פענוח קבצי ה-.ghas עם Emsisoft Decrypter עבור STOP/Djvu

Check Point analysts גילה that SharkBot Android malware has once again made its way into the Google Play Store, masquerading as antivirus apps.

This time, the malware was distributed through three developer accounts (Zbynek Adamcik, Adelmio Pagnotto, ו Bingo Like Inc), two of which were active in the fall of 2021.

תן לי להזכיר לך את זה SharkBot was previously reported על ידי NCC Group מומחים. They said that malware usually disguises itself as antiviruses, actually stealing money from users that installed the application. SharkBot, like its counterparts תוכנה זדונית בחנות Google Play, FluBot, ו Oscorp (UBEL), belongs to the category of banking Trojans capable of stealing credentials from hacked devices and bypassing multi-factor authentication mechanisms. The malware first appeared on the scene in the fall of 2021.

The NCC Group report emphasized that SharkBot’s hallmark is its ability to perform unauthorized transactions through Automatic Transfer System (ATS) מערכות, עיתונאים מדגישים כי נכון לעכשיו אין ראיות לכך שתשלום הכופר יוביל בדרך כלל לקבלת המפתח, לדוגמה, distinguishes it from TeaBot, which requires interaction with a live operator for performing malicious actions.

And also, לדוגמה, Cleafy ו ThreatFabric אומר, that the Android Trojan SharkBot uses the Accessibility service to steal credentials from banking and cryptocurrency applications in Italy, בריטניה וארצות הברית.

עכשיו, צ'ק פוינט specialists have supplemented the analysis of NCC Group and their colleagues from Cleafy with new data. They write that the malware, again seen in the גוגל חנות משחקים, does not infect users from China, הוֹדוּ, Romania, Russia, Ukraine and Belarus. באותו הזמן, six malicious applications found by researchers were installed more than 15,000 times before being removed, and most of the victims were in Italy and the UK.

They also noticed that SharkBot has a very unusual self-distributing mechanism: it is able to automatically respond to notifications from פייסבוק Messenger and WhatsApp, distributing malicious links to its fake antivirus applications among the victim’s contacts.

הרשה לי להזכיר לך שגם אנחנו כתבנו את זה התגלה לאחרונה PhoneSpy תוכנות ריגול כבר נדבקו מעל 1000 טלפונים.