Attackers try to sneak a Ztorg Trojan onto Google Play by wrapping it in another one
Kaspersky Lab experts have discovered Ztorg apps on the Google Play Store that appear to show cybercriminals trying different ways to get their malware past security – in this case by installing their malicious code in stages and wrapping a Trojan SMS around an encrypted rooting Trojan.
The attackers used the Trojan SMS to make money from victims through Premium-rate SMS while they waited to execute the rooting Trojan. The apps were downloaded more than 50,000 times since mid-May, 2017, but have now been removed from Google Play.
The determination of cybercriminals to infect Android devices with Ztorg malware through the Google Play Store shows no signs of slowing down, with attackers constantly adapting their tools and techniques to avoid discovery.
In May 2017, Kaspersky Lab researchers discovered what appeared to be a standalone Ztorg variant, a Trojan SMS. On closer inspection, it turned out to contain an encrypted Ztorg rooting Trojan. The Ztorg SMS was found in two apps, a browser and a “noise detection” application.
The browser app, which was downloaded 50,000 times, was uploaded to Google Play on 15 May, and never updated – possibly because it was a test run to see if the functionality worked.
The researchers were able to make a more detailed study of the “noise detection” app, uploaded on 20 May and installed more than 10,000 times before being deleted by Google. Their analysis suggests the cybercriminals’ ultimate aim was to execute a regular version of the Ztorg Trojan.
But since they had opted for a stage-by-stage approach involving a series of clean and then malicious updates, they added some supplementary malicious functionality to make money while they were waiting to run the rooting malware.
The Ztorg SMS functionality allows the app to send premium rate SMS, delete incoming SMS and switch off sound.
“The Ztorg Trojan continues to appear on the Google Play Store, accompanied by new tricks to bypass security and infect as many different Android devices and OS versions as possible. Even if a victim downloads what is clearly a clean app, there is no guarantee that it will still be clean in a few days’ time. Users, Google and security researchers need to remain vigilant at all times and to be proactive about protection,” said Roman Unuchek, Senior Malware Analyst, Kaspersky Lab.
Kaspersky Lab advises users to install a reliable security solution, such as Kaspersky Internet Security for Android, on their device, always check that apps have been created by a reputable developer, to keep their OS and application software up-to-date, and not to download anything that looks at all suspicious or whose source cannot be verified.
Pingback: d8xc45m78oe35rm739
Pingback: cxqw234xracrwcr4
Pingback: xdsffx4crta4rtxa34w
Pingback: uscojufm9r4tue4urtse4
Pingback: tư vấn định cư canada
Pingback: https://royalcbd.com/product/cbd-oil-2500mg/
Pingback: cbd products
Pingback: Reviews
Pingback: canada pharmacy canada pharmacy
Pingback: 메리트카지노 추천
Pingback: paydayloano.com
Pingback: 메리트카지노 주소
Pingback: kiosk mega888 login
Pingback: canada pharmacy online
Pingback: Roberto Badalotti
Pingback: real drivers license for sale
Pingback: phim sex online
Pingback: buy viagra illegally
Pingback: Ruko bsd
Pingback: các sàn forex uy tín
Pingback: Home Appliances
Pingback: casino club
Pingback: lace wigs
Pingback: color hair
Pingback: mega888 no deposit
Pingback: download mega888 download windows 10
Pingback: Pound of Weed
Pingback: c34r54wxw4r34c3
Pingback: digga d social media
Pingback: twitter header aesthetic
Pingback: same Day Courier uk
Pingback: joker123 apk 2020
Pingback: t-shirts
Pingback: phenq recensioni vere
Pingback: best cbd oil for dogs
Pingback: billing software
Pingback: شركة كشف تسربات المياه بالاحساء
Pingback: alexandrite june birthstone ring
Pingback: cbd oil for dogs
Pingback: buy instagram followers
Pingback: best cbd gummies for pain
Pingback: best cbd gummies for pain
Pingback: cbd for dogs
