Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/15/2017
04:45 PM
50%
50%

Stealthy Android Malware Found in Google Play

Eight apps found infected with a new Trojan family that ups the ante in obfuscation with four payload stages.

A sneaky new Android Trojan family employs four payload stages in its attack rather than the more typical two stages, researchers say.

The Android/TrojanDropper.Agent.BKY family was found in at least eight apps in Google Play so far, but the damage has been limited. Each of the apps only had a few hundred downloads before Google pulled them from the store, according to ESET, which discovered the malware family and notified Google.

The attack's use of four payload stages before delivering its final nastiness, a mobile banking Trojan, is rare. "Two-stage payloads are really common in the Android ecosystem. Four-stage malware on Google Play isn't so common," observes Lukas Stefanko, an ESET malware researcher.

With more payload stages, attackers are able to deeply hide the true intent of their payload.

"This one added some extra obfuscating layers - dropper and decryptor, plus a downloader - to hide its malicious purpose," Stefanko explains.

The Attack

Once a user launches the app, it initially behaves like a legitimate app by mimicking its advertised functions and withholding suspicious permission requests. The first stage calls for the malicious app to decrypt and execute the second-stage payload. Both steps are invisible to users.

Inside the second-stage payload is a hardcoded URL, which then downloads another malicious app or third payload. App users are prompted to install this bogus but legitimate-looking app. In some cases, it's disguised as an Adobe Flash Player or Android update.

"Once they see a request to install the third stage payload, it should become a bit suspicious for users," Stefanko notes.

After the third payload, or app, has all its requested permissions granted, it will decrypt and execute the fourth and final payload – a mobile banking Trojan. The malicious app will take users to a bogus login form to steal their credentials or credit card details, according to ESET's report.

One of the malicious apps ESET reviewed had 3,000 downloaded links, with the vast majority of the victims coming from the Netherlands.

Although the Android/TrojanDropper.Agent.BKY samples ESET came across were banking Trojans or spyware, the downloader could be any nefarious piece of code that the attacker wants, the researchers say.

ESET came across the Android/TrojanDropper.Agent.BKY family in late September when its systems detected the apps dropping payloads in an unusual way. For now, it is not clear who is behind these attacks, Stefanko says.

Related Content:

 

Join Dark Reading LIVE for two days of practical cyber defense discussions. Learn from the industry’s most knowledgeable IT security experts. Check out the INsecurity agenda here.

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
kevinsmart051
50%
50%
kevinsmart051,
User Rank: Apprentice
11/21/2017 | 6:38:55 AM
Permissions...
Is there any way to make sure revoke access to the vulnerable parts of my smartphone (like calendar, contacts, msg, email/sms sending etc.)? Because nearly every app asks for those permissions and I'm not comfortable with granting them to each and every Candy Crush clone...

Regards,

Mark
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34812
PUBLISHED: 2021-06-18
Use of hard-coded credentials vulnerability in php component in Synology Calendar before 2.4.0-0761 allows remote attackers to obtain sensitive information via unspecified vectors.
CVE-2021-34808
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in cgi component in Synology Media Server before 1.8.3-2881 allows remote attackers to access intranet resources via unspecified vectors.
CVE-2021-34809
PUBLISHED: 2021-06-18
Improper neutralization of special elements used in a command ('Command Injection') vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34810
PUBLISHED: 2021-06-18
Improper privilege management vulnerability in cgi component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to execute arbitrary code via unspecified vectors.
CVE-2021-34811
PUBLISHED: 2021-06-18
Server-Side Request Forgery (SSRF) vulnerability in task management component in Synology Download Station before 3.8.16-3566 allows remote authenticated users to access intranet resources via unspecified vectors.