Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/15/2017
04:45 PM
50%
50%

Stealthy Android Malware Found in Google Play

Eight apps found infected with a new Trojan family that ups the ante in obfuscation with four payload stages.

A sneaky new Android Trojan family employs four payload stages in its attack rather than the more typical two stages, researchers say.

The Android/TrojanDropper.Agent.BKY family was found in at least eight apps in Google Play so far, but the damage has been limited. Each of the apps only had a few hundred downloads before Google pulled them from the store, according to ESET, which discovered the malware family and notified Google.

The attack's use of four payload stages before delivering its final nastiness, a mobile banking Trojan, is rare. "Two-stage payloads are really common in the Android ecosystem. Four-stage malware on Google Play isn't so common," observes Lukas Stefanko, an ESET malware researcher.

With more payload stages, attackers are able to deeply hide the true intent of their payload.

"This one added some extra obfuscating layers - dropper and decryptor, plus a downloader - to hide its malicious purpose," Stefanko explains.

The Attack

Once a user launches the app, it initially behaves like a legitimate app by mimicking its advertised functions and withholding suspicious permission requests. The first stage calls for the malicious app to decrypt and execute the second-stage payload. Both steps are invisible to users.

Inside the second-stage payload is a hardcoded URL, which then downloads another malicious app or third payload. App users are prompted to install this bogus but legitimate-looking app. In some cases, it's disguised as an Adobe Flash Player or Android update.

"Once they see a request to install the third stage payload, it should become a bit suspicious for users," Stefanko notes.

After the third payload, or app, has all its requested permissions granted, it will decrypt and execute the fourth and final payload – a mobile banking Trojan. The malicious app will take users to a bogus login form to steal their credentials or credit card details, according to ESET's report.

One of the malicious apps ESET reviewed had 3,000 downloaded links, with the vast majority of the victims coming from the Netherlands.

Although the Android/TrojanDropper.Agent.BKY samples ESET came across were banking Trojans or spyware, the downloader could be any nefarious piece of code that the attacker wants, the researchers say.

ESET came across the Android/TrojanDropper.Agent.BKY family in late September when its systems detected the apps dropping payloads in an unusual way. For now, it is not clear who is behind these attacks, Stefanko says.

Related Content:

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
kevinsmart051
50%
50%
kevinsmart051,
User Rank: Apprentice
11/21/2017 | 6:38:55 AM
Permissions...
Is there any way to make sure revoke access to the vulnerable parts of my smartphone (like calendar, contacts, msg, email/sms sending etc.)? Because nearly every app asks for those permissions and I'm not comfortable with granting them to each and every Candy Crush clone...

Regards,

Mark
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19642
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
CVE-2019-19637
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19638
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.
CVE-2019-19635
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function sixel_decode_raw_impl at fromsixel.c.
CVE-2019-19636
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_encode_body at tosixel.c.