This dangerous new malware also has ransomware capabilities

Date:
Wed, 26 Apr 2023 17:56:19 +0000

Description:
Daam malware found targeting Android devices, where it can steal data and encrypt files.

FULL STORY ======================================================================

A new Android malware variant has been found thats capable of hiding from antivirus programs, stealing sensitive data, and even deploying ransomware on the infected endpoints.

Cybersecurity experts from CloudSEKs Threat Intelligence Research Team discovered the malware, which they dubbed Daam.

The malware was communicating with various Android APK files, the researchers said, suggesting that this was a likely source of infection. Recording calls

Once deployed on a device, the malware will first try to circumvent security checks on a range of mobile brands. If it successfully manages to hide from antivirus programs, it will try to get highly sensitive permissions, such as the ability to record audio, read history bookmarks, kill background processes, and read call logs.

The malware is also able to record all ongoing calls, both cellular and VoIP ones, and later transmit them to the command & control (C2) server. Daam is also capable of stealing contacts from the victim's device, as well as pilfering newly added contacts, as well.

In other words, even your WhatsApp calls wouldnt be safe from eavesdropping, and the files you store on your mobile device could be stolen.

To make matters worse, the malware was also observed to have ransomware capabilities. The researchers are saying Daam is able to encrypt the files on the device using AES algorithms present in the root directory and SD card. It also drops a readme_now.txt file - most likely a ransom note. Read more

This dangerous Android malware is seeing a huge rise in infections

Dangerous new 'Hook' Android malware lets hackers remotely control your

phone

Check out the best malware removal tools right now

After the encryption, all other files are deleted from local storage, leaving only the encrypted files with a .enc extension on the device.

The malware is being distributed through third-party websites, the researcher said, finding a total of three apps being circulated: Psiphon Client for Android and Windows - a circumvention software for Windows and Android that bypasses paywalls and other censored content; Boulders - a mobile game; and Currency Pro - a currency converter.

As usual, to stay safe, make sure to download apps only from legitimate sources, and to check reviews and user comments before downloading anything. Here are the best firewalls today



======================================================================
Link to news story: https://www.techradar.com/news/this-dangerous-new-malware-also-has-ransomware- capabilities


--- Mystic BBS v1.12 A47 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)