Gustuff Android Trojan Targeting 30+ Cryptocurrency Apps & 100 International Banks

guest · Mar 28, 2019

Gustuff Android Trojan Targeting 30+ Cryptocurrency Apps & 100 International Banks
March 28, 2019
https://www.technadu.com/gustuff-android-trojan-targets-30-apps-100-banks/63120/

Named “Gustuff”, the Trojan was first seen about a year ago, but its systematic and continuous updating has made it a powerful bank credential phishing tool that features amazing inter-operative capabilities, automating bank transactions for 32 cryptocurrency apps and support for over a hundred banking apps.

Gustuff features a powerful and streamlined ATS (Automatic Transfer Service) system, enabling it to open the supported apps, fill in the phished credentials (which were acquired through social engineering), and then make the transactions.
[...] by taking advantage of the ‘Accessibility Service‘ which is meant to help people with disabilities register user input across Android and individual apps.

For now, the Google Play Store remains free of apps that are infected with the Gustuff Trojan [...]
If Gustuff finds its way to the Play Store, Android phones will face serious trouble, as the Trojan has the capacity to disable the Google Play Protect services, push any kind of masqueraded notifications, and collect images or videos that are stored in the phone.
Click to expand...

guest · Apr 9, 2019

Gustuff banking botnet targets Australia
April 9, 2019
https://blog.talosintelligence.com/2019/04/gustuff-targets-australia.html

Cisco Talos has uncovered a new Android-based campaign targeting Australian financial institutions. As the investigation progressed, Talos came to understand that this campaign was associated with the "ChristinaMorrow" text message spam scam previously spotted in Australia.

Although this malware's credential-harvest mechanism is not particularly sophisticated, it does have an advanced self-preservation mechanism. Even though this is not a traditional remote access tool (RAT), this campaign seems to target mainly private users.
The information collected by the malware and the control over the victim's mobile device allows their operators to perform more complex social engineering attacks. [...] This is a good example where two-factor authentication based on SMS would fail since the attacker can read the SMS.

Beside the obfuscation and the environment checks, the malware also has some interesting anti-sandbox mechanisms.
Click to expand...

guest · Oct 21, 2019

Gustuff Android Banker Switches Up Technical Approach
October 21, 2019
https://threatpost.com/gustuff-android-banker-switches-technical-approach/149403/

An Instagram-initiated campaign using the Gustuff Android mobile banking trojan has rolled out in October, featuring an updated version of the malware that lowers its detection profile.

How the cybercriminals are rolling out the campaign is the same as a previous offensive seen in June, according to researchers at Cisco Talos: Instagram posts designed to lure users into downloading and installing malware are the initial attack vector. Once infected, SMS messages from the device are used to propagate the trojan to others in the victim’s contact lists.
And, just as before, the campaign mainly targets Australian banks and digital currency wallets, looking to steal credentials and financial data.

From a technical perspective, Cisco Talos researchers said that the malware is still deployed using the same packer that has been seen in previous campaigns, but many other aspects of the latest version of Gustuff have seen significant changes.
Overall, the malware code has evolved to have a lower detection footprint, and, based on the apps list and code changes, it is “safe to assume that the actor behind it is looking for other uses of the malware,” Cisco Talos researchers warned.
Click to expand...

Cisco Talos: Gustuff return, new features for victims

Log in or Sign up

Gustuff Android Trojan Targeting 30+ Cryptocurrency Apps & 100 International Banks

guest Guest

guest Guest

guest Guest

Log in or Sign up

Gustuff Android Trojan Targeting 30+ Cryptocurrency Apps & 100 International Banks

guest Guest

guest Guest

guest Guest

Useful Searches