This Trojan masquerades as Google Play to hide on your phone in plain sight

A new Trojan has been unmasked by researchers which pretends to be a Google service on infected Android devices. The malware, dubbed “GPlayed,” is a Trojan which labels itself “Google Play Marketplace” and uses a very similar icon to the standard Google Play app in order to dupe victims into believing the software is legitimate.

According to researchers from Cisco Talos, GPlayed is “extremely powerful” and its key strengths are flexibility and the ability to adapt after deployment. The Trojan contains a number of interesting built-in capabilities.

Written in .NET using the Xamarin mobile environment, GPlayed’s main .DLL is called Reznov, which, in turn, contains a root class called “eClient.” The malware has been given a modular infrastructure which is able to remotely load plugins installed in real-time or when the malware is compiled and packaged. “This means that the authors or the operators can add capabilities without the need to recompile and upgrade the Trojan package on the device,” Talos says.

The Trojan’s destructive capabilities are similar to other malware strains in the same class. GPlayed focuses on the theft of financial information alongside espionage and is able to harvest banking credentials, monitor device location, steal device data, log keys, and more.

Once an Android mobile device has been compromised, the Trojan will attempt to register the device with the malware’s command-and-control (C2) server. The malware will also exfiltrate private information at this point of the infection, including the handset’s model, IMEI, phone number, registered country, and the version of Android in use.

See also: Old banking Trojan TrickBot has been taught new tricks GPlayed will also register the SMS handler in order to forward on any future message content and information relating to the sender to the C2.

More security news

The final stage of registration involves the Trojan requesting additional permissions for the purpose of privilege escalation. GPlayed will not only request admin privileges but will also ask the user to allow the seemingly-legitimate app to access device settings.

The user can ignore these requests and close the window. However, the Trojan has an inbuilt timer which will continually bring the window back again, and again, until the user capitulates. Once installed, the Trojan will wait for a time before activating eClient and a subclass called “GoogleCC.” This opens a Google-themed web page on the device without user interaction which requests the user’s payment information in order to use Google services.

TechRepublic: Microsoft Office is more dangerous than you think: Docs deliver 45% of all malware The screen is locked until details are entered, checked, and confirmed as valid. A payment, configurable by the attacker, is also requested by the Trojan at this point of the attack.

If the victim enters their details, the information is whisked away to the C2 via HTTP. The stolen information is obfuscated through JSON and Base64 encoding. GPlayed is able to inject JavaScript to tamper with browser sessions and redirect users to malicious pages, and the malware is capable of compiling new .NET coding on the go for execution.

CNET: Cryptomining malware discovered masquerading as Flash updates Cisco Talos believes that the Trojan is in the final stages of testing. A number of strings and labels contain the word “test,” and the only sample available of GPlayed was uncovered in a public repository.

The Trojan has also been submitted to public antivirus detection platforms.

“Our analysis indicates that this trojan is in its testing stage but given its potential, every mobile user should be aware of GPlayed,” the researchers say. “Mobile developers have recently begun eschewing traditional app stores and instead want to deliver their software directly through their own means.

But GPlayed is an example of where this can go wrong, especially if a mobile user is not aware of how to distinguish a fake app versus a real one.”

Previous and related coverage

Google ChromecastStream a huge variety of content on your TV with Google Chromecast. This compact media streaming device plugs into the HDMI port on your TV, letting you access sport, movies, TV shows, games, music and more from your phone, tablet, laptop or Mac. With Chromecast you can use your phone as your remote. Simply tap the Cast button in your apps to start watching on the TV. Search, play, pause, and more, right from your phone. For apps that are not Cast-enabled, use your Android phone or tablet to display exactly what's on your screen to the TV. You can also mirror your laptop's Chrome browser to the TV. A vast world of choice includes over 200,000 TV shows and movies, 30 million songs, plus radio, sports, games, and more. There are also thousands of apps at chromecast.com/apps. Everything looks sharper now thanks to an enhanced video resolution and lower buffering. A sleeker design also makes it even easier to plug into crowded HDMI ports. Depth: 51.9 MM Height: 13.8 MM Width: 51.9 MM Wifi Enabled: Y Easily stream from your device to your TV Chromecast connects to your TV's HDMI port - and you can stream TV shows, movies, games, and more from your device to the TV. Chromecast is compatible with iPhone®, iPad®, Android smartphones and tablets, Mac® and Windows® laptops, and Chromebook. Unlimited entertainment - whenever you want - Apps, such as Netflix, YouTube, and Google Play give you access to TV shows, movies, songs, and more. Music by voice command - When you pair Chromecast with a Google Home device, streaming your favorite entertainment is easy with voice input - More Info - EAN: 0842776106445

