Virus alerts

Android.MagicAd trojan displays ads despite all restrictions

Thu, 04 Jun 2026 03:00:00 GMT

Doctor Web’s experts have discovered Android.MagicAd, a trojan that bypasses Android OS restrictions in various ways to display background ads. One of these methods is universal, while the others are designed for devices from specific manufacturers. These include exploiting third-party software and using the system media player.

Android.MagicAd.1 was distributed via GetApps, the official app catalog for Xiaomi devices, and was concealed in more than 50 games and programs. They were appearing in the app store for a short period of time—usually for up to a month, after which they would disappear and be replaced by the new ones. It is possible that this way, the threat actors were trying to protect Android.MagicAd.1 from premature detection; all that while maintaining its activity, because once removed from the store, the trojan programs remain on users’ devices and can continue performing malicious activities. Currently, none of the apps we identified as containing Android.MagicAd.1 are available for download in the GetApps catalog; and the developers who were distributing them have stopped adding new apps containing this trojan.

A study conducted by Doctor Web malware analysts showed that the first versions of Android.MagicAd.1 emerged in 2025, and that in addition to the GetApps catalog, they were also encountered in the Samsung Galaxy Store.

Examples of games and programs from the GetApps catalog in which Android.MagicAd.1 was concealed. At the time of this news release, these and other trojan modifications were unavailable for download

Part of Android.MagicAd.1’s malicious functionality is located in dex files hidden in encrypted native libraries, which are stored in the trojan’s file resource directory. While in operation, the trojan decrypts these libraries, and then extracts and runs its components from them.

Before proceeding to display ads, the trojan performs a number of checks to make sure its environment is safe. For example, it searches for signs that it is running in a virtual machine and verifies whether its installation was organic, whether the infected device’s IP address is in the malware’s black list, etc.

If Android.MagicAd.1 does not detect suspicious activity, it hides its icon from the apps list in the main screen menu. Next, it creates a notification channel, through which it launches several malicious persistence services necessary for the trojan app to work in the background when its window is closed. After that, using the task scheduler, Android.MagicAd.1 creates a task that periodically restarts services that check how the notification channel is working and restart it, if necessary. In addition, when running on devices with relatively old Android OS versions, the trojan launches a virtual screen so that the system cannot interrupt the work of one of its components.

To display ads in the background when its window is closed, Android.MagicAd.1 uses a number of techniques selected on the basis of the infected device’s manufacturer. At the same time, these methods are implemented without the explicit request for the system permission SYSTEM_ALERT_WINDOW, which allows the app to display itself on top of other programs’ windows.

Regardless of the technique used, all advertising banners are loaded as a Translucent Activity, which allows the trojan to draw them over the existing windows.

Examples of ads displayed by Android.MagicAd.1

One technique is implemented via Intents addressed to other programs. It allows the trojan to bypass the restrictions of modern Android OS versions, which do not allow programs to launch themselves. Depending on the infected device’s model, Android.MagicAd.1 uses this technique to either display ads itself or directly “force” target apps to show the advertising banners.

In one variation of this method, the trojan targets the following programs:

Mi Browser on Xiaomi devices;
Miui SystemUI graphical shell on Xiaomi devices; and
Amazon Fire TV Home Screen launcher on Amazon TV devices.

All of these are system apps on the corresponding devices, so they can process intents even when not launched by the user directly. While they are active and can receive intents, Android.MagicAd.1 can use them to display ads.

It is worth noting that if Mi Browser is installed on a Xiaomi device as a non-system program, the trojan can also use it to show ads—until the browser window is closed.

When Android.MagicAd.1 detects Mi Browser on a suitable device, it sends its dex component (detected by Dr.Web as Android.MagicAd.1.origin) a pending intent for launching the advertisement. This dex forms its own intent from it and sends it to the browser, which extracts the initial intent and launches the advertisement corresponding to it.

The interaction with two other target programs slightly differs, as they are used to call the trojan from the background. First, Android.MagicAd.1 sends its dex component a pending intent for launching the ad; this dex then sends its own intent to the target apps so that they awaken it. If the target app is Miui SystemUI, this program responds by sending its intent to awaken the module. If the target app is Amazon Fire TV Home Screen, this app launches the module directly—using the name of the module’s program packet. Once the Android.MagicAd.origin module gains control, it launches the advertisement from the pending intent sent by the main malicious program.

If the trojan fails to display the ad, it tries this method twice more, and if that fails, it tries displaying the advertisement directly, without using pending intents and its malicious dex module.

Another variant of this method resembles the previous one and is used to exploit apps on Vivo devices. It differs in that advertisements are launched with the help of Android Binder, a system component that facilitates interaction between processes. The trojan targets the following system programs:

iManager;
Phonebook;
Vivo Browser; and
Baidu IME Customized.

Android.MagicAd.1 launches these programs via Android Binder by sending it regular intents via the Parcel data container. These programs then launch the Android.MagicAd.origin trojan component from the background, and it displays the advertisement.

Android.MagicAd.1 also has several other methods for displaying ads while running in the background, with using media player being one of them. Unlike the techniques that target specific devices, this method is universal and works on most Android device models from different manufacturers. Android.MagicAd.1 decrypts an audio file from its body and saves it to its work directory. Next, the malware launches an instance of the system media player, sets a minimum volume in it, and links the player with the Android OS global media control system. After that, to launch advertisements, Android.MagicAd.1 enables a broadcast receiver that monitors button clicks in this player. The trojan then uses a special adb command to simulate user behavior by pressing the record button in the player and then instantly closes the player’s window. Pressing the button triggers the system media receiver, which allows Android.MagicAd.1 to take control and launch the ad.

Dr.Web Security Space for mobile devices reliably detects and removes all known versions of the Android.MagicAd.1 malware, keeping our users well protected from this threat.

Indicators of compromise

More details about Android.MagicAd.1

More details about Android.MagicAd.1.origin

Instead of a job—stolen data and money. Trojan stealer targeting macOS and Windows users conceals itself in fake online interview apps

Thu, 07 May 2026 14:41:46 GMT

Doctor Web’s experts are warning users about the spread of JobStealer, a trojan app that steals confidential information from macOS and Windows computer users. It primarily aims to hijack data from crypto wallets. Fraudsters, under the pretext of conducting online interviews, lure potential victims to malicious websites and ask them to download a video conferencing app. In reality, this software is the JobStealer trojan.

The attack begins with the threat actors contacting potential victims and offering them a particular job vacancy. They invite users to a job interview and provide them with links to websites for the online meeting “platforms”—supposedly to connect to a video conference. These websites look presentable but are actually fraudulent. The malicious program JobStealer, disguised as an online conferencing app, is downloaded from them. Cybercriminals use different designs for these Internet resources and also change the names of the “software”. Our specialists identified variants called MeetLab, Juseo, Meetix, Carolla, and others. In some cases, the attackers use names of real services, like Webex.

Examples of websites for fake online conferencing services from which JobStealer is downloaded

To convince users that these platforms are fully functional, scammers create corresponding Telegram channels and social media accounts—for example, on X.

To disguise the trojan as a legitimate piece of software, threat actors create the appearance of activity on social networks

To install the app on devices running macOS, visitors to malicious websites are provided with two options:

copy the bash command listed on the website and run it in the terminal;
download a disk image file in the .dmg format and launch it.

The JobStealer trojan is downloaded from malicious websites both in the form of a dmg container and by running a bash command in the terminal

In the first case, when a command is executed in the terminal, a script is automatically downloaded from the Internet and then executed. This script downloads and runs the JobStealer’s executable file (detected as Mac.PWS.JobStealer.1).

In the second case, the dmg image offered for download initially contains the abovementioned files. When mounted, it displays instructions on how to “install” the app. These instructions state that the user needs to open the terminal and drag the provided script into its window. In fact, instead of the video conferencing app getting installed, the script will launch the trojan file.

An image with the instructions that are displayed when the disk image file containing the JobStealer trojan is opened

Mac.PWS.JobStealer.1 is an executable container file in the Fat Mach-O format. It contains binary code for several processor architectures—x64 and arm64. Depending on the infected computer’s platform, when the trojan is launched, the component corresponding to the target processor is automatically initialized.

It should be noted that different versions of Mac.PWS.JobStealer.1 exist. The earlier variants of the malware did not work on Mac computers with the arm64 architecture. They also lacked obfuscation—something the trojan’s creators began to add and strengthen when updating the stealer.

When launched, Mac.PWS.JobStealer.1 displays a phishing window that alerts users about an alleged error in the app’s operation. To “fix” this error, the malicious program asks users to provide their user account password.

A phishing window asking for a Mac user account password

Next, Mac.PWS.JobStealer.1 collects the following data:

operating system version and computer ID;
data from about 300 crypto wallet browser extensions installed in target browsers based on Chromium (Chrome, Opera, Brave, OperaGX, Vivaldi, Edge, Arc, and CocCoc);
cookie files from these browsers;
passwords and bank card details saved in the browser’s autofill lists;
Telegram messenger files from the directories /Library/Application Support/Telegram Desktop/tdata and /Documents/temp_data/Apps/Telegram, where session authorization keys, downloaded files, etc., are stored;
user notes from the native macOS Notes application;
evidence that the crypto wallets Ledger Live and Trezor Suite are present in the system.

This data is packed into a ZIP archive and uploaded to the C2 server.

The malware’s creators have also prepared a version of JobStealer for computers running the Windows operating system. Its functionality is similar to that of the macOS version. In addition, some malicious websites distributing the stealer have dedicated sections for downloading the app for other popular operating systems. However, at this time, our virus analysts have not recorded their distribution. For example, the button for downloading the app for the Linux operating system is either inactive or leads to the Windows version of the trojan. And sections for downloading the app onto devices with iOS and Android inform users that these versions are in development. At the same time, it cannot be ruled out that the attackers will begin distributing variants of this trojan for those platforms in the future.

Malicious sites can potentially distribute versions of the JobStealer trojan designed for Linux, iOS, and Android

Dr.Web Security Space anti-virus products for macOS and Windows reliably detect and delete all known JobStealer malware modifications, keeping our users well protected from this threat. Fraudulent websites distributing the trojan are added to the database of non-recommended and dangerous resources and are also blocked by Dr.Web.

MITRE ATT&CK®

We analyzed Mac.PWS.JobStealer.1 using the MITRE ATT&CK® framework, a matrix describing the tactics and techniques that cybercriminals utilize to attack information systems. The following key techniques were identified:

Stage	Technique
Execution	User Execution (T1204) Malicious Copy and Paste (T1204.004) Malicious File (T1204.002)
Discovery	File and Directory Discovery (T1083)
Collection	Automated Collection (T1119) Data from Local System (T1005) Credentials from Password Stores (T1555) Keychain (T1555.001) Credentials from Web Browsers (T1555.003) Input Capture (T1056) GUI Input Capture (T1056.002) Archive Collected Data (T1560)
Command and Control	Web Service (T1102)
Exfiltration	Automated Exfiltration (T1020) Exfiltration Over C2 Channel (T1041) Exfiltration Over Web Service (T1567)

More details about Mac.PWS.JobStealer.1

Indicators of compromise

Doctor Web’s Q3 2025 virus activity review

Wed, 01 Oct 2025 06:00:00 GMT

October 1, 2025

According to statistics collected by the Dr.Web anti-virus, the total number of threats detected in the third quarter of 2025 decreased by 4.23%, compared to the second quarter. The number of unique threats increased by 2.17%. Among the most commonly detected threats were unwanted adware software, ad-displaying trojans, and malicious scripts. Email traffic was dominated by malicious scripts, backdoors, and various trojans, including downloaders, droppers, and password stealers.

Users whose files were affected by encoder trojans had mostly encountered Trojan.Encoder.35534, Trojan.Encoder.35209, and Trojan.Encoder.35067.

In July, Doctor Web’s experts informed users about the Trojan.Scavenger malware family whose trojans are designed to steal cryptocurrency and passwords. Threat actors distributed these trojans under the guise of mods, cheats, and patches for games. This malware was launched using legitimate apps, including through the exploitation of the DLL Search Order Hijacking vulnerabilities in them.

In August, our malware analysts warned about the spread of Android.Backdoor.916.origin, a multifunctional backdoor for mobile devices that was targeting representatives of Russian business. Cybercriminals remotely controlled this malware and used it to steel confidential data and spy on victims.

That same month, Doctor Web's anti-virus laboratory released a study of a targeted attack committed against a Russian engineering enterprise by the Scaly Wolf hacker group. The threat actors used a variety of malicious instruments, one of the main ones being the Updatar modular backdoor. With its help, the attackers tried to obtain confidential data from infected computers.

In Q3 2025, our Internet analysts detected more fake Telegram messenger websites and a number of fraudulent finance-themed online resources. In addition, over the past three months, our specialists have recorded the emergence of dozens of malicious and unwanted apps on Google Play. Among these were Android.Joker trojans, which subscribe users to paid services, and Android.FakeApp fake programs.

Principal trends in Q3 2025

The number of threats detected on protected devices decreased
The number of unique threats attacking users were detected in increased numbers
More fake Telegram messenger and fraudulent finance-themed websites emerged
Password- and cryptocurrency-stealing Trojan.Scavenger malware was spotted in the wild
The backdoor Android.Backdoor.916.origin was used to spy on Russian business representatives and steal confidential data
Android.MobiDash ad-displaying trojans became the most widespread threat for Android devices
The activity of Android.HiddenAds adware trojans decreased for the second quarter in a row
Many threats were detected on Google Play

According to Doctor Web’s statistics service

The most common threats in Q3 2025:

VBS.KeySender.7: A malicious script that, in an infinite loop, searches for windows containing the text mode extensions, разработчика, and розробника and sends them an Escape key press event, forcibly closing them.
Adware.Downware.20091: Adware that often serves as an intermediary installer of pirated software.
Trojan.Siggen31.34463: A trojan written in the Go programming language and designed to download various miner trojans and adware into infected systems. This malware is a DLL file located at %appdata%\utorrent\lib.dll. To launch, it exploits a DLL Search Order Hijacking vulnerability in the uTorrent torrent client.
Adware.Ubar.20: A torrent client designed to install unwanted programs on a user’s device.
JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.

Statistics for malware discovered in email traffic

W97M.DownLoader.2938: A family of downloader trojans that exploit vulnerabilities in Microsoft Office documents. They can also download other malicious programs to a compromised computer.
Exploit.CVE-2017-11882.123
Exploit.CVE-2018-0798.4: Exploits designed to take advantage of Microsoft Office software vulnerabilities and allow an attacker to run arbitrary code.
JS.Phishing.745: A malicious JavaScript script that generates a phishing web page.
JS.Muldrop.371: A malicious JavaScript script that installs a payload into the system.

Encryption ransomware

In Q3 2025, the number of requests made to decrypt files affected by encoder trojans increased by 3.02%, compared to Q2 2025.

The dynamics of the decryption requests received by Doctor Web’s technical support service:

The most common encoders of Q3 2025:

Trojan.Encoder.35534 — 26.99% of user requests
Trojan.Encoder.35209 — 3.07% of user requests
Trojan.Encoder.35067 — 2.76% of user requests
Trojan.Encoder.41542 — 2.15% of user requests
Trojan.Encoder.29750 — 1.84% of user requests

Network fraud

In Q3 2025, Doctor Web’s Internet analysts continued to detect new fake Telegram messenger websites, including those that fraudsters used to try to gain access to user accounts:

In addition, finance-themed fraudulent sites continued to emerge. One of them lured users to an “investment platform of the future” called Apple Trade AI, which supposedly had been created by the Apple Corporation. Cybercriminals promised potential victims the opportunity to make more than $4,000 a month. To “access” the platform, they were required to register by providing personal information.

Other Internet resources offered visitors a chance to join a “new investment platform from Meta” and “create a source of constant income, starting from $4,000 a month”. To access the “platform”, users were asked to take a survey and then register.

Our experts also discovered more variants of fake investing platforms that allegedly allowed users to make money with the help of trading bots in WhatsApp.

To “work” with the promised services, potential victims had to provide personal data:

A number of fraudulent websites were designed for audiences in specific countries. Some of them were targeting CIS-based users, to whom fraudsters offered the chance to “open a closed investment market” and access some exclusive investments through the INSIDER X financial service. To do so, visitors had to “leave a request” by providing personal data.

In one of the schemes designed for Russian users, cybercriminals asked users to take a survey in order to gain access to an “investment platform” that was supposedly related to large oil and gas companies and the state-backed Gosuslugi (Госуслуги) portal:

Scammers passed off some other sites as legitimate Russian bank services and told users they could register in order to “earn at least 50,000 rubles a week”:

Once again, users from some other countries encountered similar fake websites. On one of them, fraudsters offered users from Kyrgyzstan the opportunity to become part of a people's program and invest in what they claimed was the country’s largest company:

Another site was allegedly tied to a Georgian bank and allowed users to join its “investment platform”:

The scammers passed off a similar fake website as belonging to one of the Kazakhstan banks and promised users an income starting from 600,000 tenge per month:

On another site, malicious actors, allegedly on behalf of a Turkish oil and gas company, offered potential victims the opportunity to join an investment platform and make “up to 9,000 Turkish lira a day”:

At the same time, fraudsters continued exploiting the topic of all kinds of government payments and compensations. On one of the unwanted sites targeting Kazakhstani users, visitors allegedly could check whether financial compensation was available to them and get up to 5,000,000 tenge:

Find out more about Dr.Web non-recommended sites

Malicious and unwanted programs for mobile devices

According to detection statistics collected by Dr.Web Security Space for mobile devices, in Q3 2025, users most often encountered Android.MobiDash ad-displaying trojans. At the same time, the previously leading Android.HiddenAds trojans dropped to second place, significantly reducing their activity. The third most common threat was Android.FakeApp fake programs.

Compared to the second quarter, the number of Android.BankBot banking trojan detections increased, while the banking trojans Android.Banker and Android.SpyMax were, to the contrary, detected less often.

In August, Doctor Web’s experts informed users about the Android.Backdoor.916.origin multifunctional backdoor that threat actors had used to spy on representatives of Russian business and steal confidential data from them.

Over the course of the last three months, more than 70 malicious and unwanted apps were discovered on Google Play. Among them were Android.Joker trojans, which subscribe users to paid services, Android.FakeApp fake programs, and Program.FakeMoney.16—a piece of software that allegedly allowed users to convert virtual rewards into real money.

The following Q3 2025 events involving mobile malware are the most noteworthy:

Android.MobiDash adware trojans were more active.
Android.HiddenAds ad-displaying trojan activity decreased.
Users encountered Android.BankBot banking trojans more often.
The number of Android.Banker and Android.SpyMax banking trojan attacks decreased.
Malicious actors used a multifunctional backdoor Android.Backdoor.916.origin to spy on Russian business representatives.
Many threats were distributed on Google Play.

To find out more about the security-threat landscape for mobile devices in Q3 2025, read our special overview.

Doctor Web’s Q3 2025 review of virus activity on mobile devices

Wed, 01 Oct 2025 03:00:00 GMT

October 1, 2025

According to detection statistics collected by Dr.Web Security Space for mobile devices, Android.MobiDash ad-displaying trojans were the most widespread threats of Q3 2025. They were detected on protected devices 18.19% more often than during the previous observation period.

The adware trojans Android.HiddenAds, whose activity decreased for the second quarter in a row, fell to second place. In the past 3 months, users encountered them 71.85% less often. These malicious apps conceal their icons, making the trojans harder to detect and remove, and then display ads, including full-screen videos.

Third place was again occupied by the Android.FakeApp trojans that cybercriminals use in various fraudulent schemes; the number of times they were detected decreased by 7.49%. Instead of providing the declared functionality, these malicious apps often load various websites, including fraudulent and malicious ones, as well as bookmaker and online casino websites.

Despite a 38.88% decline in activity, Android.Banker trojans remain the most widespread banking malware. Threat actors use them to gain illegal access to banking accounts and steal money. These trojans can display phishing windows to hijack logins and passwords, imitate the appearance of real banking software, intercept SMS to obtain one-time codes, etc.

Android.Banker trojans were followed by the Android.BankBot trojans, which were detected 18.91% more often than in Q2. Such trojans also try to gain access to users’ online banking accounts by intercepting confirmation codes. At the same time, these malicious apps can execute various commands coming from cybercriminals. Some of them also allow infected devices to be controlled remotely.

Rounding out the top three, Android.SpyMax banking trojans were detected 17.25% less often than in the previous quarter. These malicious apps are based on the source code of the spyware trojan SpyNote and provide a wide range of functions, including the ability to remotely control affected devices.

In August, we informed users about a malware distribution campaign involving the Android.Backdoor.916.origin multi-functional backdoor. Cybercriminals use this piece of malware to steal confidential data and spy on Android device users. Threat actors sent messages to potential victims via various messengers, offering an “anti-virus” that can be installed from the attached APK file. Doctor Web’s anti-virus laboratory discovered the first versions of this backdoor back in January 2025 and has continued to monitor its development ever since. Our experts believe that this backdoor is used in targeted attacks and is not intended for mass distribution. The main target for cybercriminals is representatives of Russian businesses.

Over the course of Q3, a large number of malicious programs were distributed on Google Play for a combined total of over 1,459,000 installations. Among them were dozens of Android.Joker trojans that subscribe victims to paid services and Android.FakeApp malicious fake programs. In addition, our malware analysts discovered yet another app that supposedly allowed virtual rewards to be converted into real money.

