Document reading app detected (fake) deceived release of malware

Document Reading App Detected (Fake) Tricked Outragely Release Anatsa Malware Mid Play Store

The official app store of Android users, such as Google Play Store, boasts of the depth of moderation of applications that will be released for download or distribution on the platform. But many times, serious malware-based applications have fallen off incredibly much, as in this news.

According to a report by the website Cyber Security News, a fake document reading application with malware insertion or a Banking Trojan named Anatsa was released to download on the official app store of the Android system, the Google Play Store. The dangerous application was known to Google, the owner of the app store, and deleted it. It has already been downloaded by more than 10,000 people. A research team from Zscaler, a cyberdefense expert, revealed that the application was spread under the package name com.groundstation.informationcontrol.filestation _ browsefiles _ readdocs. The package was able to avoid detection by The Play Store's defense system and hide on the app store for quite a long time.

The application will act as a malware extension or a dropper. The foreground will behave like a common document reader application. There is no distortion behind it. The malware will contact the Remote Server to download Anatsa's payload files from http: / / 23.251.108 [.] 10: 8080 / privacy .txt silently onto the victim's machine. The two-layer malware installation method is possible to evade detection from the app store's protection system and the Android system.

After the malware has successfully run on the machine, the malware will deceive the victim to allow the malware to use the Disabled Support Mode or Accessibility Mode. If the malware has successfully completed access, the malware will automatically access other Privilege permissions, such as Overlay screen, which will be used to steal passwords by tricking the victim into entering the password on the Overlay Screen or Overlay Attack, access permissions and interfering with SMS or Short Message Service, and display. Alert (Alert) in full screen etc.

The malware also has many other capabilities, such as the ability to hide on the system by splitting DEX files into corrupted zip files. These files are only processed during Runtime, and when used, they are immediately deleted, making them difficult to detect. The embedded method is also used on JSON script files, which are deleted immediately. Not only is the transmission of traffic to the C2 or Command and Control server encrypted (C2 or Command and Control). Encryption) is also based on an XOR algorithm. The C2 server is located at http: / / 172.86.91 [.] 94 / api /, http: / / 193.24.123 [.] 18: 85 / api /, and http: / / 162.252.173 [.] 37: 85 / api /. The bank application screen used to attack the victim with a screen overlay is downloaded from these servers when the malware needs to be used. Not only that, the malware also has an anti-Sandbox system.

# Trending # Lemon 8 Howtoo # lemon 8 diary # Document # freedomhack