Vulnerabilities / Threats
2/19/2016
03:50 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

New Trojan Xbot A Swiss-Army Knife Of Malicious Features

Malware can steal banking and card info, encrypt SD cards, intercept messages and more, say researchers at Palo Alto Networks

The creators of a new Android Trojan dubbed Xbot that has begun targeting victims in Australia and Russia appear to have throw in everything but the kitchen sink into the malware.

Security vendor Palo Alto Networks, which sounded the alert on it this week, described Xbot as capable of taking a variety of malicious actions, including stealing banking credentials and credit card data, remotely locking Android devices, encrypting data on external storage, and asking for ransom.

Xbot can also steal SMS messages and contact information from Android devices that it infects, intercept SMS messages before they hit the device, and extract the mobile transaction authentication numbers that banks sometimes require when logging into accounts.

So far, the malware appears to be targeting only Android users in Australia and Russia. The phishing pages that Xbot uses to try and trick victims into sharing bank account information and credit card data are designed to spoof the login pages of mobile apps belonging to seven major banks, six of which are based in Australia.

But the manner in which it is designed and the fact that new features are still being added to the malware suggest that Xbot can be easily repurposed to attack other targets, Palo Alto said. According to security researchers at the company, the malware could soon pose a problem for Android users everywhere.

Once installed on a system, Xbot connects with a command-and-control server and launches phishing attacks when a user interacts with Google Play or any of the banking apps on its target list. The pages are very convincing-looking fakes of the real Google Play interface for collecting card information and of the login pages of the banks.

The remote command-and-control server is designed to send a variety of instructions to Xbot, including those that ask the malware to turn the device into silent mode to change its password and to encrypt data on the phone’s external storage devices, like an SD card. The malware can serve up a ransom note and prevent users from exiting the screen. Though the note claims the encryption is unbreakable, in reality it can be easily overcome, the Palo Alto researchers said.

Like many other malware samples floating in the wild, Xbot too borrows its design and behavior from previous malware tools. The security researchers believe that Xbot is a successor to Aulrin, an equally nasty piece of malware that first surfaced in 2014 and featured many of the same capabilities present in Xbot. “The earliest sample of Xbot we found was compiled in May 2015 and while comparing Xbot to Aulrin, it seemed to us the author re-wrote Aulrin using a different language and framework,” Palo Alto researchers Cong Zheng, Zhi Xu and Claud Xiao said in their alert.

In the process, the author or authors of Xbot have also made it more complex, the researchers said. For example, the most recent versions of Xbot integrate an obfuscation tool called Dexguard that is legitimately used to prevent Android apps from being reverse-engineered.

For the moment at least, it is not entirely clear how Xbot is being distributed. But samples of it have been seen on a handful of URLs for several months, the researchers said.

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Cybersecurity's 'Broken' Hiring Process
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/11/2017
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What did you expect from this SOC? A unicorn....
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.