24 C
Jaipur
Wednesday, October 21, 2020

New Variant of Infamous Android Joker Malware Detected

Must read

telia company: Telecom operator Telia core profit tops forecast – Latest News

STOCKHOLM: Nordic telecom operator Telia Company on Wednesday reported quarterly core earnings ahead of market expectations aided by cost savings and said it had...

DJI Pocket 2 with better camera, audio system launched

DJI has launched the second iteration of the Osmo Pocket called DJI Pocket 2. It’s a stabilised mini camera that can record in...

JioPages: Reliance Jio launches ‘made-in-India’ browser, JioPages: Features and how to download

Reliance Jio has launched a made-in-India browser, JioPages. The company claims that JioPages focusses on data-privacy and gives users full...

This is the only country where Apple has to provide free EarPods with iPhone 12 by law

Apple is no longer providing EarPods and the charging adapter with any of its iPhones. Citing environmental reasons, Apple has trimmed the...

The Joker malware detected in early June 2019, it employs several tactics to bypass GooglePlay protection and to perform several malicious activities.

The malware used to hide inside different apps and once users downloaded to the phone they got infected with the Joker malware.

It aims to steal money from the user by signing for paid subscriptions, it interacts with the user’s SMS messages, contact lists, and other data from the device.

Earlier it was observed that Joker malware hidden with 24 apps different apps, all the apps have been reported to Google and removed from the store.

New Joker variant

Check Point researchers discovered a new variant of Joker Dropper and Premium Dialer spyware in Google Play hidden with 11 apps that removed from Google Play on April 30, 2020.

The updated version of Joker malware hides behind look like legitimate apps and downloads additional malware on the device.

“This time, however, the malicious actor behind Joker adopted an old technique from the conventional PC threat landscape and used it in the mobile app world to avoid detection by Google.”

The Joker malware utilizes Notification Listener service and a dynamic dex file loaded from the C&C server to subscribe to users for the premium services.

The new malware also checks the malicious flow every time by creating a new object that communicates with the C&C to check if the campaign was still active.

To minimize the Joker’s fingerprint, the malicious actors loaded the dynamic dex file “from sight while still ensuring it can load – a technique which is well-known to developers of malware for Windows PCs.”

The new variant of the malware hides it’s malicious dex file within the application as Base64 encoded strings, ready to be decoded and loaded.

The new variant also contains the code of the original Joker malware in its main dex file “the registration of the NotificationListener service, subscribing the user to premium services, and more.”

Here you can find the package names of 11 malicious applications that hide a new variant of Joker.

If you have installed any of the malicious apps, it is recommended to remove them immediately and to check your mobile and credit-card bills for unwanted charges.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Also Read

Cerberus Android Banking Malware Mimic as Currency Converter App Found on Google Play

Android Devices Infected with Undeletable Adware that Sits on System Partition

Source link

- Advertisement -

More articles

LEAVE A REPLY

Please enter your comment!
Please enter your name here

Latest article

telia company: Telecom operator Telia core profit tops forecast – Latest News

STOCKHOLM: Nordic telecom operator Telia Company on Wednesday reported quarterly core earnings ahead of market expectations aided by cost savings and said it had...

DJI Pocket 2 with better camera, audio system launched

DJI has launched the second iteration of the Osmo Pocket called DJI Pocket 2. It’s a stabilised mini camera that can record in...

JioPages: Reliance Jio launches ‘made-in-India’ browser, JioPages: Features and how to download

Reliance Jio has launched a made-in-India browser, JioPages. The company claims that JioPages focusses on data-privacy and gives users full...

This is the only country where Apple has to provide free EarPods with iPhone 12 by law

Apple is no longer providing EarPods and the charging adapter with any of its iPhones. Citing environmental reasons, Apple has trimmed the...

Vivo V20 Pro to launch in India in November, confirms India CEO

Vivo is soon going to launch its Vivo V20 Pro smartphone in India. The confirmation of the India launch of the handset...