Here are the Play Store apps that stole banking credentials

A group of researchers has discovered a app group, downloaded from Play Store about 300,000 times, who later turned out to be gods trojan bancari. The aforementioned applications, apparently harmless, they actually stole banking credentials from users and logged keystrokes. Let’s find out all the details.

Play Store: These apps were downloaded 300,000 times but were banking Trojans

The apps – which present themselves as scanner QR, scanner PDF e cryptocurrency wallets – belonged to four separate families of Android malware spread over the course of four months. The bad guys have used several tricks to bypass the restrictions that Google has come up with in an effort to curb the relentless distribution of fraudulent apps in its official marketplace.

“What makes these Google Play distribution campaigns very difficult to detect from an automation (sandbox) and machine learning perspective is that the dropper apps all have a very small malicious footprint,” the researchers wrote in a post. mobile security company ThreatFabric. “This small footprint is a (direct) consequence of the authorization restrictions applied by Google Play.”

Here’s what it means. The campaigns initially delivered a harmless app. After the app was installed, users received messages prompting them to download updates with additional functions. Apps often required updates to be downloaded from third party sources but at that point, many users trusted without problems. Most apps initially had zero detections by the malware checkers available on VirusTotal.

Moreover, in many cases, malware operators they installed manually malicious updates only after having checked the geographic location of the infected phone.

The most dangerous malware

The malware family responsible for the most infections is known as Anatsa. This “pretty advanced Android banking trojan” offers a variety of capabilities, including remote access e automatic transfer systems, that they empty automatically victims’ accounts and send the content to accounts belonging to the malware operators.

The researchers wrote:

The process of infection with Anatsa looks like this: at the beginning of the installation from Google Play, the user is forced to update the app to continue using it. At this moment, Anatsa’s payload is downloaded from the C2 server and installed on the unsuspecting victim’s device.

The actors behind it took pains to make theirs look like legitimate and useful apps. There are a large number of positive reviews for the apps. The number of installations and the presence of reviews can convince android users to install the app. Furthermore, these apps actually possess the claimed functionality; after installation, they function normally and further convince the victim of their legitimacy.

Despite the overwhelming number of installations, not all devices that have installed these droppers will receive Anatsa, as the bad guys have made efforts only to target the regions of their interest.

Finally, the researchers found three other malware families: Alien, Hydra ed Ermac. One of the droppers used to download and install malicious payloads was known as Gymdrop. It used filter rules based on the infected device model to prevent targeting of search devices.

The guilty apps