SpyNote Android Trojan Builder Leaked Is Now Widely Available On The Dark Web

Palo Alto Networks’ Unit 42 team recently discovered a new Android Trojan called SpyNote which facilitates remote spying.Unit 42 discovered the Trojan while monitoring malware discussion forums. 

SpyNote is similar to OmniRat and DroidJack, which are RATs (Remote Administration Tools) that allow malware owners to gain remote administrative control of an Android device.
Droidjack made news earlier this month when researchers at Proofpoint found a rigged version of the massively popular game Pokémon Go with the Trojan. OmniRat is similar in function and was first spotted in Germany in November by researchers who said targeted victims received a text message asking them to download an app to view an image.

The Trojan, found has not been spotted in any active campaigns but warn that attacks are forthcoming.

SpyNote has many features that includes the following:

1.     No root access required
2.     Install new APKs and update the malware
3.     Copy files from device to computer
4.     View all messages on the device
5.     Listen to calls made on the device
6.     List all the contacts on the device
7.     Listen live or record audio from the device’s microphone
8.     Gain control of the camera on the device
9.     Get IMEI number, Wi-Fi MAC address, and cellphone carrier details
10.     Get the device’s last GPS location
11.     Make calls on the device

Upon installation, SpyNote will remove the application’s icon from the victim’s device.The SpyNote APK requires victims to accept and give SpyNote many permissions, including the ability to edit text messages, read call logs and contacts, or modify or delete the contents of the SD card.

Once installed, SpyNote is hard to get rid off.

 The SpyNote builder application is developed in .NET
The application is neither obfuscated nor protected with any Obfuscator or Protector.

The above video is a demo a user appears to be running SpyNote showing a remote takeover of an Android device.

Unit 42 Team States that, The uploader might be following the instructions described in YouTube videos on using SpyNote, considering the port number used is exactly the same as in the videos and the uploader only changes the icon of the APK file .

SpyNote is configured to communicate with a command and control server via IP address via TCP using hard-coded SERVER_IP and SERVER_PORT values. That has given researchers the ability to extract C2 information from the malware. 

 

Unit 42 asserts, Installing apps from third-party sources can be very risky — those sources often lack the governance provided by official sources such as the Google Play Store, which, even with detailed procedures and algorithms to weed out malicious applications, is not impregnable. Side-loading apps from questionable sources exposes users devices to a variety of malware and possible data loss.

Thus far we have not observed SpyNote used in active attacks but we suspect cyber criminals will begin using it as the building of SpyNote is freely available. 

Source:PaloAltoNetworks

Russian Hacker Used Corcow Trojan To Manipulate Currency Value For 14 Minutes.

 Russian hackers have managed to allegedly jacked up the Ruble-Dollar exchange rates for a whole 14 minutes to make handful of profit from  it.The hackers use malware to manipulate Russian currency value.

The hackers used malware to infiltrate a regional Russian bank and manipulate the ruble-dollar exchange rate by more than 15 percent in minutes, according to a cybersecurity firm investigating the attack. 

The swing in the exchange rates was immediately noticed by Russian central bank and it has started an investigation into possible market manipulation.

The Moscow Exchange has said that its systems were not hacked in the incident. A separate investigation by the central bank found no evidence of currency manipulation, blaming the swing — which lasted 14 minutes and caused the exchange rate to fluctuate from 55 and 66 rubles per dollar — on traders’ mistakes.

According to the researchers hackers used a virus called Corcow Trojan to accomplish their infernal task. 

Anti-virus softwares are not effective against the Corcow Trojan, which can hide undetected in a bank’s systems for more than six months.The hackers used Corcow Trojan to open a backdoor into Kazan-based Energobank’s systems in February 2015, and then place over $500 million in orders at non-market rates, Group-IB told Bloomberg.

Corcow trojan has reportedly infiltrated 250,000 computers worldwide and infected over 100 financial institutions.

“This is the first documented attack using this virus and it has potential to do much more damage, Once the malware has penetrated a local network, it is sophisticated enough to infect computers that are even not connected to the Internet.” said Dmitry Volkov, the head of Group-IB’s cyber intelligence department.