A Remote Access Trojan is infecting Android devices by posing as legitimate, well-known apps.
If you saw an app called "The Nasty, Malicious App That Will Record Your Phone Calls and Worse," you wouldn't download it. That's why Android malware creators repackage their nefarious software within legitimate, well-known apps. It's a common tactic, and one that's easy to pull off. It's also the strategy used by Krysanec, a Remote Access Trojan discovered by ESET.
We've talked about RATs before, but here's a quick refresher: these malicious applications let malware authors remotely control infected devices. According to ESET, Krysanec is built on the Unrecom RAT and comes with a very user friendly point-and-click interface to control infected devices.
Once an infected app is installed on a victim's device, the malware's creator can add additional plug-in modules to the basic malware. These modules allow the malware author to do all sorts of nasty things, like take photos, record audio through the microphone, locate the victim via the device's GPS, view the victim's contact list, and intercept and send text messages.
The malware creator also has a very deep view into the victim's phone, able to see lists of websites the victim has visited, all the installed applications, and incoming and outgoing phone calls.
Yes, always. But in this particular case, you can rest a little easier as you're unlikely to encounter Krysanec . ESET says that this particular malware is circulating well off the beaten track on filesharing sites and Russian social media sites. But because this malware is injected into legitimate apps, it has many faces. ESET found the malware in a malicious version of the MobileBank app and 3G Traffic Guard.
Given some of the infected apps used by the malware's creators and the choice of distribution sites, it seems likely that at least some of this malware campaign is being targeted at Russian users.
Also, RATs are powerful tools, but not highly automated. They require the malware author to pay attention to their victims, which is at odds with the en masse approach preferred by most malware operators.
The best way to avoid the Krysanec RAT is to not fall for its innocuous packaging. The Google Play store has safeguards that would prevent Krysanec from being distributed, so it's best to stick to this trusted store for your Android apps.
We also recommend installing security software on your Android device. Though it's unlikely you'll ever encounter malware, it's a smart precaution and the apps include lots of handy tools like antitheft features. avast! Mobile Security & Antivirus and Bitdefender Mobile Security and Antivirus are both Editors' Choice winners, and ESET has a solid app as well. Choose your weapon, and watch out for RATs!