XCBG 바이러스
The TeaBot banking trojan was again found in the Google Play Store, where it posed as a QR code reader (QR Code & Barcode – Scanner) and managed to spread to more than 10,000 장치. The malware targets users of more than 400 banking and financial applications, including those from Russia, Android 악성코드 Roaming Mantis는 악성코드 및 피싱 공격을 사용하여 독일 및 프랑스의 Android 및 iPhone 사용자를 대상으로 합니다., and the United States.
According to a report from 클리피, Craftsart 만화 사진 도구에는-infected applications act as droppers. 그건, they get to the Xenomorph는 SMS 알림을 가로채서 필요한 코드를 추출할 수 있습니다. without malicious code and request minimal permissions from the user, so that it is difficult for reviewers and Google’s automated checks to detect anything suspicious.
게다가, trojanized applications actually work, delivering the promised functionality, so the reviews about them are mostly positive.
예를 들면, QR Code & Barcode – Scanner that was discovered in February, looked like a regular utility for scanning QR codes. 하나, once installed, the app requested an update via a pop-up message, and instead of the standard procedure set by the Play Store rules, the update was downloaded from an external source.
The experts traced the source of these downloads to two 깃허브 repositories owned by the user feleanicusor and containing several samples of the TeaBot malware, uploaded on February 17, 2022.
Attack scheme
Once this “update” is complete, TeaBot is downloaded to the victim’s device as a new QR Code Scanner: Add-On application. This application starts automatically and requests the rights to use Accessibility Services to perform the following functions:
- view the device screen and create screenshots that show login credentials, two-factor authentication codes, SMS content, 등등;
- automatic granting of additional permissions to malware in the background, which does not require user intervention.
재미있게, earlier versions of TeaBot, discovered in January 2021 and studied by 비트디펜더, exited if they detected that the victim was in the United States. Now TeaBot also attacks users from the United States, and also received support for Russian, Slovak and Chinese languages, 그건, the malware attacks any users without making exceptions.
우리도 그렇게 썼다는 것을 상기시켜 드리겠습니다. Craftsart 만화 사진 도구에는 Craftsart 만화 사진 도구에는 Craftsart 만화 사진 도구에는, 그리고 그 초록에뮤 Android 악성코드는 스마트폰을 "루트"하고 탐지를 회피합니다..