Principal trends of Q3 2025

Android.MobiDash ad-displaying trojans became the most widespread threats
The activity of Android.HiddenAds adware trojans continued to decline
The number of Android.BankBot banking trojan attacks increased
Banking trojans Android.Banker and Android.SpyMax were less active
Cybercriminals used a multi-functional backdoor, Android.Backdoor.916.origin, to attack representatives of Russian businesses
Many malicious apps were found on Google Play

According to statistics collected by Dr.Web Security Space for mobile devices

Android.MobiDash.7859: A trojan app that displays obnoxious ads. It is a special software module that developers incorporate into applications.
Android.FakeApp.1600: A trojan app that loads the website that is hardcoded into its settings. Known modifications of this malicious program load an online casino site.
Android.Click.1812: The detection name for malicious WhatsApp messenger mods that can covertly load various websites in the background.
Android.HiddenAds.673.origin: A trojan app designed to display intrusive ads. Members of the Android.HiddenAds family are often distributed as popular and harmless applications. In some cases, other malware can install them in the system directory. When these infect Android devices, they typically conceal their presence from the user. For example, they “hide” their icons from the home screen menu.
Android.Triada.5847: The detection name for a packer for Android.Triada trojans that is designed to protect them from being detected and analyzed. Threat actors most often use the packer together with malicious Telegram messenger mods in which these trojans are embedded.

Program.FakeMoney.11: The detection name for Android applications that allegedly allow users to earn money by completing different tasks. These apps make it look as if rewards are accruing for each one that is completed. At the same time, users are told that they have to accumulate a certain sum to withdraw their “earnings”. Typically, such apps have a list of popular payment systems and banks that supposedly could be used to withdraw the rewards. But even if users succeed in accumulating the needed amount, in reality they cannot get any real payments. This virus record is also used to detect other unwanted software based on the source code of such apps.
Program.CloudInject.5
Program.CloudInject.1: The detection name for Android programs that have been modified using the CloudInject cloud service and the eponymous Android utility (the latter was added to the Dr.Web virus database as Tool.CloudInject). Such programs are modified on a remote server; meanwhile, the modders (users) who are interested in such modifications cannot control exactly what will be added to the apps. Moreover, these programs receive a number of dangerous system permissions. Once modification is complete, modders can remotely manage these apps—blocking them, displaying custom dialogs, tracking when other software is being installed or removed from a device, etc.
Program.FakeAntiVirus.1: The detection name for adware programs that imitate anti-virus software. These apps inform users of nonexistent threats, mislead them, and demand that they purchase the software’s full version.
Program.TrackView.1.origin: The detection name for a program that allows users to be monitored via their Android devices. Malicious actors can utilize it to track a target device’s location, take photos and video with the camera, eavesdrop via the microphone, record audio, etc.

Tool.NPMod.3
Tool.NPMod.1
Tool.NPMod.4: The detection name for Android programs that have been modified using the NP Manager utility. A special module is embedded in such apps, and it allows them to bypass digital signature verification once they have been modified.
Tool.LuckyPatcher.2.origin: A tool that allows apps installed on Android devices to be modified (i.e., by creating patches for them) in order to change the logic of their work or to bypass certain restrictions. For instance, users can apply it to disable root-access verification in banking software or to obtain unlimited resources in games. To add patches, this utility downloads specially prepared scripts from the Internet, which can be crafted and added to a shared database by any third party. The functionality of such scripts can prove to be malicious; thus, patches made with this tool can pose a potential threat.
Tool.Androlua.1.origin: The detection name for some potentially dangerous versions of a specialized framework for developing Android software based on the Lua scripting language. The main logic of Lua-based apps resides in corresponding scripts that are encrypted and decrypted by the interpreter upon execution. By default, this framework often requests access to a large number of system permissions in order to operate. As a result, the Lua scripts that it executes can potentially perform various malicious actions in accordance with the acquired permissions.

Adware.AdPush.3.origin
Adware.Adpush.21846: Adware modules that can be built into Android apps. They display notifications containing ads that mislead users. For example, such notifications can look like messages from the operating system. In addition, these modules collect a variety of confidential data and are able to download other apps and initiate their installation.
Adware.ModAd.1: The detection name for some modified versions (mods) of the WhatsApp messenger, whose functions have been injected with a specific code. This code is responsible for loading target URLs by displaying web content (via the Android WebView component) when the messenger is in operation. Such web addresses perform redirects to advertised sites, including online casino, bookmaker, and adult sites.
Adware.Youmi.4: The detection name for an unwanted adware module that adds advertizing shortcuts onto the Android OS home screen.
Adware.Basement.1: These are apps that display unwanted ads which often lead to malicious and fraudulent websites. They share a common code base with the Program.FakeMoney.11 unwanted applications.

Threats on Google Play

In Q3 2025, Doctor Web's anti-virus laboratory detected over 50 trojans from the Android.Joker family which subscribe users to paid services. They were distributed under the guise of different software, including messengers, various system tools, image-editing apps, camera apps, programs for working with documents, etc.

One trojan was hidden in the system-optimizing app Clean Boost (Android.Joker.2412), and another — in the app Convert Text to PDF (Android.Joker.2422) for creating PDF documents

Moreover, our specialists discovered more fake apps from the Android.FakeApp family being used in fraudulent schemes. As before, cybercriminals passed off some of them as financial apps, like reference books and teaching aids and software for accessing investing services. Other Android.FakeApp trojans were distributed as games and under certain conditions could load bookmaker and online casino websites instead of operating as promised.

Examples of Android.FakeApp trojans disguised as financial apps. Android.FakeApp.1889 offered users the chance to test their financial literacy and Android.FakeApp.1890 the opportunity to develop financial intellection

Our experts also discovered Program.FakeMoney.16—an unwanted app, distributed as software called Zeus Jackpot Mania. In this program, users could get virtual rewards that they could supposedly convert into real money and withdraw it.

Program.FakeMoney.16 on Google Play

To “withdraw” the money, victims had to give this app some of their data. However, ultimately, they did not receive any payments.

Program.FakeMoney.16 asks users to provide their full name and information about their bank account

To protect your Android device from malware and unwanted programs, we recommend installing Dr.Web anti-virus products for Android.

Indicators of compromise

Doctor Web’s Q2 2025 review of virus activity on mobile devices

Tue, 01 Jul 2025 06:00:00 GMT

July 1, 2025

According to detection statistics collected by Dr.Web Security Space for mobile devices, adware trojans from various families remained the most common malware. Members of the Android.HiddenAds trojan family were again the most active, despite the fact that users encountered them 8.62% less often. These were followed by Android.MobiDash adware trojans; the number of attacks involving them increased by 11.17%. Android.FakeApp malicious programs, used in various fraudulent schemes, ranked third; they were detected on protected devices 25.17% less frequently.

The activity of Android.Banker banking trojans increased by 73.15%, compared to the previous quarter. At the same time, some other banking trojan families were detected less often, e.g., Android.BankBot (by 37.19%) and Android.SpyMax (by 19.14%).

In April, our virus analysts informed the public about the discovery of a large-scale campaign to steal cryptocurrency from Android smartphone users. During this campaign, malicious actors hid Android.Clipper.31 in a modified version of the WhatsApp messenger and implanted it into the firmware of some budget Android smartphone models. This trojan hijacks messages sent and received in the messenger, searches the Tron and Ethereum crypto wallet addresses in them, and replaces legitimate addresses with ones belonging to the scammers. At the same time, the trojan conceals this substitution, and users of infected devices see the “correct” wallets in their messages. Moreover, Android.Clipper.31 sends all images in the jpg, png, and jpeg formats to a remote server to search mnemonic phrases for their victims’ crypto wallets.

Also in April, we reported on a spyware trojan targeting Russian military personnel. The Android.Spy.1292.origin malicious program was hidden in a modified version of Alpine Quest mapping software. It was distributed via a fake Telegram channel of an app created by the threat actors as well as via one of the Russian Android app catalogs. Android.Spy.1292.origin sent various confidential data to the attackers, including user accounts, their mobile phone number, contacts from the phone book, and information about the infected device’s geolocation and the files stored in its memory. When commanded by malicious actors, the trojan could steal specified files. The malware creators were particularly interested in confidential documents sent via popular messengers as well as in Alpine Quest’s location log file.

At the same time, during this most recent observation period, Doctor Web’s virus laboratory detected more threats on Google Play. Among them were various trojans and unwanted ad-displaying software.

Principal trends of Q2 2025

Android.HiddenAds adware trojans intensified their activity
Adware trojans from the Android.MobiDash family also heightened their activity
Android.Banker banking trojans were less commonly detected on protected devices, compared to the previous quarter
Decreased numbers of Android.BankBot and Android.SpyMax banking trojan family attacks were noted
A trojan designed to steal cryptocurrency was found in the firmware of several budget Android smartphone models
Malicious actors distributed a trojan that spied on Russian military personnel
More threats emerged on Google Play

According to statistics collected by Dr.Web Security Space for mobile devices

Android.HiddenAds.657.origin
Android.HiddenAds.4214
Android.HiddenAds.4213: Trojan apps designed to display intrusive ads. Members of the Android.HiddenAds family are often distributed as popular and harmless applications. In some cases, other malware can install them in the system directory. When these infect Android devices, they typically conceal their presence from the user. For example, they “hide” their icons from the home screen menu.
Android.MobiDash.7859: A trojan app that displays obnoxious ads. It is a special software module that developers incorporate into applications.
Android.FakeApp.1600: A trojan app that loads a website that is hardcoded into its settings. Known modifications of this malicious program load an online casino site.

Program.FakeMoney.11: The detection name for Android applications that allegedly allow users to earn money by completing different tasks. These apps make it look as if rewards are accruing for each one that is completed. At the same time, users are told that they have to accumulate a certain sum to withdraw their “earnings”. Typically, such apps have a list of popular payment systems and banks that supposedly could be used to withdraw the rewards. But even if users succeed in accumulating the needed amount, in reality they cannot get any real payments. This virus record is also used to detect other unwanted software based on the source code of such apps.
Program.CloudInject.1: The detection name for Android programs that have been modified using the CloudInject cloud service and the eponymous Android utility (the latter was added to the Dr.Web virus database as Tool.CloudInject). Such programs are modified on a remote server; meanwhile, the modders (users) who are interested in such modifications cannot control exactly what will be added to the apps. Moreover, these programs receive a number of dangerous system permissions. Once modification is complete, modders can remotely manage these apps—blocking them, displaying custom dialogs, tracking when other software is being installed or removed from a device, etc.
Program.FakeAntiVirus.1: The detection name for adware programs that imitate anti-virus software. These apps inform users of nonexistent threats, mislead them, and demand that they purchase the software’s full version.
Program.TrackView.1.origin: The detection name for a program that allows users to be monitored via their Android devices. Malicious actors can utilize it to track a target device’s location, take photos and video with the camera, eavesdrop via the microphone, record audio, etc.
Program.SecretVideoRecorder.1.origin: The detection name for various modifications of an application that is designed to record videos and take photos in the background, using built-in Android device cameras. It can operate covertly by allowing notifications about ongoing recordings to be disabled. It also allows an app’s icon and name to be replaced with fake ones. This functionality makes this software potentially dangerous.

Tool.NPMod.3
Tool.NPMod.1: The detection name for Android programs that have been modified using the NP Manager utility. A special module is embedded in such apps, and it allows them to bypass digital signature verification once they have been modified.
Tool.Androlua.1.origin: The detection name for some potentially dangerous versions of a specialized framework for developing Android software based on the Lua scripting language. The main logic of Lua-based apps resides in the corresponding scripts that are encrypted and decrypted by the interpreter upon execution. By default, this framework often requests access to a large number of system permissions in order to operate. As a result, the Lua scripts that it executes can potentially perform various malicious actions in accordance with the acquired permissions.
Tool.SilentInstaller.14.origin: A riskware platform that allows applications to launch APK files without installing them. It creates a virtual runtime environment in the context of the apps in which they are integrated. The APK files launched with the help of this platform can operate as if they are part of such programs and can also obtain the same permissions.
Tool.Packer.1.origin: A packer tool designed to protect Android applications from unauthorized modifications and reverse engineering. This tool is not malicious in itself, but it can be used to protect both harmless and malicious software.

Adware.ModAd.1: The detection name for some modified versions (mods) of the WhatsApp messenger, whose functions have been injected with a specific code. This code is responsible for loading target URLs by displaying web content (via the Android WebView component) when the messenger is in operation. Such web addresses perform redirects to advertised sites, including online casino, bookmaker, and adult sites.
Adware.AdPush.3.origin: Adware modules that can be built into Android apps. They display notifications containing ads that mislead users. For example, such notifications can look like messages from the operating system. In addition, these modules collect a variety of confidential data and are able to download other apps and initiate their installation.
Adware.Basement.1: These are apps that display unwanted ads which often lead to malicious and fraudulent websites. They share a common code base with the Program.FakeMoney.11 unwanted applications.
Adware.Fictus.1.origin: An adware module that malicious actors embed into the cloned versions of popular Android games and applications. Its incorporation is facilitated by a specialized net2share packer. Copies of software created this way are then distributed through various software catalogs. When installed on Android devices, such apps and games display obnoxious ads.
Adware.Jiubang.1: Unwanted ad-displaying software for Android devices that displays a banner showing recommended programs when applications are being installed.

Threats on Google Play

Over the course of the second quarter of 2025, Doctor Web’s virus analysts discovered several dozen threats on Google Play, including various fake programs from the Android.FakeApp family. These trojans were again actively being distributed under the guise of finance-related programs and, instead of the promised functionality, could load fraudulent websites.

Android.FakeApp.1863 and Android.FakeApp.1859 are examples of the trojans that were discovered. The former was hidden in the “TPAO” app and targeted Turkish users who were told that the app could help them “easily control their deposits and incomes”. The latter was disguised as a “financial assistant” (“Quantum MindPro”) and was geared toward a French-speaking audience.

Games remain another popular disguise for such fake programs. Under certain conditions, they load online casino and bookmaker websites instead of providing gaming functionality.

Android.FakeApp.1840 (“Pino Bounce”) is one of the fake games that could load an online casino site.

In addition, our specialists detected the unwanted ad-displaying software Adware.Adpush.21912. It was hidden in the “Coin News Promax” app, which contains informational materials about cryptocurrencies. Adware.Adpush.21912 displays notifications that, when clicked, load into WebView the link specified by the С2 server.

To protect your Android device from malware and unwanted programs, we recommend installing Dr.Web anti-virus products for Android.

Indicators of compromise

Doctor Web’s Q2 2025 virus activity review

Tue, 01 Jul 2025 03:00:00 GMT

July 1, 2025

According to statistics collected by the Dr.Web anti-virus, the total number of threats detected in the second quarter of 2025 decreased by 7.38%, compared to the first quarter. At the same time, the number of unique threats decreased by 23.10%. Unwanted adware apps, backdoors, ad-displaying trojans, and malicious scripts were among the threats most commonly detected on protected devices. In email traffic, most frequently detected were trojan downloaders, various malicious scripts, and trojan droppers.

Users whose files were affected by encoder trojans had mostly encountered Trojan.Encoder.35534, Trojan.Encoder.35209, and Trojan.Encoder.29750.

In April, Doctor Web’s virus analysts reported on a trojan found in the firmware of a number of Android smartphone models. Cybercriminals used this malware to steal cryptocurrency from their victims. In addition, our specialists discovered a trojan that malicious actors embedded into a version of a popular mapping program; it was used to spy on Russian military personnel.

Over the course of the second quarter, our Internet analysts uncovered many new fraudulent websites. Among them were websites of non-existent educational platforms that supposedly allowed potential victims to undergo online training and improve their qualifications. There were also more investment-themed websites promising quick and easy money.

The detection statistics on mobile devices showed a decrease in activity of the part of Android.HiddenAds ad-displaying trojans. However, this malware family remains the most widespread Android threat. At the same time, our virus laboratory detected many new threats on Google Play.

Principal trends in Q2 2025

The number of threats detected on protected devices decreased
Unique threats used in attacks were detected in decreased numbers
Many fraudulent websites, allegedly related to the education sector and finances, emerged
A spyware trojan attack targeting Russian military personnel was detected; the attack exploited popular mapping software for Android devices
A trojan designed to steal cryptocurrency was found in the firmware of a variety of Android smartphones
Android.HiddenAds adware trojans remain among the most widespread Android threats
More malicious and unwanted programs were detected on Google Play

According to Doctor Web’s statistics service

The most common threats in Q2 2025:

VBS.KeySender.6: A malicious script that, in an infinite loop, searches for windows containing the text mode extensions, разработчика, and розробника and sends them an Escape key press event, forcibly closing them.
Adware.Downware.20091: Adware that often serves as an intermediary installer of pirated software.
Trojan.BPlug.4242
Trojan.BPlug.3814: The detection name for malicious components of the WinSafe browser extension. These components are JavaScript files that display intrusive ads in browsers.
Trojan.Siggen30.53926: The detection name of an Electron framework host process modified by threat actors. It mimics a Steam application component (Steam Client WebHelper) and loads a JavaScript backdoor.

Statistics for malware discovered in email traffic

JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.
JS.Inject: A family of malicious JavaScripts that inject a malicious script into the HTML code of webpages.
Win32.HLLW.Rendoc.3: A network worm that spreads via removeable storage media and other channels.
W97M.DownLoader.2938: A family of downloader trojans that exploit vulnerabilities in Microsoft Office documents. They can also download other malicious programs to a compromised computer.
PDF.Phisher.867: PDF documents used in phishing newsletters.

Encryption ransomware

In Q2 2025, the number of requests made to decrypt files affected by encoder trojans decreased by 14.65%, compared to Q1 2025.

The dynamics of the decryption requests received by Doctor Web’s technical support service:

The most common encoders of Q2 2025:

Trojan.Encoder.35534 — 24.41% of user requests
Trojan.Encoder.35209 — 4.41% of user requests
Trojan.Encoder.29750 — 2.71% of user requests
Trojan.Encoder.35067 — 2.71% of user requests
Trojan.Encoder.41868 — 2.71% of user requests

Network fraud

Over the course of the second quarter, Doctor Web’s Internet analysts detected many fraudulent websites supposedly related to the education sector. Online resources offering training in various professions became widespread. For example, the SMM Академия (“SMM Academy”) and LearnIT KZ platforms, designed for Kazakhstani users, supposedly allowed them to “master the SMM manager profession in 3 months” and “become a data analyst”.

On other websites, potential victims were allegedly able to access various courses. Among them were courses for learning English and for gaining capital management skills—from the EnglishPro and FinCourse “platforms”, respectively:

And the fraudulent website of a certain service called Финансовое Образование (“Financial Education”) could supposedly help users improve their financial literacy. It offered visitors the chance to “master their finances and guarantee their future”:

To “access” their advertised services, such websites ask users to register an account by providing personal data, like their name, mobile phone number, email address, etc. Such data accumulates in the criminals’ hands and can later be used in various fraudulent schemes.

At the same time, new fraudulent websites appeared for pseudo-investment projects that cybercriminals often presented as allegedly being related to well-known companies and services. For instance, one offered users the opportunity to become participants in an innovative project based on AI (artificial intelligence) technologies. This “project” was passed off as a service from the Audi automobile concern and supposedly allowed cryptocurrencies to be traded automatically and a guaranteed high income to be received. For “accessing” the service, a starting sum of €250 was required.

Another “investment project” was allegedly related to the TikTok social network. Visitors to the fraudulent website were asked to complete a short survey and then provide personal information for registering and accessing the promised service:

Moreover, other fraudulent websites were discovered that were camouflaged as official online resources for the WhatsApp messenger. One of them offered visitors the opportunity to receive digital coins, each of which “brings the owner €15 a day”. The user supposedly received 160 of these coins, but to begin “earning money on them”, they were asked to register an account by providing personal data. In reality, the potential victim did not get any digital assets, and their data ended up in the hands of the scammers.

Another fake WhatsApp website supposedly granted access to yet another trading bot, based on some so-called unique developments. Users were asked to “run the WhatsApp Bot and make money automatically”. For this, they were traditionally required to register by indicating their personal data, which was then transferred to the threat actors.

Fraudsters also targeted users from specific countries. For example, Russian citizens could encounter websites offering them the opportunity to “make their dreams come true” with the help of this or that investment service. Malicious actors utilized the same template to design such websites, only changing the appearance and the names of the non-existent projects.

It is noteworthy that websites based on the same template were also created for residents of other countries, for example, Uzbekistan:

One fraudulent website that was discovered lured Russian-speaking users living in Europe. On this website, cybercriminals promised potential victims a passive income of up to €1000 per week “with the help of innovative, new-generation financial solutions” from some platform called LevelUPTrade:

French users could become victims of malicious actors offering the chance to access the non-existent TraderAI automated trading software. With its help, potential victims allegedly had the opportunity to earn a hefty sum, starting from €3500:

For Mexican citizens, scammers prepared an “intellectual trading system” called QuantumIA. This is one of many variants of the well-known pseudo-trading system known as Quantum System or QuantumAI, which supposedly allows automatic trading to take place in financial markets using quantum computing and artificial intelligence technologies.

On another website, fraudsters, allegedly on behalf of a large bank, offered Mexican users some investment services. Potential victims were promised that they could make 16,000 Mexican pesos within a short period of time after registering. For this, they were asked to provide their personal data.

German users risked falling victim to the fake trading platform Lucrosa Infinity. Its image has been exploited in one form or another by cybercriminals for several years. On one fraudulent website, threat actors offered users the opportunity to “start investing and open the door to financial independence”.

Cybercriminals also offered Canadian users the opportunity to use “unique” services that allegedly provide high income through investments and cryptocurrency trading. Among the uncovered fraudulent websites, for example, were those advertising “platforms” like BitcoinFusionPro and BitcoinReaction. These supposedly allowed clients to make at least 1,000 Canadian dollars per day by investing “only” 350 dollars:

Users from Poland also encountered similar websites. On one of them, scammers promised their potential victims earnings from $950 to $2,200 a day with “the most advanced cryptocurrency management software in the world”:

Another website offered them €250 to invest and then earn €700 daily:

One fraudulent website promised Polish users “the opportunity to work from home and make decent money” thanks to the automated system Click Money. With its help, people without trading experience could allegedly earn up to 64,000,000 Polish zlotys annually:

Find out more about Dr.Web non-recommended sites

Malicious and unwanted programs for mobile devices

According to detection statistics collected by Dr.Web Security Space for mobile devices, in Q2 2025, Android.HiddenAds ad-displaying trojans were most commonly detected on protected devices. Compared to the previous quarter, users encountered them somewhat less frequently. Next came adware trojans from the Android.MobiDash family and Android.FakeApp malicious fake programs; the activity of the former increased, while that of the latter decreased.

