Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
A novel RAT uses trojanized replacements of legitimate banking apps to neutralize security controls from inside itself.
Hirudo is a remote access banking trojan for Android that combines elements of a traditional banking trojan and a full-featured RAT: it includes on-device credential theft with live remote control of the same phone. Remote control provides live screen viewing via WebRTC, remote camera access, and remote interaction through Android Accessibility Services.
The malware, tracked and analyzed by ThreatFabric, is delivered via a dropper contained within genuine-looking downloaded content (a shopping app, an adult video app or a short drama app advertised via social media). Victims install what appears to be a legitimate application, but once installed, the contained dropper checks whether the Hirudo RAT is already present and installs it if not.
The Hirudo payload currently targets eight Indonesian banking apps. Internal code suggests it could also be used to target banks...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
