Threat researchers have discovered an obfuscation platform that attaches malware to legitimate Android applications to lure users to install the malicious payload and make it difficult for security tools to detect.
Analysts with cybersecurity vendor ThreatFabric found the platform, named “Zombinder,” on the darknet while investigating a campaign that targeted both Android and Windows users with different types of malware.
Zombinder came to light while the researchers were analyzing a campaign involving the Ermac Android banking trojan. That effort yielded evidence of another campaign using multiple trojans aimed at both Android and Windows systems. Along with Ermac, it was distributing desktop malware including Erbium, Aurora stealer, and Laplas clipper.
“While investigating Ermac’s activity, our researchers spotted an interesting campaign masquerading as applications for Wi-Fi authorization,” the researchers write. “It was distributed through a fake one-page website containing only two buttons.”
It was distributed through a fake one-page website containing only two buttons
The buttons offered downloads for either Windows or Android. Clicking the latter downloaded Ermac, which can steal Gmail messages, two-factor authentication codes, and seed phrases from cryptocurrency wallets. It’s also a keylogger.
“However, another detail drew our attention: some of the downloaded apps were not directly Ermac, but a ‘legitimate’ app that, during its normal operation, installed Ermac as payload targeting multiple banking applications,” the researchers say.
These apps essentially were modified versions of legitimate apps, from a football streaming service to a Wi-Fi authenticator tool. The malware packages bound to them also carried the same name as the legitimate apps.
The researchers discovered that the cybercriminals were using a third-party service – Zombinder – that provided the “glue” to bind the malware dropper capabilities to the legitimate app. Once downloaded, the app – now tied to the malware – operated as expected until an update message appeared.
“At this point, if accepted by the victim, the seemingly legitimate application will install this update, which is nothing else than Ermac,” they write. “Such process is achieved by ‘glueing’ [an] obfuscated malicious payload to a legitimate app with minor updates made to original source code to include installation and loading of the malicious payload.”
The APK binding service has been available since March and is being frequently used by different attacks, the researchers write. It’s provided by what they say is “an actor well-known in the threat landscape.”
An ad for Zombinder on a darknet forum explains “binding is needed to install your bot via making a potential victim feel more safe and trust the legitimate software in which your android bot will be embedded.”
The most recent campaign using Zombinder distributed the Xenomorph banking trojan glued to the application from a media downloading company, with the victim lured through malicious ads. Zombinder drops and launches Xenomorph even as the legitimate app is operating normally for the unsuspecting victim.
Also unique to the campaign was the addition of the “Download for Windows” button on the fake Wi-Fi authorization site that distributed Ermac. It’s common for cybercriminals targeting mobile devices to use multiple trojans to target a number of platforms, but this one also targeted Windows desktop applications, distributing Ermac with other malware.
The Erbium trojan is used against Windows users, stealing data including saved passwords, credit card details, browser cookies, and crypto wallets. Erbium was used during the campaign to steal information from more than 1,300 victims, among thousands of …….