Date:04/04/18
New Android Trojan could be stealing your data through mobile instant messaging apps such as Facebook Messenger, Twitter, Skype and other IM clients.
This malware was detected by security researchers from Trustlook, a cyber-security firm. A report published on Monday describes the new trojan as a simple one with few abilities.
After infecting the app, the trojan tries to modify the “/system/etc/install-recovery.sh” file to enable its execution, each time the app is opened.
It seems that the primary purpose of this malware is to steal data from messaging apps, which is later uploaded to a remote server. The trojan retrieves the IP of this server from a local configuration file.
Here’s the list of apps that could be affected by this malware:
Although it has a simple design and singular focus on extracting IM data, this malware uses some advanced evasion techniques.
According to Trustlook Labs, this Trojan obfuscates its configuration file and part of its modules to avoid detection which makes it difficult for anti-virus software to spot its presence.
It uses anti-emulator and debugger detection techniques to evade dynamic analysis and is capable of hiding strings inside its source code to prevent any code reversing attempts.
Since the Android Trojan has a single objective (to steal data), it is quite possible that its authors are trying to collect sensitive data through private conversations, images, and videos that could be used later for extortion.
Though it is not clear on how this malware gets distributed, Trustlab researchers spotted this malware inside a Chinese app named Cloud Module with the package name com.android.boxa.
Given that the malware has a Chinese name and unavailability of Play Store in China, the malware coders are probably spreading this infectious app through links on Android app forums or third-party app stores.
Android Trojan Steals Data From Messenger Apps Like Facebook, Skype, Twitter
New Android Trojan could be stealing your data through mobile instant messaging apps such as Facebook Messenger, Twitter, Skype and other IM clients.This malware was detected by security researchers from Trustlook, a cyber-security firm. A report published on Monday describes the new trojan as a simple one with few abilities.
After infecting the app, the trojan tries to modify the “/system/etc/install-recovery.sh” file to enable its execution, each time the app is opened.
It seems that the primary purpose of this malware is to steal data from messaging apps, which is later uploaded to a remote server. The trojan retrieves the IP of this server from a local configuration file.
Here’s the list of apps that could be affected by this malware:
- Facebook Messenger
- Skype
- Telegram Messenger
- Tencent WeChat
- Viber
- Voxer Walkie Talkie Messenger
- Gruveo Magic Call
- Line
- Coco
- BeeTalk
- TalkBox Voice Messenger
- Momo
Although it has a simple design and singular focus on extracting IM data, this malware uses some advanced evasion techniques.
According to Trustlook Labs, this Trojan obfuscates its configuration file and part of its modules to avoid detection which makes it difficult for anti-virus software to spot its presence.
It uses anti-emulator and debugger detection techniques to evade dynamic analysis and is capable of hiding strings inside its source code to prevent any code reversing attempts.
Since the Android Trojan has a single objective (to steal data), it is quite possible that its authors are trying to collect sensitive data through private conversations, images, and videos that could be used later for extortion.
Though it is not clear on how this malware gets distributed, Trustlab researchers spotted this malware inside a Chinese app named Cloud Module with the package name com.android.boxa.
Given that the malware has a Chinese name and unavailability of Play Store in China, the malware coders are probably spreading this infectious app through links on Android app forums or third-party app stores.
Views: 425
©ictnews.az. All rights reserved.
Similar news
- Cellphone Use May Raise Cancer Risk
- Australian police pushes cyber safety education
- Vietnam aims to lead in e-government
- Senate Website Gets Hacked
- US builds net for cyber war games
- Japan enacts anti-computer virus law
- India passes law vs e-waste
- Anonymous Declares War On The City Of Orlando
- Microsoft highlights evolving dangers as online identity data proliferates
- Consumers want internet security to be provided by banks
- Government facilities targets of cyber attack
- South Korean web attacks might been war drill
- Sri Lanka to Establish National Passport Database to Increase Border Security
- Hi-tech crime agencies set to employ information security professionals
- Phone hacking and online campaign bring down the News of the World