Pingback: cbd oil
Pingback: Julian Di Benedetto
Pingback: https://www.freitag.de/autoren/cmaier8/der-kleine-mann-im-aktienhandel
Pingback: JakeGeruson
Pingback: 강남안마
Pingback: 강남 안마
Pingback: 강남안마
Pingback: security of costs application
Pingback: parkerslegacy.com
Pingback: Aaron Lal
Pingback: air conditioning service livonia mi
Pingback: covent garden police
Pingback: porn
Pingback: Superslot
Pingback: invest in bitcoin
Pingback: kay jewelry
Pingback: Best Baby Products in India
Pingback: 인싸포커
Pingback: CREDIT CARD BANKING
Pingback: 코인카지노
Pingback: bernardsville nj payday loans online
Pingback: http://troykxlt816.almoheet-travel.com/why-we-love-dashi-and-you-should-too
Pingback: 바카라사이트
Pingback: delta 8 THC for sale
Pingback: Cialis
Pingback: click
Pingback: Intimacy
Pingback: Read More
Pingback: Click Here
Pingback: jfdbet.blogspot.com/p/online-live-casino-malaysia-play-live.html
Pingback: click
Pingback: click
Pingback: check it
Pingback: read here
Pingback: click
Pingback: Viagra
Pingback: click
Pingback: d bal
Pingback: https://onlymp3.net/
Pingback: leki na potencję
Pingback: สล็อต รับ เครดิต ฟรี
Pingback: become a credit card processor
Pingback: ISO merchant services
Pingback: takipçi satın al
Pingback: become a credit card processing company
Pingback: W88
Pingback: W88vnbet
Pingback: Next Dogecoin 1000X ECP
Pingback: W88
Pingback: Start a payment processing company
Pingback: it disposal
Pingback: it recycling
Pingback: متجر تطبيقات بلس
Pingback: satta matka
Pingback: slot online
Pingback: phim hiếp dâm
Pingback: Kamagra
Pingback: Gym
Pingback: period cup
Pingback: the new york times daily
Pingback: wireless outdoor security cameras
Pingback: corporate computer disposal
Pingback: free computer disposal
Pingback: best delta 8 THC vape cartridges
Pingback: w88
Pingback: links
Pingback: student debt
Pingback: dispensary near me
Pingback: trusted online casino malaysia 2021
Pingback: buy weed
Pingback: Vibro shaper
Pingback: 4 beds in one bunk bed
Pingback: floor of the car
Pingback: dyson
Pingback: CBD Candles
Pingback: Victor Metlege
Pingback: Michael Wisniewski CT
Pingback: TAXI TO GATWICK FROM BRIGHTON
Pingback: https://www.pinterest.com/AnthonyCharles9940/_created/
Pingback: delta-8 moon rocks
Pingback: organic growth instagram service
Pingback: Love spells that work
Pingback: لحب الشباب
Pingback: Cloud Reporting
Pingback: Pool Supply
Pingback: Bluetooth
Pingback: https://beegix.com/tags/underware
Pingback: Karikatur
Pingback: https://ad.beegix.com/search/hentai-fuck
Pingback: best adjustable beds
Pingback: vnw88
Pingback: перевод денег зная номер карты
Pingback: centerpoint energy esid lookup
Pingback: His Secret Obsession
Pingback: His Secret Obsession
Pingback: bet188
Pingback: fb8cup
Pingback: step by step noida
Pingback: school in central delhi for nursery admission
Pingback: jbo088
Pingback: top 10 Schools in East Delhi
Pingback: เว็บตรงสล็อต
Pingback: His Secret Obsession
Pingback: lynda bellingham movies and tv shows
Pingback: sbotop vietnam
Pingback: https://youtu.be/E5kEQJtkiQ8
Pingback: https://www.youtube.com/
Pingback: Victor Metlege
Pingback: classifieds
Pingback: Mesiti
Pingback: Sitapur - 261121
Pingback: Fence Company Miami
Pingback: Bartier Perry
Pingback: Dr Shaun Segal
Pingback: Mesiti
Pingback: Fence Company New Orleans
Pingback: New Orleans fence Company
Pingback: Fence Companies New Orleans
Pingback: d2r crypto
Pingback: Dentitox Pro Dropper
Pingback: weebly
Pingback: coco peat suppliers
Pingback: feet
Pingback: bimbim webcam
Pingback: xnzx
Pingback: Victor Metlege
Pingback: does Dentitox Pro really work
Pingback: mens silk boxer briefs
Pingback: https://youtu.be/RotY-Slcf3c
Pingback: pyjama en soie
Pingback: auction sites like ebay
Pingback: https://www.bartier.com.au/insights/articles/modern-slavery-reporting-the-clock-is-ticking/ or press release - https://www.bartier.com.au/insights/in-the-media/lack-of-clarity-may-hamper-aussie-companies-tackling-modern-slavery/
Pingback: Dentitox Pro Reviews: Supplement, Ingredient And How To Use!
