Kaspersky Lab’s Anti-malware Research Team has detected one of the most dangerous Android banking Trojans to date. The Acecard malware is capable of attacking users of nearly 50 different online financial applications and services and is able to bypass the Google Play store’s security measures.
[su_note note_color=”#ffffcc” text_color=”#00000″]Anti-malware Research Team at Kaspersky Lab:
During the third quarter of 2015, Kaspersky Lab experts detected an unusual increase in the number of mobile banking attacks in Australia. It looked suspicious and very soon it was discovered that the main reason for this increase was a single banking Trojan: Acecard.
The Acecard Trojan family uses almost all of the malware functionality currently available – from stealing a bank’s text and voice messages, to overlaying official app windows with false messages that simulate the official login page in an attempt to steal personal information and account details. The most recent versions of the Acecard family can attack the client applications of some 30 banks and payment systems. Considering that these Trojans are capable of overlaying any application on command, the overall number of attacked financial applications may be much higher.
Besides banking apps, Acecard can overlay the following applications with phishing windows:
- IM services: WhatsApp, Viber, Instagram, Skype;
- Social networks: VKontakte, Odnoklassniki, Facebook, Twitter;
- The Gmail client;
- The PayPal mobile app;
- c and Google Music applications.
The malware was first detected in February 2014, but for a long period it showed almost no signs of malicious activity. It evolved in 2015 when Kaspersky Lab researchers detected a spike in attacks: in the period May to December 2015, more than 6,000 users were attacked with this Trojan. Most of them were living in Russia, Australia, Germany, Austria and France.
During the two years of observation, Kaspersky Lab researchers witnessed the active development of the Trojan. They registered more than ten new versions of the malware, each with a far longer list of malicious functions than the previous one.
Google Play is under attack
Mobile devices were usually infected after downloading a malicious application masquerading as a legitimate one. Acecard versions are typically distributed as Flash Player or PornoVideo, although other names are sometimes used in a bid to imitate useful and popular software.
But this is not the only way this malware is distributed. On 28 December 2015, Kaspersky Lab experts were able to spot a version of the Acecard downloader Trojan – Trojan-Downloader.AndroidOS.Acecard.b – in the official Google Play store. The Trojan propagates under the guise of a game. When the malware is installed from Google Play, the user will only see an Adobe Flash Player icon on the desktop screen and no actual sign of the installed application.
Who is behind it?
Looking closely at the malware code, Kaspersky lab experts are inclined to think that Acecard was created by the same group of cybercriminals that was responsible for the first TOR Trojan for Android Backdoor.AndroidOS.Torec.a and the first mobile encryptor/ransomware Trojan-Ransom.AndroidOS.Pletor.a.
The evidence for this is based on similar code lines (names of methods and classes) and the use of the same C&C (Command and Controls) servers. This proves that Acecard was made by a powerful and experienced group of criminals, most likely Russian-speaking.
“This cybercriminal group uses virtually every available method to propagate the banking Trojan Acecard. It can be distributed under the guise of another program, via official app stores, or via other Trojans. A distinctive feature of this malware is that it’s capable of overlaying more than 30 banking and payment systems as well as social media, instant messaging and other apps. The combination of Acecard’s capabilities and methods of propagation make this mobile banker one of the most dangerous threats to users today,”. warns Roman Unuchek Senior Malware Analyst at Kaspersky Lab USA.[/su_note]
[su_box title=”About Kaspersky Lab” style=”noise” box_color=”#336588″]
Kaspersky Lab is one of the world’s fastest-growing cybersecurity companies and the largest that is privately-owned. The company is ranked among the world’s top four vendors of security solutions for endpoint users (IDC, 2014). Since 1997 Kaspersky Lab has been an innovator in cybersecurity and provides effective digital security solutions and threat intelligence for large enterprises, SMBs and consumers. Kaspersky Lab is an international company, operating in almost 200 countries and territories across the globe, providing protection for over 400 million users worldwide.[/su_box]
About the Author
The opinions expressed in this post belongs to the individual contributors and do not necessarily reflect the views of Information Security Buzz.