Mixed dynamics were also observed with banking trojans. For example, more attacks by representatives of the Android.Banker family were recorded. At the same time, trojans from the Android.BankBot and Android.SpyMax families were detected less often on protected devices.

In the second quarter, Doctor Web’s specialists discovered the Android.Clipper.31 trojan in the firmware of a number of Android smartphone models. This malicious app was hidden in one of the WhatsApp messenger versions modified by attackers and was used to steal cryptocurrency from the owners of infected devices. Moreover, our virus analysts uncovered the Android.Spy.1292.origin malicious program. Cybercriminals embedded it into one version of Alpine Quest mapping software and used it to spy on Russian military personnel.

Over the course of the last 3 months, dozens of threats have been detected on Google Play. Among them were malicious fake apps from the Android.FakeApp family and new unwanted ad-displaying software Adware.Adpush.21912.

The following Q2 2025 events involving mobile malware are the most noteworthy:

Android.HiddenAds ad-displaying trojans were less active.
Android.MobiDash adware trojan activity increased.
Android.Banker banking trojans were detected more often on protected devices, compared to the first quarter.
The number of Android.BankBot and Android.SpyMax banking trojan attacks decreased.
A trojan designed to steal cryptocurrency was found in the firmware of several Android smartphone models.
A spyware trojan targeting Russian military personnel was discovered.
New threats emerged on Google Play.

To find out more about the security-threat landscape for mobile devices in Q2 2025, read our special overview.

Doctor Web’s Q1 2025 virus activity review

Thu, 27 Mar 2025 00:00:00 GMT

March 27, 2025

According to statistics collected by the Dr.Web anti-virus, the total number of threats detected in the first quarter of 2025 increased by 7.23%, compared to the fourth quarter of 2024. At the same time, the number of unique threats decreased by almost a third—27.59%. This suggests that, while increasing the intensity of their attacks, threat actors were using the same malicious and unwanted applications in them more often. Malicious scripts with different functionality, ad-displaying trojans, and adware apps were the most widespread threats.

In email traffic, trojan droppers and downloaders, adware software, malicious scripts, and trojans designed to run various threats on attacked computers were most frequently detected.

Users whose files were affected by encoder trojans had mostly encountered Trojan.Encoder.35534, Trojan.Encoder.35209, and Trojan.Encoder.35067.

In January, Doctor Web’s virus laboratory uncovered an active Monero cryptocurrency mining campaign using many different trojans. To conceal some of them, threat actors utilized steganography, a technique that allows some data to be hidden within other data—for example, inside images.

At the same time, over the course of the first quarter, our Internet analysts detected an increase in the number of fraudulent websites aimed at stealing Telegram messenger user accounts.

In the mobile threats department, Doctor Web’s specialists observed increased activity on the part of adware trojans and some banking trojans used to target the Android OS. In addition, they uncovered dozens of new malicious apps on Google Play.

Principal trends in Q1 2025

Threats were detected on protected devices in increasing numbers.
The quantity of unique threats used in attacks decreased.
Phishing sites designed to steal Telegram accounts became more prevalent.
Several widespread ad-displaying and banking trojan families, used to target the Android operating system, heightened their activity.
New malware emerged on Google Play.

According to Doctor Web’s statistics service

The most common threats in Q1 2025:

VBS.KeySender.6: A malicious script that, in an infinite loop, searches for windows containing the text mode extensions, разработчика, and розробника and sends them an Escape key press event, forcibly closing them.
Adware.Downware.20091: Adware that often serves as an intermediary installer of pirated software.
Trojan.BPlug.4242: The detection name for malicious components of the WinSafe browser extension. These components are JavaScript files that display intrusive ads in browsers.
JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.
Trojan.Siggen30.53926: The detection name of an Electron framework host process modified by threat actors. It mimics a Steam application component (Steam Client WebHelper) and loads a JavaScript backdoor.

Statistics for malware discovered in email traffic

JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.
JS.Inject: A family of malicious JavaScripts that inject a malicious script into the HTML code of webpages.
Trojan.AVKill.63950: This is a dropper that installs the JS.BackDoor.42 backdoor on computers running the Windows operating system.
Trojan.Inject5.13806: A malicious program for Windows-based computers that was created using the AutoIt scripting language. It launches several system processes and injects the Trojan.Fbng spyware trojan into them. The attackers can use the latter as banking malware and for other purposes.

Encryption ransomware

In Q1 2025, the number of requests made to decrypt files affected by encoder trojans decreased by 9.34%, compared to Q4 2024.

The dynamics of the decryption requests received by Doctor Web’s technical support service:

The most common encoders of Q1 2025:

Trojan.Encoder.35534 — 11.89% of user requests
Trojan.Encoder.35209 — 5.95% of user requests
Trojan.Encoder. 35067 — 3.57% of user requests
Trojan.Encoder.38200 — 2.38% of user requests
Trojan.Encoder.37369 — 1.98% of user requests

Network fraud

In Q1 2025, Doctor Web’s Internet analysts observed the emergence of many new phishing websites designed to steal Telegram messenger user accounts. Among the most common variants were fake login pages and support pages that informed users about alleged problems due to some violation of the terms of service.

Fake sites of online stores were widespread once again. On these, cybercriminals asked potential victims to log in to their accounts.

A phishing authorization form on a fake website of one Russian online store

Our specialists continued detecting fraudulent sites with all sorts of “great offers”, such as quick or easy ways to make money; others were about receiving certain gifts, participating in promotions, etc. One of the schemes, for instance, targeted residents of Great Britain, offering them the chance to obtain “limited edition” transportation cards, which were supposedly dedicated to the anniversaries of various carriers and would allow them to use public transport services free of charge for a long period of time.

Fraudulent sites offering the chance to obtain “special” First Essex and Oyster transportation cards that allow public transport services to be used for free

Users had to answer several questions and then play a game by opening virtual gift boxes (the “winning” box in such scenarios is hardcoded). After “winning”, users had to provide personal information and pay £2 to “receive” the promised card. As a result, the victims’ personal information and money ended up in the hands of threat actors.

A potential victim has allegedly obtained a card successfully from one of the game boxes, and in order to receive it, they must provide personal data and also pay £2

A form for entering bank card details to pay for a non-existent promotional transportation card

Fraudsters continue luring potential victims with all sorts of trading platforms that have “unique” algorithms, including ones that are supposedly based on artificial intelligence (AI) technologies. At the same time, cybercriminals exploit the names of famous people and hide behind real companies and services, attributing to themselves a connection with them. One popular scenario is based on claims that users can make money with the help of certain specialized services from Telegram, WhatsApp, and other companies.

Some of these fraudulent sites were advertising various AI platforms, such as Telegram AI and WHATSAPP AI, which allegedly could help users make at least €14,000 per month, thanks to an “automated trading system”:

Other variants exploited the theme of trading bots, which are commonly passed off as instruments created by the messengers’ owners themselves. One website, for instance, promised that “Pavel Durov’s bot” Telegram.AI would allow users to earn €2,500+ monthly; and another one offered the option to use the WhatsApp Bot, supposedly created by Mark Zuckerberg, to make up to €500 per day.

Another scam website offered users the option to register on a “Telegram platform” that allegedly runs directly from a smartphone browser, automatically trades shares of global companies, and earns €10,000 per month:

One website promised “every Europe resident” an income starting at €5,000 per month with the help of certain AI-based algorithms from the WhatsApp Company:

Scam platform “The wealth formula” (“Formule Bohatstvi” in Czech), with its fake AI-based trading system, is a popular variation of this fraudulent scheme. It supposedly makes trades in a split second by analyzing huge amounts of data. Different sites of this non-existent system invite visitors to watch an informational video and register an account for consultations in the “anti-crisis solutions office”. The fraudsters are mainly targeting Europeans—Czech users in particular— who are promised an income of €1,000 per day “for life”. To access the system, potential victims are required to make a minimum deposit of €250.

Other similar scenarios, such as generating income using various specialized software, also remain popular. One such website invited Czech users to make thousands of crowns per day with “the world’s most intelligent cryptographic software”:

Another scam Internet portal promised earnings of over 4.7 million crowns monthly using certain trading software known as «10K EVERY DAY APP»:

At the same time, users continued encountering fake investment-themed websites targeting residents of different countries. For example, for an audience from Kazakhstan, fraudsters prepared yet another platform for earning passive income through oil and gas trading:

Many other sites offered the opportunity to “earn as much as possible” by trading shares of companies in Kazakhstan, Russia, China, and other countries:

Russian and Kyrgyz residents also encountered similar websites; on these, users allegedly could make money by trading oil and gas:

And one scam Internet resource offered Romanian users the chance to join the BRUA pipeline project, promising 3,000 lei per week as passive income:

Sites that promise government support to the population in the form of benefits, social payments, etc., remain a lure for potential victims. Threat actors, for instance, tried to bait Russian users with more fake Gosuslugi web portals. One asked them to provide personal data—supposedly to participate in an oil and gas company payment program and also to receive bonuses from the government:

Another scam site promised every Kazakhstan resident assistance in the form of money payments. It was allegedly organized on behalf of a large bank to “avoid problems and disasters”:

Fake investing service websites, including those supposedly belonging to Russian credit organizations, are still a problem. Many of them mimic real bank websites in order to confuse potential victims as much as possible.

Examples of fake Russian bank websites offering access to “investing services”

Find out more about Dr.Web non-recommended sites

Malicious and unwanted programs for mobile devices

According to detection statistics collected by Dr.Web Security Space for mobile devices, in Q1 2025, Android.HiddenAds and Android.MobiDash ad-displaying trojans, along with Android.FakeApp malicious fake programs, were the Android threats most commonly encountered; their activity increased, compared to the last quarter of 2024. In addition, users progressively encountered Android.BankBot and Android.Banker banking trojans. In contrast, Android.SpyMax spyware trojans, whose attacks increased in number almost every month in 2024, were detected less frequently.

Our specialists once again discovered many threats on Google Play. Among them were trojans used in various fraudulent schemes, cryptocurrency-stealing malware, and adware trojans.

The following Q1 2025 events involving mobile malware are the most noteworthy:

Android.HiddenAds and Android.MobiDash adware trojan activity increased.
Android.BankBot and Android.Banker banking trojans were more active.
The number of Android.SpyMax spyware trojans attacks declined.
New threats were discovered on Google Play.

To find out more about the security-threat landscape for mobile devices in Q1 2025, read our special overview.

Doctor Web’s Q1 2025 review of virus activity on mobile devices

Thu, 27 Mar 2025 00:00:00 GMT

March 27, 2025

According to detection statistics collected by Dr.Web Security Space for mobile devices, ad-displaying Android.HiddenAds trojans remained the most common Android malware. Moreover, they were detected on protected devices more than twice as often as in the fourth quarter of last year. Second place once again went to Android.FakeApp malware, which cybercriminals use in various fraudulent schemes—their activity increased by almost 8%. Adware trojans from the Android.MobiDash family ranked third; the number of their detections almost quintupled.

Similar dynamics were observed among many banking trojans. For instance, an increase was recorded in the number of attacks involving Android.BankBot and Android.Banker trojan family members—by 20.68% and 151.71%, respectively. At the same time, Android.SpyMax trojans, whose activity grew throughout almost all of 2024, were detected 41.94% less frequently than in the previous quarter.

Over the past 3 months, Doctor Web’s specialists discovered dozens of new threats on Google Play. Our virus laboratory’s findings in this catalog included cryptocurrency-stealing malware and other trojans that display intrusive ads, along with the traditionally large number of Android.FakeApp trojans.

PRINCIPAL TRENDS OF Q1 2025

Increased activity on the part of adware trojans
Increased numbers of Android.BankBot and Android.Banker banker malware attacks
Decreased activity on the part of Android.SpyMax spyware trojans
The emergence of many new threats on Google Play

According to statistics collected by Dr.Web Security Space for mobile devices

Android.HiddenAds.657.origin
Android.HiddenAds.655.origin
Android.HiddenAds.4214: Trojan apps designed to display intrusive ads. Members of the Android.HiddenAds family are often distributed as popular and harmless applications. In some cases, other malware can install them in the system directory. When these infect Android devices, they typically conceal their presence from the user. For example, they “hide” their icons from the home screen menu.
Android.FakeApp.1600: A trojan app that loads a website that is hardcoded into its settings. Known modifications of this malicious program load an online casino site.
Android.MobiDash.7859: A trojan app that displays obnoxious ads. It is a special software module that developers incorporate into applications.

Program.FakeMoney.11
Program.FakeMoney.14: The detection name for Android applications that allegedly allow users to earn money by completing different tasks. These apps make it look as if rewards are accruing for each one that is completed. At the same time, users are told that they have to accumulate a certain sum to withdraw their “earnings”. Typically, such apps have a list of popular payment systems and banks that supposedly could be used to withdraw the rewards. But even if users succeed in accumulating the needed amount, in reality they cannot get any real payments. This virus record is also used to detect other unwanted software based on the source code of such apps.
Program.FakeAntiVirus.1: The detection name for adware programs that imitate anti-virus software. These apps inform users of nonexistent threats, mislead them, and demand that they purchase the software’s full version.
Program.CloudInject.1: The detection name for Android programs that have been modified using the CloudInject cloud service and the eponymous Android utility (the latter was added to the Dr.Web virus database as Tool.CloudInject). Such programs are modified on a remote server; meanwhile, the modders (users) who are interested in such modifications cannot control exactly what will be added to the apps. Moreover, these programs receive a number of dangerous system permissions. Once modification is complete, users can remotely manage these apps. They can block them, display custom dialogs, and track when other software is being installed or removed from a device, etc.
Program.TrackView.1.origin: The detection name for a program that allows users to be monitored via their Android devices. Malicious actors can utilize it to track a target device’s location, take photos and video with the camera, eavesdrop via the microphone, record audio, etc.

Tool.NPMod.1: The detection name for Android programs that have been modified using the NP Manager utility. A special module is embedded in such apps, and it allows them to bypass digital signature verification once they have been modified.
Tool.Androlua.1.origin: The detection name for some potentially dangerous versions of a specialized framework for developing Android software based on the Lua scripting language. The main logic of Lua-based apps resides in the corresponding scripts that are encrypted and decrypted by the interpreter upon execution. By default, this framework often requests access to a large number of system permissions in order to operate. As a result, the Lua scripts that it executes can potentially perform various malicious actions in accordance with the acquired permissions.
Tool.SilentInstaller.14.origin: A riskware platform that allows applications to launch APK files without installing them. It creates a virtual runtime environment in the context of the apps in which they are integrated. The APK files launched with the help of this platform can operate as if they are part of such programs and can also obtain the same permissions.
Tool.LuckyPatcher.1.origin: A tool that allows apps installed on Android devices to be modified (i.e., by creating patches for them) in order to change the logic of their work or to bypass certain restrictions. For instance, users can apply it to disable root-access verification in banking software or to obtain unlimited resources in games. To add patches, this utility downloads specially prepared scripts from the Internet, which can be crafted and added to the common database by any third party. The functionality of such scripts can prove to be malicious; thus, patches made with this tool can pose a potential threat.
Tool.Packer.1.origin: A packer tool designed to protect Android applications from unauthorized modifications and reverse engineering. This tool is not malicious in itself, but it can be used to protect both harmless and malicious software.

Adware.ModAd.1: The detection name for some modified versions (mods) of the WhatsApp messenger, whose functions have been injected with a specific code. This code is responsible for loading target URLs by displaying web content (via the Android WebView component) when the messenger is in operation. Such web addresses perform redirects to advertised sites, including online casino, bookmaker, and adult sites.
Adware.Basement.1: These are apps that display unwanted ads which often lead to malicious and fraudulent websites. They share a common code base with the Program.FakeMoney.11 unwanted applications.
Adware.AdPush.3.origin
Adware.Adpush.21846: Adware modules that can be built into Android apps. They display notifications containing ads that mislead users. For example, such notifications can look like messages from the operating system. In addition, these modules collect a variety of confidential data and are able to download other apps and initiate their installation.
Adware.Fictus.1.origin: An adware module that malicious actors embed into the cloned versions of popular Android games and applications. Its incorporation is facilitated by a specialized net2share packer. Copies of software created this way are then distributed through various software catalogs. When installed on Android devices, such apps and games display obnoxious ads.

Threats on Google Play

In Q1 2025, Doctor Web’s virus laboratory detected several dozen malicious programs. Among them were various modifications of the trojans Android.HiddenAds.4213 and Android.HiddenAds.4215, which conceal their presence on infected devices and start displaying ads on top of other apps’ windows and the operating system UI. They masqueraded as software for taking photos and videos with different effects, image-editing programs, an image collection app, and a women’s health diary.

The Android.HiddenAds adware trojans concealed in the apps “Time Shift Cam” and “Fusion Collage Editor”

Our specialists also discovered Android.CoinSteal.202, Android.CoinSteal.203, and Android.CoinSteal.206, malicious programs designed to steal cryptocurrency that are distributed under the guise of official software from the Raydium and Aerodrome Finance blockchain platforms and the Dydx cryptocurrency exchange.

The “Raydium” and “Dydx Exchange” programs are trojans that steal cryptocurrency

When launched, these malicious apps ask potential victims to enter a mnemonic phrase (the seed phrase)—supposedly to connect their crypto wallet. But, in reality, the data that users provide is sent to threat actors. To further mislead users, forms for entering mnemonic phrases can be disguised as requests from other crypto platforms. As shown in the example below, Android.CoinSteal.206 displayed a phishing form allegedly on behalf of the crypto exchange PancakeSwap.

At the same time, Android.FakeApp fake programs were once again being distributed via Google Play. Fraudsters passed off many of them as finance-related software, including teaching aids, instruments for accessing investing services, and personal finance software. They loaded various phishing websites, including those used by threat actors to collect personal information.

Examples of the Android.FakeApp trojan apps distributed under the guise of financial software: «Умные Деньги» (“Smart Money”) is Android.FakeApp.1803, and “Economic Union” is Android.FakeApp.1777

Under certain conditions, other Android.FakeApp trojans loaded bookmaker and online casino sites. Such malware variants were distributed as different games and other software, like a speed-typing trainer and a drawing tutorial. Among them were new modifications of the Android.FakeApp.1669 trojan.

Examples of malicious fake apps that, instead of providing the declared functionality, could load online casino and bookmaker websites

To protect your Android device from malware and unwanted programs, we recommend installing Dr.Web anti-virus products for Android.

Indicators of compromise

Doctor Web’s annual virus activity review for 2024

Thu, 30 Jan 2025 00:00:00 GMT

January 30, 2025

In 2024, malicious programs created with the AutoIt scripting language and distributed as part of other malicious apps to make the latter more difficult to detect were once again among the most widespread threats. In addition, adware trojans and all kinds of malicious scripts were highly active. In email traffic, malicious scripts were also most commonly detected. Furthermore, threat actors used spam emails to distribute various trojans, phishing documents, and exploits that allow arbitrary code to be executed.

Ad-displaying trojans, spyware trojans, and unwanted adware apps were the threats most commonly detected on mobile devices. Throughout the year, increasing activity on the part of mobile banking trojans was observed. In addition, our virus laboratory discovered hundreds of malicious and unwanted programs on Google Play.

Doctor Web’s Internet analysts noted high activity on the part of online fraudsters, whose arsenal included both old and new schemes for deceiving users.

Compared to 2023, the number of user requests to decrypt files affected by encoder trojans decreased. At the same time, our specialists observed many information security incidents and events. Over the course of the year, Doctor Web investigated several targeted attacks, uncovered another infection impacting Android TV box sets, and repelled an attack on its own infrastructure.

Principal trends of the year

Trojans created with the AutoIt scripting language remained highly active.
Malicious scripts were among the most widespread threats.
Malicious scripts and various trojans were among the threats most commonly detected in email traffic.
New targeted attacks were detected.
Threat actors exploited eBPF technology more often to conceal their malicious activity.
The number of requests to decrypt files affected by encoder trojans decreased.
Internet fraudsters were highly active.
Cybercriminals used mobile banking trojans more frequently.
Many new threats were discovered on Google Play.

The most notable events of 2024

In January, Doctor Web’s specialists informed customers about the mining trojan Trojan.BtcMine.3767, which was concealed in pirated programs that were being distributed via a specially created Telegram channel and a number of websites. This malware infected tens of thousands of Windows computers. To anchor itself in an attacked system, it created a scheduler task for its own autorun and added itself to the Windows Defender anti-virus exceptions. Next, it injected a component directly responsible for cryptocurrency mining into explorer.exe (Windows Explorer). Trojan.BtcMine.3767 also allowed a number of other malicious actions to be performed, e.g., fileless rootkits can be installed, access to websites can be blocked, and Windows updates can be disabled.

In March, our company published research on a targeted attack against a Russian enterprise in the mechanical-engineering sector. An investigation into the incident revealed a multi-stage infection vector and the use of several malicious programs by the attackers. Among these programs, of greatest interest was the JS.BackDoor.60 backdoor, through which the main interaction between the attackers and the infected computer took place. This trojan uses its own JavaScript framework and consists of a main body and additional modules. It allows files to be stolen from infected machines, keystrokes to be hijacked, and screenshots to be taken. It can download its own updates and expand its functionality by downloading new modules.

In May, Doctor Web’s virus analysts discovered the trojan clicker Android.Click.414.origin in Love Spouse, an app used to control adult toys, and also in the QRunning app, used to track physical activity. Both were distributed through Google Play. Android.Click.414.origin was disguised as a component for collecting debugging information and was embedded into several new versions of the target apps. Later, the developer of the Love Spouse program updated the app, and the trojan was no longer present in it. There was no reaction from the developer of the second program. Android.Click.414.origin had modular architecture and could perform various malicious tasks with the help of its components. It could collect information about an infected device, covertly load webpages, display ads, perform clicks, and interact with the contents of loaded pages.

