All the news
19.06 New Node.js trojan threatens gamers
June 19, 2019
Yandex has submitted a rare sample of the Node.js trojan for research to Doctor Web’s virus laboratory. This malware was distributed via websites with video game cheats and has several versions and components.
When users attempt to download a cheat they download a password-protected 7zip archive to their computers. Inside there is an executable file; which upon launch, will download the requested cheats alongside other trojan’s components.
Upon launching on the victim's device, Trojan.MonsterInstall downloads and installs all the components necessary for its work, gathers information about the system its installed on, and sends it to the developer’s server. After receiving a response, it installs itself in the autorun and starts mining the TurtleCoin cryptocurrency.
Developers of this malware own several websites with game cheats, which they use to spread the malware, but they also infect other similar websites with the same trojan. According to SimilarWeb’s statistics, users browse these websites at least 127,400 times per month.
Websites owned by the malware developers:
- румайнкрафт[.]рф;
- clearcheats[.]ru;
- mmotalks[.]com;
- minecraft-chiter[.]ru;
- torrent-igri[.]com;
- worldcodes[.]ru;
- cheatfiles[.]ru.
Moreover, some cheats from the proplaying[.]ru website turned out to be infected as well.
Doctor Web’s experts recommend that users timely update the anti-virus and avoid downloading suspicious software.
We would also like to thank specialists from Yandex for providing the sample and additional information about the trojan’s points of distribution.
#JavaScript #games #mining
14.06 Doctor Web: Android users threatened by fraudulent push notifications
June 14, 2019
The Web Push technology allows websites to send notifications even when the webpage is not open in the browser if the user agrees to that. When it comes to harmless websites, this feature can be useful and convenient. For example, social media can notify the users on new messages, and news agencies can spread information about new articles. However, cybercriminals and unscrupulous advertisers can abuse this technology by spreading advertising and fraudulent notifications that come from hacked or malicious websites.
PC, laptop browsers, as well as mobile devices support these notifications. Typically, the victim gets to a questionable spamming website by clicking a unique link or an advertising banner.
When launched, the trojan loads a website in Google Chrome. The website is specified in the trojan settings. According to its parameters, it performs several redirects to pages of various affiliated programs. Each of them prompts the user to allow notifications. To be convincing, they inform the victim that it is done for verification purposes (for example, that the user is not a robot), or simply hint on which dialog button to click. Thus, they increase the number of successful subscriptions. See examples of such queries in the images below:
After activating the subscription, websites start sending the user numerous notifications of questionable content. Notifications are displayed in the status bar of the operating system even if the browser is closed and the trojan has already been removed. The contents can be anything, from false notifications about cash bonuses or transfers or new messages on social media to advertisements of horoscopes, casinos, goods and services, even various “news”.
Many of them look like real notifications of actual online services and applications installed on the device. For example, they display the logo of a bank, a dating website, a news agency, or a social network, as well as an eye-catching banner. Owners of Android devices can receive dozens of such spam messages per day.
Although these notifications also indicate the address of the website they come from, an unskilled user may fail to notice it, or not give it much thought. See below the examples of fraudulent notifications:
Having clicked a notification, the user is redirected to a website with questionable content. This may include advertising of casinos, betting shops, various Google Play applications, discounts and coupons, fake online polls and prize drawings, aggregators of partner links, and other online resources that vary depending on the country of residence of the user. See examples of such websites below:
Many of these resources are involved in well-known fraudulent schemes for stealing funds, but attackers can also launch an attack to steal confidential data at any time. For example, by sending an “important” notification via the browser on behalf of a bank or a social network. Potential victims can think the fake notification is real and tap it only to be redirected to a phishing site, where they will be prompted to indicate their name, credentials, email addresses, bank card numbers, and other confidential information.
Doctor Web experts believe that cybercriminals will make more active use of this method to promote questionable services, so mobile users should be careful while visiting websites and not subscribe to notifications if the website is unfamiliar or suspicious. If you are already subscribed to spam notifications, perform the following steps:
- Go to the Google Chrome settings, select “Site Settings” and then “Notifications”;
- On the list of websites with notifications, find the website address, tap it, and select “Clear & reset”.
Dr.Web for Android successfully detects and removes all known modifications of
Read more about Android.FakeApp.174
Your Android needs protection.
