Threat researchers have discovered an obfuscation platform that attaches malware to legitimate Android applications to lure users to install the malicious payload and make it difficult for security tools to detect.
Analysts with cybersecurity vendor ThreatFabric found the platform, named “Zombinder,” on the darknet while investigating a campaign that targeted both Android and Windows users with different types of malware.
Zombinder came to light while the researchers were analyzing a campaign involving the Ermac Android banking trojan. That effort yielded evidence of another campaign using multiple trojans aimed at both Android and Windows systems. Along with Ermac, it was distributing desktop malware including Erbium, Aurora stealer, and Laplas clipper.
“While investigating Ermac’s activity, our researchers spotted an interesting campaign masquerading as applications for Wi-Fi authorization,” the researchers write. “It was distributed through a fake one-page website containing only two buttons.”
It was distributed through a fake one-page website containing only two buttons
The buttons offered downloads for either Windows or Android. Clicking the latter downloaded Ermac, which can steal Gmail messages, two-factor authentication codes, and seed phrases from cryptocurrency wallets. It’s also a keylogger.
“However, another detail drew our attention: some of the downloaded apps were not directly Ermac, but a ‘legitimate’ app that, during its normal operation, installed Ermac as payload targeting multiple banking applications,” the researchers say.
These apps essentially were modified versions of legitimate apps, from a football streaming service to a Wi-Fi authenticator tool. The malware packages bound to them also carried the same name as the legitimate apps.
The researchers discovered that the cybercriminals were using a third-party service – Zombinder – that provided the “glue” to bind the malware dropper capabilities to the legitimate app. Once downloaded, the app – now tied to the malware – operated as expected until an update message appeared.
“At this point, if accepted by the victim, the seemingly legitimate application will install this update, which is nothing else than Ermac,” they write. “Such process is achieved by ‘glueing’ [an] obfuscated malicious payload to a legitimate app with minor updates made to original source code to include installation and loading of the malicious payload.”
The APK binding service has been available since March and is being frequently used by different attacks, the researchers write. It’s provided by what they say is “an actor well-known in the threat landscape.”
An ad for Zombinder on a darknet forum explains “binding is needed to install your bot via making a potential victim feel more safe and trust the legitimate software in which your android bot will be embedded.”
The most recent campaign using Zombinder distributed the Xenomorph banking trojan glued to the application from a media downloading company, with the victim lured through malicious ads. Zombinder drops and launches Xenomorph even as the legitimate app is operating normally for the unsuspecting victim.
Also unique to the campaign was the addition of the “Download for Windows” button on the fake Wi-Fi authorization site that distributed Ermac. It’s common for cybercriminals targeting mobile devices to use multiple trojans to target a number of platforms, but this one also targeted Windows desktop applications, distributing Ermac with other malware.
The Erbium trojan is used against Windows users, stealing data including saved passwords, credit card details, browser cookies, and crypto wallets. Erbium was used during the campaign to steal information from more than 1,300 victims, among thousands of people attacked during the overall campaign.
Another piece of malware downloaded to the same device was the Laplas clipper, a relatively new threat that lets cybercriminals substitute the copied crypto wallet address of the recipient of a transfer with one controlled by the attackers. Also distributed through the malicious site was Aurora, a Windows stealer written in the Golang language.
“The notable thing about this particular [Aurora] build is its size: more than 300 MB,” the researchers write. “This is probably a tactic to overcome detection by antivirus engines, as most of the data is just an ‘overlay’ filled with zero bytes. At the same time the actual payload is encrypted and unpacked during the execution of the application.”
The use of so many different trojans could indicate that the malicious Wi-Fi authorization page is used by multiple crooks who obtain it through a third-party distribution service, the researchers believe. The combination of malware development and distribution and multiple tactics for using it is an indication of the growing sophistication of cyber-threats.
In addition, by targeting multiple platforms, threat groups can reach a wider number of victims and steal more information, which then can be used in future campaigns.
Zombinder is the latest reminder of the dangers of third-party app and APK download sites, Chris Hauk, consumer privacy champion at Pixel Privacy.
“Malware as a service is a growing problem, allowing any bad actors to cause havoc with little to no programming skills,” Hauk told The Register. “This is why users should never install apps from outside of the Google Play Store. ®