Pingback: OG Whatsapp Anti Ban
Pingback: Pune call girl whatsapp group link
Pingback: brighton to uk city transfers cost
Pingback: java burn diet
Pingback: coco peat suppliers indonesia
Pingback: Pat Mesiti
Pingback: excavation contractors near me
Pingback: Vancouver Excavating contractors
Pingback: Vancouver Excavating company
Pingback: Excavating company near me
Pingback: Excavating companies Vancouver
Pingback: excavating contractors near me
Pingback: sàn forex
Pingback: email template builder
Pingback: d2r builds
Pingback: craigslist alternatives
Pingback: new product idea
Pingback: ebay alternative
Pingback: Bartier Perry
Pingback: Caleb Moss
Pingback: how to get a patent with InventHelp
Pingback: InventHelp email
Pingback: www.thepressworld.com/2021/07/01/%
Pingback: call girls in colaba
Pingback: Bartier Perry
Pingback: Pat Mesiti
Pingback: InventHelp TV Commercial
Pingback: 1000mg THC vape juice
Pingback: poşet imalatı
Pingback: https://bit.ly/3BEajjd
Pingback: battery recycling
Pingback: computer disposal service
Pingback: computer equipment recycling
Pingback: computer disposal service
Pingback: https://voyance-paris.best
Pingback: sudhir memorial institute doltala
Pingback: Bartier Perry
Pingback: christ knowledge city
Pingback: pages like craigslist
Pingback: vigora 100
Pingback: xxx
Pingback: xnxxx
Pingback: SQL Server 2017 Standard
Pingback: call girls in kandivali
Pingback: best seo services
Pingback: Microsoft Windows Server 2016
Pingback: Insurance
Pingback: websites like craigslist for cars
Pingback: casino
Pingback: Bartier Perry
Pingback: USA
Pingback: rait lms
Pingback: GMB Listing service
Pingback: horse racing picks
Pingback: Bitboy Crypto
Pingback: Application development
Pingback: Eclipse c++
Pingback: Steam Sterilizer
Pingback: witch
Pingback: 파워볼사이트
Pingback: HDCinemaPlus
Pingback: signal jamming device
Pingback: Cash app money generator
Pingback: Online Resume Maker
Pingback: NFT
Pingback: Escorts In Connaught Place
Pingback: Related Site
Pingback: baby fetal doppler
Pingback: learn more
Pingback: Best Short News website
Pingback: school admission
Pingback: taki house govt sponsored girls high school ward 36 kolkata municipality kolkata 700009
Pingback: eken babu
Pingback: Best CA Foundation English
Pingback: trådlös laddning
Pingback: tax advisor Frankfurt
Pingback: management team building events gauteng
Pingback: Russian Escorts In Delhi
Pingback: recycling it
Pingback: computers disposal company
Pingback: Office 365 Family 6PC/MAC
Pingback: missing person private investigators
Pingback: how to create an email account
Pingback: Bartier Perry
Pingback: Bartier Perry
Pingback: condonlotto.com
Pingback: Call Girls in Lahore
Pingback: spbo live macau
Pingback: next nft to explode 2022
Pingback: http://www.frankhamilton.org/
Pingback: gps blocker
Pingback: remote connect
Pingback: odsylam tutaj
Pingback: Ao tv sale
Pingback: testosteron jak brać
Pingback: 50 mcg ile to mg
Pingback: Microsoft Windows 10 Pro
Pingback: private investigator corporate investigation
Pingback: impozit loto
Pingback: เครดิต ฟรี
Pingback: สล็อต อียิปต์
Pingback: North American Bancard ISO
Pingback: exipure scam
Pingback: merchant services sales agents
Pingback: warehouses for rent
Pingback: how to become a credit card processing agent
Pingback: How to become a payment processor
Pingback: North American Bancard Agent Program
Pingback: get a high risk merchant account
Pingback: how to get a high risk merchant account
Pingback: merchant processing ISO program
Pingback: Nutrigenomics
Pingback: ISO agent Program
Pingback: best credit card processing agent programs
Pingback: missing person investigators
Pingback: how to sell credit card processing services
Pingback: North American Bancard Agent Program
Pingback: seo
Pingback: North American Bancard Agent Program
Pingback: weight loss advice
Pingback: Payment Processing Referral Program
Pingback: become a payment processor
Pingback: bitcoin merchant services
Pingback: North American Bancard Agent
Pingback: cryptocurrency merchant services
Pingback: online casino merchant account
