.jpg?w=1600&resize=1600,900&ssl=1 "Android spyware and adware ‘Mandrake’ hidden in apps on Google Play since 2022")
A brand new model of the Android spyware and adware ‘Mandrake’ has been present in 5 purposes downloaded 32,000 instances from Google Play, the platform’s official app retailer.
Bitdefender first documented Mandrake in 2020, with the researchers highlighting the malware’s subtle spying capabilities and noting that it has operated within the wild since no less than 2016.
Kaspersky now reviews {that a} new variant of Mandrake that options higher obfuscation and evasion sneaked into Google Play by way of 5 apps submitted to the shop in 2022.
These apps remained obtainable for no less than a yr, whereas the final one, AirFS, which was probably the most profitable by way of recognition and infections, was eliminated on the finish of March 2024.
Supply: Kaspersky
Kaspersky recognized the 5 Mandrake-carrying apps as follows:
- AirFS – File sharing through Wi-Fi by it9042 (30,305 downloads between April 28, 2022, and March 15, 2024)
- Astro Explorer by shevabad (718 downloads from Could 30, 2022 to to June 6, 2023)
- Amber by kodaslda (19 downloads between February 27, 2022, and August 19, 2023)
- CryptoPulsing by shevabad (790 downloads from November 2, 2022, to June 6, 2023)
- Mind Matrix by kodaslda (259 downloads between April 27, 2022 and June 6, 2023)
The cybersecurity agency says most downloads come from Canada, Germany, Italy, Mexico, Spain, Peru, and the UK.
Supply: Kaspersky
Evading detection
Not like typical Android malware, which locations malicious logic within the app’s DEX file, Mandrake hides its preliminary stage in a local library, ‘libopencv_dnn.so,’ which is closely obfuscating utilizing OLLVM.
Upon the malicious app’s set up, the library exports capabilities to decrypt the second-stage loader DEX from its property folder and cargo it into reminiscence.
The second stage requests permissions to attract overlays and hundreds a second native library, ‘libopencv_java3.so,’ which decrypts a certificates for safe communications with the command and management (C2) server.
Having established communication with the C2, the app sends a tool profile and receives the core Mandrake element (third stage) if deemed appropriate.
As soon as the core element is activated, Mandrake spyware and adware can carry out a variety of malicious actions, together with information assortment, display screen recording and monitoring, command execution, simulation of person swipes and faucets, file administration, and app set up.
Notably, the risk actors can immediate customers to put in additional malicious APKs by displaying notifications that mimic Google Play, hoping to trick customers into putting in unsafe recordsdata by way of a seemingly trusty course of.
Kaspersky says the malware additionally makes use of the session-based set up technique to bypass Android 13’s (and later) restrictions on the set up of APKs from unofficial sources.
Like different Android malware, Mandrake can ask the person to grant permission to run within the background and conceal the dropper app’s icon on the sufferer’s machine, working stealthily.
The malware’s newest model additionally options batter evasion, now particularly checking for the presence of Frida, a dynamic instrumentation toolkit widespread amongst safety analysts.
It additionally checks the machine root standing, searches for particular binaries related to it, verifies if the system partition is mounted as read-only, and checks if improvement settings and ADB are enabled on the machine.
The Mandrake risk stays alive, and whereas the 5 apps recognized as droppers by Kaspersky are now not obtainable on Google Play, the malware might return through new, harder-to-detect apps.
Android customers are beneficial solely to put in apps from respected publishers, verify person feedback earlier than putting in, keep away from granting requests for dangerous permissions that appear unrelated to an app’s operate, and make it possible for Play Shield is at all times lively.
.jpg?w=1600&resize=1600,900&ssl=1&description=Android%20spyware%20and%20adware%20%E2%80%98Mandrake%E2%80%99%20hidden%20in%20apps%20on%20Google%20Play%20since%202022){kind=link}