Use Dr.Web
- The first Russian anti-virus for Android
- Over 140 million downloads—just from Google Play
- Available free of charge for users of Dr.Web home products
05.06 Components updated in Dr.Web 12.0 products for Windows
June 5, 2019
Changes made to SpIDer Agent for Windows:
- Minor UI defects have been corrected;
- Problems with the file dialogue box have been eliminated;
- Now Dr.Web checks if system restart permissions are available under the current user account before the “Restart now” prompt appears on the notification bar;
- The new UI language file format is now supported.
Changes made to Dr.Web Scanner SE:
- UI elements in the plugin settings window now display properly on high-resolution screens;
- More accurate information about scanning progress is now displayed;
- The new UI language file format is now supported.
Changes made to the Dr.Web Net filtering Service:
- The new UI language file format is now supported.
Changes made to Dr.Web for Outlook Plugin:
- Issues involving Polish UI texts have been resolved;
- Text file previews generated during the malicious attachment neutralisation process now display correctly;
- The correct number of ignored objects is now shown in the statistics;
- An issue that could interrupt email scanning if MS Outlook was being started from the context menu has been resolved;
- The new UI language file format is now supported.
Furthermore, the UI language file format (LNG instead of DWL) and the files' catalogue location have been changed.
The update will be performed automatically; however, a system reboot will be required.
June 4, 2019
Specifically, it eliminates a problem preventing War Thunder from launching under Windows 10 1903 Redstone 6.
The update will be downloaded and installed automatically.
04.06 Dr.Web 12.0.4 for Microsoft Exchange Server released
June 4, 2019
A new module option lets users specify additional types of objects that are to be marked as spam. Those include mailing lists, advertisements, suspected spear-phishing emails, social media messages, and transaction notifications. The option can be found in the «Mark as spam» section.
More information about the upgrade process, as well as the system requirements for Dr.Web 12.0.4 for Microsoft Exchange Server, can be found in the release notes.
03.06 A stealer trojan found in email traffic, new macOS backdoor and other events in May 2019
June 3, 2019
03.06 Doctor Web’s May 2019 virus activity review
June 3, 2019
In May, Dr.Web’s statistics registered a 1.49% increase in the number of unique threats compared to April; while the number of all detected threats increased by 14.51%. Malware and unwanted programs statistics show the prevalence of adware and installers. E-mail traffic is still dominated by malware that uses the vulnerabilities of Microsoft Office programs, but in May we also registered an increase in the spread of the dangerous trojan,
Principal Trends in May
- An increase in malware spreading activity
- Trojan stealers distributed via email
Threat of the month
In May, Doctor Web’s researchers warned about unique malware for the macOS operating system–
According to Doctor Web’s statistics servers
Threats of the month:
- Adware.Softobase.12
- Installation adware that spreads outdated software and changes the browser’s settings.
- Adware.Ubar.13
- A torrent client designed to install unwanted programs on a user’s device.
- Trojan.InstallCore.3553
- Another well-known adware installer. It shows ads and installs additional programs without the user’s permission.
- Trojan.Winlock.14244
- A ransomware trojan that blocks or limits a user’s access to the Windows operating system and its functionalities. In order to unlock the system, a user must transfer money to the cybercriminals.
- Trojan.Starter.7394
- A trojan designed to launch other malicious software on a victim’s device.
Statistics for malware discovered in email traffic
Threats of the month:
- W97M.DownLoader.2938
- A family of downloader trojans that exploit vulnerabilities in Microsoft Office applications. Designed to download other malware onto a compromised computer.
- Exploit.ShellCode.69
- Another malicious Microsoft Office Word document. This one uses vulnerability called CVE-2017-11882.
- Exploit.Rtf.CVE2012-0158
- Another malicious Microsoft Office Word document. This one uses a vulnerability called CVE2012-0158.
- Exploit.Rtf.435
- A malicious Microsoft Office document that uses the CVE-2017-11882 vulnerability to download the Trojan.Fbng.8 (FormBook) trojan on users’ devices.
- Trojan.PWS.Stealer.19347
- A family of trojans designed to steal passwords and other confidential information stored on an infected computer.
Increased malware activity:
- Trojan.Inject3.15480
- Trojan also known as Trojan.Fbng.8 (FormBook). The Trojan also known as FormBook. It’s designed to steal private data, but can also receive commands from the developer’s server.
