According to Nathan Collier, Senior Malware Intelligence Analyst, Xhelper’s behavior is ushering in a new era of mobile malware. The possibility of reinfection using a hidden directory containing an APK that could evade detection is really scary.

“This is by far the nastiest infection I have encountered as a mobile malware researcher. Usually a factory reset, which is the last option, resolves even the worst infection. I cannot recall a time that an infection persisted after a factory reset unless the device came with pre-installed malware”, — says Nathan Collier.

Researchers first discovered Xhelper in March 2019. At that time, the functionality of malware was relatively simple, and its main function were monetizing visits to advertising pages. However, this did not stop the malware from entering the TOP 2019 threats.

Since then, most security applications for Android devices have added xHelper detection, but it turned out that getting rid of malware is not as simple.

According to experts from Malwabytes, xHelper is not distributed as part of the pre-installed malware contained in the firmware, but uses the Google Play store to re-infect after a complete reboot of the device or cleaning with antivirus software.

“We have seen important pre-installed system apps infected with malware in the past. But Google PLAY itself!? After further analysis, we determined that, no, Google PLAY was not infected with malware. However, something within Google PLAY was triggering the re-infection—perhaps something that was sitting in storage. Furthermore, that something could also be using Google PLAY as a smokescreen, falsifying it as the source of malware installation when in reality, it was coming from someplace else”, — explain Malwabytes specialists.

According to experts, the malware makes believe that Google Play is a source of infection, while in fact the installation is carried out from another place.

While analyzing files stored on one of the victims’ compromised Android smartphones, it was discovered that the Trojan downloader was embedded in the APK located in the com.mufc.umbtts directory.

Experts have not yet been able to figure what is the Google Play role in process of infecting.

“Here’s the confusing part: Nowhere on the device does it appear that Trojan.Dropper.xHelper.VRW is installed. It is our belief that it installed, ran, and uninstalled again within seconds to evade detection—all by something triggered from Google PLAY. The “how” behind this is still unknown. It’s important to realize that unlike apps, directories and files remain on the Android mobile device even after a factory reset. Therefore, until the directories and files are removed, the device will keep getting infected”, — write the researchers.

Users are advised to turn off the Google Play store, and then start scanning the device with an antivirus program. Otherwise, malware will continue to return despite removing it from the device.

The post Xhelper Trojan remains on the device even after resetting to factory settings appeared first on Gridinsoft Blog.

Experts said that for the first time in three years, a mobile Trojan entered the general list of malware, and it has become the most widespread mobile threat in the last month.

The XHelper Mobile Trojan has been active since March 2019. A multi-purpose trojan designed for Android users is able to download other malicious applications and display malicious ads.

“The application is able to hide itself from user and mobile anti-virus programs and reinstall itself if the user uninstalls it. Over the past six months, the malware code has been constantly updated, which helped him bypass mobile anti-virus solutions and continue to infect new devices”, – say the researchers.

As a result, he took 8th place in the top 10 malware.

XHelper is a versatile, multi-purpose malware that can be adapted to the needs of criminals, such as ransomware, spam campaigns, or malicious ads.

Researchers also note the activity of the Formbook infostiller – it affected almost 12% of organizations. The main danger of Formbook and other similar programs is that for a long time they can go unnoticed in order to collect as much information as possible from the victim’s device. Info-dealers can steal information about bank account, credit card number, phone number and more.

“Now criminals are trying to use several different tactics to monetize their operations, instead of following a single trend, such as crypto mining, which dominated in 2018. Therefore, it is important that organizations implement the latest generation of anti-virus solutions not only in their networks, but also on employees’ mobile devices, in order to protect all enterprise endpoints. It is necessary regularly remind employees of the dangers of opening attachments from emails or clicking on links that come from unknown sources”, – tell representatives of Check Point Software Technologies.

The most active malware in November 2019 in the world was:

Emotet maintained its position in the top of the list of malware, affecting 9% of organizations in the world. XMRig (7%) and Trickbot (6%) are in the second and third place respectively.

1. Emotet is an advanced self-propagating modular trojan. Emotet was once an ordinary banking trojan, and has recently been used to further spread malware and campaigns. The new functionality allows sending phishing emails containing malicious attachments or links.
2. XMRig is open source software first discovered in May 2017. Used to mine Monero cryptocurrency.
3. Trickbot – one of the dominant banking trojans, which is constantly updated with new features, functions and distribution vectors. Trickbot is a flexible and customizable malware that can spread through multi-purpose campaigns.

The most active mobile threats in November 2019:

xHelper, the new program on the list, has become the most common malware for mobile devices. It is followed by Guerilla and Lotoor.

1. xHelper is a malicious Android application, active since March 2019, it was used to download other malicious applications and display ads. The application is able to hide itself from user and mobile anti-virus programs and reinstall itself if the user uninstalls it.
2. Guerilla – clicker for Android, which can interact with the remote control server, download additional malicious plugins and aggressively clicks on ads without the consent of the user.
3. Lotoor – a program that uses vulnerabilities in the Android operating system to obtain privileged root access on hacked mobile devices.

The most common vulnerabilities in November 2019:

1. SQL injection – inserting SQL code into the input from the client to the page using a vulnerability in the application software.
2. HeartBleed error in OpenSSL TLS DTLS software (CVE-2014-0160; CVE-2014-0346) – a vulnerability exists in OpenSSL that could reveal the contents of memory on a server or on a connected client. The vulnerability related to an error when processing Heartbeat TLS/DTLS packets.
3. Remote code execution MVPower DVR. An MVPower DVR device has a remote code execution vulnerability. An attacker could use this vulnerability to execute arbitrary code on a vulnerable router using a specially crafted request.

A complete list of the top 10 malware families for November can be found on the Check Point blog.

Do not forget about the dangers of various ransomware programs, as, for example, the international software company Altran, the Norwegian aluminum producer Norsk Hydro, as well as the American chemical companies Hexion and Momentive suffered from LockerGoga during the outgoing year. Now LockerGoga creators and distributorS, at the request of the French authorities, are looked for in Ukraine.

The post Check Point named the most dangerous malware of November 2019 appeared first on Gridinsoft Blog.