New malware SURXRAT helps hackers log in

The new malware, SURXRAT, allows hackers to fully log in to Android.

The type of malware that can be called coming up today will not be able to escape the remote access trojan type of malware, which has a wide range of systems, and now Android systems have fallen victim to this type of malware again.

According to a report by the website, Cyberpress has mentioned the detection of a new RAT type of malware that focuses on the implementation of the Android operating system. This malware, named SURXRAT, is distributed as malware for rental (MaaS or Malware-as-a-Service) on the famous chat platform Telegram under the name "SURXRAT V5" (making it predicted that the detected one is not the first, but has already been developed to the fifth generation). The rental will be in a monthly subscription form, which the sales system will allow the reseller to distribute the version. Custom can also be adapted to customers. According to a review of the Telegram channel that distributed the malware, there were hackers from Indonesia behind it.

The ability of this malware can be called the ability to spy on the victim and take control of the victim's machine. After installation, the malware gives the malware hackers the right to take over the victim's system. The capabilities of this malware are as follows:

Data Collection and Exfiltration is the ability to access sensitive data on the machine, such as call logs, short messages (SMS or Short Message Service), Location, etc. These data are sent to a C2 or Command and Control server running on a Firebase basis with the ability to smooth (Blending) malware data to data communicating with cloud services.

Remote Device Control The malware allows hackers to gain full control through commands such as:

Access is used for data access on Clipboard.

Lock to operate the screen lock system.

For Data Wipe

Wal used to change the background image (Wallpaper)

Brow is used to search the browser history.

The ability to form is similar to Ransomware-like malware by relying on the ability to log screens and change background images, allowing hackers to lock screens and turn background images into messages threatening victims for extortion.

Artificial Intelligence by malware can download AI models from digital archives such as Hugging Face to help with malware and hackers.

Technically, after the malware is installed on the victim's machine, the malware deceives the victim's access to the system. From the requested permissions, the malware and active hackers can access the data storage, contacts, SMS messages and locations.

After the malware is granted, the malware will contact the C2 server and immediately start smuggling the stolen data from the victim's machine back to the server. In addition, the malware will register itself as a common application to guarantee persistence on the system (Persistence) and access the Disabled Assistance Mode or Accessibility Mode to gain complete control of the machine without the victim having to interact with the malware.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Malware # freedomhack