In July, we informed users about the emergence of a Linux version of the well-known remote access trojan TgRat, which is used for targeted attacks on computers. Dubbed Linux.BackDoor.TgRat.2, the new variant of this malware was discovered during an investigation into an information security incident that a hosting provider contacted us about. Dr.Web anti-virus detected a suspicious file on the server of one of their clients; it turned out to be the backdoor dropper that actually installed the trojan. Threat actors controlled Linux.BackDoor.TgRat.2 through a private Telegram group, using the Telegram bot connected to it. Through the messenger, they could download files from a compromised system, take screenshots, remotely execute commands, or upload files to a computer via chat attachments.

In early September, we published an article on our website, detailing the case of a failed spear-phishing attack on a major Russian enterprise in the rail freight industry. Several months earlier, the company’s information security team had detected a suspicious email with a file attached to it. Our virus analysts’ examination of it showed that it was a Windows shortcut disguised as a PDF document, and that it had hardcoded parameters for launching the PowerShell command interpreter. Opening this shortcut would lead to a multi-stage infection of the target system, with several malicious programs designed for cyber espionage. One of them was Trojan.Siggen27.11306, which exploited the CVE-2024-6473 vulnerability in Yandex Browser to intercept the DLL search order (DLL Search Order Hijacking). The trojan placed a malicious DLL library into the browser installation directory; this file had the same name as the system component Wldp.dll responsible for securely launching applications. Since the malicious file was located in the browser directory, it received higher priority to be loaded when the program was launched, thanks to the browser vulnerability. The library also obtained all the permissions of the browser. This vulnerability was later fixed.

A little later, our specialists reported on another attack on Android-based TV box sets. In this campaign, the malicious program Android.Vo1d was used. It infected nearly 1.3 million devices belonging to users in 197 countries. This was a modular backdoor that placed its components into the system storage area and, upon receiving the attackers’ commands, could covertly download and run other programs.

Moreover, in September, we detected a targeted attack on our company’s resources. Doctor Web’s specialists promptly stopped the attempt to damage our infrastructure, successfully repelling the attack. At the same time, none of our users were harmed.

In October, Doctor Web’s virus analysts reported on the discovery of a number of new malicious programs for Linux. They were uncovered thanks to a study of attacks on devices that had the Redis database management system installed on them. This system is increasingly becoming the target of cybercriminals wanting to exploit the various vulnerabilities in it. Among the threats detected were backdoors, droppers, and a new modification of a rootkit that installs the Skidmap mining trojan on compromised devices. This miner has been active since 2019, and its primary targets are large servers and cloud environments.

Also in October, our virus laboratory uncovered a large-scale campaign aimed at distributing malware for cryptocurrency mining and theft. Over 28,000 users, most of whom were from Russia, suffered from the actions of the attackers. The trojans were hiding in pirated software that was being distributed via fraudulent websites created on the GitHub platform. In addition, the malware creators placed links for downloading malicious programs under videos posted on the YouTube platform.

In November, our experts discovered a number of new variants of the Android.FakeApp.1669 trojan, whose task is to load websites. Unlike the malware most similar to it, Android.FakeApp.1669 receives target website addresses from the TXT records of malicious DNS servers. For this, it uses the modified code of the open-source library dnsjava. At the same time, the trojan exhibits malicious activity only when connected to the Internet through certain providers. In other cases, it operates as harmless software.

At the end of 2024, while investigating a request from one of our clients, Doctor Web’s virus laboratory specialists detected an ongoing hacker campaign primarily targeting users from Southeast Asia. During the attacks, cybercriminals used a range of malicious programs as well as methods and techniques that are only increasing in popularity among virus writers. One of them involves exploiting eBPF (extended Berkeley Packet Filter) technology, which was created to provide enhanced control over the network subsystem of the Linux operating system and its processes. This technology was used to conceal malicious network activity and processes, collect confidential information, and bypass firewalls and intrusion detection systems. Another technique involved storing the trojan configuration not on the C&C server, but on public platforms such as GitHub and blogs. The third feature of the attacks was the use of post-exploitation frameworks in tandem with malicious apps. Although such tools are not malicious and are used in security audits of digital systems, their functionality and the presence of vulnerability databases can expand the capabilities of attackers.

The malware landscape

According to the statistics collected by Dr.Web anti-virus, the total number of threats detected in 2024 increased by 26.20%, compared to 2023. The number of unique threats increased by 51.22%. Among the most common malicious programs were trojans created in the AutoIt scripting language. They are distributed as part of other malware and are designed to make the latter more difficult to detect. Moreover, users encountered various malicious scripts and adware trojans.

JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of Russian cities.
Trojan.AutoIt.1224
Trojan.AutoIt.1131
Trojan.AutoIt.1124
Trojan.AutoIt.1222: The detection name for packed versions of the Trojan.AutoIt.289 malicious app that are written in the AutoIt scripting language. This trojan is distributed as part of a group of several malicious applications, including a miner, a backdoor, and a self-propagating module. Trojan.AutoIt.289 performs various malicious actions that make it difficult for the main payload to be detected.
Trojan.StartPage1.62722: A malicious program that can modify the home page in the browser settings.
Trojan.BPlug.3814: The detection name for malicious components of the WinSafe browser extension. These components are JavaScript files that display intrusive ads in browsers.
VBS.KeySender.6: A malicious script that, in an infinite loop, searches for windows containing the text mode extensions, разработчика and розробника and sends them an Escape key press event, forcibly closing them.
BAT.AVKill.37: A component of the Trojan.AutoIt.289 malicious program. This script launches other malware components, sets them to autorun via Windows Task Scheduler, and also adds them to Windows Defender’s anti-virus exceptions.
Trojan.Unsecure.7: A trojan that blocks the launch of anti-viruses and other software through AppLocker policies in the Windows operating system.

As for email threats, the most widespread were various malicious scripts and all kinds of trojans, including backdoors, malware downloaders and droppers, trojans with spyware functionality, malicious cryptocurrency miners, and others. Threat actors also distributed phishing documents, often fake login forms mimicking those on popular websites. Additionally, users encountered worms and malicious apps that exploit vulnerabilities in Microsoft Office documents.

JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of Russian cities.
JS.Inject: A family of malicious JavaScripts that inject a malicious script into the HTML code of webpages.
LNK.Starter.56: The detection name for a shortcut that is crafted in a specific way. This shortcut is distributed through removable media, like USB flash drives. To mislead users and conceal its activities, it has a default icon of a disk. When launched, it executes malicious VBS scripts from a hidden directory located on the same drive as the shortcut itself.
Win32.HLLW.Rendoc.3: A network worm that spreads via removable storage media and other channels.
Exploit.CVE-2018-0798.4: An exploit designed to take advantage of Microsoft Office software vulnerabilities so that an attacker can run arbitrary code.
Trojan.AutoIt.1122: The detection name for a packed version of the Trojan.AutoIt.289 malicious app that is written in the AutoIt scripting language. This trojan is distributed as part of a group of several malicious applications, including a miner, a backdoor, and a self-propagating module. Trojan.AutoIt.289 performs various malicious actions that make it difficult for the main payload to be detected.
Trojan.SpyBot.699: A multi-module banking trojan. It allows cybercriminals to download and launch various applications on infected devices and run arbitrary code.
VBS.BtcMine.13
VBS.BtcMine.12: A VBS script designed to covertly mine cryptocurrencies.

Encryption ransomware

Compared with 2023, in 2024, Doctor Web’s technical support service registered 33.05% fewer user requests to decrypt files affected by encryption trojans. The dynamics of when those requests were registered is shown in the graph below:

The most common encoders of 2024:

Trojan.Encoder.35534 (13.13% of user requests): An encoder trojan also known as Mimic. It uses the everything.dll library from the legitimate software Everything, which is designed to instantly locate files on Windows computers.
Trojan.Encoder.3953 (12.10% of user requests): An encoder trojan that has several versions and modifications. It uses the AES-256 algorithm in CBS mode to encrypt files.
Trojan.Encoder.26996 (7.44% of user requests): A trojan encoder known as STOP Ransomware. It attempts to obtain a private key from a server. If unsuccessful, it uses the hardcoded one. It uses Salsa20 stream cipher to encrypt files.
Trojan.Encoder.35067 (2.21% of user requests): An encoder trojan also known as Macop (Trojan.Encoder.30572 is one of its other variants). It has a small size, about 30-40 Kbytes. This is partially due to the fact that the trojan does not carry third-party cryptographic libraries and uses exclusively CryptoAPI functions for encryption and key generation. It uses the AES-256 algorithm to encrypt files, and the keys themselves are encrypted with RSA-1024.
Trojan.Encoder.37369 (2.10% of user requests): One of many modifications of #Cylance ransomware. To encrypt files, it uses the ChaCha12 algorithm with the Curve25519 (X25519) elliptic curve key exchange scheme.

Network fraud

Over the course of 2024, Doctor Web’s Internet analysts observed high activity on the part of cyber fraudsters using both traditional and new scenarios to deceive users. In the Russian segment of the Internet, the most widespread schemes were again those using fraudulent sites of multiple formats. Some of them were fake sites of online stores and social networks with promotions and prize draws allegedly sponsored by them. Potential victims always “win” on such websites, but to get their nonexistent prize, they are asked to pay a “commission”.

A fraudulent site, allegedly related to a Russian online store, offers the visitor the chance to participate in a nonexistent prize draw

A fake social network website offers the chance to “try your luck” and win large cash prizes or other gifts

One of the current variants of such a scheme is not new: using fake websites of retailers and household appliance and electronics stores to offer users the opportunity to buy goods at a discount. On such sites, potential victims are typically asked to pay for their “orders” with a bank card. But last year, fraudsters started resorting to the Faster Payment System.

A fake website of a household appliance and electronics store promises potential victims big discounts

A fraudulent site offers visitors the option to use the Faster Payment System as one way to pay for their “order”

The scheme involving “free” lottery tickets also remained popular. Lottery draws, allegedly performed online, always end in “winnings” for potential victims. To get their prize, users also have to pay a “commission”.

This user has supposedly won 314,904 rubles in the lottery, and to “get” their prize, they need to pay a “commission”

Scammers also kept fake finance-themed websites in their arsenal. Popular were such topics as receiving some payments from the government or private companies, investing in the oil and gas sector, financial literacy training, trading stocks with the help of “unique” automated systems or “verified” strategies that supposedly guarantee income, and others. Threat actors engaged in strategies that included exploiting the names of media personalities to attract users’ attention. Examples of such sites are shown below.

A fraudulent site offers visitors the chance to “make up to 10,000 euros per month on the unique WhatsApp platform”

Russian singer Shaman “shared a secret platform for success” that allegedly can generate an income of $14,000 per month

The fake site of an oil and gas company offers access to an investment service and promises income starting at 150,000 rubles

Fraudulent sites that imitate real bank investing services

Meanwhile, our specialists detected new schemes. For example, scammers, allegedly on behalf of large companies, offered users a reward for participating in service-quality surveys. Such fakes included fictitious websites of credit organizations. On these, users were asked to provide sensitive personal information that could include their full name, the mobile phone number linked with their bank account, and their bank card number.

A fake bank website offers a reward of 6,000 rubles for participating in a survey on “improving service quality”

At the same time, such fakes also affected users in other countries. For instance, the site shown below assured European users that they will get dividends for investing in promising sectors of the economy:

And this site advertised a “new investing platform from Google” that could allegedly help users make money, starting at €1000:

Another fraudulent Internet resource offered Slovak users the opportunity to “make more than $192,460 per month” with the help of some investing service:

Users from Azerbaijan allegedly could also significantly improve their financial situation, making from 1000 manat per month. All they had to do was participate in a short survey and get access to the service, which was supposedly related to an Azerbaijani oil and gas company:

At the end of the year, fraudsters held to tradition and began adapting these fake websites to the New Year holiday theme. The next fake Internet resource of a crypto exchange, for example, promised Russian users New Year payments:

Another site offered users holiday payments supposedly on behalf of an investing company:

And this fraudulent Internet resource promised users from Kazakhstan large payments in honor of Independence Day as part of a “New Year offer”:

Throughout the year, our Internet analysts detected other phishing sites as well. Among them were fake websites of online education services. One, for instance, simulated the appearance of a genuine site and offered programming courses. To “receive a consultation”, users were asked to provide their personal data.

A fake website that was disguised as a real online resource of an online education service

Additionally, attempts to steal Telegram user accounts continued. For this, fraudsters used phishing websites camouflaged as various online voting platforms. Among these, sites asking visitors to “vote in children’s drawing competitions” were widespread again. Potential victims are asked to provide their mobile phone number to receive a one-time code. However, when they enter this code on such a website, users are giving scammers access to their accounts.

A phishing website for “voting” in an online children’s drawing competition

On other similar sites, potential victims were offered a “free” subscription to a Telegram Premium service. Users are asked to log into their account, but the confidential data that they enter there is sent to the cybercriminals who then hijack their accounts. It is noteworthy that the links to these sites are distributed in a variety of ways, including through the messenger itself. And the real address of the target site in such messages often does not match the one that users see.

A phishing message in Telegram, in which, in order to “activate” a Telegram Premium subscription, users are asked to follow the given link. The text of this link does not in fact match the target URL

The phishing site loaded after the link in the fraudulent message is followed

After the user clicks the button on the previous page, the website displays an authorization form that looks like the genuine one

To distribute links to fraudulent sites, cybercriminals use email spam, among other avenues. Over the course of last year, our Internet analysts detected many different spam campaigns. They observed the active distribution of phishing emails targeting Japanese users. For example, scammers, allegedly on behalf of some bank, informed potential victims about some purchase and suggested that they view the details of the “payment” by following the provided link. In reality, this link led to a phishing Internet resource.

A phishing email, supposedly sent on behalf of a bank and offering Japanese users the option to view the details of a payment

In another popular scenario, threat actors, supposedly on behalf of credit organizations, were sending fake notifications containing information about a month’s worth of bank card expenses. At the same time, the links to phishing sites were often concealed and seemed harmless in the email texts.

In the texts of spam emails, users saw the links to real bank web addresses, but when clicked, these addresses led to a fraudulent Internet resource

One spam campaign targeted European users. For example, users in Belgium encountered phishing emails that claimed their bank accounts had been “blocked”. To get them “unblocked”, they were asked to follow a link which, in fact, led to the fraudsters’ website.

An unwanted letter threatens a potential victim with a “blocked” bank account

We also detected other spam campaigns, for example, those aimed at an English-speaking audience. In one such campaign, potential victims received messages asking them to confirm receipt of a large money transfer. However, the link in these messages led to a phishing online bank authorization form, which resembled the one on the genuine bank’s website.

A spam email saying that the user supposedly needs to confirm receipt of $1,218.16 US

Russian users most often encountered spam letters that helped fraudsters lure potential victims to the phishing websites we covered earlier in this review. Common topics for these unwanted messages were prizes and discounts from online stores, free lottery tickets, and access to investment services. Examples of them are shown in the screenshots below.

A letter, allegedly from an online store, offering the chance to participate in a “prize draw”

A letter, allegedly from a credit organization, offering the chance to “become a successful investor”

A letter, allegedly sent on behalf of an electronics store, offering a promo code that the recipient can activate to get a discount on goods

Mobile devices

According to detection statistics collected by Dr.Web Security Space for mobile devices, in 2024, Android.HiddenAds trojans were once again the most common Android malicious programs. They accounted for more than a third of malware detections. Such trojans conceal their presence on infected devices and display ads. Among the most active members of this family were Android.HiddenAds.3956, Android.HiddenAds.3851, Android.HiddenAds.655.origin, and Android.HiddenAds.3994. At the same time, users encountered Android.HiddenAds.Aegis trojan variants capable of running automatically after installation. Other widespread malicious programs were Android.FakeApp trojans, used in a variety of fraudulent schemes, and Android.Spy spyware trojans.

The most active unwanted programs were members of the Program.FakeMoney, Program.CloudInject, and Program.FakeAntiVirus families. The first ones offer users the opportunity to get virtual rewards by completing various tasks and then withdraw those rewards as real money. However, users never receive any payments. The second ones are programs modified through a specialized cloud service. When modified, an uncontrolled code and a number of dangerous permissions are added to them. The third ones are programs that imitate anti-virus software, detect nonexistent threats and offer users the option to buy the full version to fix the “problems” that had allegedly been found.

Tool.SilentInstaller utilities, which allow Android apps to run without being installed, were once again the most commonly detected potentially dangerous software. They accounted for more than a third of the detections of this type of threat. Also widespread were apps modified with the NP Manager tool (these are detected as Tool.NPMod). A special module is embedded into such modified programs, which allows them to bypass the digital signature verification process once they have been modified. Apps protected with the Tool.Packer.1.origin software packer were also detected quite often, as was the Tool.Androlua.1.origin framework. The latter allows installed Android programs to be modified and potentially dangerous Lua scripts to be executed.

The most widespread adware software was the new family Adware.ModAd, which accounted for almost half of all detections. These are specially modified versions of the WhatsApp messenger, whose functions have been injected with a specific code for loading advertising links. Members of the Adware.Adpush family ranked second, while another new family, Adware.Basement, occupied third place.

In 2024, Android banking trojans were slightly more active than in 2023. At the same time, our specialists observed an increase in the popularity of some techniques used to protect malware from analysis and detection. This was commonly seen in banking trojans. Such techniques included undertaking various manipulations with the ZIP file format (as Android APK files are based on this format) and the configuration file AndroidManifest.xml of Android apps.

The widespread distribution of the Android.SpyMax malicious program is worth a separate mention. Cybercriminals actively used this spyware trojan as a banking trojan, particularly against Russian users (46.23% of detections), and also against Brazilian (35.46% of detections) and Turkish (5.80% of detections) Android device owners.

Throughout the year, Doctor Web’s virus analysts detected over 200 different threats on Google Play. Among them were trojans that subscribe users to paid services, spyware trojans, and fraudulent and adware apps. Combined, they have been downloaded at least 26.7 million times. Moreover, our specialists detected another attack on Android TV box sets: the Android.Vo1d backdoor has infected almost 1.3 million user devices in 197 countries. This trojan placed its components into the system storage area and, when commanded, could covertly download third-party apps from the Internet and install them.

To find out more about the security-threat landscape for mobile devices in 2024, read our special overview.

Prospects and possible trends

The events of the past year have once again demonstrated the diversity of the modern cyber-threat landscape. Malicious actors are interested in both large targets, like private corporate and government sector, and ordinary users. The functionality of many of the malicious programs used in the targeted attacks we investigated indicates that virus writers are constantly searching for new opportunities to improve their methods of conducting malicious campaigns and developing their tools. Over time, new techniques inevitably transfer to more widespread threats. In this regard, in 2025, we may witness the emergence of more trojans that use eBPF technology to conceal their malicious activity. Moreover, we should also expect new targeted attacks, including those that utilize exploits.

One of the main goals of cybercriminals is to make money illegally, so 2025 may see an increase in the activity of banking and ad-displaying trojans. In addition, users may be threatened by more malware with spyware functionality.

At the same time, not only Windows computer users will be the target, but also users of other operating systems, such as Linux and macOS. The distribution of mobile threats will continue. Android device owners should above all be wary of the emergence of new spyware and banking trojans as well as malicious and unwanted ad-displaying apps. New attempts to infect Android TVs, Android TV box sets, and other Android-based devices are also to be expected. Moreover, chances are high that new threats will emerge on Google Play.

The Anti-virus Times

Infinite horizons

Doctor Web’s review of virus activity on mobile devices in 2024

Thu, 30 Jan 2025 00:00:00 GMT

January 30, 2025

In 2024, ad-displaying trojans were once again the most widespread Android threats. Fraudulent software, ransom trojans, clickers, and banking trojans were more active than in the previous year. Among the latter, compared to 2023, the most common were simple banking trojans that steal only online bank account access data and SMS confirmation codes.

Among the most active unwanted software programs were apps offering users the opportunity to complete various tasks in exchange for virtual rewards, which can supposedly be converted into real money. The most commonly detected riskware apps were tools that allow Android programs to launch without being installed. And the most active adware programs were specially modified WhatsApp messenger versions whose functions had been injected with code for loading adware URLs.

Over the course of last year, Doctor Web's malware analysts discovered hundreds of new threats on Google Play, with over 26.7 million cumulative downloads. Among these were malicious programs, including a spyware trojan, and unwanted and adware apps.

Our experts also uncovered a new attack on Android-based TV box sets. Around 1.3 million devices were affected by a backdoor that infected the system storage and, when commanded by attackers, could download and install third-party software.

In addition, Doctor Web’s virus analysts noted the growing popularity of a number of techniques aimed at making Android malware more complicated to analyze and more difficult for antiviruses to detect. These techniques included various manipulations with the ZIP archive format (the APK files of Android apps are based on the ZIP format), manipulations with the apps’ configuration file AndroidManifest.xml, and others. These methods were most often found to be used in banking trojans.

PRINCIPAL TRENDS IN 2024

Ad-displaying malware remained the most widespread threat;
An increase in banking trojan activity;
Cybercriminals increasingly used simple Android.Banker banking trojans, which steal only login data for online bank accounts and also verification codes from SMS;
Threat actors increasingly resorted to manipulating the format of APK apps and their structural components to avoid being detected by anti-viruses and to make it more difficult for their malware to be analyzed;
An increase in the number of Android.Locker ransomware trojans and Android.Click trojan clickers;
The emergence of many new threats on Google Play.

