A new Android banking trojan named SharkBot is makings its presence felt

guest · Nov 15, 2021

A new Android banking trojan named SharkBot is makings its presence felt
November 15, 2021
https://therecord.media/a-new-android-banking-trojan-named-sharkbot-is-makings-its-presence-felt/

At the end of October, security firms Cleafy and ThreatFabric have discovered a new Android banking trojan.

Named SharkBot, the malware targets the mobile users of banks in Italy and the UK.

The malware can automate the theft of user banking funds, but it can also target five cryptocurrency apps.

Click to expand...

Named SharkBot, after one of the domains used for its command and control servers, the malware has been actively distributed since late October 2021, when it was first spotted by mobile security firms Cleafy and ThreatFabric.

“At the time of writing, we didn’t notice any samples on Google’s official marketplace,” Cleafy researchers said in a report on Friday.
Instead, SharkBot creators appear to rely on tricking users into downloading and manually installing (side-loading) the apps on their devices, a practice that Google has constantly warned against.
Click to expand...

Once a malicious SharkBot-infected app is installed, the malware asks the users to grant it access to the Android Accessibility service, a feature designed to help physically impaired users to interact with their devices by automating certain tasks.

Instead, SharkBot uses these features to mimic screen taps and perform malicious tasks, such as granting itself admin rights, showing fake login screens on the user’s device, collecting keystrokes, intercepting/hiding 2FA SMS messages, and accessing mobile banking and cryptocurrency apps to transfer funds.
Click to expand...

Sahin says SharkBot’s usage of an automatic transfer system (ATS) to automate the process of stealing funds from users’ accounts is in line with a general trend observed in other Android banking trojans over the past two years, such as Alien, EventBot, Medusa, Gustuff, Anatsa, and FluBot.

“In the way the ATS is executed, it makes it a threat to any (banking) app,” Sahin told The Record, suggesting that new modules could be very easily added to expand the trojan’s targeting capabilities.
Click to expand...

Cleafy: SharkBot: a new generation of Android Trojans is targeting banks in Europe

Key Points

At the end of October 2021, a new Android banking trojan was discovered and analyzed by the Cleafy TIR team. Since we didn't find references to any known families, we decided to dub this new family SharkBot.

The main goal of SharkBot is to initiate money transfers from the compromised devices via Automatic Transfer Systems (ATS) technique bypassing multi-factor authentication mechanisms (e.g., SCA). These mechanisms are used to enforce users' identity verification and authentication, they are usually combined with behavioural detection techniques to identify suspicious money transfers.

We identified a botnet which is currently targeting the UK, Italy, and the US, including banking applications and cryptocurrency exchanges. Given its modularity architecture we don't exclude the existence of botnets with other configurations and targets.

Click to expand...

Once SharkBot is successfully installed in the victim's device, attackers can obtain sensitive banking information through the abuse of Accessibility Services, such as credentials, personal information, current balance, etc., but also to perform gestures on the infected device.

At the time of writing, SharkBot appears to have a very low detection rate by antivirus solutions since multiple anti-analysis techniques have been implemented: string obfuscation routine, emulator detection and a domain generation algorithm (DGA) for its network communication in addition to the fact that the malware has been written from scratch.

SharkBot implements Overlay attacks to steal login credentials and credit card information and it also has capabilities to intercept legitimate banking communications sent through SMS.

At the time of writing, multiple indicators suggest that SharkBot could be at its early stages of development.

Click to expand...

guest · Sep 4, 2022

SharkBot malware sneaks back on Google Play to steal your logins
By Bill Toulas @billtoulas - September 4, 2022

A new and upgraded version of the SharkBot malware has returned to Google's Play Store, targeting banking logins of Android users through apps that have tens of thousands of installations.

The malware was present in two Android apps that did not feature any malicious code when submitted to Google's automatic review.
However, SharkBot is added in an update occurring after the user installs and launches the dropper apps.
According to a blog post by Fox IT, part of the NCC Group, the two malicious apps are “Mister Phone Cleaner” and “Kylhavy Mobile Security,” collectively counting 60,000 installations.
Click to expand...

