Security-X

Forum Security-X => News => Discussion démarrée par: igor51 le novembre 10, 2017, 09:02:10

Titre: [FireEye]Android Users Beware -- ‘Mandiant’-Branded Malware Identified
Posté par: igor51 le novembre 10, 2017, 09:02:10

Android Users Beware -- ‘Mandiant’-Branded Malware Identified

 

FireEye Labs recently identified malware for Android devices that
    masquerades as a Mandiant product. The malware can lock Android
    devices and displays a lock screen that uses the Mandiant brand.

   

To a victim in the United States, this lock screen may appear
  as:

          style="border: 2.0px solid black;" alt="Figure 1"
      src="https://www.fireeye.com/content/dam/legacy/ammo/Figure-16.png"
      width="536" height="819" />

To try to make the lock message
    more convincing, the criminals can use a different header image
    depending on the victim's country:

    class="size-full wp-image-5708 " style="border: 2.0px solid black;"
    title="Banner displayed to victims in the US"
    alt="Banner displayed to victims in the US"
    src="https://www.fireeye.com/content/dam/legacy/ammo/Banner-displayed-to-victims-in-the-US.jpg"
    width="1000" height="175" />Banner displayed to victims in the
    US    style="border: 2.0px solid black;"
    alt="Banner displayed to victims in Australia"
    src="https://www.fireeye.com/content/dam/legacy/ammo/Banner-displayed-to-victims-in-Australia.jpg"
    width="1000" height="175" />Banner displayed to victims in
    Australia    style="border: 2.0px solid black;"
    alt="Banner displayed to victims in Ireland"
    src="https://www.fireeye.com/content/dam/legacy/ammo/Banner-displayed-to-victims-in-Ireland.jpg"
    width="1000" height="175" />Banner displayed to victims in
    Ireland    style="border: 2.0px solid black;"
    alt="Banner displayed to victims in Poland"
    src="https://www.fireeye.com/content/dam/legacy/ammo/Banner-displayed-to-victims-in-Poland.jpg"
    width="1000" height="175" />Banner displayed to victims in
    Poland    style="border: 2.0px solid black;"
    alt="Banner displayed to victims in France"
    src="https://www.fireeye.com/content/dam/legacy/ammo/Banner-displayed-to-victims-in-France.jpg"
    width="1000" height="175" />Banner displayed to victims in
    France

The Android malware is typically delivered by tricking the
    victim into installing it after visiting a malicious website. Once
    installed, it will run every time the device boots and displays the
    lock screen. The malware can communicate with several command and
    control servers using the following domains:

-
  police-strong-mobile[.]com

- mobile-policeblock[.]com

-
  police-secure-mobile[.]com

- police-scan-mobile[.]com

-
  police-mobile-stop[.]com

- police-guard-mobile[.]com

Our
    research indicates police-strong-mobile[.]com is actively in use,
    and has been online since March 29, 2014.

The apps themselves
    are well obfuscated-the method names inside the app are written in
    non-meaningful strings. The methods the app calls are constructed
    using a 5-byte XOR key dynamically. We have also noticed different
    XOR keys used for every different decoding instance. The app also
    blocks access to images, and it forces the user to pay a fee to
    access the contents.

This isn't the first time that we've
    seen cybercriminals trading on Mandiant's brand. Last year, Mandiant
    identified PC malware that was locking users' computers and
    displaying content saying the system was locked due to criminal
    activity. As       href="https://www.mandiant.com/blog/malware-mandiants/"
      target="_blank">we indicated last year, this is part of a scam
    designed to extort money from victims.

We recommend victims
    of this malware report the incident to the       href="https://www.ic3.gov/default.aspx" target="_blank">Internet
      Crime Center.

Source: Android Users Beware -- ‘Mandiant’-Branded Malware Identified (http://)