FunkyBot Malware Intercepts Android Texts, 2FA Codes

guest · Sep 5, 2019

FunkyBot Malware Intercepts Android Texts, 2FA Codes
The spyware poses as a legitimate application, spreading via SMS messages to victims’ contact lists
September 5, 2019
https://threatpost.com/funkybot-malware-intercepts-android-texts-2fa-codes/148059/

An Android malware dubbed “FunkyBot” has started making the scene in Japan, operated by the same attackers responsible for the FakeSpy malware. It intercepts SMS messages sent to and from infected devices.

According to FortiGuard Labs, the malware (named after logging strings found in the persistence mechanism of the payload) masquerades as a legitimate Android application. The payload thus consists of two .dex files: One is a copy of the original legitimate application that the malware is impersonating, and the other is malicious code.

“It uses an open source library that can be found on Github to keep the service alive on the device,” explained FortiGuard’s Dario Durando, in a blog this week. “It also allows the malware to mute sounds from the device.”
It also harvests the victim’s list of contacts for propagation purposes; to wit, the C2 sends a telephone number and a message body to the malware, which it uses to generate an SMS message that will be sent to everyone on the list.

“The capabilities of this family are limited at the moment, but the fact that we were able to find different samples that showed significant improvement in the span of a few weeks shows that this family should not be underestimated.”
Click to expand...

Fortinet: FunkyBot: A New Android Malware Family Targeting Japan

Log in or Sign up

FunkyBot Malware Intercepts Android Texts, 2FA Codes

guest Guest

Log in or Sign up

FunkyBot Malware Intercepts Android Texts, 2FA Codes

guest Guest

Useful Searches