The most notable events of 2024

Last May, Doctor Web’s experts informed users about the Android.Click.414.origin trojan clicker, which was found in an app used to control sex toys and in software for tracking physical activity. Both programs were distributed through Google Play and had more than 1.5 million installs combined. Android.Click.414.origin had a modular structure and used its components to execute certain tasks. For example, the trojan covertly loaded advertising websites and performed various actions on them. It could scroll webpages, enter text into forms, mute audio on webpages, and take screenshots of webpages to analyze their contents and click on desired areas. In addition, Android.Click.414.origin sent detailed information about infected devices to its C&C server. At the same time, the clicker did not specifically attack certain users, and it did not start on devices where the interface language was set to Chinese.

Some versions of the Love Spouse and QRunning programs had the Android.Click.414.origin trojan hidden in them

In September, our specialists revealed the details of their analysis regarding cases of Android TV box sets being infected with the Android.Vo1d backdoor. This modular malware affected nearly 1.3 million devices belonging to users in 197 countries. It placed its components into the system storage area and could covertly download and install third-party software when commanded by threat actors.

Countries found to have the highest number of TV boxes infected with the Android.Vo1d backdoor

Already in November, our virus analysts used Android.FakeApp.1669 as an example to show how threat actors use the DNS protocol to covertly connect malware to C&C servers. Android.FakeApp.1669 is a rather primitive trojan whose only task is to load target websites. It differs from most of the threats similar to it in that it receives the addresses of target sites from the TXT record of a malicious DNS server. For this, it uses the modified code of an open source dnsjava library. At the same time, Android.FakeApp.1669 manifests its malicious nature only when connected to the Internet through certain providers; in other cases it operates as harmless software.

An example of a target domain’s TXT record. It was sent by the DNS server upon request via the Linux ‘dig’ tool while one of the Android.FakeApp.1669 modifications was undergoing analysis

Statistics

According to detection statistics collected by Dr.Web Security Space for mobile devices, malicious programs were the threats most commonly detected in 2024.They accounted for 74.67% of all registered detections. Adware programs, with a share of 10.96%, ranked second. Riskware apps, which accounted for 10.55% of all detections, ranked third. The fourth most common threats were unwanted apps, which users encountered in 3.82% of cases.

Malicious programs

Once again the malicious Android apps most commonly encountered were ad-displaying trojans from the Android.HiddenAds family. Over the course of last year, their share of the total number of malware programs detected by the Dr.Web anti-virus increased by 0.34 pp. to 31.95% of all detections.

In this malware family, the most active member was Android.HiddenAds.3956 (15.10% of the detections for the entire family and 4.84% of all malware detected). This is one of many variants of Android.HiddenAds.1994 malware that users have been encountering for several years now. This particular version, Android.HiddenAds.3956, emerged in 2023 along with other modifications. We predicted that it could take a leading position in the family, which is what eventually happened. In 2024, its new variants also became widespread: Android.HiddenAds.3980, Android.HiddenAds.3989, Android.HiddenAds.3994, Android.HiddenAds.655.origin, Android.HiddenAds.657.origin, and some others.

At the same time, our experts also noticed activity on the part of the Android.HiddenAds.Aegis subfamily. Unlike most other Android.HiddenAds malware, members of this group have the ability to autorun and have some other features. Modifications like Android.HiddenAds.Aegis.1, Android.HiddenAds.Aegis.4.origin, Android.HiddenAds.Aegis.7.origin, and Android.HiddenAds.Aegis.1.origin were the ones most commonly detected on devices protected by Dr.Web anti-virus.

The second most widespread malicious programs were trojans from the Android.FakeApp family, which cybercriminals use in various fraudulent schemes. Last year, they accounted for 18.28% of all malware detections, which is 16.45 pp. higher than the year before. Typically, such trojans load unwanted websites designed for phishing attacks and online fraud.

Android.Spy trojans, which have spyware functionality, ranked third with a share of 11.52%; their share decreased by 16.7 pp., compared to 2023. As in the year before, the most common member of this family was Android.Spy.5106. It accounted for 5.95% of all detected malware.

In 2024, we observed a mixed trend in the distribution of malware that is designed to download and install other apps and capable of executing arbitrary code. Compared to the previous year, the share of Android.DownLoader downloader trojans decreased by 0.49 pp. to 1.69%; the share of Android.Mobifun trojans decreased by 0.15 pp. to 0.10%; and the share of Android.Xiny trojans decreased by 0.14 pp. to 0.13%. At the same time, Android.Triada and Android.RemoteCode trojans were detected more often. The number of detection cases for the former increased by 0.6 pp. to 2.74%, and for the latter by 0.95 pp. to 3.78%.

The share of Android.Packed malware protected by software packers decreased from 7.98% to 5.49%, nearly returning to the 2022 figure. The number of attacks involving Android.MobiDash adware trojans also decreased—from 10.06% to 5.38%. At the same time, the number of Android.Locker ransomware and Android.Proxy trojan detections increased slightly—from 1.15% to 1.60% and from 0.57% to 0.81%, respectively. Android.Proxy trojans allow threat actors using infected Android devices to redirect their network traffic through them. In addition, the activity of Android.Click malicious programs increased significantly, from 0.82% to 3.56%. These trojans can open advertising websites and perform clicks on webpages.

The ten most commonly detected malicious programs in 2024:

Android.FakeApp.1600: A trojan app that loads a website that is hardcoded into its settings. Known modifications of this malicious program load an online casino site.
Android.Spy.5106: The detection name for a trojan that presents itself as modified versions of unofficial WhatsApp messenger mods. This malicious program can steal the contents of notifications and offer users other apps from unknown sources for installation. And when such a modified messenger is used, it can also display dialog boxes containing remotely configurable content.
Android.HiddenAds.3956
Android.HiddenAds.3851
Android.HiddenAds.655.origin
Android.HiddenAds.3994
Android.HiddenAds.657.origin: Trojan apps designed to display intrusive ads. Members of the Android.HiddenAds family are often distributed as popular and harmless applications. In some cases, other malware can install them in the system directory. When these infect Android devices, they typically conceal their presence from the user. For example, they “hide” their icons from the home screen menu.
Android.Click.1751: This trojan is built into third-party WhatsApp messenger mods and camouflaged as Google library classes. While the host application is being used, Android.Click.1751 connects to one of the C&C servers and receives two URLs from it. One of them is intended for Russian-speaking users, and the other is for everyone else. The trojan then displays a dialog box whose contents it has also received from a remote server. When a user clicks on the confirmation button, malware loads the corresponding link in the browser.
Android.HiddenAds.Aegis.1: A trojan app that conceals its presence on Android devices and displays intrusive ads. It has a number of characteristics that differentiate it from other members of the Android.HiddenAds family. For example, this trojan can run automatically after its installation. Moreover, it implements a mechanism that allows its service to remain constantly running. And, in some cases, it can also use hidden Android operating system functions.
Android.MobiDash.7815: A trojan app that displays obnoxious ads. It is a special software module that developers incorporate into applications.

Unwanted software

The unwanted program most commonly detected in 2024 was Program.FakeMoney.11. It accounted for more than half (52.10%) of the total number of unwanted software detected on protected devices. It belongs to a class of apps that offer users a chance to make money by completing various tasks but ultimately do not provide any real rewards.

Programs that Dr.Web anti-virus detects as Program.CloudInject.1 ranked second, with a share of 19.21% (up 9.75 pp. from the previous year). Such apps are modified through the CloudInject cloud service. When modified, they have dangerous permissions and an obfuscated code added to them, and the purpose of that code cannot be controlled.

Program.FakeAntiVirus.1 program activity declined for the second year in a row. With a share of 10.07%, which is down 9.35 pp. from 2023, these programs became the third most widespread unwanted software. They imitate anti-virus software, detect nonexistent threats, and ask users to buy full versions to “fix” the issues that have allegedly been found.

Over the course of last year, users encountered a variety of programs for monitoring and controlling activity. Such software can be used to collect data, both with the consent of device owners and without their knowledge. In the latter case, these actually turn into spying tools. The following monitoring programs were most often detected on devices protected by Dr.Web anti-virus: Program.TrackView.1.origin (2.40% of cases), Program.SecretVideoRecorder.1.origin (2.03% of cases), Program.wSpy.3.origin (0.98% of cases), Program.SecretVideoRecorder.2.origin (0.90% of cases), Program.Reptilicus.8.origin (0.64% of cases), Program.wSpy.1.origin (0.39% of cases), and Program.MonitorMinor.11 (0.38% of cases).

Additionally, Program.Opensite.2.origin Android programs, with a share of 0.60% of all the unwanted software detected, were also spotted. These programs are designed to load target websites and display ads.

The ten unwanted programs most commonly detected in 2024:

Program.FakeMoney.11
Program.FakeMoney.7: The detection name for Android applications that allegedly allow users to earn money by completing different tasks. These apps make it look as if rewards are accruing for each one that is completed. At the same time, users are told that they have to accumulate a certain sum to withdraw their “earnings”. Typically, such apps have a list of popular payment systems and banks that supposedly could be used to withdraw the rewards. But even if users succeed in accumulating the needed amount, in reality they cannot get any real payments. This virus record is also used to detect other unwanted software based on the source code of such apps.
Program.CloudInject.1: The detection name for Android programs that have been modified using the CloudInject cloud service and the eponymous Android utility (the latter was added to the Dr.Web virus database as Tool.CloudInject). Such programs are modified on a remote server; meanwhile, the modders (users) who are interested in such modifications cannot control exactly what will be added to the apps. Moreover, these programs receive a number of dangerous system permissions. Once modification is complete, users can remotely manage these apps. They can block them, display custom dialogs, and track when other software is being installed or removed from a device, etc.
Program.FakeAntiVirus.1: The detection name for adware programs that imitate anti-virus software. These apps inform users of nonexistent threats, mislead them, and demand that they purchase the software’s full version.
Program.TrackView.1.origin: The detection name for a program that allows users to be monitored via their Android devices. Malicious actors can utilize it to track a target device’s location, use the camera to record video and take photos, eavesdrop via the microphone, record audio, etc.
Program.SecretVideoRecorder.1.origin
Program.SecretVideoRecorder.2.origin: The detection name for various modifications of an application that is designed to record videos and take photos in the background, using built-in Android device cameras. It can operate covertly by allowing notifications about ongoing recordings to be disabled. It also allows an app’s icon and name to be replaced with fake ones. This functionality makes this software potentially dangerous.
Program.wSpy.3.origin: This is a commercial spyware app designed to covertly monitor Android device user activity. It allows intruders to read SMS and chats in popular messaging software, listen to the surroundings, track device location and browser history, gain access to the phonebook and contacts, photos and videos, and take screenshots and pictures through a device’s built-in camera. In addition, it has keylogger functionality.
Program.Reptilicus.8.origin: An application that allows Android device users to be monitored. It can track device location, collect information from SMS and social media messages, intercept phone calls and record the surroundings, take screenshots, act as a keylogger, copy files from a target device and perform other actions.
Program.Opensite.2.origin: The detection name for single-type Android programs whose function is to load target websites and display ads. Such apps often masquerade as other software. For instance, there exist modifications that are distributed under the guise of YouTube player. They load a genuine YouTube website and display advertisement banners, using the advertising SDKs connected to them.

Riskware

In 2024, Tool.SilentInstaller utilities, which allow Android programs to launch without being installed, retained their leading positions in terms of riskware software detection numbers. In total, they accounted for more than a third of all apps of this type identified on protected devices. Modifications like Tool.SilentInstaller.17.origin (16.17%), Tool.SilentInstaller.14.origin (9.80%), Tool.SilentInstaller.7.origin (3.25%), and Tool.SilentInstaller.6.origin (2.99%) were most often detected.

Other common riskware apps were programs modified using the NP Manager utility. This tool embeds a special module into the target software, which allows the digital signature verification process to be bypassed once the apps have been modified. Dr.Web anti-virus detects such programs as different variants of the Tool.NPMod family. Of these, Tool.NPMod.1 variants were most commonly detected. Over the course of 2024, they significantly strengthened their position, accounting for 16.49% of all riskware detections, up 11.68 pp. from 2023. At the same time, the share of programs modified using the NP Manager tool and detected with another virus record, Tool.NPMod.2, was 7.92%. As a result, members of this family were responsible for almost a quarter of potentially dangerous software detections.

Programs protected by the Tool.Packer.1.origin packer were also among the leaders. They were detected in 13.17% of cases, up 12.38 pp. from the year before. Moreover, the number of Tool.Androlua.1.origin detections increased from 3.10% to 3.93%. This is a framework that makes it possible to modify Android apps and run Lua scripts that can potentially be malicious.

At the same time, one 2023 leader, the Tool.LuckyPatcher family of utilities, was, on the contrary, less active—down from 14.02% to 8.16%. These tools allow Android programs to be modified and scripts downloaded from the Internet to be added to them. Also less frequently encountered were programs protected by the obfuscating utility Tool.Obfuscapk (down from 3.22% to 1.05%) and by the packer Tool.ApkProtector (down from 10.14% to 3.39%).

The ten most widespread riskware apps detected on protected Android devices in 2024:

Tool.NPMod.1
Tool.NPMod.2: The detection name for Android programs that have been modified using the NP Manager utility. A special module is embedded in such apps, and it allows them to bypass digital signature verification once they have been modified.
Tool.SilentInstaller.17.origin
Tool.SilentInstaller.14.origin
Tool.SilentInstaller.7.origin
Tool.SilentInstaller.6.origin: Riskware platforms that allow applications to launch APK files without installing them. They create a virtual runtime environment in the context of the apps in which they are integrated. The APK files, launched with the help of these platforms, can operate as if they are part of such programs and can also obtain the same permissions.
Tool.Packer.1.origin: A packer tool designed to protect Android applications from unauthorized modification and reverse engineering. This tool is not malicious in itself, but it can be used to protect both harmless and malicious software.
Tool.LuckyPatcher.1.origin: A tool that allows apps installed on Android devices to be modified (i.e., by creating patches for them) in order to change the logic of their work or to bypass certain restrictions. For instance, users can apply it to disable root-access verification in banking software or to obtain unlimited resources in games. To add patches, this utility downloads from the Internet specially prepared scripts, which can be crafted and added to the common database by any third party. The functionality of such scripts can prove to be malicious; thus, patches made with this tool can pose a potential threat.
Tool.Androlua.1.origin: The detection name for some potentially dangerous versions of a specialized framework for developing Android software in the Lua scripting language. The main logic of Lua-based apps resides in the corresponding scripts that are encrypted and decrypted by the interpreter upon execution. By default, this framework often requests access to a large number of system permissions in order to operate. As a result, the Lua scripts that it executes can potentially perform various malicious actions in accordance with the acquired permissions.
Tool.Packer.3.origin: The detection name for Android programs whose code is encoded and obfuscated by the NP Manager tool.

Adware

The most common adware in 2024 was the new Adware.ModAd family, which accounted for 47.45% of detections. The previous year’s leaders, members of the Adware.Adpush family, dropped to second place with a share of 14.76% (a 21.06 pp. decrease in the number of detections). Third place, with a share of 8.68%, was occupied by another new adware family, Adware.Basement.

Also commonly encountered were families like Adware.Airpush (their share decreased from 8.59% to 4.35%), Adware.Fictus (down from 4.41% to 3.29%), Adware.Leadbolt (down from 4.37% to 2.26%), and Adware.ShareInstall (down from 5.04% to 1.71%). Unwanted ad-displaying Adware.MagicPush programs, which ranked second in 2023, significantly curtailed their activity and did not even make it into the top 10; they moved straight to eleventh place with a share of 1.19% (a 8.39 pp. decrease).

The ten most widespread adware apps detected on protected Android devices in 2024:

Adware.ModAd.1: The detection name for some modified versions (mods) of the WhatsApp messenger, whose functions have been injected with a specific code. This code is responsible for loading target URLs by displaying web content (via the Android WebView component) when the messenger is in operation. Such web addresses perform redirects to advertised sites, including online casino, bookmaker, and adult sites.
Adware.Basement.1: These are apps that display unwanted ads which often lead to malicious and fraudulent websites. They share a common code base with the Program.FakeMoney.11 unwanted applications.
Adware.Fictus.1
Adware.Fictus.1.origin: An adware module that malicious actors embed into cloned versions of popular Android games and applications. Its incorporation is facilitated by a specialized net2share packer. Copies of software created this way are then distributed through various software catalogs. When installed on Android devices, such apps and games display obnoxious ads.
Adware.Adpush.21846
Adware.AdPush.39.origin: Adware modules that can be built into Android apps. They display notifications containing ads that mislead users. For example, such notifications can look like messages from the operating system. In addition, these modules collect a variety of confidential data and are able to download other apps and initiate their installation.
Adware.Airpush.7.origin: Adware modules that can be built into Android apps and display various ads. Depending on the modules’ version and modification, these can be notifications containing ads, pop-up windows or banners. Malicious actors often use these modules to distribute malware by offering their potential victims diverse software for installation. Moreover, such modules collect personal information and send it to a remote server.
Adware.ShareInstall.1.origin: An adware module that can be built into Android applications. It displays notifications containing ads on the Android OS lock screen.
Adware.Youmi.4: The detection name for an unwanted adware module that adds advertizing shortcuts onto the Android OS home screen.
Adware.Inmobi.1: The detection name for some versions of the Inmobi adware SDK. These are capable of making phone calls and adding event entries into an Android device’s calendar.

Threats on Google Play

In 2024, Doctor Web’s virus analysts discovered over 200 threats with more than 26.7 million combined downloads. In addition to Android.Click.414.origin, these included many other threats, such as ad-displaying Android.HiddenAds trojans. They were distributed under the guise of all kinds of software: image-editing programs, QR code scanners, image collection apps, and even an “anti-theft” alarm for protecting smartphones from falling into the wrong hands. Such trojans conceal their icons after installation and proceed to display aggressive ads that overlap the interface of the operating system and other programs and prevent the device from being used normally.

Examples of adware trojans discovered on Google Play in 2024. Android.HiddenAds.4013 was hiding in the photo editor “Cool Fix Photo Enhancer”, Android.HiddenAds.4034 was in the “Cool Darkness Wallpaper” image-collection app, Android.HiddenAds.4025 was in the QR scanning program “QR Code Assistant”, and Android.HiddenAds.656.origin was in the “anti-theft” alarm program “Warning Sound GBD”

Our experts also discovered various trojans that threat actors were protecting with a complicated software packer.

The “Lie Detector Fun Prank” program was the Android.Packed.57156 trojan, and the “Speaker Dust and Water Cleaner” app was the Android.Packed.57159 trojan; both were protected with a software packer

Other malware we found were members of the Android.FakeApp family, which are used in various fraudulent schemes. The main task of most of these trojans is to open a target URL, while some of them, under certain conditions, can also operate as the software they are disguised as. Many of them were distributed as different apps, including financial programs, like teaching aids and reference books, profit calculators, apps for accessing trading, and instruments for home bookkeeping. Others were disguised as notepads and diaries, software for participating in quiz games, surveys, etc. They also loaded fraudulent investment sites.

Examples of Android.FakeApp trojans that opened links to fraudulent websites: Android.FakeApp.1681 (disguised as the “SenseStrategy” app), Android.FakeApp.1708 (disguised as the “QuntFinanzas” app)

Some Android.FakeApp fake programs were distributed as a variety of games. Many of them could actually provide the declared functionality, but their main task was to load online casino and bookmaker sites.

Examples of Android.FakeApp trojans that were disguised as games and loaded bookmaker and online casino websites: Android.FakeApp.1622 (“3D Card Merge Game”) and Android.FakeApp.1630 (“Crazy Lucky Candy”)

Some trojans from this family were once again camouflaged as job-search programs. Such scam apps load fake vacancy listings and offer users the opportunity to create a resume by providing personal information. In other cases, the trojans can ask potential victims to contact “the employer” via a messenger. In reality, they will actually be writing to the scammers, who will try to lure them into one or another fraudulent scheme.

Examples of the Android.FakeApp trojans that scammers passed off as job-search apps: Android.FakeApp.1627 (the “Aimer” app) and Android.FakeApp.1703 (the “FreeEarn” app)

In addition, more trojans that subscribe users to paid services were uncovered on Google Play. One of them was Android.Subscription.22, which was being distributed as the “InstaPhoto Editor” photo-editing program.

The Android.Subscription.22 trojan is designed to subscribe users to paid services

Other such trojans were members of the related Android.Joker and Android.Harly families, which have a modular architecture. The former can download additional components from the Internet, while the latter are distinguished by the fact that they typically store the modules they need in encrypted form in their file resources.

Examples of apps that subscribed victims to paid services. The Android.Joker.2280 was hiding in the horoscope program “My Horoscope”, and the Android.Harly.87 was hiding in the game “BlockBuster”

In addition to malware, Doctor Web’s specialists discovered new unwanted software on Google Play, which included different modifications of Program.FakeMoney.11 and Program.FakeMoney.14. These belong to a family of programs that offer users virtual rewards for completing various tasks (often this involves watching ads). The rewards can allegedly be converted into real money or prizes, but to withdraw their “earned” reward, users must collect a certain sum. However, even if they succeed in doing so, they will not get any real payments.

One of the Program.FakeMoney.11 variants was distributed as the game “Copper Boom”, and Program.FakeMoney.14 was disguised as the game “Merge Party”

In addition, throughout the year, our malware analysts discovered new adware programs. Among them were apps and games with the built-in adware module Adware.StrawAd, which is capable of displaying ads from various advertising service providers.

Examples of games containing the adware module Adware.StrawAd: “Crazy Sandwich Runner” (Adware.StrawAd.1), “Poppy Punch Playtime” (Adware.StrawAd.3), “Finger Heart Matching” (Adware.StrawAd.6), and “Toimon Battle Playground” (Adware.StrawAd.9)

Adware.Basement adware programs were also distributed via Google Play. Ads from these often lead to malicious and fraudulent websites. It is noteworthy that this family shares a code base with the unwanted Program.FakeMoney.11 apps.

