To replace the legitimate banking apps the Trojan needs Accessiblity Services privileges, which it insistently requests after being started. It opens a copy of the original interface of the legitimate banking app and this overlay sends entered data like usernames and passwords to the threat actor. It does this by mimicking legitimate banking apps. The main task of these banking Trojans is to steal credentials, combined with the use of SMS and Notification interception to log and use potential 2FA tokens. Xenomorph was recognized as a new malware closely related to the Alien banking Trojans, which was one of the other possible payloads. The Fast Cleaner app has now been removed from the Play Store but not before it was downloaded more than 50,000 times. This makes it hard for Google to determine that such an app has an ulterior motive and gives the threat actor the opportunity to distribute the dropper. To avoid early detection or being denied access to the Play Store these malicious dropper apps are distributed before the malware is placed on the remote server. One of these payloads was the banking Trojan Xenomorph. In reality this application was a Trojan dropperwhich contacted a remote server and downloaded one of several payloads based on certain parameters. The researchers found the dropper for the Xenomorph banking Trojan on the Google Play Store under the name Fast Cleaner, pretending to be an application aimed at speeding up the device by removing unused clutter and removing battery optimization blocks. The researchers dubbed this malware Xenomorph because it shows similarities to another banking Trojan that is generally known as Alien. Researchersfound this banking Trojan to be distributed on the official Google Play Store, with more than 50,000 installations. Besides the name of the creature that “stars” in the Alien movies by 20 thCentury Fox, Xenomorph is also the name given to an Android banking Trojan.
0 kommentar(er)
