{"id":2417,"date":"2022-03-10T10:00:00","date_gmt":"2022-03-10T17:00:00","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/?p=2417"},"modified":"2022-03-10T15:14:34","modified_gmt":"2022-03-10T22:14:34","slug":"sharkbot-a-banking-trojan-spreading-via-fake-android-anti-virus-application","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/isec-601-f21\/2022\/03\/10\/sharkbot-a-banking-trojan-spreading-via-fake-android-anti-virus-application\/","title":{"rendered":"SharkBot: A Banking Trojan Spreading via Fake Android Anti-Virus Applications"},"content":{"rendered":"\n

A deadly banking virus was just identified, spreading through an apparently innocent-looking Android app, and if you are not aware of it, you are most likely a prospective victim of losing your own money. By posing as an antivirus software, the threat actor behind a fledgling Android banking malware known as SharkBot was able to get past Google Play Store security restrictions recently [1]. Researchers from the NCC Group issued a report earlier this week that detailed how SharkBot operates and how it was able to circumvent Play Store security protections.<\/p>\n\n\n\n

What is SharkBot?<\/strong><\/h3>\n\n\n\n

SharkBot is a malicious piece of malware that targets Android devices. SharkBot, like its malware cousins TeaBot, FluBot, and Oscorp (UBEL), belongs to a class of financial trojans capable of syphoning passwords and initiating money transfers from infected computers by bypassing multi-factor authentication methods. Therefore, the primary purpose of SharkBot is to gather and abuse financial data by deceptively diverting and starting money transactions from users\u2019 devices [2]. In November 2021, it initially appeared on the scene, found by the Cleafy Threat Intelligence Team<\/a>.<\/p>\n\n\n\n

\"\"
source: https:\/\/www.furaffinity.net\/<\/figcaption><\/figure><\/div>\n\n\n\n

How does it work?<\/strong><\/h3>\n\n\n\n

SharkBot, like other Android-targeting harmful apps, takes control of a smartphone by exploiting the operating system’s Accessibility Services. These features are designed to help in reading and interacting with the device. SharkBot obtains this level of control over compromised devices since the Android Accessibility Services encompass reading the screen (including written data) and simulating\/interacting with the touchscreen. If Android Accessibility Services are not enabled, this virus shows pop-up windows asking permission to utilise these services on a constant basis. It can resume operations after being granted permission.<\/p>\n\n\n\n

\"\"
source: https:\/\/research.nccgroup.com<\/figcaption><\/figure><\/div>\n\n\n\n

The malicious programme works as a three-tier poison pill, with one layer impersonating antivirus and the second layer impersonating a scaled-down version of SharkBot, which finally upgrades by downloading the full-fledged malware. That’s when it starts robbing victims’ bank accounts via a number of methods [3]. SharkBot differs from TeaBot in that it can carry out unlawful transactions through Automatic Transfer Systems (ATS), as opposed to TeaBot, which requires a human operator to interact with infected devices in order to carry out harmful operations.<\/p>\n\n\n\n

\"\"
source: https:\/\/research.nccgroup.com<\/figcaption><\/figure><\/div>\n\n\n\n

“The ATS features allow the malware to receive a list of events to be simulated, and they will be simulated in order to do the money transfers. Since these features can be used to simulate touches\/clicks and button presses, it can be used to not only automatically transfer money but also install other malicious applications or components.”<\/p>Alberto Segura and Rolf Govers, malware analysts at cybersecurity firm NCC Group, said<\/a> in a report published last week [4]. <\/cite><\/blockquote>\n\n\n\n

SharkBot\u2019s hidden techniques to get what it needs<\/strong><\/h4>\n\n\n\n

SharkBot may steal banking credentials from Android users using one of the following methods, the majority of which need victims to activate Accessibility Permissions & Services [5] :<\/p>\n\n\n\n