By Gagandeep Singh
21-Jan-2023
A report by ThreatFabric, an Android Malware by the name of ‘Hook’ is being sold by cybercriminals.
The attackers brag that the malware can remotely take control of smartphones in real time using Virtual Network Computing (VNC).
The creator of the malware claims that the new malware code was written from scratch; as per ThreatFabric substantial codes of the two Android malware overlay each other with 'Hook' having extra features.
The Feature that ‘Hook’ has over Ermac is WebSocket communication, in addition to the extensively used HTTP traffic of Ermac. The network used is still encrypted by a hardcoded key.
The main feature of the malware is the VNC allows attackers to communicate with the interface of the infected device in real time, enabling the malware to perform anything on the infected device, i.e., PII.
A File Manager command turns the malware into a file manager & the attackers get the record of all the files stored in the file manager and download the file of their liking.
The malware uses a Geolocation tracking mechanism help malware to get a hold of the victim's location by exploiting the ‘Access Fine Location’ permission.
The countries in which Hook targeted banking app users - the United States, Spain, Australia, & more. However, one important thing to note here is that Hook targets worldwide.