SharkBot malware hides as Android antivirus in Google Play

[tarekma7]

SharkBot banking malware has infiltrated the Google Play Store, the official Android app repository, posing as an antivirus with system cleaning capabilities.

Although the trojan app was far from popular, its presence in Play Store shows that malware distributors can still bypass Google's automatic defenses. The app is still present in Google's store at the moment of writing.

SharkBot was discovered in Google Play by researchers at the NCC Group, who today published a detailed technical analysis of the malware.

What can SharkBot do?

The malware was first discovered by Cleafy in October 2021. Its most significant feature, which set it apart from other banking trojans, was transfering money via Automatic Transfer Systems (ATS). This was possible by simulating touches, clicks, and button presses on compromised devices.

NCC reports that the money transfer feature is still available in the latest version but used only in some cases of advanced attacks.

The four primary functions in SharkBot's latest version are:

Injections (overlay attack): SharkBot can steal credentials by showing web content (WebView) with a fake login website (phishing) as soon as it detects the official banking app opened
Keylogging: Sharkbot can steal credentials by logging accessibility events (related to text fields changes and buttons clicked) and sending these logs to the command and control server (C2)
SMS intercept: Sharkbot can intercept/hide SMS messages.
Remote control/ATS: Sharkbot has the ability to obtain full remote control of an Android device (via Accessibility Services).
To perform the above, SharkBot abuses the Accessibility permission on Android and then grants itself additional permissions as needed.

This way, SharkBot can detect when the user opens a banking app, performs the matching web injections, and steals the user's credentials.

The malware can also receive commands from the C2 server to execute various actions such as:

Send SMS to a number
Change SMS manager
Download a file from a specified URL
Receive an updated configuration file
Uninstall an app from the device
Disable battery optimization
Display phishing overlay
Activate or stop ATS
Close a specific app (like an AV tool) when the user attempts to open it

Source