SharkBot evolved
Malware analysts at Cleafy, an Italian online fraud management and prevention company, discovered SharkBot in October 2021. In March 2022, NCC Group found the first apps carrying it on the Google Play.

At that time, the malware could perform overlay attacks, steal data through keylogging, intercept SMS messages, or give threat actors complete remote control of the host device by abusing the Accessibility Services.
In May 2022, researchers at ThreatFabric spotted SharkBot 2 that came with a domain generation algorithm (DGA), an updated communication protocol, and a fully refactored code.
Click to expand...

Researchers at Fox IT discovered a new version of the malware (2.25) on August 22, which adds the capability to steal cookies from bank account logins.

Additionally, the new dropper apps don’t abuse the Accessibility Services as they did before.

“Abusing the accessibility permissions, the dropper was able to automatically click all the buttons shown in the UI to install Sharkbot. But this not the case in this new version of the dropper for Sharkbot,” Fox IT
Click to expand...

Fox IT: Sharkbot is back in Google Play

by Alberto Segura (main author) and Mike Stokkel (co-author)
After we discovered in February 2022 the SharkBotDropper in Google Play posing as a fake Android antivirus and cleaner, now we have detected a new version of this dropper active in the Google Play and dropping a new version of Sharkbot.

This new dropper doesn’t rely Accessibility permissions to automatically perform the installation of the dropper Sharkbot malware. Instead, this new version ask the victim to install the malware as a fake update for the antivirus to stay protected against threats.
We have found two SharkbotDopper apps active in Google Play Store, with 10K and 50K installs each of them.
Click to expand...

guest · Nov 22, 2022

SharkBot Banking Trojan Returns to Google Play Store
According to Bitdefender, most of the malicious apps were aimed at users in Italy and the United Kingdom.
By Habiba Rashid - November 22, 2022

SharkBot banking trojan, as we know it, has been targeting Android devices for a while now. What appears to have become a trend was recently identified by Bitdefender when they found a trove of malicious apps in the official Google Play Store that pushed aggressive unwanted ads which could potentially lead to more serious attacks.
Click to expand...

This finding was not surprising since, in the last few months, malicious apps have begun to be distributed directly from the official store which makes people inclined to believe that they’re safe.

Through their real-time behavioral technology designed to detect softwares acting suspiciously, the research team at Bitdefender uncovered apps downloaded from Google Play acting as droppers for SharkBot banking trojan a short while after being installed.

“The Google Play Store would likely detect a trojan banker uploaded to their repository, so criminals resort to more covert methods. One way is with an app, sometimes legitimate with some of the advertised features, that doubles as a dropper for more insidious malware,”.
Click to expand...

The apps that Bitdefender found were disguised as file managers, which allows them to easily request and gain permission from the user to install external packages. What adds to their disguise and allows them to evade detection is that the malicious behavior is activated to a restricted pool of users and Google Play apps only need the functionality of a file manager to install another app.
Click to expand...

Bitdefender: Android SharkBot Droppers on Google Play Underline Platform's Security Needs

By Elena FLONDOR, Albert ENDRE-LASZLO, Vlad Sebastian CREȚU, Adina MATEESCU, Alexandra BOCEREG, Silviu STAHIE - November 21, 2022
November 21, 2022
A common theme we've noticed in the last few months consists of malicious apps distributed directly from the Google Play Store. If something comes from an official store, people could be inclined to believe it’s safe. Our research has shown this to be false, many times over.

The apps Bitdefender found are disguised as file managers, which explains why they request permission to install external packages (REQUEST_INSTALL_PACKAGES) from the user.
While none of the apps in this research are still available on the Google Play Store, they're still present across the web in different third-party stores, making them a current threat.
Click to expand...

Log in or Sign up

A new Android banking trojan named SharkBot is makings its presence felt

guest Guest

guest Guest

guest Guest

Log in or Sign up

A new Android banking trojan named SharkBot is makings its presence felt

guest Guest

guest Guest

guest Guest

Useful Searches