Softpedia >News >Security
Softpedia Homepage   

Android Backdoor GhostCtrl Can Steal Everything from a Phone, Spy on Users

Security company warns of new form of Android malware

Jul 17, 2017 10:03 GMT  ·  By
The malware spreads as stand-alone APKs, not published in the Google Play Store
   The malware spreads as stand-alone APKs, not published in the Google Play Store

Android seems to have become the preferred target of virus writers across the world, with new forms of malware capable of infecting more devices detected every day.

This time, security company Trend Micro warns of a new Android backdoor called GhostCtrl and which is a variant of the more famous OmniRAT that was discovered in late 2015 and affected a wider array of platforms, including Windows, Linux, and Mac.

GhostCtrl is specifically trying to infect Android devices and it spreads as stand-alone APKs with names like App, MMS, whatsapp, or Pokemon GO. The malware has been discovered in three different versions, with the most advanced giving hackers full control over a device and the rights to access and transfer any data stored locally.

“The malicious APK, after dynamically clicked by a wrapper APK, will ask the user to install it. Avoiding it is very tricky: even if the user cancels the “ask for install page” prompt, the message will still pop up immediately. The malicious APK doesn’t have an icon. Once installed, a wrapper APK will launch a service that would let the main, malicious APK run in the background,” the company explains.

Full control of a device

The malware uses a service called com.android.engine, which could easily trick users into believing it’s a legitimate process that doesn’t need to be killed. Once it infects a device, GhostCtrl awaits for commands by connecting to a C&C server on port 3176.

The infection allows the hacker to steal pretty much anything from a compromised device, including call logs, SMS records, contacts, phone numbers, SIM serial number, location, and browser bookmarks. Furthermore, it can get data from the camera, running processes, and even the wallpaper. And the worst thing, hackers can start the camera or record audio and then upload the content to the server, with all data being encrypted during the process.

Virus writers can also send commands to the compromised phone for more special tasks, like resetting the password of a configured account or making the phone to play different sound effects.

As with any malware, avoiding the download APKs from untrusted sources is the main thing to do to remain protected. Trend Micro detects the malware as ANDROIDOS_GHOSTCTRL.OPS/ANDROIDOS_GHOSTCTRL.OPSA.