Encryption ransomware
In May, victims of the following encryption ransomware most frequently contacted Doctor Web’s technical support service:
Trojan.Encoder.18000 — 15.38%Trojan.Encoder.858 — 9.89%Trojan.Encoder.11464 — 5.49%Trojan.Encoder.25574 — 5.49%Trojan.Encoder.11539 — 5.27%Trojan.Archivelock — 5.05%Trojan.Encoder.567 — 1.98%
Dr.Web Security Space for Windows protects against encryption ransomware
Dangerous websites
During May 2019, Doctor Web added 223,952 URLs to the Dr. Web database of non-recommended sites.
| April 2019 | May 2019 | Dynamics |
|---|---|---|
| + 345 999 | + 223 952 | - 35.27% |
Malicious and unwanted programs for mobile devices
In May, malware developers again distributed various malicious programs through the Google Play service. Researchers at Doctor Web discovered a trojan,
The most noticeable May event related to mobile malware:
- The spread of new malware on Google Play;
Find out more about malicious and unwanted programs for mobile devices in our special overview.
Learn more with Dr.Web
03.06 Spyware trojans and obnoxious ads: May 2019 mobile virus activity review
June 3, 2019
| Go to the review |
03.06 May 2019 mobile malware review from Doctor Web
June 3, 2019
In the past month, Android devices were once again targeted by malicious programs distributed via Google Play. The list contained the
PRINCIPAL TREND IN MAY
- Distribution of malicious applications on Google Play
Mobile threat of the month
The malware detected in May included spyware trojans from the
After installation and launch, these malicious programs attempted to assign themselves as the default SMS manager, requesting permission from the user. If permission was granted,
Specific features of the malware:
- it was intended for Spanish-speaking users;
- it was based on the open source SMSdroid software with an added trojan function.
According to statistics collected by Dr.Web for Android
Android.Backdoor .682.origin- A trojan that executes cybercriminals’ commands and helps them control infected mobile devices.
Android.RemoteCode .4411Android.RemoteCode .197.origin- Malicious applications designed to download and execute arbitrary code.
Android.HiddenAds .261.originAndroid.HiddenAds .1102- Trojans designed to display intrusive advertisements. They are distributed as popular applications by other malicious programs; which in some cases, covertly install them in the system catalog.
- Adware.Zeus.1
- Adware.Jiubang.2
Adware.AdPush .33.origin- Adware.Toofan.1.origin
- Unwanted program modules that embed themselves into Android applications and display obnoxious ads on mobile devices.
Tool.VirtualApk .1.origin- A riskware platform that allows applications to launch APK files without installing them.
Adware trojan
In early May, Doctor Web analysts discovered the
The malicious program did allow users to listen to music, but then hid its icon after the first launch, preventing users from launching it again.
New malicious and unwanted applications keep appearing on Google Play. Doctor Web recommends Android device owners to install Dr.Web for Android to protect themselves.
Your Android needs protection.
Use Dr.Web
- The first Russian anti-virus for Android
- Over 140 million downloads—just from Google Play
- Available free of charge for users of Dr.Web home products
14.05 A new threat for the macOS system spreads disguised as WhatsApp
May 14, 2019
Our researchers discovered the new threat on April 29. This malware was named
When users open one of those websites, the embedded code detects the visitor’s operating system and depending on that uploads either the backdoor or a trojan. If a visitor uses macOS, their device gets infected with
According to our information, the website spreading
13.05 Components in Dr.Web Enterprise Security Suite 11.0 updated
May 13, 2019
Changes made to Lua-script for help:
- The script version has been updated.
Changes made to Dr.Web Control Service:
- An issue preventing the software from updating in mobile mode has been resolved.
Changes made to Dr.Web Enterprise Agent for Windows setup:
- The update addresses an installation issue that could occur if a current user account name contained more than 17 ideograms.
The update will be downloaded and installed automatically.
May 6, 2019
| Go to the review |
06.05 Doctor Web’s April 2019 virus activity review
May 6, 2019
In April, Dr.Web’s statistics showed a 39.44% decrease in the number of unique threats compared to March; while the number of all detected threats decreased by 14.96%. E-mail traffic is still dominated by malware that uses the vulnerabilities of Microsoft Office programs. The previous month’s malware and unwanted programs trend also continues. The malicious browser extensions, unwanted programs and adware account for the majority of detected threats.
