New Rooting Malware infects Android devices, evades detection

guest · Oct 28, 2021

New AbstractEmu malware roots Android devices, evades detection
October 28, 2021
https://www.bleepingcomputer.com/ne...lware-roots-android-devices-evades-detection/

New Android malware can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks.

The malware, dubbed AbstractEmu by security researchers at the Lookout Threat Labs who found it, was bundled with 19 utility apps distributed via Google Play and third-party app stores (including the Amazon Appstore, the Samsung Galaxy Store, Aptoide, and APKPure).

Apps bundling the malware included password managers and tools like data savers and app launchers, all of them providing the functionality they promised to avoid raising suspicions.
Click to expand...

Lite Launcher, an app launcher and one of the apps used to deliver the AbstractEmu malware on unsuspecting Android users' devices, had over 10,000 downloads when taken down from Google Play.

"AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app," the Lookout researchers said.
Exploits upgraded to target more Android devices
To root Android devices it infects, AbstractEmu has multiple tools at its disposal in the form of exploits targeting several vulnerabilities, including CVE-2020-0041, a bug never exploited in the wild by Android apps before this.
Click to expand...

The malware also uses a CVE-2020-0069 exploit to abuse a vulnerability found in MediaTek chips used by dozens of smartphone manufacturers that have collectively sold millions of devices.
The threat actors behind AbstractEmu also have enough skills and tech know-how to add support for more targets to publicly available code for CVE-2019-2215 and CVE-2020-0041 exploits.

Additional actions AbstractEmu can perform after rooting an infected device range from monitoring notifications, capturing screenshots, and recording the screen to locking the device and even resetting the device password.
Click to expand...

Lookout: Rooting Malware Makes a Comeback: Lookout Discovers Global Campaign

While rare, rooting malware is very dangerous. By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction. Elevated privileges also give the malware access to other apps’ sensitive data, something not possible under normal circumstances.
Click to expand...

Rasheed187 · Oct 31, 2021

And the problem with smartphones is that there is no easy way to protect against this. I wonder if mobile AV's can perhaps tackle this stuff, but I doubt it. That's what I don't like about iOS and Android.

guest · Nov 17, 2021

Rooting Malware Is Back for Mobile. Here’s What to Look Out For.
November 16, 2021
https://threatpost.com/rooting-malware-mobile/176376/

Over the last several years, as the Android ecosystem matured, widely-distributed malware with rooting capabilities has become rare. But its rarity doesn’t mean it’s not still a threat.

Recently, the Lookout Threat Lab uncovered the first widespread rooting malware campaign in five years. Dubbed AbstractEmu due to its use of code extraction and anti-emulation checks to avoid detection, the malware was found on Google Play and other prominent third-party app stores such as Amazon Appstore and the Samsung Galaxy Store. Lookout notified Google and the apps were promptly removed.
Click to expand...

Things Are Not Always What They Seem: Trojanized Apps
Something that is not unique to rooting malware, but has aided the distribution of the AbstractEmu campaign, is trojanizing apps. By disguising its malicious intent behind seemingly innocuous apps, the threat actor is able to lure unsuspecting users into downloading the malware.

AbstractEmu disguised itself as a number of different apps, including utility apps, such as password managers, and system tools like app launchers or data savers.
Click to expand...

Rare or Not, Always Use Cybersecurity Best Practices
Tablets and smartphones are how most of us stay connected to work and manage personal responsibilities, which means they hold an immense amount of data. These devices are also very sophisticated and have countless functionalities that bad actors can leverage.

To protect yourself and your organization, you should always keep your device’s operating system up to date. I also recommend using official app stores only, and even then, exercise caution when downloading something unknown to you.
Click to expand...

Log in or Sign up

New Rooting Malware infects Android devices, evades detection

guest Guest

Rasheed187 Registered Member

guest Guest

Log in or Sign up

New Rooting Malware infects Android devices, evades detection

guest Guest

Rasheed187 Registered Member

guest Guest

Useful Searches