The scary scenario of the spread of GhostCtrl malware on Android devices

Appearing dangerous Android malicious code specializing in stealing chat content on Facebook Messenger, Skype ...
10 million Android devices are preinstalled with malicious code from the factory

The growing number of people who buy and use smartphones, especially Android, makes these devices an attractive target for hackers to create malware. New strains of malware (malware) are frequently created but a special strain of viruses has shocked the cyber security world.

With the name GhostCtrl - this is the third time this malicious code has hacked the Android system. However, unlike the previous two versions, the new variant of GhostCtrl has much more frightening features.

Summary of effective Anti-Ransomware software
With the NMR's 15 free Ransomware decoding tools, you won't need to ransom the file anymore

The way GhostCtrl spreads

GhostCtrl infiltrates the victim's device when they install an infected APK file, which is usually anonymous under a popular application like WhatsApp or Pokémon Go. When the user installs it, the APK will display the installation message as usual. However, if the user refuses to install, that message will reappear.

The scary scenario of the spread of GhostCtrl malware on Android devices Picture 1

When a user clicks on a setting to end up annoying messages, the virus infects the system itself using backdoor. After that, it will open a communication channel to the hacker server - C&C server. C&C is an acronym for "command and control" and is used in bonet operations to send commands to infected devices. Thus, when a phone is infected with GhostCtrl, it receives commands from malware distributors via the C&C server.

What does GhostCtrl do?

GhostCtrl's scariest point is not how it spreads. TrendLabs has a complete list of all action codes that hackers can send to GhostCtrl via C&C server and what each code does. Here is an example of some of the activities that GhostCtrl does:

Real-time monitoring of phone sensor data.
List the file information in the current directory and upload it to the C&C server.
Delete the file in the specified directory.
Send SMS / MMS to the specified number of hackers (content can be customized).
Call the phone number that the hacker specifies.

In addition, TrendLabs also said GhostCtrl can also steal information stored on the phone. Stolen data may include information about Android version, browser history and camera data. Not only that, it can also track and upload SMS logs and call logs.

Depending on the hacker designation, GhostCtrl is also capable of performing a ransomware attack. It can change all passwords and PINs on infected devices then "blackmail" users.

So what to do to prevent it?

There are a few simple precautions that can help you not become a victim of this attack.

As mentioned above, GhostCtrl works as an infected APK file. Therefore, users can put themselves at risk of downloading APK files from an unknown source. For example, users can be redirected to third party APK sites. Therefore, you should stay away from APK sites and not download suspicious applications even when they are downloaded in the Google Play store.

Installing a reputable antivirus program will also help you prevent malicious code from infecting your system. Besides, you can also use mobile firewall to alert you and prevent malicious software from reaching its goal.

The scary scenario of the spread of GhostCtrl malware on Android devices Picture 2

Hopefully the information above will help you be safe from this malicious code!

Jessica Tanner

Update 25 May 2019

You should read it

May be interested

More than 9 million Android devices infected with malicious code from applications in Huawei AppGallery
at least 9.3 million android devices are believed to have been infected with a new type of extremely dangerous malware, with the ability to steal victims' data and phone numbers.
Malware using machine learning technology, downloaded more than 240,000 times by Android users
sparkcat has several notable features that make its spread more dangerous than ever.
What malicious code is designed to spread through IoT devices?
mirai is a malicious code designed to spread through iot devices. click to see this article now to learn how to prevent your computer from being infiltrated by malicious codes!
What is Joker Malware? The most effective way to protect against Joker Malware
joker malware is a sophisticated malware that targets mobile devices, especially on android and ios operating systems.
Discover a new kind of malicious code that can record the phone call to extort money
reddrop is one of the most sophisticated android malware that researchers have ever seen spread widely.
Detecting Android malware can easily steal OTP code without the victim knowing
android malware can extract and steal one-time passcode (otp) generated through google authenticator application.
Microsoft warns of new malware threat spread through Teams
microsoft has just issued an urgent cybersecurity alert regarding a threat actor using microsoft teams chats to spread malware.
How to detect and remove malware Agent Smith on Android
agent smith targets android mobile operating systems, replacing installed applications with malicious versions without users' knowledge.
5 tips to help detect signs of malware
removing the spread of malicious code by malware on your computer as quickly as possible will prevent malware from adding any malicious action or infecting other computers.
What is Clipper Malware? How does it affect Android users?
on january 8, 2019, users saw the first version of clipper malware on google play store. it has disguised as a harmless application to trick all downloads, then start redirecting electronic money to the owner of the malware.