Legit Android apps Poisoned by sticky 'Zombinder' Malware

upnorth

Moderator
Thread author
Verified
Staff Member
Malware Hunter
Well-known
Jul 27, 2015
5,457
website.png

Threat researchers have discovered an obfuscation platform that attaches malware to legitimate Android applications to lure users to install the malicious payload and make it difficult for security tools to detect.

Analysts with cybersecurity vendor ThreatFabric found the platform, named "Zombinder," on the darknet while investigating a campaign that targeted both Android and Windows users with different types of malware. Zombinder came to light while the researchers were analyzing a campaign involving the Ermac Android banking trojan. That effort yielded evidence of another campaign using multiple trojans aimed at both Android and Windows systems. Along with Ermac, it was distributing desktop malware including Erbium, Aurora stealer, and Laplas clipper.

"While investigating Ermac's activity, our researchers spotted an interesting campaign masquerading as applications for Wi-Fi authorization," the researchers write. "It was distributed through a fake one-page website containing only two buttons."
The researchers discovered that the cybercriminals were using a third-party service – Zombinder – that provided the "glue" to bind the malware dropper capabilities to the legitimate app. Once downloaded, the app – now tied to the malware – operated as expected until an update message appeared.

"At this point, if accepted by the victim, the seemingly legitimate application will install this update, which is nothing else than Ermac," they write. "Such process is achieved by 'glueing' [an] obfuscated malicious payload to a legitimate app with minor updates made to original source code to include installation and loading of the malicious payload." The APK binding service has been available since March and is being frequently used by different attacks, the researchers write. It's provided by what they say is "an actor well-known in the threat landscape."

An ad for Zombinder on a darknet forum explains "binding is needed to install your bot via making a potential victim feel more safe and trust the legitimate software in which your android bot will be embedded."
 

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top