Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Ewind – Adware in Applications’ Clothing

Summary: Unit 42 has tracked new samples of the Android adware family Ewind since mid-2016, in which actors decompile popular legitimate apps such as GTA Vice City, AVG Cleaner, Minecraft Pocket Edition, VKontakte and Opera Mobile, add malicious routines, repackage the APK, and distribute it through Russian-language Android app sites. Beyond displaying ads, Ewind collects device data, forwards SMS messages to the attacker, and can potentially give full remote access to the infected device, with samples signed by a certificate whose owner and issuer are both CN=app.

Key Takeaway: The SMS-forwarding filter is likely intended to defeat SMS-based two-factor authentication, and the C2 sent ad commands during testing only when finance-related apps were in the foreground - a targeted-app list the server refreshes once a day.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related