Examples of Adware.Basement unwanted adware programs: “Lie Detector: Lie Prank Test”, “TapAlarm:Don't touch my phone”, and “Magic Voice Changer” are examples for Adware.Basement.1; and “Auto Clicker:Tap Auto” for Adware.Basement.2

Banking trojans

According to detection statistics provided by Dr.Web Security Space for mobile devices, in 2024, banking trojans represented 6.29% of the total number of registered malicious apps, which is up 2.71 pp. from the previous year. Starting in January, their activity steadily declined, but from mid-spring onwards, the number of attacks started to increase again. Their activity remained virtually unchanged during the third quarter, after which they continued to be more active, reaching an annual maximum in November.

In 2024, well-known banking trojan families became widespread again. Among them were the malicious programs Coper, Hydra (Android.BankBot.1048.origin, Android.BankBot.563.origin), Ermac (Android.BankBot.1015.origin, Android.BankBot.15017), Alien (Android.BankBot.745.origin, Android.BankBot.1078.origin), Anubis (Android.BankBot.670.origin). In addition, attacks using the following were observed: Cerberus (Android.BankBot.11404), GodFather (Android.BankBot.GodFather.3, Android.BankBot.GodFather.14.origin), and Zanubis (Android.BankBot.Zanubis.7.origin).

Over the course of 2024, malicious actors actively distributed Android.SpyMax spyware trojans, which have rich malicious functionality. They are also widely used as banking trojans. This family originally included the multifunctional RAT trojan SpyNote (RAT — Remote Administration Trojan or Remote Access Trojan). However, after its source code was leaked, many new modifications based on this code started to emerge, including CraxsRAT and G700 RAT. Dr.Web Security Space detection statistics show that members of this family became more active in the second half of 2023; since then, almost every month they have been detected in increasing numbers, and this trend continues.

Android.SpyMax trojans target users all over the world. Last year, they were also found to be involved in numerous attacks on Russian users, as 46.23% of the detections of this family were registered on devices belonging to this particular audience. These trojans were also most actively distributed among Brazilian (35.46% of detections) and Turkish (5.80% of detections) Android device owners.

It is noteworthy that these malicious programs are mainly distributed in Russia not via spam or classic phishing, but during one stage of telephone fraud. At the beginning of their call, threat actors traditionally try to convince their victims that they are employees of a bank or a law enforcement agency. They inform them about a problem that has allegedly occurred, e.g., an attempt to steal money from the victim’s bank account or an unplanned loan; or, on the contrary, they report “good news” about free money that is supposedly due their victims from the government. When the scammers realize that a user has believed them, they encourage their victim to install an “anti-virus update”, a “banking program”, or some other similar app—for example, to “ensure a secure transaction”. Such a program will, in fact, contain an Android.SpyMax trojan.

In 2024, Russian users also encountered the Falcon banking trojan family (Android.BankBot.988.origin, Android.Banker.5703) and the Mamont family (Android.Banker.637.origin, Android.Banker.712.origin). In addition, attacks involving the banking trojans Android.Banker.791.origin and Android.Banker.829.origin were observed. These targeted Android device owners from Russia and Uzbekistan. Other attacks were perpetrated by Android.Banker.802.origin and affected Russian, Azerbaijani, and Uzbekistani users. Android.Banker.757.origin targeted users from Russia, Uzbekistan, Tajikistan, and Kazakhstan.

Our experts once again detected attacks coming from the MoqHao trojans (Android.Banker.367.origin, Android.Banker.430.origin, Android.Banker.470.origin, Android.Banker.593.origin) that were aimed at users from many countries, including Southeast Asian and Asia-Pacific countries. The same audience was also targeted by other trojans. For example, South Korean Android device owners encountered families like Fakecalls (Android.BankBot.919.origin, Android.BankBot.14423, Android.Banker.5297), IOBot (Android.BankBot.IOBot.1.origin), and Wroba (Android.Banker.360.origin). Other Wroba modifications (Android.BankBot.907.origin, Android.BankBot.1128.origin) attacked users from Japan.

Banking trojans that threatened Chinese users included, for instance, the Android.Banker.480.origin trojan, and Vietnamese users were attacked by Android.BankBot.1111.origin. At the same time, cybercriminals used trojans like TgToxic (Android.BankBot.TgToxic.1) to attack bank customers from Indonesia, Thailand, and Taiwan, and the GoldDigger trojan (Android.BankBot.GoldDigger.3) was used to target users from Thailand and Vietnam.

Attacks on Iranian users were again recorded. These users encountered such banking trojans as Android.Banker.709.origin, Android.Banker.5292, Android.Banker.777.origin, Android.BankBot.1106.origin, and some others. And banking trojans that attacked Turkish bank customers included representatives of the Tambir family (Android.BankBot.1104.origin, Android.BankBot.1099.origin, Android.BankBot.1117.origin), along with some others.

Banking trojans like Android.Banker.797.origin, Android.Banker.817.origin and Android.Banker.5435 targeted Indian users. These trojans were camouflaged as software that was allegedly related to the credit institutions Airtel Payments Bank, PM KISAN, and IndusInd Bank. In addition, Rewardsteal banking trojans (Android.Banker.719.origin, Android.Banker.5147, Android.Banker.5443) remained active. These primarily targeted Indian customers of banks like Axis bank, HDFC Bank, SBI, ICICI Bank, RBL bank, and Citi bank.

In Latin American counties, PixPirate (Android.BankBot.1026.origin) trojan activity was observed; these trojans target Brazilian bank customers.

Among the trojans targeting European users were Anatsa (Android.BankBot.Anatsa.1.origin) and Copybara (Android.BankBot.15140 and Android.BankBot.1100.origin). The latter mainly targets users from Italy, the United Kingdom, and Spain.

During 2024, Doctor Web’s virus analysts observed an increase in the popularity of certain methods of protecting Android malware (primarily banking trojans) from analysis and detection. In particular, attackers performed various manipulations with the ZIP format on which Android APK files are based. As a result, many instruments of static analysis that use standard algorithms to work with ZIP archives are unable to correctly process such “damaged” files. At the same time, the Android OS accepts such modified trojans as normal programs, allowing them to be installed and run.

One common technique is to manipulate the fields compression method and compressed size in the local file header inside the APK. Threat actors intentionally specify the wrong values for the fields compressed size and uncompressed size or write an incorrect or nonexistent compression method in the compression method field. Another option is to specify a method that does not involve compression for the archive. The header fields compressed size and uncompressed size will not match, although they should.

Another popular technique is to use incorrect information about the disk in the ECDR (End of Central Directory Record) and in the CD (Central Directory that contains data about files and archive parameters). Both these parameters should match for a single archive. However, cybercriminals can specify different values for these as if it were not a single archive, but a multi-archive.

Also widespread was a technique whereby a flag was set in the local file headers of some files in the archive, indicating that these files are encrypted. In reality they are not encrypted but due to this, such an archive will be parsed incorrectly.

Along with manipulating the structure of APK files, malware creators also used other practices, such as modifying the AndroidManifest.xml configuration file of Android apps. In particular, they added garbage bytes b'\x00' to this file’s attribute structure, causing it to be read incorrectly.

Prospects and trends

The past year has shown that cybercriminals are still actively enriching themselves at the expense of Android device owners. Their main tools remain ad-displaying and banking trojans, malicious programs with spyware capabilities, and fraudulent software. In this regard, we should expect the emergence of new threats of this type in 2025.

Despite the steps taken to improve the security of Google Play, this app catalog still remains an Android threat distribution source. Therefore, new malicious and unwanted apps emerging in it should not be ruled out.

Another case of Android TV box sets being infected was detected last year, indicating that malware creators use different attack vectors. It is quite possible that threat actors will not only turn their attention to such devices again, but will also continue to look for other potential targets among the variety of Android gadgets.

It is possible that malware developers will continue to actively introduce new techniques that allow their malicious programs to bypass analysis and detection.

Doctor Web’s specialists continue to both monitor the evolution of mobile cyber threats and ensure that our users are protected. To improve your mobile device security, install Dr.Web Security Space, which helps in the fight against malicious, unwanted, and other dangerous programs; fraudsters; and other threats.

Indicators of compromise

Doctor, where did you get these pictures? Using steganography in a cryptocurrency mining campaign.

Fri, 24 Jan 2025 07:00:00 GMT

January 24, 2025

When analyzing telemetry data, virus analysts at Doctor Web identified malware samples that, upon closer examination, turned out to be components of an active campaign to mine the Monero cryptocurrency. This campaign is notable because it is implemented as a series of malware chains, two of which are based on executing scripts that extract malicious payloads from BMP image files.

The campaign likely began in 2022 when our analysts first observed Services.exe, a .NET application that launched a malicious VBscript. This script implements backdoor functionality by contacting the attacker's server and executing the scripts and files sent in response. For example, the malicious file ubr.txt, a PowerShell script whose extension was changed from ps1 to txt, was downloaded to the victim's computer.

The ubr.txt script checks for miners that may already be installed on the compromised machine and replaces them with the versions the attackers provide. The files installed by the script are the SilentCryptoMiner miner and its configuration, which the hackers used to mine the Monero cryptocurrency.

We have reported on the use of this miner by attackers who are attracted by its ease of configuration, its advanced capabilities for mining different types of cryptocurrencies and hiding from diagnostic utilities, and its ability to remotely manage all of the miners in the botnet via a web panel.

As part of this campaign, the miner files are disguised as components of various software, such as the Zoom video conferencing application (ZoomE.exe and ZoomX.exe), Windows services (Service32.exe and Service64.exe), etc. Although there exist several sets of malicious modules with different names, they all perform the same tasks: removing other miners, installing a new miner, and delivering updates for it.

PowerShell script ubr.txt

In addition, the miner accesses the getcert[.]net domain, which hosts the m.txt file containing the cryptocurrency mining settings. This domain is also used in other infection chains.

The miner configuration included in the m.txt file

Later, fraudsters modified the attack methodology, making it much more interesting and incorporating steganography tools.

Steganography is a method of hiding information within other information. Unlike cryptography, which can draw attention to encrypted data, steganography allows information to be hidden inconspicuously, such as in an image. Many cybersecurity experts believe that the use of steganography to bypass defenses will grow in popularity.

The image on the left (credit: Marek Piwnicki) contains a hidden image with the Dr.Web logo

The second, more recent chain employs the Amadey trojan, which runs the PowerShell script Async.ps1. The script downloads BMP images from the legitimate image-hosting site imghippo.com. A steganographic algorithm extracts two executables from the images: the Trojan.PackedNET.2429 stealer and a payload that does the following:

Disables the UAC prompt for administrators
Makes numerous exceptions to the built-in Windows Defender antivirus
Disables notifications in Windows
Creates a new task in \Microsoft\Windows\WindowsBackup\ with the name 'User'.

Contents of the Async1.ps script

During its execution, the task accesses the attackers' domains whose DNS TXT record contains the address of the payload. After downloading it, the archive containing BMP images is unpacked and the following files are launched:

Cleaner.txt, a PowerShell script that removes all other miners,
m.txt, a PowerShell script that extracts payloads from m.Bmp and IV.Bmp images. The payload inside the images is SilentCryptoMiner and the injector that runs it,
Net.txt, a script that reads a DNS TXT record from the domains windowscdn[.]site and buyclients[.]xyz. This record contains a payload link pointing to raw.githack[.]com.

A DNS TXT record is an extension of the standard DNS record and contains data that helps to verify a domain. However, the domain owner can include any data in it, such as, in this case, a payload link.

Contents of the archive with malicious images

The miner modules are constantly evolving. Recently, the authors switched to using legitimate resources to host malicious images and the GitHub platform to store payloads. Additionally, we have observed modules that verify whether this malware is running in sandboxes and virtual machines.

A module that checks the names of running applications against the names of common tools used by cybersecurity researchers

One of the wallets found in the miner's configuration was created in May 2022, and so far, it has received 340 XMR. However, the exchange rate of this cryptocurrency is experiencing a period of significant volatility, so in this case the fraudsters' profit could be 65–70 thousand USD. Judging by the wave-like shape of the hash rate curve, which indicates that the computers in the botnet are turned on and off regularly, this mining campaign mostly involves ordinary users located in the same group of time zones. On average, the hash rate is 3.3 million hashes per second, which allows compromised machines to earn the attackers 1 XMR every 40 hours or so.

This campaign is just the tip of the iceberg in the world of steganography-based cyber threats and underscores the importance of being vigilant in the digital space. Doctor Web's recommendations remain unchanged: only install software from reliable sources, do not click on suspicious links, and do not disable antivirus protection when downloading files from the Internet.

Attack chain

Indicators of compromise

Doctor Web’s Q4 2024 review of virus activity on mobile devices

Thu, 26 Dec 2024 10:00:00 GMT

December 26, 2024

According to detection statistics collected by Dr.Web Security Space for mobile devices, Android.HiddenAds ad-displaying trojans were the malware programs most frequently detected in the fourth quarter of 2024 (Q4). The second most common threats were Android.FakeApp trojans, which are used in fraudulent schemes. Trojans from the Android.Siggen family, capable of executing various malicious tasks, ranked third.

Over the course of Q4, Doctor Web’s malware analysts discovered many threats on Google Play. Among them were numerous Android.FakeApp trojans and malware from the Android.Subscription and Android.Joker families, which subscribe users to paid services. More Android.HiddenAds adware trojans were also detected. In addition, threat actors distributed malicious apps protected with a sophisticated software packer.

PRINCIPAL TRENDS OF Q4 2024

High activity on the part of Android.HiddenAds adware trojans and Android.FakeApp fraudulent apps
The distribution of many malicious programs through the Google Play catalog

According to statistics collected by Dr.Web Security Space for mobile devices

Android.FakeApp.1600: A trojan app that loads a website that is hardcoded into its settings. Known modifications of this malicious program load an online casino site.
Android.HiddenAds.655.origin
Android.HiddenAds.657.origin: Trojan apps designed to display intrusive ads. Members of the Android.HiddenAds family are often distributed as popular and harmless applications. In some cases, other malware can install them in the system directory. When these infect Android devices, they typically conceal their presence from the user. For example, they “hide” their icons from the home screen menu.
Android.Packed.57083: The detection name for malicious applications protected with an ApkProtector software packer. Among them are banking trojans, spyware, and other malicious software.
Android.Click.1751: This trojan is built into third-party WhatsApp messenger mods and camouflaged as Google library classes. While the host application is being used, Android.Click.1751 connects to one of the C&C servers and receives two URLs from it. One of them is intended for Russian-speaking users, and the other is for everyone else. The trojan then displays a dialog box whose contents it has also received from a remote server. When a user clicks on the confirmation button, malware loads the corresponding link in the browser.

Program.FakeMoney.11: The detection name for Android applications that allegedly allow users to earn money by completing different tasks. These apps make it look as if rewards are accruing for each one that is completed. At the same time, users are told that they have to accumulate a certain sum to withdraw their “earnings”. Typically, such apps have a list of popular payment systems and banks that supposedly could be used to withdraw the rewards. But even if users succeed in accumulating the needed amount, in reality they cannot get any real payments. This virus record is also used to detect other unwanted software based on the source code of such apps.
Program.FakeAntiVirus.1: The detection name for adware programs that imitate anti-virus software. These apps inform users of nonexistent threats, mislead them, and demand that they purchase the software’s full version.
Program.CloudInject.1: The detection name for Android programs that have been modified using the CloudInject cloud service and the eponymous Android utility (the latter was added to the Dr.Web virus database as Tool.CloudInject). Such programs are modified on a remote server; meanwhile, the modders (users) who are interested in such modifications cannot control exactly what will be added to the apps. Moreover, these programs receive a number of dangerous system permissions. Once modification is complete, users can remotely manage these apps. They can block them, display custom dialogs, and track when other software is being installed or removed from a device, etc.
Program.TrackView.1.origin: The detection name for a program that allows users to be monitored via their Android devices. Malicious actors can utilize it to track a target device’s location, use the camera to record video and take photos, eavesdrop via the microphone, record audio, etc.
Program.SecretVideoRecorder.1.origin: The detection name for various modifications of an application that is designed to record videos and take photos in the background, using built-in Android device cameras. It can operate covertly by allowing notifications about ongoing recordings to be disabled. It also allows an app’s icon and name to be replaced with fake ones. This functionality makes this software potentially dangerous.

Tool.NPMod.1: The detection name for Android programs that have been modified using the NP Manager utility. A special module is embedded in such apps, and it allows them to bypass digital signature verification once they have been modified.
Tool.SilentInstaller.14.origin: A riskware platform that allows applications to launch APK files without installing them. It creates a virtual runtime environment in the context of the apps in which they are integrated. The APK files launched with the help of this platform can operate as if they are part of such programs and can also obtain the same permissions.
Tool.LuckyPatcher.1.origin: A tool that allows apps installed on Android devices to be modified (i.e., by creating patches for them) in order to change the logic of their work or to bypass certain restrictions. For instance, users can apply it to disable root-access verification in banking software or to obtain unlimited resources in games. To add patches, this utility downloads specially prepared scripts from the Internet, which can be crafted and added to the common database by any third party. The functionality of such scripts can prove to be malicious; thus, patches made with this tool can pose a potential threat.
Tool.Packer.1.origin: A packer tool designed to protect Android applications from unauthorized modifications and reverse engineering. This tool is not malicious in itself, but it can be used to protect both harmless and malicious software.
Tool.Androlua.1.origin: The detection name for some potentially dangerous versions of a specialized framework for developing Android software based on the Lua scripting language. The main logic of Lua-based apps resides in the corresponding scripts that are encrypted and decrypted by the interpreter upon execution. By default, this framework often requests access to a large number of system permissions in order to operate. As a result, the Lua scripts that it executes can potentially perform various malicious actions in accordance with the acquired permissions.

Adware.ModAd.1: The detection name for some modified versions (mods) of the WhatsApp messenger, whose functions have been injected with a specific code. This code is responsible for loading target URLs by displaying web content (via the Android WebView component) when the messenger is in operation. Such web addresses perform redirects to advertised sites, including online casino, bookmaker, and adult sites.
Adware.Basement.1: These are apps that display unwanted ads which often lead to malicious and fraudulent websites. They share a common code base with the Program.FakeMoney.11 unwanted applications.
Adware.Fictus.1.origin: An adware module that malicious actors embed into the cloned versions of popular Android games and applications. Its incorporation is facilitated by a specialized net2share packer. Copies of software created this way are then distributed through various software catalogs. When installed on Android devices, such apps and games display obnoxious ads.
Adware.AdPush.3.origin
Adware.Adpush.21846: Adware modules that can be built into Android apps. They display notifications containing ads that mislead users. For example, such notifications can look like messages from the operating system. In addition, these modules collect a variety of confidential data and are able to download other apps and initiate their installation.

Threats on Google Play

In Q4 2024, Doctor Web’s malware analysts discovered over 60 malicious apps on Google Play, most of which were trojans from the Android.FakeApp family. Some of them were distributed as financial programs, teaching aids, reference books, and other software, including diaries, notepads, and so on. Their primary task was to load fraudulent websites.

The “QuntFinanzas” and “Trading News” apps, which, among other numerous Android.FakeApp trojans, loaded fraudulent sites

Malicious actors disguised other Android.FakeApp trojans as games. These could load online casino and bookmaker websites.

“Bowl Water” and “Playful Petal Pursuit” are examples of games with trojan functionality

Our experts also uncovered new variants of the Android.FakeApp.1669 trojan that was hiding behind the mask of various programs and could also load online casino websites. Android.FakeApp.1669 is interesting in that it gets the target website URL from the malicious DNS server’s TXT file. At the same time, it only manifests itself when connected to the Internet through certain providers.

Examples of new Android.FakeApp.1669 trojan modifications. The “WordCount” app was disguised as a text tool, and the “Split it: Checks and Tips” app was supposed to help café- and restaurant-goers pay their bills and calculate tips.

Several new members of the Android.HiddenAds adware trojan family were among the threats detected on Google Play. They conceal their presence on infected devices.

This “Cool Fix Photo Enhancer” photo-editing software was hiding the Android.HiddenAds.4013 ad-displaying trojan

Moreover, trojans protected with a sophisticated software packer were also discovered: Android.Packed.57156, Android.Packed.57157, and Android.Packed.57159, for example.

The “Lie Detector Fun Prank” and “Speaker Dust and Water Cleaner” programs are trojans protected with a software packer

Our specialists also detected Android.Subscription.22, malware designed to subscribe users to paid services.

Instead of editing photos, the “InstaPhoto Editor” program subscribed users to a paid service

At the same time, cybercriminals again distributed trojans from the Android.Joker family, which also subscribed victims to paid services.

The SMS messenger “Smart Messages” and the third-party keyboard “Cool Keyboard” tried to covertly subscribe victims to a paid service

To protect your Android device from malware and unwanted programs, we recommend installing Dr.Web anti-virus products for Android.

Indicators of compromise

Doctor Web’s Q4 2024 virus activity review

Thu, 26 Dec 2024 04:00:00 GMT

December 26, 2024

According to the statistics collected by the Dr.Web anti-virus, the total number of threats detected in the fourth quarter of 2024 decreased by 1.53%, compared to the third quarter. At the same time, the number of unique threats increased by 94.43%. Among the most commonly detected threats were adware programs and adware trojans, malicious scripts, and trojans that are distributed with other malware and used to make the main payload difficult to detect. The majority of detections in email traffic were due to malicious scripts, adware trojans, and cryptocurrency-mining trojans. Increased activity on the part of spyware malicious apps was also noted.

Users whose files were affected by encoder trojans most commonly encountered Trojan.Encoder.35534, Trojan.Encoder.35067, and Trojan.Encoder.26996.

Once again, the most widespread threats observed on Android devices were Android.HiddenAds ad-displaying trojans. At the same time, our malware analysts discovered many new threats.

Principal trends in Q4 2024

Adware software and adware trojans were once again the most commonly detected threats.
The number of unique threats increased, compared to the previous quarter.
Increased activity on the part of spyware trojans in email traffic.
The distribution of many trojan apps through Google Play.

