sb-au logo
Story image

Dangerous Android Trojan masquerades as Flash Player update

22 Feb 2017

 A new Android Trojan has been lurking under a fake app that tries to mimic a Flash Player update, ESET discovered this week.

The Android/TrojanDownloader Agent JI is able to download and execute additional malware, which is capable of emptying bank accounts or conducting ransomware attacks.

The Trojan is delivered through compromised websites such as social media and ‘adult’ sites. ESET says that the Trojan uses ‘safety measures’ as the reason to target users in the fake Flash update.

“This particular Trojan has been built so other malware can be downloaded. When our analysts looked at this downloader, its real payload was designed to steal money from bank accounts. However, it would take only the cybercriminals distributing this downloader to change the payload malware for the user to get served with spyware or ransomware,” says Nick FitzGerald, ESET senior research fellow.

The Flash update screen looks genuine enough, however those that fall for the scam are then prompted of a successful install. The malware then creates a ‘Saving Battery’ service that wants access to permissions in Android’s Accessibility functions.

Those permissions are ‘monitor your actions, retrieve window content and turn on Explore by touch’, all of which enable attackers to copy user clicks and select anything on the screen.

Meanwhile, the Flash malware hides its icon and communicates with the C&C server and provides information about the infected device. The server can then deliver a URL with other malware. The compromised device then shows a fake lock screen with no option to close it, disguising all malicious activity.

ESET provides the following tips for users to find out if they have been infected:

"The key indicator of whether a device has been infected with this malware is the presence of a “Saving Battery” option amongst Services in the Accessibility menu.

Denying the service its permissions will not get rid of Android/TrojanDownloader.Agent.JI. To remove the downloader, try manually uninstalling the app from Settings -> Application Manager -> Flash-Player.

In some instances, the user has been successfully tricked into granting Device administrator rights to the app. In such a case, it is necessary to deactivate the administrator rights first, by going to Settings -> Security -> Flash-Player, before uninstalling."

To avoid infection, Fitzgerald offers some key pointers:

“There is no Adobe Flash Player for Android, so if you have installed one, warned that your version needs updating, or installed that “update”, you should install a security product and scan the whole device, as you have been duped and most likely have something undesirable running on your device.”

  • Use official app stores and trustworthy sources for app downloads and updates
  • Carefully consider what permissions the app is asking for
  • Use mobile security for better protection 
Story image
Fast track your digital transformation with dynamic security services from Fortinet
Jon McGettigan, Fortinet A/NZ Regional Director, explains how enterprises can speed up their network service delivery programmes by embracing Fortinet’s dynamic security services.More
Link image
Webinar: Best practices for managing disparate security solutions
As budgets get more constrained, the emphasis shifts from merely finding threats to increased efficiency in managing security operations. Learn how to juggle a crowded field of solutions.More
Story image
OT networks warned of vulnerabilities in CodeMeter software
Manufacturers using the Wibu-Systems CodeMeter third-party licence management solution are being urged to remain vigilant and to urgently update the solution to CodeMeter version 7.10.More
Story image
Gartner: By 2023, 65% of the world will have personal data covered under modern privacy regulations
“Security and risk management (SRM) leaders need to help their organisation adapt their personal data handling practices without exposing the business to loss."More
Story image
Ripple20 threat has potential for 'vast exploitation', ExtraHop researchers find
One in three IT environments are vulnerable to a cyber threat known as Ripple20. This is according to a new report from ExtraHop, a cloud-native network detection and response solutions provider. More
Story image
CrowdStrike integrates with ServiceNow program to bolster incident response
As part of the move, users can now integrate device data from the CrowdStrike Falcon platform into their incident response process, allowing for the improvement of both the security and IT operation outcomes.More