-wrote Aulrin using a different language and framework,” Palo Alto researchers Cong Zheng, Zhi Xu and Claud Xiao said in their alert.

In the process, the author or authors of Xbot have also made it more complex, the researchers said. For example, the most recent versions of Xbot integrate an obfuscation tool called Dexguard that is legitimately used to prevent Android apps from being reverse-engineered.

For the moment at least, it is not entirely clear how Xbot is being distributed. But samples of it have been seen on a handful of URLs for several months, the researchers said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
'Hidden Tunnels' Help Hackers Launch Financial Services Attacks
Kelly Sheridan, Staff Editor, Dark Reading,  6/20/2018
Inside a SamSam Ransomware Attack
Ajit Sancheti, CEO and Co-Founder, Preempt,  6/20/2018
Tesla Employee Steals, Sabotages Company Data
Jai Vijayan, Freelance writer,  6/19/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12716
PUBLISHED: 2018-06-25
The API service on Google Home and Chromecast devices before mid-July 2018 does not prevent DNS rebinding attacks from reading the scan_results JSON data, which allows remote attackers to determine the physical location of most web browsers by leveraging the presence of one of these devices on its l...
CVE-2018-12705
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have XSS via the SSID (it is validated only on the client side).
CVE-2018-12706
PUBLISHED: 2018-06-24
DIGISOL DG-BR4000NG devices have a Buffer Overflow via a long Authorization HTTP header.
CVE-2018-12714
PUBLISHED: 2018-06-24
An issue was discovered in the Linux kernel through 4.17.2. The filter parsing in kernel/trace/trace_events_filter.c could be called with no filter, which is an N=0 case when it expected at least one line to have been read, thus making the N-1 index invalid. This allows attackers to cause a denial o...
CVE-2018-12713
PUBLISHED: 2018-06-24
GIMP through 2.10.2 makes g_get_tmp_dir calls to establish temporary filenames, which may result in a filename that already exists, as demonstrated by the gimp_write_and_read_file function in app/tests/test-xcf.c. This might be leveraged by attackers to overwrite files or read file content that was ...