The Rotexy mobile Trojan – banker and ransomware

guest · Nov 22, 2018

The Rotexy mobile Trojan – banker and ransomware
November 22, 2018
https://securelist.com/the-rotexy-mobile-trojan-banker-and-ransomware/88893/

The modern version of Rotexy combines the functions of a banking Trojan and ransomware.

Rotexy intercepts all incoming SMSs and processes them according to the templates it received from the C&C. Also, when an SMS arrives, the Trojan puts the phone into silent mode and switches off the screen so the user doesn’t notice that a new SMS has arrived.

The Trojan displays a phishing page (bank.html) prompting the user to enter their bank card details. This page mimics a legitimate bank form and blocks the device screen until the user enters all the information.
[...] Typically, it is a message saying that the user has received a money transfer, and that they must enter their bank card details so the money can be transferred to their account.
Geography of Rotexy attacks
According to our data, 98% of all Rotexy attacks target users in Russia. Indeed, the Trojan explicitly targets Russian-speaking users. There have also been cases of users in Ukraine, Germany, Turkey and several other countries being affected.
Click to expand...

Log in or Sign up

The Rotexy mobile Trojan – banker and ransomware

guest Guest

Log in or Sign up

The Rotexy mobile Trojan – banker and ransomware

guest Guest

Useful Searches