According to Doctor Web’s statistics service

The most common threats in Q4 2024:

Adware.Downware.20091: Adware that often serves as an intermediary installer of pirated software.
VBS.KeySender.6: A malicious script that, in an infinite loop, searches for windows containing the text mode extensions, разработчика, and розробника and sends them an Escape key press event, forcibly closing them.
JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.
Trojan.BPlug.4210: The detection name for malicious components of the WinSafe browser extension. These components are JavaScript files that display intrusive ads in browsers.
Trojan.Starter.8242: A malicious program that launches a mining trojan.

Statistics for malware discovered in email traffic

JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.
JS.Inject: A family of malicious JavaScripts that inject a malicious script into the HTML code of webpages.
LNK.Starter.56: The detection name for a shortcut that is crafted in a specific way. This shortcut is distributed through removable media, like USB flash drives. To mislead users and conceal its activities, it has a default icon of a disk. When launched, it executes malicious VBS scripts from a hidden directory located on the same drive as the shortcut itself.
Win32.HLLW.Rendoc.3: A network worm that spreads via removeable storage media and other channels.
Trojan.Fbng.123: A spyware trojan also known as Formbook. Designed to steal various data from infected devices, it hijacks passwords saved in web browsers, email clients, online messengers, and other software; intercepts input data in web forms; monitors keystrokes (it executes a keylogger functionality); and takes screenshots. In addition, it can download and run other programs and execute various commands, operating as a backdoor.

Encryption ransomware

In Q4 2024, the number of requests made to decrypt files affected by encoder trojans decreased by 18.96%, compared to Q3 2024.

The dynamics of the decryption requests received by Doctor Web’s technical service:

The most common encoders of Q4 2024:

Trojan.Encoder.35534 — 22.63% of user requests
Trojan.Encoder. 35067 — 3.91% of user requests
Trojan.Encoder.26996 — 3.35% of user requests
Trojan.Encoder.35209 — 3.07% of user requests
Trojan.Encoder.38200 — 3.07% of user requests

Network fraud

In Q4 2024, threat actors continued exploiting a popular fraudulent scheme in which they used specially crafted websites to offer potential victims opportunities to make money through different investments. To “access” the investing service, users are asked to register an account by providing personal data that subsequently ends up in the fraudsters’ hands. Residents of various countries have encountered such websites.

On this fraudulent site, supposedly affiliated with the World Bank, European users are assured that they will get dividends for investing in promising economic sectors

A fraudulent website offers Slovak users the chance to “earn more than $192,460 per month” with the help of some investing service

Fraudsters pose as large banks and oil and gas companies and offer users from Armenia and Moldova opportunities to “make money on stocks”

The fake website of an Azerbaijani oil and gas company on which visitors are promised income starting from 1,000 manat per month

The website of a “new Google investing platform” offers the opportunity to take a survey and get access to a service that will supposedly allow users to make at least €1,000

One of the fraudulent sites promises Russian users “a safe passive income”, starting from 150,000 rubles per month

Doctor Web’s experts noted a seasonal change in the contents of such sites. Ahead of the New Year holidays, scammers began exploiting the gifts theme, allegedly acting on behalf of banks, oil and gas companies, crypto exchanges, and other organizations. On one such fake site, Russian users supposedly could receive payments from a crypto exchange in accordance with some “lists”. And to check whether such payments are available to them, potential victims were asked to take a survey and provide personal data.

A fake crypto exchange website offers Russian users the chance to get “New Year payments”

Another fake site informed visitors about some “New Year’s offer” from an oil and gas company, whereby many Kazakhstani users could allegedly start receiving from 200,000 to 1,000,000 tenge per month in honor of the country’s Independence Day. To “receive” payments, potential victims had to submit an “application” by providing their personal information on this website.

This fraudulent site promised Kazakhstani users large payments in honor of Independence Day as part of a “New Year’s offer”

At the same time, our Internet analysts detected the emergence of new fake websites of Russian banks. On these, potential victims are asked to take part in a service-quality survey and then allegedly receive a money reward for doing so. Users are asked to provide personal data, including their full names, the mobile phone number linked to their bank account, as well as their bank card number.

An example of a bogus site that mimics the appearance of a genuine bank website and offers potential victims the opportunity to participate in the survey for a reward

To “participate” in the survey, the user has to fill out the form by providing their personal information

Moreover, fraudulent sites offering online training, such as programming, were identified. Interested visitors were asked to leave their contact information to “receive a consultation”.

A website that offers programming courses online. To “receive a consultation”, users have to provide their personal information.

Online scammers keep trying to steal Telegram accounts. In Q4 2024, more phishing sites disguised as various online voting platforms were discovered, for example, for “children’s drawing competitions”. To “confirm” their vote, users are asked to provide their mobile phone number to which a verification code will be sent. However, by typing this code on the bogus website, they are granting fraudsters access to their accounts.

A scammer website on which visitors are asked to vote in the children’s drawing competition

A “vote counting system” demands a mobile phone number for “confirming the vote” and sending a one-time code

When victims enter the received code, they grant the fraudsters access to their Telegram accounts

Find out more about Dr.Web non-recommended sites

Malicious and unwanted programs for mobile devices

According to detection statistics collected by Dr.Web Security Space for mobile devices, in Q4 2024, users most often encountered Android.HiddenAds ad-displaying trojans and the Android.FakeApp and Android.Siggen malicious apps. At the same time, over the past quarter, Doctor Web’s experts discovered many new threats on Google Play.

The following Q4 2024 events involving mobile malware are the most noteworthy:

High activity on the part of Android.HiddenAds ad-displaying trojans and Android.FakeApp fraudulent malware,
The emergence of new malicious apps on Google Play.

To find out more about the security-threat landscape for mobile devices in Q4 2024, read our special overview.

Contactless banking for thee (and for thief): NFC money theft scheme reaches Russian users

Thu, 26 Dec 2024 02:00:00 GMT

December 26, 2024

Malware analysts at “Doctor Web” warn about the emergence of new versions of the NGate banking trojan, targeting users in Russia. This trojan relays data from the NFC chip of the compromised device, allowing the attacker to withdraw money from the victim's accounts at ATMs without any victim’s involvement.

The NGate banker first appeared on the radar of antivirus vendors in the autumn of 2023, when reports of attacks on customers of major Czech banks began to appear in specialized media. The attackers' strategy involved a combination of social engineering, phishing and the use of malware. When used together, these standard tactics created a rather innovative scenario: after interacting with the victim, the hackers gained remote access to the NFC capabilities of their payment method. Law enforcement in the Czech Republic was able to stop this campaign, but its concept was adapted to the Russian context and used there for illegal enrichment.

The event that initiates the chain of attack is likely to be a phone call from fraudsters claiming that the victim is eligible for a social benefit or other financial gain. To receive it, the victim must tap on the link, which leads to a fraudulent website, that hosts a malicious APK containing the NGate trojan. The APK is disguised as an application for the Gosuslugi (government services) portal, the Bank of Russia or one of the other popular banks.

Icons of fake applications, made to look like their official counterparts

The NGate banking trojan is a malicious modification of the open source NFCGate application, which was developed to debug NFC data transfer protocols. NFCGate supports a number of functions, but of most interest to attackers is the ability to capture NFC traffic and send it to a remote device, which could be either an intermediary server or the attacker's own smartphone. The criminals have modified the source code by adding user interfaces similar to the official applications and enabling the NFC data relay mode. In addition, the application includes the nfc-card-reader library, which allows the hackers to remotely obtain the card number and its expiry date.

After launching the application, the victim is prompted to place their payment card on the back of the smartphone, enter the PIN and wait for the fake application to verify the card. At this point, all the data on the card is read and transferred to the criminals. Note that the compromised smartphone does not need to be rooted to expose its NFC data.

Screens that ask the victim to place their bank card on the back of their smartphone.

While the victim holds their card close to their smartphone, the attacker is already at the ATM requesting a cash withdrawal. Another option is to use this scheme for contactless payments. When the ATM asks for the bank card, the hacker simply taps their phone, which will transmit the digital thumbprint of the victim's bank card. The transaction is confirmed using the PIN code the victim previously submitted.

To prevent money theft, the analysts at “Doctor Web” have the following recommendations:

do not share your PIN or CVV codes for your bank cards,
use an antivirus program, it will block downloading and installation of malicious applications,
carefully check the addresses of web pages that ask for financial information,
only install applications from official sources such as AppGallery and Google Play,
do not talk to scammers. If you receive an unexpected call from the police, a bank or any other organization, simply hang up. If you have any doubts about the legitimacy of the call, find the contact details on the official website and contact the organization yourself.

More about Android.Banker.NGate.1

Indicators of compromise

Malware trends: eBPF exploitation, malware configurations stored in unexpected places, and increased use of custom post-exploitation tools

Tue, 10 Dec 2024 11:09:06 GMT

December 10, 2024

An investigation into an information security incident has allowed virus analysts at Doctor Web to uncover an ongoing campaign that incorporates many modern trends employed by cybercriminals.

A client approached Doctor Web after suspecting that their computer infrastructure had been compromised. While analyzing the client’s data, our virus analysts identified a number of similar cases, leading them to conclude that an active campaign was underway. It appears that the hackers' efforts are primarily concentrated in Southeast Asia. During the attacks, they utilize a comprehensive suite of malware that is deployed at various stages. Unfortunately, it was impossible for our analysts to determine how initial access to the compromised machines was obtained. However, they were able to reconstruct the rest of the attack chain. Notably, the threat actors managed to maliciously exploit eBPF (extended Berkeley Packet Filter) technology.

eBPF technology was developed to enhance control over the network subsystem of the Linux operating system and its processes. It has demonstrated significant potential, attracting the attention of major IT companies: almost from the moment of its inception, giants like Google, Huawei, Intel, and Netflix joined the eBPF Foundation to participate in its further development. Unfortunately, hackers have also taken an interest in eBPF.

By providing extensive low-level capabilities, eBPF can be used by malicious actors to conceal network activity and processes, gather confidential information, and bypass firewalls and intrusion detection systems. The amount of effort needed to detect such malware allows hackers to use it in APT (advanced persistence threat) attacks and to mask their presence for extended periods.

These are the capabilities that the attackers decided to exploit by loading two rootkits onto the compromised machine. The first was an eBPF rootkit that concealed the operation of another rootkit, implemented as a kernel module, which in turn prepared the system for the installation of a remote access trojan. A notable feature of the trojan is its support for various traffic-tunneling technologies that allow it to communicate with the attackers from private network segments and conceal the transmission of commands.

Overall, since 2023, the use of malicious eBPF software has been gaining momentum. This is evidenced by the emergence of several families of malware based on this technology, including Boopkit, BPFDoor, and Symbiote. New vulnerabilities, routinely found in this technology, only exacerbate the situation. As of now, 217 BPF vulnerabilities are known to exist, with about 100 of them discovered in 2024.

Another notable feature of the campaign is the rather creative approach taken by the threat actors with regards to storing the trojan's settings. Previously, they were likely to use dedicated servers for such purposes, but now instances where the malware configurations are being stored openly on public platforms are increasing. For example, the malware in question accessed platforms like GitHub and even a Chinese blog on information security. This helps draw less attention to the traffic coming from the compromised machine, as to an unsuspecting observer, the machine appears to be interacting with a safe network host. This negates the need to ensure access to a control server where settings are stored. Overall, the idea of leveraging publicly available services as a control infrastructure is not new; hackers are known to have previously used Dropbox, Google Drive, OneDrive, and even Discord for this purpose. However, regional restrictions on these services in several countries, particularly in China, make them less attractive in terms of ensuring availability. Meanwhile, access to GitHub remains available to most providers, making it preferred in the eyes of hackers.

Settings stored on GitLab and in a security blog. Curiously, in the latter case, the hacker asks for help decrypting third-party code. The code will later be sent to the trojan as an argument for one of the commands.

Another feature of this campaign is that the trojan is starting to be adapted for later use as a component for a post-exploitation framework, which is a suite of software used after a computer has been accessed. Such frameworks are not inherently illegal; they are used by companies that officially provide security-audit services. The most popular tools are Cobalt Strike and Metasploit, which allow a large number of checks to be automated and have a built-in vulnerability database.

An example of a network map created by Cobalt Strike (source: official website)

Of course, such capabilities are highly sought after by threat actors. In 2022, a cracked version of Cobalt Strike became available to a wide audience, leading to a surge in hacker activity. Geographically, the Cobalt Strike infrastructure has a significant presence in China. It is worth noting that the developer aims to track all Cobalt Strike installations, and servers with cracked versions are routinely shut down by law enforcement. Therefore, hackers are steadily trending towards using open-source frameworks that support extensions out of the box and are able to modify the network communication between the infected host and its control server. They prefer this strategy as it does not draw additional attention to their infrastructure.

As a result of the investigation, our analysts added all identified threats to our malware databases and incorporated additional heuristic rules to ensure that malicious eBPF programs are recognized.

More about Trojan.Siggen28.58279

Indicators of compromise

Hidden cryptocurrency mining and theft campaign affected over 28,000 users

Tue, 08 Oct 2024 14:47:30 GMT

October 8, 2024

Virus analysts at Doctor Web have identified a large-scale campaign aimed at spreading cryptomining and cryptostealing malware by delivering trojans to victims' computers under the guise of office programs, game cheats, and online trading bots.

During routine analysis of cloud telemetry submitted by our users, specialists at the Doctor Web virus lab detected suspicious activity of a program disguised as a Windows component (StartMenuExperienceHost.exe, a legitimate process with this name is responsible for managing the Start menu). This program communicated with a remote network host and waited for an incoming connection to immediately launch the cmd.exe command line interpreter.

Disguised as a system component was the Ncat network utility, which, when used for legitimate purposes, transfers data over the network via the command line. This discovery helped reconstruct a sequence of security events, including attempts to infect computers with malware, which were prevented by Dr.Web.

The source of infection is fraudulent pages created by attackers on GitHub (note that such activity is prohibited by the platform's rules) or Youtube pages containing malware links in the description below the video. By clicking on the link, the victim downloads a self-extracting, password-protected archive. Because the archive is encrypted, it cannot be automatically scanned by antivirus software. After entering the password provided by the hackers on the download page, the following temporary files are extracted to the %ALLUSERSPROFILE%\jedist folder on the victim's computer:

UnRar.exe - an application for extracting RAR archives;
WaR.rar - a RAR archive;
Iun.bat - a script that creates a task to run the Uun.bat script, then initiates a computer restart, and deletes itself;
Uun.bat - an obfuscated script that extracts WaR.rar, runs the ShellExt.dll and UTShellExt.dll files it contains, and then deletes the task created by Iun.bat and the jedist folder along with its contents.

The ShellExt.dll file is an AutoIt language interpreter and is not malicious in and of itself. However, this is not its true name. Attackers have renamed it from AutoIt3.exe to ShellExt.dll to disguise it as a WinRAR library that is responsible for integrating archiver functionality to the Windows right-click menu. Once launched, the interpreter in turn loads the UTShellExt.dll file, which the cybercriminals borrowed from the Uninstall Tool utility. Perfectly legitimate in its own right, it even carries a valid digital signature, but it has a malicious AutoIt script attached to it. Once executed, the script unpacks its payload, which consists of a series of heavily obfuscated files.

AutoIt is a programming language for creating automation scripts and utilities for Windows. Its ease of use and broad functionality have made it popular with various categories of users, including malware writers. Some antivirus programs detect all compiled AutoIt scripts as malicious.

The UTShellExt.dll file performs the following actions:

Scans the process list for running debugging software. The script contains the names of about 50 different debugging utilities, and if at least one process from this list is detected, the script will terminate
If no debugging software is found, the files needed to continue the attack are extracted on the compromised system. Some of the files are “clean”, they are necessary to implement network communication, while the rest perform malicious actions
Creates system events to gain network access using Ncat and execute BAT and DLL files, and modifies the registry to gain persistence using the IFEO technique
Image File Execution Options (IFEO) is a feature that Windows makes available to software developers. For example, it allows them to automatically launch a debugger when an application starts. However, attackers can use the IFEO technique to gain a foothold in the system. They accomplish this by swapping the path to the debugger with the path to the malicious file, so that every time a legitimate application is launched, the malicious application is started as well. In this case, the hackers "hijacked" Windows system services, as well as the Google Chrome and Microsoft Edge update processes (MoUsoCoreWorker.exe, svchost.exe, TrustedInstaller.exe, GoogleUpdate.exe and MicrosoftEdgeUpdate.exe).
Revokes the delete and modify permissions for the folders and files created in step 2.
Disables the Windows Recovery Service
Sends the specifications of the compromised computer, its name, operating system version and information about the installed antivirus software to the attackers using a Telegram bot.

The DeviceId.dll and 7zxa.dll files perform hidden cryptomining and cryptostealing functions, respectively. Both files inject their payload into the explorer.exe (Windows Explorer) process using the Process Hollowing technique. The first file is a legitimate library distributed as part of the .NET framework that has a malicious AutoIt script embedded that executes the SilentCryptoMiner miner. This miner has extensive configuration and stealth capabilities for cryptocurrency mining, as well as remote control functionality.

The 7zxa.dll library, which again is a legitimate library of the 7-Zip archiver, contains a clipper. This type of malware is used to monitor data in the clipboard, which it can either spoof or pass on to attackers. In this case, the clipper waits for typical strings in the clipboard that are characteristic of wallet addresses and replaces them with those specified by the attackers. At the time of publication, it is confirmed that only thanks to the clipper hackers were able to get hold of more than 6000 dollars worth of cryptocurrency.

The Process Hollowing technique consists of running a trusted process in a suspended state, overwriting its code in memory with malicious code, and then resuming the process execution. The use of this technique results in the presence of copies of the process with the same name, so in our case three explorer.exe processes were observed on the victims' machines, which is suspicious in itself as this process normally exists as a single copy.

In total, this malware campaign has affected more than 28,000 people, the vast majority of whom are residents of Russia. Significant numbers of infections have also been observed in Belarus, Uzbekistan, Kazakhstan, Ukraine, Kyrgyzstan and Turkey. Since the victims' computers were compromised by installing pirated versions of popular programs, the main recommendations to prevent such incidents include downloading software from official sources, using their open source replacements, and installing capable antivirus software. Users of Dr.Web products are not affected by this threat.

Redis honeypot: server with vulnerable Redis database reveals new SkidMap modification used to hide cryptocurrency mining process

Thu, 03 Oct 2024 03:00:00 GMT

October 3, 2024

Doctor Web virus analysts have identified a new rootkit modification that installs the Skidmap mining trojan on compromised Linux machines. This rootkit is designed as a malicious kernel module that hides the miner’s activity by providing fake information about CPU usage and network activity. This attack appears to be indiscriminate, primarily targeting the enterprise sector—large servers and cloud environments—where mining efficiency can be maximized.

The Redis database management system is the world’s most popular NoSQL database: Redis servers are used by large companies such as X (formerly Twitter), Airbnb, Amazon and others. Its advantages are obvious: maximum performance, tiny memory footprint, and support for various data types and programming languages. However, this product also has some downsides: since Redis was never intended to be used at the network’s edge, it only supports basic security features in its default configuration, and no access control and encryption mechanisms exist prior to version 6. In addition, cybersecurity publications report numerous Redis vulnerabilities each year. In 2023, for example, there were 12 vulnerabilities, three of which had a “Serious” status. The growing number of reports of compromised servers and the subsequent installation of mining programs sparked the interest of Doctor Web's virus lab staff, who wanted to experience the attack firsthand. For this purpose, they decided to set up their own unprotected Redis server and wait for uninvited guests. The server was active for a year, and during that time it was attacked about 10–14 thousand times a month. Recently, the server was hit with a modification of the SkidMap trojan, as our analysts expected. What came as a surprise, however, was that the cybercriminals used a new method to hide the miner's activity and installed four backdoors at the same time.

The Skidmap trojan first made headlines in 2019. This trojan-miner is specialized and mainly targets enterprise networks since the greatest stealth mining profits can be achieved in the corporate segment. Despite the fact that five years have passed since the trojan’s debut, the principle of its operation remains unchanged: the trojan is installed on a system by exploiting vulnerabilities or through misconfigured software. In the case of our honeypot server, the hackers added tasks to the system scheduler in which a script downloaded the Linux.MulDrop.142 dropper (or its other modification, Linux.MulDrop.143) every 10 minutes. This executable checks the OS kernel version, disables the SELinux security module, and then unpacks the Linux.Rootkit.400 rootkit, the Linux.BtcMine.815 miner, and the Linux.BackDoor.Pam.8/9 and Linux.BackDoor.SSH.425/426 backdoors on the system. The dropper is remarkable in that it is quite large, as it packs about 60 executables for various Linux distributions. In this case, the dropper contained the files for various versions of Debian and Red Hat Enterprise Linux distributions, which are most commonly encountered on servers.

Once installed, the rootkit intercepts a number of system calls, allowing it to generate fake information in response to diagnostic commands entered by an administrator. Intercepted functions include those that report average CPU usage, network activity on a number of ports, and lists of files in directories. The rootkit also checks all kernel modules when they are loaded and prevents those that can detect its presence from running. All this allows it to thoroughly hide all aspects of the miner's cryptocurrency mining activity: computation, sending hashes, and receiving jobs.

The purpose of the four backdoors installed by the dropper as part of this attack is to collect SSH credentials from a compromised machine and send them to the attackers and to create a master password for all accounts on the system. Note that all passwords are additionally encrypted using the Caesar cipher with a 4-letter offset.

To increase their ability to control a compromised system, the attackers install the Linux.BackDoor.RCTL.2 remote access trojan. It allows commands to be sent to the infected machine and data to be exfiltrated via the encrypted connection that the trojan itself initiates, thus bypassing the routing problem.

The xmrig program is installed as a miner that can mine a number of cryptocurrencies, the most famous of which is Monero, which has gained popularity on the darknet due to its complete anonymity at the transaction level. It should be said that detecting a rootkit-covered miner in a cluster of servers is no trivial task. If the diagnostic data are spoofed, the only thing that might indicate a compromise is excessive power consumption and increased heat generation. However, to somewhat mitigate that, attackers can also tweak the miner's settings to find an optimal balance between mining performance and preserving hardware performance, thus drawing less attention to a compromised system.

