New Android Malware Mimics Social Media Apps to Steal Sensitive Data

A new RAT malware targeting Android devices has been discovered, capable of executing additional commands compared to other RAT malware. It can also conduct phishing attacks by masquerading as legitimate applications such as Snapchat, Instagram, WhatsApp, Twitter, and Google, to harvest credentials from victims.

Sonicwall’s deeper investigation revealed multiple HTML files in its assets folder, which replicate login pages of various legitimate applications. These files harvest users’ credentials and transmit them back to the C2 server.

Android Malware Mimics Social Media Apps

The malware’s infection chain begins after the malicious application is installed on the victim’s Android devices. During installation, it requests Accessibility service and Device admin permission to seize control over the installed device and carry out additional malicious actions.

The distribution method of this malware remains unclear, but researchers speculate it will utilize traditional social engineering techniques. Once installed, the malware communicates with the C2 server to receive instructions and commands for specific tasks.

The malware executes the following commands:

The C2 URL is embedded in the resource file.

Upon receiving commands from the C2 server, the malware harvests credentials from browsers and other Android applications by presenting a fake login page using HTML files (phishing).

When victims enter their credentials on these phishing pages, they are collected and shared with the showTt function.

Furthermore, the malware gathers the list of phone numbers stored on the victim’s device and tries to alter the device’s wallpaper when certain conditions are met. If the ‘str’ parameter matches the decrypted value to 0, 1, or 2, the condition for changing the wallpaper is associated with a particular resource.

The malware retrieves information about installed applications from the victim’s device. Upon deeper analysis of the code, it was found that the malware utilizes the CameraManager to toggle the flashlight on/off on the victim’s device. Additionally, it sends a message to a specific number based on inputs received from the C2 server.