The number of non-recommended websites increased by 28.04%. One such website was used for spreading a banking trojan and stealer, along with the video and sound editing software, which we reported at the beginning of the month. Additionally, Doctor Web’s researchers warned about the phishing newsletter sent from official e-mails of large international companies.
Principal trends in April
- A decline in malware spreading activity
- An increase in the number of domain names added to the Dr.Web database of non-recommended websites
Threat of the month
Doctor Web researchers warned users about a compromised, popular website, which distributes video and sound editing software. Hackers hijacked download links on the website causing visitors to download the dangerous banking trojan, Win32.Bolik.2, and the Trojan.PWS.Stealer (KPOT) stealer, along with the editing software. Trojans of this family are designed to perform web injections, intercept traffic, log keys and steal information from different bank-client systems. Additionally, the attackers later changed the Win32.Bolik.2 trojan to another malware, the Trojan.PWS.Stealer (KPOT Stealer). This trojan steals information from browsers, Microsoft accounts, several messengers and some other programs.
According to Doctor Web’s statistics servers
Threats of the month:
- Adware.Softobase.12
- Installation adware that spreads outdated software and changes the browser’s settings.
- Adware.Ubar.13
- A torrent client designed to install unwanted programs on a user’s device.
- Trojan.Starter.7394
- Trojan designed for launching other malicious software on a victim’s device.
Adware.Downware.19283 - The sort of adware that is usually distributed as an installer for pirated software. Upon installation, it changes a browser’s settings and may install other software without asking for the user’s permission.
Statistics for malware discovered in email traffic
- Exploit.ShellCode.69
- A modified Microsoft Office document. It exploits the CVE-2017-11882 vulnerability in order to run malicious code.
- Exploit.Rtf.CVE2012-0158
- Another malicious Microsoft Office Word document. This one uses a vulnerability called CVE2012-0158.
- JS.DownLoader.1225
- A variety of malicious code written in JavaScript and designed to download and install other malware on a computer.
- Trojan.Encoder.26375
- A malicious program from the encryption ransomware family. This trojan encrypts files and demands a ransom for data decryption.
- W97M.DownLoader.2938
- A family of downloader Trojans that exploit vulnerabilities in office applications. Designed to download other malware onto a compromised computer.
Encryption ransomware
In April, Doctor Web’s technical support was most frequently contacted by victims of the following encryption ransomware:
Trojan.Encoder.858 — 17.95%Trojan.Encoder.18000 — 14.65%Trojan.Encoder.11464 — 7.69%Trojan.Archivelock — 5.49%Trojan.Encoder.567 — 3.85%Trojan.Encoder.11539 — 3.85%Trojan.Encoder.25574 — 2.75%
Dr.Web Security Space for Windows protects against encryption ransomware
Dangerous websites
During April 2019, Doctor Web added 345,999 URLs to the Dr.Web database of non-recommended websites.
| March 2019 | April 2019 | Dynamics |
|---|---|---|
| + 270 227 | + 345 999 | + 28.04% |
Malicious and unwanted programs for mobile devices
In April, Doctor Web reported the dangerous trojan,
Also during April, new malware such as trojan downloaders and clickers were discovered in the Google Play catalogue, as well as new credential stealers for Instagram, called Android.PWS.Instagram.4 and Android.PWS.Instagram.5.
Additionally, new banking trojans threatened Android smartphone and tablet users. Among them were new versions of the
Among the most noticeable April events related to mobile malware were:
- the spread of malicious programs on Google Play;
- the distribution of banking trojans.
Learn more with Dr.Web
April 30, 2019
| Go to the review |
30.04 April 2019 mobile malware review from Doctor Web
April 30, 2019
In April Doctor Web reported on the
PRINCIPAL TRENDS IN APRIL
- The detection of new malicious applications on Google Play
- Distribution of banking trojans
Mobile threat of the month
In early April Doctor Web reported on a dangerous trojan,
According to statistics collected by Dr.Web for Android
Android.Backdoor .682.origin- A trojan that executes cybercriminals’ commands and helps them control infected mobile devices.
Android.HiddenAds .1102Android.HiddenAds .261.origin- Trojans designed to display intrusive advertisements. They are distributed as popular applications by other malicious programs; which in some cases, covertly install them in the system catalog.
Android.RemoteCode .4411- A malicious application designed to download and execute arbitrary code.
Android.DownLoader .812.origin- A Trojan that downloads other malicious applications.