The evolution of the Skidmap malware family can be seen in the increasing complexity of the attack chain: the launched programs call each other, disable security systems, interfere with a large number of system utilities and services, download rootkits, etc., which makes it much more difficult to respond to such incidents.

Indicators of compromise

Doctor Web’s Q3 2024 review of virus activity on mobile devices

Tue, 01 Oct 2024 03:00:00 GMT

October 1, 2024

According to detection statistics collected by Dr.Web Security Space for mobile devices, Android.FakeApp trojan apps, used by threat actors in various fraudulent schemes, were the malicious programs most frequently detected on protected devices in the third quarter of 2024. Adware trojans from the Android.HiddenAds family ranked second. The third most commonly detected threats were Android.Siggen trojans—programs that have different malicious functionality and that are difficult to classify into any particular family.

In August, Doctor Web’s experts discovered the Android.Vo1d backdoor, which had infected nearly 1.3 million Android TV box sets belonging to users in 197 countries. This malicious app places its components into the system storage area of infected devices and, when commanded by threat actors, can covertly download and install various programs.

In addition, banking trojans targeting Indonesian users were found. One of these, Android.SmsSpy.888.origin, is protected with a software packer and detected as Android.Siggen.Susp.9415. It was distributed under the guise of the BRI bank customer support app BRImo Support.

When launched, the trojan loads the real bank website https://bri.co.id in WebView. At the same time, it uses a Telegram bot API to send technical information about the infected device into the Telegram chat created by the threat actors.

Android.SmsSpy.888.origin intercepts incoming SMS and also sends them into this chat. When it receives messages like 55555, <number>, <text>, it interprets them as commands and sends corresponding messages containing the text <text> to the number <number>. This way, the malware can both send SMS spam and spread among users.

Another trojan that attacked Indonesian users was Android.SmsSpy.11629. This malicious program is an SMS spy that is distributed under the guise of all kinds of apps. The variant in question was targeting Bank Mandiri Taspen customers and was passed off by the attackers as an official banking app—Movin by Bank Mandiri Taspen. The trojan displays instructions to potential victims and asks them to accept a user agreement. When a user accepts it, the trojan requests the permissions needed to work with SMS.

Next, the malicious program loads a real page of the bank’s website https://mail.bankmantap.co.id/: in WebView:

Android.SmsSpy.11629 intercepts all incoming SMS. Next, it uses the Telegram bot API to send these messages into the attackers’ Telegram chat. It adds the text developed by : @AbyssalArmy to all of the messages.

At the same time, our malware analysts again discovered threats on Google Play. Among them were many new fake apps and several ad-displaying trojans.

PRINCIPAL TRENDS OF Q3 2024

The Android.Vo1d backdoor infected over a million TV box sets
High activity on the part of Android.FakeApp malicious apps, which are used to commit fraud
High activity on the part of Android.HiddenAds adware trojans
The emergence of new malware on Google Play

According to statistics collected by Dr.Web Security Space for mobile devices

Android.FakeApp.1600: A trojan app that loads a website that is hardcoded into its settings. Known modifications of this malicious program load an online casino site.
Android.HiddenAds.3994: A trojan app designed to display intrusive ads. Members of the Android.HiddenAds family are often distributed as popular and harmless applications. In some cases, other malware can install them in the system directory. When these infect Android devices, they typically conceal their presence from the user. For example, they “hide” their icons from the home screen menu.
Android.MobiDash.7815
Android.MobiDash.7813: Trojans that display obnoxious ads. These are special software modules that developers incorporate into applications.
Android.Click.1751: This trojan is built into third-party WhatsApp messenger mods and camouflaged as Google library classes. While the host application is being used, Android.Click.1751 connects to one of the C&C servers. It receives two URLs from it. One of them is intended for Russian-speaking users, and the other is for everyone else. The trojan then displays a dialog box whose contents it has also received from a remote server. When a user clicks on the confirmation button, malware loads the corresponding link in their browser.

Program.FakeMoney.11: The detection name for Android applications that allegedly allow users to earn money by completing different tasks. These apps make it look as if rewards are accruing for each one that is completed. At the same time, users are told they have to accumulate a certain sum to withdraw their “earnings”. Typically, such apps have a list of popular payment systems and banks that supposedly could be used to withdraw the rewards. But even if users succeed in accumulating the needed amount, in reality they cannot get any real payments. This virus record is also used to detect other unwanted software based on the source code of such apps.
Program.CloudInject.1: The detection name for Android programs that have been modified using the CloudInject cloud service and the eponymous Android utility (the latter was added to the Dr.Web virus database as Tool.CloudInject). Such programs are modified on a remote server; meanwhile, the modders (users) who are interested in such modifications cannot control exactly what will be added to the apps. Moreover, these programs receive a number of dangerous system permissions. Once modification is complete, users can remotely manage these apps. They can block them, display custom dialogs, and track when other software is being installed or removed from a device, etc.
Program.FakeAntiVirus.1: The detection name for adware programs that imitate anti-virus software. These apps inform users of nonexistent threats, mislead them, and demand that they purchase the software’s full version.
Program.SecretVideoRecorder.1.origin: The detection name for various modifications of an application that is designed to record videos and take photos in the background, using built-in Android device cameras. It can operate covertly by allowing notifications about ongoing recordings to be disabled. It also allows an app’s icon and name to be replaced with fake ones. This functionality makes this software potentially dangerous.
Program.TrackView.1.origin: The detection name for a program that allows users to be monitored via their Android devices. Malicious actors can utilize it to track a target device’s location, use the camera to record video and take photos, eavesdrop via the microphone, record audio, etc.

Tool.Packer.1.origin: A packer tool designed to protect Android applications from unauthorized modifications and reverse engineering. This tool is not malicious in itself, but it can be used to protect both harmless and malicious software.
Tool.SilentInstaller.17.origin: A riskware platform that allows applications to launch APK files without installing them. It creates a virtual runtime environment in the context of the apps in which they are integrated. The APK files, launched with the help of this platform, can operate as if they are part of such programs and can also obtain the same permissions.
Tool.NPMod.1
Tool.NPMod.2: The detection name for Android programs that have been modified using the NP Manager utility. A special module is embedded in such apps, and it allows them to bypass digital signature verification once they have been modified.
Tool.LuckyPatcher.1.origin: A tool that allows apps installed on Android devices to be modified (i.e., by creating patches for them) in order to change the logic of their work or to bypass certain restrictions. For instance, users can apply it to disable root-access verification in banking software or to obtain unlimited resources in games. To add patches, this utility downloads specially prepared scripts from the Internet, which can be crafted and added to the common database by any third party. The functionality of such scripts can prove to be malicious; thus, patches made with this tool can pose a potential threat.

Adware.ModAd.1: The detection name for some modified versions (mods) of the WhatsApp messenger, whose functions have been injected with a specific code. This code is responsible for loading target URLs by displaying web content (via the Android WebView component) when the messenger is in operation. Such web addresses perform redirects to advertised sites, including online casino, bookmaker, and adult sites.
Adware.Basement.1: These are apps that display unwanted ads which often lead to malicious and fraudulent websites. They share a common code base with the Program.FakeMoney.11 unwanted applications.
Adware.Fictus.1.origin: An adware module that malicious actors embed into the cloned versions of popular Android games and applications. Its incorporation is facilitated by a specialized net2share packer. Copies of software created this way are then distributed through various software catalogs. When installed on Android devices, such apps and games display obnoxious ads.
Adware.Adpush.21846
Adware.AdPush.39.origin: Adware modules that can be built into Android apps. They display notifications containing ads that mislead users. For example, such notifications can look like messages from the operating system. In addition, these modules collect a variety of confidential data and are able to download other apps and initiate their installation.

Threats on Google Play

In Q3 2024, Doctor Web’s malware analysts continued uncovering threats on Google Play. Among these were many new Android.FakeApp fake programs that were distributed under the guise of a variety of software. Malicious actors passed some of them off as finance-related programs, such as investing apps, financial reference books and teaching aids, different home bookkeeping tools, and so on. Quite a few of these did actually provide the stated functionality, but their primary task is to load fraudulent websites. Such sites promise potential victims quick and easy money through investments, trading natural resources, cryptocurrency, etc. To supposedly join the “service”, users are asked to register an account or to provide personal data by filling out an “application”.

It is noteworthy that fraudsters disguised one of the Android.FakeApp trojans as an online dating and chat app. However, it also loaded a bogus “investing” site.

Other Android.FakeApp trojans were again distributed as games. Under certain conditions, they loaded online casino and bookmaker sites.

Among these fake apps, our experts also detected new trojan variants that masquerade as job-search tools. Such malware loads fake job lists and suggests to users that they contact the applicable employer via a messenger (this “employer” is, in fact, a fraudster) or that they create a “resume” by providing personal data.

Doctor Web’s virus analysts also discovered more Android.HiddenAds trojans on Google Play. These trojans conceal their icons from the home screen menu and start displaying intrusive ads. The detected malware was camouflaged as various apps, including image collections, photo-editing software, and barcode scanners.

To protect your Android device from malware and unwanted programs, we recommend installing Dr.Web anti-virus products for Android.

Indicators of compromise

Doctor Web’s Q3 2024 virus activity review

Tue, 01 Oct 2024 01:00:00 GMT

October 1, 2024

According to the detection statistics collected by the Dr.Web antivirus, the total number of threats detected in the third quarter of 2024 was up 10.81% over the previous quarter. The number of unique threats decreased by 4.73%. The majority of detections were due to adware programs. Also widespread were malicious scripts, ad-displaying trojans, and trojans distributed within other malware to make the latter more difficult to detect. In email traffic, malicious scripts and programs that exploit vulnerabilities in Microsoft Office documents were most commonly detected.

On Android devices, the most commonly detected threats were trojans from the Android.FakeApp family, which are used for fraudulent purposes; Android.HiddenAds adware trojans; and Android.Siggen malicious apps possessing different functionality. At the same time, in August, our experts discovered Android.Vo1d, a new trojan that had infected nearly 1.3 million TV box sets running Android. In addition, several banking trojans targeting Indonesian users were found.

Doctor Web’s virus laboratory also uncovered many new threats on Google Play throughout the third quarter.

Principal trends in Q3 2024

Adware programs remained the most commonly detected threats.
Malicious scripts were again predominant in malicious email traffic.
Over 1 million Android-based TV box sets were found to be infected with the Android.Vo1d backdoor.
New threats were discovered on Google Play.

According to Doctor Web’s statistics service

The most common threats in Q3 2024:

Adware.Downware.20091
Adware.Downware.20477: Adware that often serves as an intermediary installer of pirated software.
JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.
Trojan.StartPage1.62722: A malicious program that can modify the home page in the browser settings.
Adware.Ubar.20: A torrent client designed to install unwanted programs on a user’s device.

Statistics for malware discovered in email traffic

JS.Siggen5.44590: Malicious code added to the es5-ext-main public JavaScript library. It shows a specific message if the package is installed on a server with the time zone of a Russian city.
JS.Inject: A family of malicious JavaScripts that inject a malicious script into the HTML code of webpages.
LNK.Starter.56: The detection name for a shortcut that is crafted in a specific way. This shortcut is distributed through removable media, like USB flash drives. To mislead users and conceal its activities, it has a default icon of a disk. When launched, it executes malicious VBS scripts from a hidden directory located on the same drive as the shortcut itself.
W97M.DownLoader.6154: A family of downloader trojans that exploit vulnerabilities in Microsoft Office documents. They can also download other malicious programs to a compromised computer.
Trojan.AutoIt.1410: The detection name for packed versions of the Trojan.AutoIt.289 malicious app that are written in the AutoIt scripting language. This trojan is distributed as part of a group of several malicious applications, including a miner, a backdoor, and a self-propagating module. Trojan.AutoIt.289 performs various malicious actions that make it difficult for the main payload to be detected.

Encryption ransomware

In Q3 2024, the number of requests made to decrypt files affected by encoder trojans decreased by 15.73%, compared to Q2 2024.

The dynamics of the requests Doctor Web’s technical service received to decrypt files affected by encoder trojans:

The most common encoders of Q3 2024:

Trojan.Encoder.35534 — 19.38%
Trojan.Encoder.3953 — 9.42%
Trojan.Encoder.38200 — 3.99%
Trojan.Encoder.26996 — 2.89%
Trojan.Encoder.35067 — 2.72%

Network fraud

During Q3 2024, Internet scammers continued distributing spam emails containing links leading to various fraudulent sites. Russian-speaking users, for example, again dealt with messages that were supposedly sent on behalf of well-known online stores. Some of these mails offered users the ability to participate in prize draws or get a gift. After clicking on the links in such emails, potential victims were directed to fraudulent sites where they were asked to pay a commission to “receive” their gift or their winnings.

Scammers, allegedly on behalf of an online store, offer their potential victim the chance to “receive their winnings” of 208,760 rubles

In other emails, users were supposedly given a discount that could be used to purchase goods in a large electronics store. The links from such messages led to a fake website designed in the style of the genuine store’s site. When potential victims placed an “order” on this fake Internet resource, they had to provide their personal data and bank card information.

A fraudulent email that lets recipients “activate a promo code” for buying electronics

Finance-themed spam remains popular among fraudsters. For instance, threat actors were sending unwanted emails for users to “confirm” their receipt of large money transfers. An example of one such mail targeting English-speaking users is shown below. It contained a link that led to the phishing login form of an online bank that outwardly resembled the form on the real bank’s website.

The user supposedly needs to confirm receipt of US $1,218.16

A phishing site that fraudsters pass off as a genuine bank website

Among the unwanted emails targeting Japanese users, our experts detected yet more fake bank notifications—for example, ones that supposedly contained the previous month’s bank card statement. In one of these messages, the scammers camouflaged the link to the phishing site. In the text of the letter, users saw links to the real addresses of the bank’s website, but when they clicked on them, they were taken to a fraudulent Internet resource.

All the links in this email actually lead to a phishing website

French-speaking users (from Belgium, in particular) encountered phishing emails informing them that their bank accounts were “blocked”. To get them “unblocked”, they were asked to follow a link that actually led to the fraudsters’ website.

Scammers scare potential victims with a “blocked” bank account message

And among Russian users, email spam, sent presumably on behalf of famous banks and offering investor opportunities, was once again actively being distributed. The links in such unwanted emails lead to fraudulent sites where visitors, under the pretense of accessing investing services, are asked to provide personal data.

The user, allegedly on behalf of the bank, is being offered the chance to complete a test and become an investor

At the same time, Doctor Web’s Internet analysts detected new phishing websites targeting cryptocurrency owners. On one of them, for example, visitors were informed, supposedly on behalf of a large cryptocurrency exchange, about an undelivered Bitcoin transfer. To “complete” the transaction, potential victims were asked to pay a “commission”. Naturally, no cryptocurrency was ever received by the users—all they did was give their own assets to the scammers.

This fraudulent site informs users about a supposedly unreceived Bitcoin transfer

In addition, websites were detected that imitated the look of the VKontakte Russian social network. Visitors to these fake sites were offered the chance to participate in some prize drawing, for which they needed to open several virtual gift boxes. After the potential victims opened the “correct” boxes and allegedly won a large amount of money, the site proposed that they pay a “fee” to receive their “winnings”.

A fraudulent site offering visitors the opportunity to “try their luck”

This user has supposedly won a prize of 194,562 rubles

Find out more about Dr.Web non-recommended sites

Malicious and unwanted programs for mobile devices

According to detection statistics collected by Dr.Web Security Space for mobile devices, in Q3 2024, Android.FakeApp malicious apps, which threat actors use in various fraudulent schemes, were most often detected on protected devices. The second most common were adware trojans from the Android.HiddenAds family. These were followed by Android.Siggen trojans.

Over the past observation period, our specialists discovered many new threats on Google Play. Among them were different trojan variants from the Android.FakeApp and Android.HiddenAds families. Moreover, an attack on Android TV box sets was detected, with the Android.Vo1d backdoor infecting about 1.3 million devices from users in 197 countries. It placed its component in the system storage area and, when commanded by threat actors, could covertly download and install third-party software. Additionally, banking trojans Android.SmsSpy.888.origin and Android.SmsSpy.11629 were found that targeted Indonesian users.

The following Q3 2024 events involving mobile malware are the most noteworthy:

The discovery of the Android.Vo1d backdoor, which infected over a million TV box sets,
High activity on the part of Android.FakeApp malicious apps,
High activity on the part of Android.HiddenAds ad-displaying trojans,
The emergence of new threats on Google Play.

To find out more about the security-threat landscape for mobile devices in Q3 2024, read our special overview.

Void captures over a million Android TV boxes

Thu, 12 Sep 2024 02:00:00 GMT

September 12, 2024

Doctor Web experts have uncovered yet another case of an Android-based TV box infection. The malware, dubbed Android.Vo1d, has infected nearly 1.3 million devices belonging to users in 197 countries. It is a backdoor that puts its components in the system storage area and, when commanded by attackers, is capable of secretly downloading and installing third-party software.

In August 2024, Doctor Web was contacted by several users whose Dr.Web antivirus had detected changes in their device’s system file area. The problem occurred with these models:

TV box model	Declared firmware version
R4	Android 7.1.2; R4 Build/NHG47K
TV BOX	Android 12.1; TV BOX Build/NHG47K
KJ-SMART4KVIP	Android 10.1; KJ-SMART4KVIP Build/NHG47K

All these cases involved similar signs of infection, so we will describe them using one of the first requests we received as an example. The following objects were changed on the affected TV box:

install-recovery.sh
daemonsu

In addition, 4 new files emerged in its file system:

/system/xbin/vo1d
/system/xbin/wd
/system/bin/debuggerd
/system/bin/debuggerd_real

The vo1d and wd files are the components of the Android.Vo1d trojan that we discovered.

The trojan’s authors probably tried to disguise one if its components as the system program /system/bin/vold, having called it by the similar-looking name “vo1d” (substituting the lowercase letter “l” with the number “1”). The malicious program’s name comes from the name of this file. Moreover, this spelling is consonant with the English word “void”.

The install-recovery.sh file is a script that is present on most Android devices. It runs when the operating system is launched and contains data for autorunning the elements specified in it. If any malware has root access and the ability to write to the /system system directory, it can anchor itself in the infected device by adding itself to this script (or by creating it from scratch if it is not present in the system). Android.Vo1d has registered the autostart for the wd component in this file.

The modified install-recovery.sh file

The daemonsu file is present on many Android devices with root access. It is launched by the operating system when it starts and is responsible for providing root privileges to the user. Android.Vo1d registered itself in this file, too, having also set up autostart for the wd module.

The debuggerd file is a daemon that is typically used to create reports on occurred errors. But when the TV box was infected, this file was replaced by the script that launches the wd component.

The debuggerd_real file in the case we are reviewing is a copy of the script that was used to substitute the real debuggerd file. Doctor Web experts believe that the trojan’s authors intended the original debuggerd to be moved into debuggerd_real to maintain its functionality. However, because the infection probably occurred twice, the trojan moved the already substituted file (i.e., the script). As a result, the device had two scripts from the trojan and not a single real debuggerd program file.

At the same time, other users who contacted us had a slightly different list of files on their infected devices:

daemonsu (the vo1d file analogue — Android.Vo1d.1);
wd (Android.Vo1d.3);
debuggerd (the same script as described above);
debuggerd_real (the original file of the debuggerd tool);
install-recovery.sh (a script that loads objects specified in it).

An analysis of all the aforementioned files showed that in order to anchor Android.Vo1d in the system, its authors used at least three different methods: modification of the install-recovery.sh and daemonsu files and substitution of the debuggerd program. They probably expected that at least one of the target files would be present in the infected system, since manipulating even one of them would ensure the trojan’s successful auto launch during subsequent device reboots.

Android.Vo1d’s main functionality is concealed in its vo1d (Android.Vo1d.1) and wd (Android.Vo1d.3) components, which operate in tandem. The Android.Vo1d.1 module is responsible for Android.Vo1d.3’s launch and controls its activity, restarting its process if necessary. In addition, it can download and run executables when commanded to do so by the C&C server. In turn, the Android.Vo1d.3 module installs and launches the Android.Vo1d.5 daemon that is encrypted and stored in its body. This module can also download and run executables. Moreover, it monitors specified directories and installs the APK files that it finds in them.

A study conducted by Doctor Web malware analysts showed that the Android.Vo1d backdoor has infected around 1.3 million devices, while its geographical distribution included almost 200 countries. The largest number of infections were detected in Brazil, Morocco, Pakistan, Saudi Arabia, Russia, Argentina, Ecuador, Tunisia, Malaysia, Algeria, and Indonesia.

Countries with the highest number of infected devices detected

One possible reason why the attackers distributing Android.Vo1d specifically chose TV boxes is that such devices often run on outdated Android versions, which have unpatched vulnerabilities and are no longer supported with updates. For example, the users who contacted us have models that are based on Android 7.1, despite the fact that for some of them the configuration indicates much newer versions, such as Android 10 and Android 12. Unfortunately, it is not uncommon for budget device manufacturers to utilize older OS versions and pass them off as more up-to-date ones to make them more attractive.

In addition, users themselves may mistakenly perceive TV boxes to be better protected devices, compared to smartphones. As a result, they may install anti-virus software on these less often and risk encountering malware when downloading third-party apps or installing unofficial firmware.

At the moment, the source of the TV boxes’ backdoor infection remains unknown. One possible infection vector could be an attack by an intermediate malware that exploits operating system vulnerabilities to gain root privileges. Another possible vector could be the use of unofficial firmware versions with built-in root access.

Dr.Web anti-virus for Android successfully detects all known Android.Vo1d trojan variants, and, if root access is available, cures the infected devices.

Indicators of compromise

More details on Android.Vo1d.1

More details on Android.Vo1d.3

More details on Android.Vo1d.5