New Malware Family “Coper” Spreads Among Android Users

guest · Jul 22, 2021

New Malware Family “Coper” Spreads Among Colombian Android Users
July 22, 2021
https://www.technadu.com/new-malware-family-coper-colombia-android-users/290887/

A new family of banking trojans called “Coper” targets Colombian Android users, customers of ‘Bancolombia’.

The apps are very tricky, abusing multiple permissions to ensure that they remain active and are hard to remove.

The entire set of the malware apps is still available for download from the Google Play Store, as the apps don’t have the malicious module.

Click to expand...

There’s a new family of Android trojans circulating out there, unfortunately even finding their way into the Play Store, targeting mainly Colombian users for now. The set of the malicious apps was discovered by researchers at Doctor Web, who have given it the name “Coper.” The apps feature a modular architecture and a multi-stage infection mechanism and also deploy several protective techniques to defend against detection and removal.

“Coper” apps pretend to be the official Android apps of Grupo Bancolombia, a large financial institution in the Latin American country.
If the victim isn’t careful enough and grants the permission request, the trojan is practically allowed to do anything on the infected device.
Click to expand...

To protect themselves from deletion, the trojan apps mask their presence as system apps using the cog icon and also monitor what the user is doing to prevent manual removal.
For example, if the user attempts to open the Play Protect page, or visits the system app list, or attempts to review the trojan’s access rights, the malware simulates a Home button click, abusing the Accessibility Services permissions to take the victim back to the home page.
Click to expand...

To avoid having to deal with nasty infections like that, only install apps from the official bank website or follow a link to the Play Store from there.
Click to expand...

Doctor Web: The Coper―a new Android banking trojan targeting Colombian users

Doctor Web warns of a newly discovered family of Android banking trojans dubbed Android.BankBot.Coper.

The malicious apps have a modular architecture and a multi-stage infection mechanism. They also have several protective techniques helping them withstand removal attempts. That allows the trojans to stay active longer and perform more successful attacks. All known Coper banker trojan modifications target Colombian users to date. However, new versions targeting users from other countries are likely to emerge over time.
Click to expand...

Log in or Sign up

New Malware Family “Coper” Spreads Among Android Users

guest Guest

Log in or Sign up

New Malware Family “Coper” Spreads Among Android Users

guest Guest

Useful Searches