Lab52 security researchers have dissected a new piece of Android malware that they discovered while analyzing infrastructure associated with Russian cyberespionage group Turla.
While it’s the only malware family to connect to a specific IP address associated with Turla, the spyware can’t be attributed to the infamous APT, “given its threat capabilities,” Lab52 says.
Once installed on a victim’s phone, the malware poses as Process Manager and shows a gear-shaped icon. However, the icon is removed after the threat’s initial run.
When executed for the first time, the malware asks for an extensive set of permissions, which essentially provide it with full access to the device and user data.
The malware requests access to screen lock/unlock, device location, network settings, camera, audio settings, call logs, contacts, external storage, SMS messages, phone state, and audio recording, as well as permissions to set the device global proxy and display on the foreground.
[ READ: Over 100 Million Android Users Installed ‘Dark Herring’ Scamware ]
After the application has been configured, tasks are executed to steal data from the device and add it to a JSON. The malware also collects information on the installed packages and on the permissions the user has for each package.
After collecting all of the needed information, the malware contacts its command and control (C&C) server, after which it sends the harvested data to the server.
The malware was also observed attempting to download and install an application called Rozdhan from a specific location. Also found in Google Play, the application is supposedly designed to help users earn money, which suggests that the attackers may attempt to use it as means to monetize the device access.
Related: Tens of Thousands Download “AbstractEmu” Android Rooting Malware
Related: ‘Xenomorph’ Android Trojan Targets 56 Banking Applications
Related: Fake Netflix App Luring Android Users to Malware

More from Ionut Arghire
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- Apria Healthcare Notifying 2 Million People of Years-Old Data Breaches
- European Cybersecurity Firm Sekoia.io Raises $37.5 Million
- GitLab Security Update Patches Critical Vulnerability
- Android App With 50,000 Downloads in Google Play Turned Into Spyware via Update
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