- Adware.Zeus.1
Adware.AdPush .33.origin- Adware.Toofan.1.origin
- Adware.Jiubang.2
- Unwanted program modules that incorporate themselves into Android applications and display obnoxious ads on mobile devices.
Tool.VirtualApk .1.origin- A riskware platform that allows applications to launch APK files without installing them.
Banking trojans for Android
Over the past month, banking trojans threatened users of Android devices. In late April Doctor Web virus analysts detected new modifications of the
These modifications of
These trojan modifications are able to intercept and send SMS on hackers’ command, show phishing windows, make calls, and listen to the surrounding environment using the device’s built-in microphone. On top of that, they can control smartphones and tablets; for example, they can turn on Wi-Fi, connect to the Internet via a mobile network, block the screen, and so on.
In addition, new downloaders from the
Trojans on Google Play
Aside from downloaders, other trojans, such as
This malicious software opens hidden activity with several WebView elements. A website is loaded on one of them to get commands. Hackers use other WebViews to load different JavaScript and specified websites where they simulate user actions. On these websites, they click links and banner ads to drive up hit and click counters. Hackers can also subscribe mobile device owners to paid services by clicking on special buttons if service providers support the Wap-Click technology of fast subscription. To make themselves more difficult to delete, trojans hide their icons from the operating system’s main screen.
In late April, new entries were added to the Dr.Web virus database to detect the trojans
Other threats
The
To distribute itself among a greater number of users, the trojan sent SMS with a link to the download page of its copy to all contacts of the infected device. The main goal of
Users of Android devices are threatened by different trojan applications that are distributed not only via malicious websites, but also via the official Google Play store. To protect smartphones and tablets, we recommend that you install Dr.Web for Android.
Your Android needs protection.
Use Dr.Web
- The first Russian anti-virus for Android
- Over 140 million downloads—just from Google Play
- Available free of charge for users of Dr.Web home products
April 26, 2019
An issue resulting in the possible abnormal termination of both products has been corrected.
If you downloaded your Dr.Web application from Google Play, the update will be downloaded and installed automatically. If you’ve disabled automatic updating on your device, go to Google Play, select Dr.Web Security Space, Dr.Web Security Space Life or Dr.Web Anti-virus Light on the application list, and click "Update”.
To update via the Doctor Web site, you need to download a new distribution file. If you’ve enabled the “New app version” option in the settings, a notification will be displayed whenever the virus databases are updated. You can start the download directly from this dialogue box.
24.04 Dr.Web Net filtering Service updated in Dr.Web Security Space 12.0 and Dr.Web Anti-virus 12.0
April 24, 2019
Changes were made to Dr.Web Net filtering Service in order to make the products compatible with i-FILTER on computers running Windows 8 and later versions.
The update will be performed automatically; however, a system reboot will be required.
April 23, 2019
Specifically, it eliminates a drweb-antispam issue preventing the anti-spam module from using a freshly downloaded library after an update was downloaded.
Also resolved was a drweb-configd issue preventing anti-spam filtering from taking place when default settings were in use.
The update is performed via the Dr.Web repository.
#update #Dr.Web #UNIX #Linux
18.04 Components updated in Dr.Web 12.0 products for Windows
April 18, 2019
Changes made to Dr.Web Control Service:
- The module has been updated to be compatible with the upcoming Windows 10 Redstone 6 release.
Changes made to Dr.Web Updater:
- An updating issue involving the update mirror directories on FAT32 partitions has been resolved.
Changes made to Dr.Web Security Space, Anti-virus for Windows setup:
- The UI elements are now displayed correctly in the setup window.
The update will be downloaded and installed automatically.
15.04 Dr.Web Security Space for Android on Google Play updated to version 12.3.2
April 15, 2019
Enhanced threat detection:
- The ability to detect the
EvilParcel vulnerability; - An improved ability to detect signs of infection in previously installed applications;
- The added ability to detect malicious applications packed with Bangcle, Sechell, and the latest version of Tencent;
- A fix that ensures uninterrupted anti-virus scanning.
Changes affecting the application’s UI and features:
- The Call and SMS Filter and Anti-theft components have been disabled;
- The URL shortening feature is no longer available;
The Call and SMS Filter and Anti-theft components have been disabled to comply with Google Play policy changes. Under the new permission policy, anyone who has an anti-virus installed on their Android device can no longer access features related to SMS data.
