New problems for Android users that also affect Italy, a well-known hacker has developed a new banking trojan with Remote Access Tooling (RAT) capabilities.
The author of the Android banking trojans, BlackRock and ERMAC has conceived another malware called Hook that introduces new features to access files stored on devices and create a remote interactive session.
ThreatFabric (a Dutch cybersecurity company), in a report shared with The Hacker News, described Hook as a new offshoot of ERMAC even if it has “all the capabilities of its predecessor”, it is advertised for sale at $ 7,000 per month.
“It also adds Remote Access Tooling (RAT) capabilities to its suite, aligning itself with Trojans such as Octo and Hydra, which are capable of performing a complete Device Take Over (DTO) and completing an entire fraud chain, starting with a leak of personal information and ending with the transaction, with all the intermediate steps, without the need for additional channels,” the Dutch cybersecurity firm said.
The majority of financial apps targeted by the malware are located in the United States, Spain, Australia, Poland, Canada, Turkey, the United Kingdom, France, Italy and Portugal.
Hook is the work of a hacker known as DukeEugene and represents, as we said, the latest evolution of ERMAC, which was first disclosed in September 2021 and is based on another trojan called Cerberus whose source code was discovered in 2020.
“ERMAC has always been a step behind Hydra and Octo in terms of capabilities and features,” ThreatFabric researcher Dario Durando told The Hacker News in an email. “This is also known among hackers, who prefer those two trojans over ERMAC.”
“The lack of a RAT functionality is a big problem for a modern Android Banker, as it does not offer the ability to perform a Device Take Over (DTO), which is the fraud method that is most likely to succeed and go undetected by fraud scoring engines or fraud analysts. This is most likely what triggered the development of this new malware variant.”
Like other Android malware of this ilk, Hook uses Android’s Accessibility Services API to conduct overlay attacks and collect all sorts of sensitive information such as contacts, call logs, keystrokes, two-factor authentication (2FA) tokens, and even WhatsApp messages.
It also features an expanded list of apps that include ABN AMRO and Barclays, while the malicious packages themselves masquerade as Google Chrome web browsers to trick unsuspecting users into downloading the malware:
• lojibiwawajinu.guna
• damariwonomiwi.docebi
• yecomevusaso.pisifo
Other key features that Hook possesses include the ability to remotely view and interact with the infected device’s screen, obtain files, extract seed phrases* from crypto wallets, and track the phone’s location, blurring the line between spyware and banking malware.
ThreatFabric said that Hook artifacts observed in testing so far could be delivered via phishing campaigns, Telegram channels, or as Google Play Store app droppers.
“The main downside of creating new malware is usually gaining trust from other attackers, but with DukeEugene’s track record among criminals, that will likely not be a problem for Hook,” Durando said.
*Seed phrase is a series of words that allow you to generate or regenerate the key tree, which gives you access to your cryptocurrency wallet
New problems for Android users that also affect Italy, a well-known hacker has developed a new banking trojan with Remote Access Tooling (RAT) capabilities.
The author of the Android banking trojans, BlackRock and ERMAC has conceived another malware called Hook that introduces new features to access files stored on devices and create a remote interactive session.
ThreatFabric (a Dutch cybersecurity company), in a report shared with The Hacker News, described Hook as a new offshoot of ERMAC even if it has “all the capabilities of its predecessor”, it is advertised for sale at $ 7,000 per month.
“It also adds Remote Access Tooling (RAT) capabilities to its suite, aligning itself with Trojans such as Octo and Hydra, which are capable of performing a complete Device Take Over (DTO) and completing an entire fraud chain, starting with a leak of personal information and ending with the transaction, with all the intermediate steps, without the need for additional channels,” the Dutch cybersecurity firm said.
The majority of financial apps targeted by the malware are located in the United States, Spain, Australia, Poland, Canada, Turkey, the United Kingdom, France, Italy and Portugal.
Hook is the work of a hacker known as DukeEugene and represents, as we said, the latest evolution of ERMAC, which was first disclosed in September 2021 and is based on another trojan called Cerberus whose source code was discovered in 2020.
“ERMAC has always been a step behind Hydra and Octo in terms of capabilities and features,” ThreatFabric researcher Dario Durando told The Hacker News in an email. “This is also known among hackers, who prefer those two trojans over ERMAC.”
“The lack of a RAT functionality is a big problem for a modern Android Banker, as it does not offer the ability to perform a Device Take Over (DTO), which is the fraud method that is most likely to succeed and go undetected by fraud scoring engines or fraud analysts. This is most likely what triggered the development of this new malware variant.”
Like other Android malware of this ilk, Hook uses Android’s Accessibility Services API to conduct overlay attacks and collect all sorts of sensitive information such as contacts, call logs, keystrokes, two-factor authentication (2FA) tokens, and even WhatsApp messages.
It also features an expanded list of apps that include ABN AMRO and Barclays, while the malicious packages themselves masquerade as Google Chrome web browsers to trick unsuspecting users into downloading the malware:
• lojibiwawajinu.guna
• damariwonomiwi.docebi
• yecomevusaso.pisifo
Other key features that Hook possesses include the ability to remotely view and interact with the infected device’s screen, obtain files, extract seed phrases* from crypto wallets, and track the phone’s location, blurring the line between spyware and banking malware.
ThreatFabric said that Hook artifacts observed in testing so far could be delivered via phishing campaigns, Telegram channels, or as Google Play Store app droppers.
“The main downside of creating new malware is usually gaining trust from other attackers, but with DukeEugene’s track record among criminals, that will likely not be a problem for Hook,” Durando said.
*Seed phrase is a series of words that allow you to generate or regenerate the key tree, which gives you access to your cryptocurrency wallet