Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/15/2017
04:45 PM
50%
50%

Stealthy Android Malware Found in Google Play

Eight apps found infected with a new Trojan family that ups the ante in obfuscation with four payload stages.

A sneaky new Android Trojan family employs four payload stages in its attack rather than the more typical two stages, researchers say.

The Android/TrojanDropper.Agent.BKY family was found in at least eight apps in Google Play so far, but the damage has been limited. Each of the apps only had a few hundred downloads before Google pulled them from the store, according to ESET, which discovered the malware family and notified Google.

The attack's use of four payload stages before delivering its final nastiness, a mobile banking Trojan, is rare. "Two-stage payloads are really common in the Android ecosystem. Four-stage malware on Google Play isn't so common," observes Lukas Stefanko, an ESET malware researcher.

With more payload stages, attackers are able to deeply hide the true intent of their payload.

"This one added some extra obfuscating layers - dropper and decryptor, plus a downloader - to hide its malicious purpose," Stefanko explains.

The Attack

Once a user launches the app, it initially behaves like a legitimate app by mimicking its advertised functions and withholding suspicious permission requests. The first stage calls for the malicious app to decrypt and execute the second-stage payload. Both steps are invisible to users.

Inside the second-stage payload is a hardcoded URL, which then downloads another malicious app or third payload. App users are prompted to install this bogus but legitimate-looking app. In some cases, it's disguised as an Adobe Flash Player or Android update.

"Once they see a request to install the third stage payload, it should become a bit suspicious for users," Stefanko notes.

After the third payload, or app, has all its requested permissions granted, it will decrypt and execute the fourth and final payload – a mobile banking Trojan. The malicious app will take users to a bogus login form to steal their credentials or credit card details, according to ESET's report.

One of the malicious apps ESET reviewed had 3,000 downloaded links, with the vast majority of the victims coming from the Netherlands.

Although the Android/TrojanDropper.Agent.BKY samples ESET came across were banking Trojans or spyware, the downloader could be any nefarious piece of code that the attacker wants, the researchers say.

ESET came across the Android/TrojanDropper.Agent.BKY family in late September when its systems detected the apps dropping payloads in an unusual way. For now, it is not clear who is behind these attacks, Stefanko says.

Related Content:

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
kevinsmart051
50%
50%
kevinsmart051,
User Rank: Apprentice
11/21/2017 | 6:38:55 AM
Permissions...
Is there any way to make sure revoke access to the vulnerable parts of my smartphone (like calendar, contacts, msg, email/sms sending etc.)? Because nearly every app asks for those permissions and I'm not comfortable with granting them to each and every Candy Crush clone...

Regards,

Mark
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/28/2020
The Problem with Artificial Intelligence in Security
Dr. Leila Powell, Lead Security Data Scientist, Panaseer,  5/26/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13693
PUBLISHED: 2020-05-29
An unauthenticated privilege-escalation issue exists in the bbPress plugin before 2.6.5 for WordPress when New User Registration is enabled.
CVE-2020-13173
PUBLISHED: 2020-05-28
Initialization of the pcoip_credential_provider in Teradici PCoIP Standard Agent for Windows and PCoIP Graphics Agent for Windows versions 19.11.1 and earlier creates an insecure named pipe, which allows an attacker to intercept sensitive information or possibly elevate privileges via pre-installing...
CVE-2019-6342
PUBLISHED: 2020-05-28
An access bypass vulnerability exists when the experimental Workspaces module in Drupal 8 core is enabled. This can be mitigated by disabling the Workspaces module. It does not affect any release other than Drupal 8.7.4.
CVE-2020-11082
PUBLISHED: 2020-05-28
In Kaminari before 1.2.1, there is a vulnerability that would allow an attacker to inject arbitrary code into pages with pagination links. This has been fixed in 1.2.1.
CVE-2020-5357
PUBLISHED: 2020-05-28
Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerability is limited to the Dell Dock Firmware Update Utilities during the time window while being executed by an administrator. During this time wi...