The Dr.Web software will be updated automatically under Android 4.4 and later. If automatic updates are disabled on your device, go to Google Play, select Dr.Web Security Space on the application list, and tap "Update."
To update via the Doctor Web site, you need to download a new distribution file. If the “New app version” option has been enabled in the settings, a notification will be displayed whenever the virus databases are updated. You can start the download directly from this dialogue box.
April 12, 2019
The attackers embed the trojan in initially harmless software and then distribute the modified copies via popular third-party Android stores, such as Nine Store and Apkpure. Our experts detected Android.InfectionAds.1 in games and software such as HD Camera, ORG 2018_19\Tabla Piano Guitar Robab Guitar, Euro Farming Simulator 2018, and Touch on Girls. Some of them were installed by at least several thousand mobile device owners. However, the number of infected applications and affected users may be much greater.
When a user launches a program containing a trojan, it extracts auxiliary modules from file resources to decrypt and launch them as well. One of them is designed to display obnoxious ads, while others infect applications and automatically install software.
Android.InfectionAds.1 overlays advertising banners on the system interface and running applications, making it difficult to work with the devices. In addition, if triggered by the command and control server, the trojan can modify the code of popular advertising platforms, such as Admob, Facebook, and Mopub, which are used in many programs and games. It replaces their advertising identifiers with its own identifier so that all profits from displaying advertisements in infected applications are transferred to the attackers.
Android.InfectionAds.1 exploits the critical vulnerability CVE-2017-13315 in Android, which allows the trojan to launch system activities. As a result, it can automatically install and uninstall programs without a user’s knowledge. The trojan is based on the PoC code (Proof of Concept) by Chinese researchers, written to prove the possibility of exploiting this system breach.
CVE-2017-13315 falls under the EvilParcel class of vulnerabilities. This means that a number of system components contain an error that allows for alteration of data during the exchange between applications and the operating system. The final value of the specifically generated fragment of the transmitted data will differ from the initial one. Thus, programs are able to bypass operating system checks, obtain higher privileges, and perform previously unavailable actions. As of now, we know of 7 vulnerabilities of this type, but the number may increase over time.
Using EvilParcel, Android.InfectionAds.1 installs the hidden APK file that contains all components of the trojan. Similarly, Android.InfectionAds.1 is able to install its own updates, downloaded from the command and control server, as well as other software or malware. For example, during our analysis, the trojan downloaded and installed the malware Android.InfectionAds.4, one of its own modifications.
An example of how the trojan installs applications without the user’s permission:
Along with EvilParcel, the trojan also exploits another Android vulnerability known as Janus (CVE-2017-13156). This system breach can be used to infect previously installed applications by embedding the trojan’s copy within them. Android.InfectionAds.1 connects to the command and control server and obtains a list of programs that it needs to infect. If it fails to connect to the remote server, it will infect applications specified in the initial settings. Depending on the modification, the list may contain different items. See below an example from one of the versions of Android.InfectionAds.1 we have investigated:
- com.whatsapp (WhatsApp Messenger);
- com.lenovo.anyshare.gps (SHAREit - Transfer & Share);
- com.mxtech.videoplayer.ad (MX Player);
- com.jio.jioplay.tv (JioTV - Live TV & Catch-Up);
- com.jio.media.jiobeats (JioSaavn Music & Radio – including JioMusic);
- com.jiochat.jiochatapp (JioChat: HD Video Call);
- com.jio.join (Jio4GVoice);
- com.good.gamecollection;
- com.opera.mini.native (Opera Mini - fast web browser);
- in.startv.hotstar (Hotstar);
- com.meitu.beautyplusme (PlusMe Camera - Previously BeautyPlus Me);
- com.domobile.applock (AppLock);
- com.touchtype.swiftkey (SwiftKey Keyboard);
- com.flipkart.android (Flipkart Online Shopping App);
- cn.xender (Share Music & Transfer Files – Xender);
- com.eterno (Dailyhunt (Newshunt) - Latest News, LIVE Cricket);
- com.truecaller (Truecaller: Caller ID, spam blocking & call record);
- com.ludo.king (Ludo King™).