Google ChromecastStream a huge variety of content on your TV with Google Chromecast. This compact media streaming device plugs into the HDMI port on your TV, letting you access sport, movies, TV shows, games, music and more from your phone, tablet, laptop or Mac. With Chromecast you can use your phone as your remote. Simply tap the Cast button in your apps to start watching on the TV. Search, play, pause, and more, right from your phone. For apps that are not Cast-enabled, use your Android phone or tablet to display exactly what's on your screen to the TV. You can also mirror your laptop's Chrome browser to the TV. A vast world of choice includes over 200,000 TV shows and movies, 30 million songs, plus radio, sports, games, and more. There are also thousands of apps at chromecast.com/apps. Everything looks sharper now thanks to an enhanced video resolution and lower buffering. A sleeker design also makes it even easier to plug into crowded HDMI ports. Depth: 51.9 MM Height: 13.8 MM Width: 51.9 MM Wifi Enabled: Y Easily stream from your device to your TV Chromecast connects to your TV's HDMI port - and you can stream TV shows, movies, games, and more from your device to the TV. Chromecast is compatible with iPhone®, iPad®, Android smartphones and tablets, Mac® and Windows® laptops, and Chromebook. Unlimited entertainment - whenever you want - Apps, such as Netflix, YouTube, and Google Play give you access to TV shows, movies, songs, and more. Music by voice command - When you pair Chromecast with a Google Home device, streaming your favorite entertainment is easy with voice input - More Info - EAN: 0842776106445

Bose On-Ear Wireless HeadphonesThese Bose On-Ear Wireless Headphones offer comfort, convenience and incredible sound. Bose  TriPort® technology  works with Active EQ to deliver sound that’s crisp and powerful, giving you the deepest lows and the clearest highs, all without a wire in sight! Lightweight and comfortable, these on-ear headphones come with cushioned ear cups that rest softly on your ears. They’re easy to use too, with voice prompts to talk you through Bluetooth pairing and provide status updates. You also can play or pause tracks, take calls and access Siri or Google Assistant™. The  noise-rejecting dual-microphone system makes it possible to hear calls clearly, even in windy or noisy environments. On a full charge, you can listen almost all day long for up to 15 hours ! A quick 15-minute charge gets you another couple hours of playback too. When not in use, these headphones fold smoothly into a compact case for easy storage.  Depth: 6 CM Height: 18 CM Width: 14 CM Blue Tooth: Y Dongle Required: N Wifi Enabled: N Noise-rejecting dual-microphone system allows clear phone calls, even in windy or noisy environments Play or pause tracks and access your phone’s Siri or your Google Assistant™ right from the headphones Wireless, lightweight and comfortable, with cushioned earcups that rest softly on your ears Up to 15 hours of play time off each charge powers you through an entire day Wireless, lightweight and comfortable, with cushioned earcups that rest softly on your ears Up to 15 hours of play time off each charge powers you through an entire day Crisp, powerful sound brings your music to life Folds smoothly in compact case - More Info - EAN: 017817770958

Bose On-Ear Wireless HeadphonesThese Bose On-Ear Wireless Headphones offer comfort, convenience and incredible sound. Bose  TriPort® technology  works with Active EQ to deliver sound that’s crisp and powerful, giving you the deepest lows and the clearest highs, all without a wire in sight! Lightweight and comfortable, these on-ear headphones come with cushioned ear cups that rest softly on your ears. They’re easy to use too, with voice prompts to talk you through Bluetooth pairing and provide status updates. You also can play or pause tracks, take calls and access Siri or Google Assistant™. The  noise-rejecting dual-microphone system makes it possible to hear calls clearly, even in windy or noisy environments. On a full charge, you can listen almost all day long for up to 15 hours ! A quick 15-minute charge gets you another couple hours of playback too. When not in use, these headphones fold smoothly into a compact case for easy storage.  Depth: 6 CM Height: 18 CM Width: 14 CM Blue Tooth: Y Dongle Required: N Wifi Enabled: N Noise-rejecting dual-microphone system allows clear phone calls, even in windy or noisy environments Play or pause tracks and access your phone’s Siri or your Google Assistant™ right from the headphones Wireless, lightweight and comfortable, with cushioned earcups that rest softly on your ears Up to 15 hours of play time off each charge powers you through an entire day Wireless, lightweight and comfortable, with cushioned earcups that rest softly on your ears Up to 15 hours of play time off each charge powers you through an entire day Crisp, powerful sound brings your music to life Folds smoothly in compact case - More Info - EAN: 017817770958

LG LAS750M 4.1Ch Surround Sound SoundbarLG LAS750M 4.1Ch Surround Sound Soundbar - More Info

You may also like...

       
Apps & Games Clothing Electronics & Photo Large Appliances
Baby Womens Apparel Garden Lighting
Beauty Mens Apparel Outdoors Luggage
Books Girls Apparel Health & Personal Care Pet Supplies
Car Boys Apparel Home Shoes & Bags
Motorbike Computers & Accessories Kitchen Equipment Sports & Outdoors
Fashion DIY & Tools Jewellery Toys & Games