Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Mobile & Wireless

Hackers Sell APK Binders for Google Android Remote Access Tool

Cyber-criminals are now selling tools need to repackage and Trojanize legitimate Google Android applications with a remote access tool known as AndroRat.

According to researchers at Symantec, the tools are called binders. When used in conjunction with AndroRat, an attacker with limited expertise can automate the process of Trojanizing any legitimate Android application with the malware. AndroRat first appeared late last year on underground forums.

Cyber-criminals are now selling tools need to repackage and Trojanize legitimate Google Android applications with a remote access tool known as AndroRat.

According to researchers at Symantec, the tools are called binders. When used in conjunction with AndroRat, an attacker with limited expertise can automate the process of Trojanizing any legitimate Android application with the malware. AndroRat first appeared late last year on underground forums.

AndroRAT“Like other RATs, it allows a remote attacker to control the infected device using a user friendly control panel,” blogged researcher Andrea Lelli. “For example, when running on a device, AndroRAT can monitor and make phone calls and SMS messages, get the device’s GPS coordinates, activate and use the camera and microphone and access files stored on the device.”

When the binders are used, the user unsuspectingly gets AndroRAT alongside the legitimate app they intended to install. As of July 16, Symantec has counted 23 cases of popular legitimate apps being Trojanized in the wild with AndroRAT.  There are only several hundred infections of AndroRAT so far worldwide, with the United States and Turkey being the most targeted countries. The number of infections however is rising, Lelli noted.

Google Android security has been in the news recently due to the disclosure of a master key vulnerability that could be used to Trojanize legitimate apps. Proof-of-concept code for the flaw, which was uncovered by Bluebox Security, was published online by a researcher with vendor viaForensics.

Google has pushed out a patch for Google Android to fix the vulnerability, and Google Play scans for the issue. Google’s Verification Tool is also able to offer protection for Android users who download their apps from other app stores. Some of the company’s OEM partners, such as Samsung, are already shipping a fix to their Android devices, Google told SecurityWeek last week.

“The evolution of remote access tools moving onto the Android platform was predicted,” Lelli blogged. “While AndroRAT is not showing a particularly high level of sophistication just yet, with the open source nature of its code and with its popularity growing, it has potential to evolve and grow into a more serious threat.”

Written By

Click to comment

Expert Insights

Related Content

Mobile & Wireless

Apple rolled out iOS 16.3 and macOS Ventura 13.2 to cover serious security vulnerabilities.

Mobile & Wireless

Technical details published for an Arm Mali GPU flaw leading to arbitrary kernel code execution and root on Pixel 6.

Mobile & Wireless

Apple’s iOS 12.5.7 update patches CVE-2022-42856, an actively exploited vulnerability, in old iPhones and iPads.

Mobile & Wireless

Two vulnerabilities in Samsung’s Galaxy Store that could be exploited to install applications or execute JavaScript code by launching a web page.

Mobile & Wireless

South Dakota Gov. Kristi Noem says her personal cell phone was hacked and linked it to the release of documents by the January 6...

Cybercrime

A digital ad fraud scheme dubbed "VastFlux" spoofed over 1,700 apps and peaked at 12 billion ad requests per day before being shut down.

Mobile & Wireless

Infonetics Research has shared excerpts from its Mobile Device Security Client Software market size and forecasts report, which tracks enterprise and consumer security client...

Application Security

Software maker Adobe on Tuesday released security patches for 29 documented vulnerabilities across multiple enterprise-facing products and warned that hackers could exploit these bugs...