InfectedAds/AgentSmith RTD
How Lookout Detects and Protects Against Threats like ArmaSpy
Lookout Security Intelligence teams leverage both static and dynamic analysis with our machine learning engine to discover new threats. While ArmaSpy is a smaller and more targeted family, its unique heuristics and code structure are being analyzed against our data corpus of 170 million devices in order to get the most accurate understanding of the malware’s presence and evolution. Devices with Lookout installed have been protected against ArmaSpy since May 2019. Lookout also protects against other sophisticated malware that could normally go undetected.
Background and Discovery Timeline
In April 2019, Lookout researchers initially investigated InfectedAds (also known as AgentSmith), a family of applications that are able to infect programs installed on Android devices. This family can add its own components to a target Android Package (APK) without changing its digital signature. By doing so, it can install infected applications masked as an update to replace the original version of the application.
Infected versions of many applications such as HD Camera, Euro Farming Simulator, and others were found in 3rd party app stores and downloaded to thousands of devices.
Capabilities and Affected Parties
The infection process has three main stages. First, the victim installs a dropper app, which has a malicious Feng Shui Bundle encrypted in the asset folder. Then, the dropper decrypts and installs the core malware, which is later responsible for malicious patching and app updates. Finally, the main malware extracts the list of installed applications on the device. If they match with a pre-existing list, the malware will extract the base APK of the legitimate app and patch it with malicious ad modules. InfectedAds generates ads that can be used for financial gain by the attacker. However, the malware could easily be leveraged for much more dangerous activity such as stealing login credentials for banking, travel, or corporate apps because of its discreet nature.
Authors
Lookout
.png)
