plc.myforum.ro

mark11 · Member Joined: 30 Mar 2014 Posts: 114

Attention!

MazarBOT is a malware program for Android OS driven Phones.
The MazarBOT scope is to steal your online bank accounts data.
They do that only for phones outside Russia and it will stop installing if it detects an Android device that is running within Russia...
If phones pass the location test, MazarBOT installs Tor browser
https://www.torproject.org/
The malware then sends an SMS saying "Thank you" along with the device's location to a phone number with Iran's country code.

Attention!
See more on:
http://www.itnews.com/article/3033103/malware-targets-all-android-phones-except-those-in-russia.html

mark11 · Member Joined: 30 Mar 2014 Posts: 114

MazarBOT: Top class Android datastealer

This Friday, a swarm of SMSs were sent to random phone numbers in Denmark and likely elsewhere. The content of the SMS had the purpose of luring the recipient into clicking the provided link, which would serve up a malicious APK.

The SMS in question arrives with the following content (sanitized by CSIS):
"You have received a multimedia message from +[country code] [sender number] Follow the link http://www.mmsforyou[.]net/mms.apk to view the message".

If the APK (an application file for Android) is run on an Android-powered smartphone, it will gain administrator rights on the victim’s device.
This will allow the attackers to:

SEND_SMS
RECEIVE_BOOT_COMPLETED
INTERNET
SYSTEM_ALERT_WINDOW
WRITE_SMS
ACCESS_NETWORK_STATE
WAKE_LOCK
GET_TASKS
CALL_PHONE
RECEIVE_SMS
READ_PHONE_STATE
READ_SMS
ERASE_PHONE

The MazarBOT The MazarBOT

Chrome injects
As if it wasn't enough that it can stop calls and launch other aggressive commands on the victim’s phone, MazarBOT is also capable of injecting itself into Chrome.
The MazarBOT The MazarBOT

And there are several other settings and commands that MazarBOT can trigger, as showcased below. These include:
The MazarBOT The MazarBOT

read more on
https://www.csis.dk/en/csis/news/4819/

Antivirus detection at the time of distribution of the APK was low (3/54):
https://www.virustotal.com/en/file/73c9bf90cb8573db9139d028fa4872e93a528284c02616457749d40878af8cf8/analysis/

mark11 · Member Joined: 30 Mar 2014 Posts: 114

GMBot: Android poor man’s “webinjects”

The GM Bot mobile Trojan was initially analyzed by CERT Polska in October 2015.
http://www.cert.pl/news/10648/langswitch_lang/en
The malware was since detected and renamed by a few other security vendors, but the actual code base is the same and not considered to be a different Trojan.
Some aliases GM Bot received are SlemBunk, Bankosy, Acecard and Slempo.

Dynamic application overlay

Application overlay is a simple technique described in our previous blog entry. It is often used in malicious Android applications in order to impersonate other app. When malicious app checks that user opened online banking app it displays a window on top of that app with a message. User assumes that this message comes from the banking app and is fine with providing login, password or even other data, that she would normally not leave on a phishing website
The MazarBOT The MazarBOT

The figure above illustrates this technique. However, up until now, we only saw that this technique was used to present a user with login / password entry form. Instead, GMBot updates a list of app overlay targets and HTML snippets corresponding to them. If user opens the targeted app, GMBot opens the WebView in which it renders the provided HTML. The code below is part of what is used to achieve that.
The MazarBOT The MazarBOT

This is almost exactly the same way Zeus and other webinject-based Windows malware uses C&C servers to provide infected users with JavaScript snippets. However, in order to get credit card information, attackers use an old, hardcoded version of app overlay. This is an artifact from a previous version of the app, for which we were able to get the source code. Snippet of this code is presented below.
The MazarBOT The MazarBOT

mark11 · Member Joined: 30 Mar 2014 Posts: 114

MazarBot Source Code Leaked
https://securityintelligence.com/android-malware-about-to-get-worse-gm-bot-source-code-leaked/