Facebook Twitter Instagram
    • Privacy Policy
    • Contact Us
    Facebook Twitter Instagram Pinterest Vimeo
    AI Home SecurityAI Home Security
    • Home
    • Home Security
    • Cyber Security
    • Biometric Technology
    Contact
    AI Home SecurityAI Home Security
    Cyber Security

    MMRat Android Trojan Executes Remote Financial Fraud Through Accessibility Feature

    justmattgBy justmattgAugust 30, 2023No Comments3 Mins Read

    [ad_1]

    Aug 30, 2023THNMobile Security / Malware

    Android Banking Malware

    A previously undocumented Android banking trojan dubbed MMRat has been observed targeting mobile users in Southeast Asia since late June 2023 to remotely commandeer the devices and perform financial fraud.

    “The malware, named after its distinctive package name com.mm.user, can capture user input and screen content, and can also remotely control victim devices through various techniques, enabling its operators to carry out bank fraud on the victim’s device,” Trend Micro said.

    What makes MMRat stand apart from others of its kind is the use of a customized command-and-control (C2) protocol based on protocol buffers (aka protobuf) to efficiently transfer large volumes of data from compromised handsets, demonstrating the growing sophistication of Android malware.

    Possible targets based on the language used in the phishing pages include Indonesia, Vietnam, Singapore, and the Philippines.

    Cybersecurity

    The entry point of the attacks is a network of phishing sites that mimic official app stores, although how victims are directed to these links is presently unknown. MMRat typically masquerades as an official government or a dating app.

    Once installed, the app leans heavily on Android accessibility service and MediaProjection API, both of which have been leveraged by another Android financial trojan called SpyNote, to carry out its activities. The malware is also capable of abusing its accessibility permissions to grant itself other permissions and modify settings.

    Android Banking Malware

    It further sets up persistence to survive between reboots and initiates communications with a remote server to await instructions and exfiltrate the results of the execution of those commands back to it. The trojan employs different combinations of ports and protocols for functions such as data exfiltration, video streaming, and C2 control.

    MMRat possesses the ability to collect a broad range of device data and personal information, including signal strength, screen status, and battery stats, installed applications, and contact lists. It’s suspected that the threat actor uses the details to carry out some sort of victim profiling before moving to the next stage.

    Some of the other features of MMRat encompass recording real-time screen content and capturing the lock screen pattern so as to allow the threat actor to remotely gain access to the victim’s device when it is locked and not actively in use.

    Cybersecurity

    “The MMRat malware abuses the Accessibility service to remotely control the victim’s device, performing actions such as gestures, unlocking screens, and inputting text, among others,” Trend Micro said.

    “This can be used by threat actors — in conjunction with stolen credentials — to perform bank fraud.”

    The attacks end with MMRat deleting itself upon receiving the C2 command UNINSTALL_APP, which typically takes place after a successful fraudulent transaction, effectively removing all traces of infection from the device.

    To mitigate threats posed by such potent malware, it’s recommended that users only download apps from official sources, scrutinize app reviews, and check the permissions an app requests for access to before usage.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.



    [ad_2]

    Source link

    Previous Article6 Ways AI Can Revolutionize Digital Forensics
    Next Article Hackers Can Exploit Windows Container Isolation Framework to Bypass Endpoint Security
    justmattg
    • Website

    Related Posts

    Cyber Security

    Name That Toon: Last Line of Defense

    April 16, 2024
    Cyber Security

    OpenJS Foundation Targeted in Potential JavaScript Project Takeover Attempt

    April 16, 2024
    Cyber Security

    Middle East Cyber Ops Intensify, With Israel the Main Target

    April 16, 2024
    Add A Comment

    Leave A Reply Cancel Reply

    Facebook Twitter Instagram Pinterest
    • Privacy Policy
    • Contact Us
    AI Home Security © 2025 All rights reserved | Designed By ESmartsSolution

    Type above and press Enter to search. Press Esc to cancel.

    ↑