Malware, Sharkbot Executing Unlawful Banking Transaction without Customer’s Knowledge Uncovered

A malware that uses Automatic Transfer Systems (ATS) to carry out unlawful banking transactions without the need for a live operator has been uncovered.


The malware, Sharkbot according to the National Information Technology Development Agency (NITDA) team at the CERRT.NG disclosed that the malware is designed to steal credentials and bank information from android devices.
NITDA said that the malware works by taking advantage of accessibility features and it has managed to evade Google Play Store’s security measures by using dropper apps.

A dropper app is a trojan program that carries malicious code with it, drop into a target device.

Sharkbot lures victims to enter their credentials in windows that mimic benign credential input forms.

And when the user enters credentials in these windows, the compromised data is sent to a malicious server.
Sharkbot also has the ability to send SMS messages, uninstall applications, send the device’s contact list to a command and control server, disable battery optimization so as to enable it run in the background, imitate the user’s actions (such as swipe over the screen, button presses, clicks and gestures), auto reply to notifications from Facebook Messenger and WhatsApp to distribute a phishing link which direct users to download dropper applications posing as antivirus apps, thus propagating the malware in a worm-like fashion.

Technical details reveals that the ATS characteristics allow the malware to get a list of events to replicate, which it then uses to make unauthorized transactions and install additional dangerous programs and carry out other malicious actions.

Sharkbot has several dropper applications that pose as antivirus apps to evade security barriers.

Some of the harmful applications that were discovered in Google PlayStore are Antivirus, Super Cleaner, Atom Clean-Booster, Antivirus, Alpha An, Powerful Cleaner Antivirus, and Center Security Antivirus.

According to NITDA, although these apps have been removed from the Google Play Store, Android device users are asked to be cautious and always make research on every app before downloading.

To further stay protected, ensure to carry out the following measures as immediately deleting such apps from device if already installed, install known antivirus and anti-malware apps on devices, run regular scans to detect threats and avoid downloading apps from unofficial marketplace or unknown sources.

Also avoid downloading attachments or open links from unknown sources.

Be the first to comment

Leave a Reply

Your email address will not be published.