Android is a SEEDSNATCHER malware victim.
Android falls victim again to SEEDSNATCHER malware that can steal Seed Krypto
When it comes to malware and the Android operating system, both are almost identical, and each malware released against an Android user is often malicious, as in this news.
According to a report by the website, Cyber Security News has mentioned the detection of a new malware distribution campaign targeting a group of Android smartphone users with the aim of stealing Krypto Kerrency coins from the victim's installed wallet. The malware is called SEEDSNATCHER by a research team from Cyfirma, a company that specializes in developing cyber management solutions. For this malware, the research team did not say what type of malware (according to the ability, it is expected to be a type of account-sucking malware or a type of Banking Trojan). The research team has reviewed a number of cases. To the assumption that the malware may have been developed by a group of hackers from China, because the User Interface is largely Chinese-based.
For the spread side of the malware, SEEDSNATCHER malware lurks in a file package named "Coin" or com.pureabuladon.auxes. The file is distributed through a hacker channel on a popular chat service like Telegram. According to the above-mentioned name, this malware focuses primarily on attacks on Krypto Currency investors and traders. It is claimed that the malware is a Crypto Currency Wallet application, creating a screen similar to the famous Waller application - Trust Wallet, TokenPocket, imToken, MetaMask, Coinbase Wallet. , TronLink, TronGlobal, Binance Chain Wallet, and OKX Wallet to trick the victim into filling the wallet loan code (Seed Phrases), allowing hackers to take possession of the wallet and all the money inside.
As for the theft of the wallet loan code, it is called that the malware can mimic the famous Krypto Currency wallet very well. For example, the trust wallet is hardcoded from the com.wallet.crypto.trustapp package to create a wallet face that is so smooth that the victim will fill in the wallet loan code. The acquired code will be validated with the BIP39 dictionary to screen for the theft of the valid mnemonic Phrases form only according to the standard. The code will be smuggled out of the victim's machine. (Exfiltration) After that, the hackers would use the code to enter their pockets and transfer the money to their pockets entirely to permanently close the recovery process.
As for the technical data of malware, the research team said that the structure of the malware shows the developer's deep proficiency in the structure of the Android operating system. From the first level after logging in with minimal access to the system (Permission), only access to short messages (SMS or Short Message Service). After successfully installing it, more and more high-level requests to reduce suspicion. To high-level methods like Dynamic Class Loading, shooting content to display. WebView deceives invisible users to the point of not being caught. The content seen is fake, and the command encryption (Commands) received by the C2 or Command and Control server (Interger) instead of Explicit or Descriptive, which deceives the Obfuscation to be more difficult to detect.
# Recap 2025 # Take care of yourself # Open statements # Includes IT matters
