A new Android malware variant has been discovered that can hide from antivirus programs, steal sensitive data and deploy ransomware (opens in new tab) on infected endpoints.
Cybersecurity experts from CloudSEK’s Threat Intelligence Research Team discovered the malware and named it ‘Daam’.
The malware was communicating with “various Android APK files,” the researchers said, suggesting that this was “a likely source of infection.”
call recording Once deployed on the device, the malware first tries to bypass security checks of various mobile brands. After successfully hiding from antivirus programs, it attempts to gain sensitive privileges such as recording audio, reading history bookmarks, killing background processes, reading call logs, etc.
The malware can also record all calls in progress, both mobile and VoIP, and later send them to a command and control (C2) server. Daam can also steal contacts from a victim’s device or newly added contacts.
In other words, even WhatsApp calls are not safe from eavesdropping, and files stored on your mobile device can be stolen.
To make matters worse, the malware was also confirmed to have ransomware capabilities. Researchers say Daam can encrypt files on the device using the AES algorithm present in the root directory and his SD card. It also drops a “readme_now.txt” file. It’s probably a ransom note.
After encryption, all other files are removed from local storage, leaving only encrypted files with .enc extension on the device.
Researchers found that the malware was distributed through a third-party website, with a total of three apps in circulation. Rock – mobile game; Currency Pro – currency converter;
As always, to stay safe, always download apps from legitimate sources only and check reviews and user comments before downloading anything.
websitebuildersnow
GIPHY App Key not set. Please check settings