March 22, 2024
Severity High Analysis Summary Ducktail Malware is a malicious program designed by hackers to infiltrate computers and networks globally. Ducktail malware is typically delivered through a […]
Rewterz Threat Alert – Active C2 Detected Hosting Ransomware, POS Malware and Others
November 5, 2019
Rewterz Threat Advisory – Omron CX-Supervisor Multiple Vulnerabilities
November 6, 2019
Rewterz Threat Alert – Active C2 Detected Hosting Ransomware, POS Malware and Others
November 5, 2019
Rewterz Threat Advisory – Omron CX-Supervisor Multiple Vulnerabilities
November 6, 2019
Severity
High
Analysis Summary
Another malware campaign is found targeting Android mobile device users. The malicious application, impersonating the InPost brand, turned out to be a banking Trojan recognized as Cerberus.
The distribution of malicious code was based on the sending of SMS messages with information about tracking the shipment via a mobile application, along with a link to download it. One of the basic functions of the bot was stealing login data for selected applications. Malicious software after granting permission to use accessibility services carried out self-improvement of its own rights. The Trojan claimed to include the ability to read the contact list, initiate USSD calls, became the administrator of the device and the default application for handling SMS. The authors intended the Trojan to allow e.g. disabling Google Play Protect, intercepting SMS communication, launching and removing installed applications, opening URLs, displaying fake notifications from banking applications, avoiding analysis through the use of anti-emulation techniques, and in some cases also stealing data using a keylogger.
User must download a file from the link in an SMS and disable the block installation of applications outside the official Google Play store. By using the screen overlay technique (overlay), the malicious tool steals login information for popular applications. Overlays are downloaded from an external server while the Trojan is running – the condition is an application installed on the device, on which criminals have an overlay prepared.
Impact
- Credential Theft
- Privilege Escalation
- Device Takeover
- Keylogging
Indicators of Compromise
Domain Name
badabinglalaland[.]com inpost24[.]tk m[.]in
MD5
a23af10405f5f87532653f79ccad45b9
SH256
8332b45100044db8c4d94b8414b4aa8e9b3c204b5e05c2230a480b41fd6c6a57
SHA1
40e5f130fab9732b3b834f52aac2ae620332aedb
URL
hxxp://inpost24[.]tk/inpost
Remediation
- Block the threat indicators at their respective controls.
- Do not respond to text messages with shipment information containing URLs.
- Make sure that ‘block installation of applications outside the official Google Play store’ option is enabled.