“New Android malware can root infected devices to take complete control and silently tweak system settings, as well as evade detection using code abstraction and anti-emulation checks,” reports BleepingComputer.
Cybersecurity company Lookout said on its blog that they’d spotted the malware on Google Play “and prominent third-party stores such as the Amazon Appstore and the Samsung Galaxy Store…. To protect Android users, Google promptly removed the app as soon as we notified them of the malware.”
We named the malware “AbstractEmu” after its use of code abstraction and anti-emulation checks to avoid running while under analysis. A total of 19 related applications were uncovered, seven of which contain rooting functionality, including one on Play that had more than 10,000 downloads…
This is a significant discovery because widely-distributed malware with root capabilities have become rare over the past five years. As the Android ecosystem matures there are fewer exploits that affect a large number of devices, making them less useful for threat actors… By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware — steps that would normally require user interaction. Elevated privileges also give the malware access to other apps’ sensitive data, something not possible under normal circumstances…
AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading… By rooting the device, the malware is able to silently modify the device in ways that would otherwise require user interaction and access data of other apps on the device.
“Apps bundling the malware included password managers and tools like data savers and app launchers,” reports BleepingComputer, “all of them providing the functionality they promised to avoid raising suspicions…”
Lookout’s blog post said they’d spotted people affected by the malware in 17 different countries.
of this story at Slashdot.
Source:: Slashdot