RAT malware on Android running Watchdog Services

RAT malware was found on Android, running Watchdog Services and Boot Receivers to evade being shut down at reboot.

According to a report by the website Cyber Security News, a new RAT type of malware called Octagon has been detected in Bahrain. It is disguised as a state-owned Alert Service, which snatches the rhythm of the Middle East crisis, tricking victims into phishing websites to download such (fake) applications that are not available on the official Android app store, such as the Google Play Store. The fake pages, if opened via mobile, are so similar to the Google Play Store that many victims have lost their way of downloading such illegal applications to install them. Ultimately addicted to malware.

For the process of embedding malware into the machine, it will start with an installation file called BH-Alert.apk. Before installation, seven steps will be granted to access the victim's system. The first application at the outpost will hide the malware code in an encryption file called ZfChs.ttf. The file will be decrypted on the machine at the time of use, making the malware scanner unable to see the code. The first application will then install the OctagonPanel application and create a code file as the machine runs time by the Service of this malware. It works in the background. In this part, the surveillance service or the Watchdog Services will monitor each other and immediately reopen the malware if it is stopped. This prevents the first layer of downtime. If it is rebooted, it cannot stop the malware. Boot Receivers will also reopen the malware immediately. In addition, the malware has created a fake Android account called OctagonPanel and rescheduled the sync task every 30 minutes, which is called Persistence. Wisely.

After the malware has fully embedded and handled the above matters, the malware will request the right to use the Disabled User Support Mode or Accessibility Mode to steal screen unlock numbers, passwords, and other sensitive information that the user has typed in, allowing hackers to take over the victim's machine and complete the use of the Virtual Private Network. The foreground deceives the victim as a use for data security. In fact, the use of the Tunnel also allows hackers to easily capture sensitive information by the application. Others that the malware does not require are packaged on the exclusion list, causing the data of those applications to run through normal channels until no fault is noticed.

Not only that, malware can also intercept short messages (SMS or Short Message Service), contacts, call logs, settings, and can secretly record screenshots. Overlay Attacks can also be used to overlay the screen of applications that need to store data. It allows the theft of the victim's code in another way.

# Trending # lemon 8 diary # Lemon 8 Howtoo # rat # freedomhack