To infect software, the trojan embeds its components in APK files without changing the digital signature. Then it installs the modified versions of the apps instead of the originals. Since the vulnerability helps the digital signature of the infected files remain the same, the programs are installed as their own updates. At the same time, EvilParcel helps perform the installation independently from the user. As a result, the affected software continues its normal operations, but with a functioning copy of Android.InfectionAds.1 within it. Once apps are infected, the trojan gets access to their data. For example, if WhatsApp is infected, the trojan gets access to all users’ messages, if a browser is infected, saved logins and passwords are available to the trojan.
The only way to remove the trojan and restore the security of the infected programs is to remove the applications containing it and reinstall their normal versions from reliable sources, such as Google Play. The updated version of Dr.Web Security Space for Android is able to detect EvilParcel vulnerabilities. This feature is available in Security Auditor. You can download a new distribution package from the Doctor Web official website. Soon it will be available on Google Play as well. All Dr. Web products for Android successfully detect and remove known modifications of Android.InfectionAds.1, so the trojan does not pose any threat to our users.
[Read more about Android.InfectionAds.1]
#Android, #trojan, #malware
11.04 Dr.Web Anti-rootkit API updated in Dr.Web 12.0 products for Windows
April 11, 2019
Specifically it resolves a threat neutralisation issue involving directory names containing invalid path characters.
The update will be downloaded and installed automatically.
11.04 The official website of a popular video editing software was infected with a banking trojan
April 11, 2019
VSDC is a popular, free software for editing video and sound. According to SimilarWeb statistics, monthly visits of the VSDC website come close to 1.3 million users. However, the security measures taken by the website’s developers often turn out to be insufficient for such traffic volume, which endangers a large number of people.
Last year unknown hackers gained access to the administrative side of the VSDC website and replaced the download links. Instead of the editing software, users received a JavaScript file, which then downloaded the AZORult Stealer, X-Key Keylogger and the DarkVNC backdoor. The VSDC team stated that they closed the vulnerability, but recently we received information about additional cases of infection through their website.
According to our researchers, the VSDC developer’s computer has been compromised several times since the previous incident. One such hack led to the website being compromised again between 2019-02-21 and 2019-03-23. This time hackers took a different approach to spreading the malware: they embedded a malicious JavaScript code inside the VSDC website. Its task was to determine the visitor’s geolocation and replace download links for users from the UK, USA, Canada and Australia. Native website links were substituted by links to another compromised website:
- https://thedoctorwithin[.]com/video_editor_x64.exe
- https://thedoctorwithin[.]com/video_editor_x32.exe
- https://thedoctorwithin[.]com/video_converter.exe
Users that downloaded software from that website also received a dangerous banking trojan, Win32.Bolik.2. Same as its predecessor,
Additionally, on 22.03.2019 the attackers changed the Win32.Bolik.2 trojan to another malware, a variation of the Trojan.PWS.Stealer, KPOT Stealer. This trojan steals information from browsers, Microsoft accounts, several messengers and some other programs. In just one day it was downloaded by 83 users.
The VSDC developers were notified about the threat; and at the present moment, download links were restored to the originals. However, Doctor Web experts recommend that all VSDC users check their devices with our antivirus.
#banker #banking_trojan #virus
10.04 Dr.Web Security Space for Android updated to version 12.3.2
April 10, 2019
Improvements in the new version include:
- Ability to detect the EvilParcel vulnerability;
- An improved ability to detect signs of infection in previously installed applications;
- The added ability to detect malicious applications packed with Bangcle, Sechell, and the latest version of Tencent;
- A fix that ensures uninterrupted anti-virus scanning.
To update via the Doctor Web site, you need to download a new distribution file. If the “New app version” option has been enabled in the settings, a notification will be displayed whenever the virus databases are updated. You can start the download directly from this dialogue box.
10.04 Full version of Dr.Web Security Space for Android available only from Doctor Web`s site
April 15, 2019
Dr.Web anti-viruses with SMS functionality were removed from Google Play as a follow-up to the recent changes in Google’s permission policy—first Dr.Web Security Space for Android Life became inaccessible, and then Dr.Web Security Space for Android was removed too. To comply with the new requirements, we removed the affected protection components from the applications, and now the programs are once again available for download from Google Play, albeit without the Call and SMS filter and the Anti-theft.
Doctor Web invites all customers wanting to use the full version of Dr.Web Security Space for Android to download the application from Doctor Web's official site. You will still be able to use the serial number you acquired from Google Play.
Download the full version of Dr.Web Security Space for Android
#Android #mobile #subscription #Google #Google_Play
