Malware News New Android Malware Secretly Records Phone Calls and Steals Private Data

[Faybert]

Content source

https://bit.ly/2q2dZJA

Security researchers at Cisco Talos have uncovered variants of a new Android Trojan that are being distributed in the wild disguising as a fake anti-virus application, dubbed "Naver Defender."

Dubbed KevDroid, the malware is a remote administration tool (RAT) designed to steal sensitive information from compromised Android devices, as well as capable of recording phone calls.

Talos researchers published Monday technical details about two recent variants of KevDroid detected in the wild, following the initial discovery of the Trojan by South Korean cybersecurity firm ESTsecurity two weeks ago.


Though researchers haven't attributed the malware to any hacking or state-sponsored group, South Korean media have linked KevDroid with North Korea state-sponsored cyber espionage hacking group "Group 123," primarily known for targeting South Korean targets.

The most recent variant of KevDroid malware, detected in March this year, has the following capabilities:

• record phone calls & audio
• steal web history and files
• gain root access
• steal call logs, SMS, emails
• collect device' location at every 10 seconds
• collect a list of installed applications

Malware uses an open source library, available on GitHub, to gain the ability to record incoming and outgoing calls from the compromised Android device.
......
......
......

 

[tim one]

A network analysis of this sample would be good, so we can collect URLs and packets, and then a static analysis just to study its code by decompiling the AndroidManifest file to its original XML format and you can also find native libraries inside the lib folder of the APK by finding native methods declarations.

 

[oneeye]

A network analysis of this sample would be good, so we can collect URLs and packets, and then a static analysis just to study its code by decompiling the AndroidManifest file to its original XML format and you can also find native libraries inside the lib folder of the APK by finding native methods declarations.

Talos likely already did a deep dive, see link to their research in the article above.

 

[tim one]

Talos likely already did a deep dive, see link to their research in the article above.

Yes I saw it thanks, I just was thinking of analyzing this malware, dusting off my old notions about APK reverse engineering