Date:02/03/17
The new Android banking malware ESET recently discovered on Google Play was spotted in the wild again, now improved and targeting more banks. Further investigation of this resurfacing threat has uncovered its code was built using source code that was made public a couple of months ago. ESET have discovered a new version of the trojan on Google Play, masquerading as yet another legitimate weather app, this time World Weather.
As it turns out, both of these Android trojans are based on a free source code that was made public online. Allegedly written from scratch, the “template” code of the Android malware along with the code of the C&C server including a web control panel have been available on a Russian forum since December 19, 2016.
On top of the weather forecast functionalities it adopted from the original legitimate application, Trojan.Android/Spy.Banker.HW (the newly detected version) is able to remotely lock and unlock infected devices by setting lock screen password and intercept text messages. The only difference between the two appears to be a wider target group – malware now affects users of 69 British, Austrian, German and Turkish banking apps – and a more advanced obfuscation technique.
New Android Banking Malware Discovered By ESET
The new Android banking malware ESET recently discovered on Google Play was spotted in the wild again, now improved and targeting more banks. Further investigation of this resurfacing threat has uncovered its code was built using source code that was made public a couple of months ago. ESET have discovered a new version of the trojan on Google Play, masquerading as yet another legitimate weather app, this time World Weather.As it turns out, both of these Android trojans are based on a free source code that was made public online. Allegedly written from scratch, the “template” code of the Android malware along with the code of the C&C server including a web control panel have been available on a Russian forum since December 19, 2016.
On top of the weather forecast functionalities it adopted from the original legitimate application, Trojan.Android/Spy.Banker.HW (the newly detected version) is able to remotely lock and unlock infected devices by setting lock screen password and intercept text messages. The only difference between the two appears to be a wider target group – malware now affects users of 69 British, Austrian, German and Turkish banking apps – and a more advanced obfuscation technique.
Views: 363
©ictnews.az. All rights reserved.
Similar news
- Cellphone Use May Raise Cancer Risk
- Australian police pushes cyber safety education
- Vietnam aims to lead in e-government
- Senate Website Gets Hacked
- US builds net for cyber war games
- Japan enacts anti-computer virus law
- India passes law vs e-waste
- Anonymous Declares War On The City Of Orlando
- Microsoft highlights evolving dangers as online identity data proliferates
- Consumers want internet security to be provided by banks
- Government facilities targets of cyber attack
- South Korean web attacks might been war drill
- Sri Lanka to Establish National Passport Database to Increase Border Security
- Hi-tech crime agencies set to employ information security professionals
- Phone hacking and online campaign bring down the News of the World
