Detecting SharkBot malware hiding in anti-virus applications on Google Play

SharkBot banking malware has infiltrated the Google Play Store, the official Android app store, masquerading as anti-virus software with the ability to clean the system.

While this malicious app is not very popular, its presence on the Play Store shows that bad actors still find a way to bypass Google's automated defenses. Up to this point, this application is still available on the Google Play Store.

Detecting SharkBot malware hiding in anti-virus applications on Google Play Picture 1

The application contains malicious code SharkBot

Detecting SharkBot malware hiding in anti-virus applications on Google Play Picture 2

Application developer details

NCC Group researchers discovered the existence of SharkBot on the Google Play Store. Recently, NCC Group published a detailed technical analysis article about this malware.

What can SharkBot do?

SharkBot malware was first discovered by Cleafy in October 2021. Its most important feature, which sets it apart from other banking trojans, is money transfer via Automated Funds Transfer System (ATS). This is done by it by simulating taps, clicks and button presses on compromised devices.

The NCC says the money transfer feature is still available in the latest version of SharkBot but is only used in case of advanced attacks.

Currently, the four main functions in the latest version of SharkBot are:

Injections (overley attack): SharkBot can steal login information by displaying web content (WebView) with a phishing login page as soon as it detects that the official banking application is open.
Keylogging: SharkBot can steal credentials by logging accessibility events (related to text field changes and buttons being clicked) and sending these logs to a command and control server (C2).
Block SMS: SharkBot can block/hide SMS messages (steal OTP codes without the user's knowledge).
Remote Control/ATS: SharkBot can take full control of Android device and control it remotely (via Accessibility Services).

To do the above, SharkBot abuses the Accessibility privilege on Android and then grants it more permissions if needed.

In this way, SharkBot can detect when the user opens the banking application then execute the appropriate website injection and steal the user's information.

In addition, SharkBot can also receive commands from the C2 server to perform other actions as follows:

Send SMS to a phone number.
Change SMS manager.
Download files from a specified URL.
Get the updated configuration file.
Uninstall the app from the device.
Turn off battery optimization.
Display overlay for phishing.
Activate or deactivate the ATS.
Closes a specific application (such as an anti-virus tool) when the user tries to open it.

Reply to notifications

One of the notable differences between SharkBot and other Android banking trojans is the use of relatively new components to take advantage of the "Direct reply" feature for notifications.

SharkBot can intercept new messages and respond to them with incoming messages directly from the C2 server.

Detecting SharkBot malware hiding in anti-virus applications on Google Play Picture 3

The source code of the auto-reply to notifications feature

NCC notes that SharkBot uses this feature to drop feature-rich payloads onto the compromised device via a shortened Bit.ly URL.

Initially, the rogue antivirus will only contain a reduced version of SharkBot to reduce the risk of detection and bypass the automatic defenses of the Google Play Store. Then, through the "Direct reply" feature, the official version of SharkBot with full features including ATS will be downloaded and installed.

Detecting SharkBot malware hiding in anti-virus applications on Google Play Picture 4

Decrypt the additional malicious download command sent from the C2 server

SharkBot's C2 server is based on a DGA (domain generation algorithm) so it becomes much more difficult to detect and block command-level domains for SharkBot.

To protect yourself against dangerous trojans like SharkBot, you should never completely trust apps on the Google Play Store. Install as few apps as possible on your device. In other words, only install applications that you feel are necessary for life and work.

android malicious code

Isabella Humphrey

Update 09 March 2022

You should read it

May be interested

Most antivirus applications on Google Play do not work as ads
according to research by av-comparatives, a austrian-based antivirus software testing company, many antivirus applications on the google play store do not work as well, but are aimed at other purposes.
The Joker malware once again bypassed Google's security, spreading strongly on the Play Store
the joker malware has been around since 2017, but google has so far struggled to detect and stop it.
Detecting new malicious code capable of 'evading' most anti-virus software
cybersecurity experts at hp company (usa) have discovered a new malware that is able to evade most anti-virus software. the new malicious code is named ratdispenser.
How to avoid Malware when downloading Pokemon GO?
security experts discovered that malware was embedded in a pokemon go version outside of google play store. so when users download pokemon go versions on other sites other than google play store, they most likely install some malware that comes with the game without them knowing.
Overview of Virus.Win32.Virut.ce malware pattern
in the following article, tipsmake.com will introduce you to some polymorphic viruses - here is virus.win32.virut and its ce variants
Decode all errors that appear on Google Play and how to fix them (Part 1)
for android users, installing applications from google play seems simple, but many times you are dumb by the store returning errors with the whole code set, but you don't know why, also like how to fix them. located in the area on xda, this is pretty good, so please forgive everyone for watching and contributing.
BankBot is back on Play Store - an uninterrupted story about malware on Android
after google's efforts to block malware from play store, malicious applications still find ways to trick android anti-malware and poisoning tools.
Instructions for purchasing applications on Google Play do not need a visa card
for those who use viettel phone sim, they can now register to buy applications and games on google play through the phone number they are using.
How to choose antivirus applications for Windows and Mac
you are wondering why some antivirus applications like norton, mcafee or kaspersky require you to pay about $ 25-75 per year, while there are many good antivirus applications that are still free.
Detected 205 malicious applications with more than 32 million downloads on Google Play only in last July
lukas stefanko, eset's malware researcher, discovered 205 malicious applications on google's store in just july. the total number of downloads of these applications has reached over 32 million.

Detecting SharkBot malware hiding in anti-virus applications on Google Play

What can SharkBot do?

Reply to notifications

You should read it

May be interested

Technology story