Pingback: ISO payment gateway
Pingback: exipure review
Pingback: brighton airport taxi
Pingback: Goehner
Pingback: Become a Credit Card Processing Company
Pingback: amazon wrocław kontakt telefoniczny
Pingback: zatkane nasieniowody objawy
Pingback: ซื้อหวยออนไลน์
Pingback: exipure review
Pingback: exipure reviews
Pingback: workplace intelligence investigation
Pingback: child custody investigator Indianapolis
Pingback: workplace investigation
Pingback: exipure real reviews
Pingback: exipure review
Pingback: exipure customer reviews
Pingback: corporate intelligence
Pingback: North American Bancard ISO Program
Pingback: North American Bancard Agent Program
Pingback: 카지노사이트
Pingback: Selling Merchant Services
Pingback: How Does Fuel Injector Cleaner Work? - TRE Racing Engines
Pingback: Top 5 Best 10-gun Gun Safe & Cabinet Reviews
Pingback: 7 of the Best Badass Competition Subwoofers That Will Absolutely Destroy The SPL - TRE Racing Engines
Pingback: Best Watercolor Pencils - Jolly Mom
Pingback: Fall-Asleep-Fast-with-DARK-SCREEN
Pingback: Cổ phiếu thưởng là gì
Pingback: Women's Jewelry
Pingback: 출장마사지
Pingback: 非原创
Pingback: web software development
Pingback: مجلة تعليم الجمال
Pingback: trade forex
Pingback: zuegelfirmazuerich
Pingback: https://robloxsongidcodes.com/|https://robloxsongidcodes.com|http://robloxsongidcodes.com/|www.robloxsongidcodes.com|robloxsongidcodes.com|roblox song id codes|roblox music codes|roblox song ids|roblox song codes|roblox music id codes|roblox id|roblox mus
Pingback: london city airport to brighton taxi
Pingback: a2 painters
Pingback: Keysmart Australia
Pingback: Womply Payout
Pingback: NUC
Pingback: dark web links
Pingback: house painters Austin tx
Pingback: are gun safes airtight
Pingback: Ready Mix Indonesia
Pingback: mild depression
Pingback: Siddha
Pingback: slot joker
Pingback: iPhone Repair Coventry
Pingback: corporate investigations
Pingback: AKNANCE
Pingback: GST Registration Goregaon
Pingback: instagram video download
Pingback: natvisa
Pingback: Premium Sexpuppen
Pingback: wifi signal jammer
Pingback: black apps
Pingback: Wholesale Edge Vaping Products Uk
Pingback: cleaning company dubai
Pingback: hair loss
Pingback: cleaning services dubai
Pingback: utv parts
Pingback: see here
Pingback: band
Pingback: Fence companies near me
Pingback: Columbus fence company
Pingback: https://www.allaboutstem.co.uk/2020/04/home-school-learning-stem-steam-resources-collection-17/
Pingback: fence company minneapolis
Pingback: Fence company near me
Pingback: Las Vegas fence company
Pingback: does tea burn really work?
Pingback: Fence companies near me
Pingback: mixparlay slot404
Pingback: Salt Lake City fence company
Pingback: fence company Lubbock
Pingback: Concrete company Lincoln Park
Pingback: Concrete company Saint Louis
Pingback: https://krajowy.biz/wojna-w-ukrainie-czy-mozna-sie-zaciagnac-do-obcej-armii/
Pingback: Vancouver concrete company
Pingback: Concrete company near me
Pingback: india
Pingback: togel55
Pingback: daftar singapoker
Pingback: Interior painters near me
Pingback: Painting company detroit
Pingback: Concrete company Dallas
Pingback: Anchorage concrete company
Pingback: Painters honolulu
Pingback: Painting company Santa Rosa
Pingback: Painters Modesto
Pingback: Fargo painters
Pingback: the zebra login
Pingback: Flipkart coupons
Pingback: Boston painting company
Pingback: Painters Stamford
Pingback: corporate office number
Pingback: Interior painters near me
Pingback: tea burn reviews
Pingback: lunch places near me
Pingback: Joker123 APK
Pingback: https://hensleypattensblog.wordpress.com/2022/04/16/tips-to-find-best-patent-services-how-inventhelp-can-protect-your-invention/
Pingback: InventHelp caveman logo
Pingback: kliktoko
Pingback: Kampala International University
Pingback: Study MBBS in Philippines
Pingback: Free quote geico
Pingback: 카지노사이트
Pingback: https://jeremylassiter.blogspot.com/2022/07/top-8-tips-to-hire-patent-attorney.html
Pingback: can you sell an idea for an invention
Pingback: https://www.instapaper.com/read/1492960709
Pingback: http://byrnehirsch04.wikidot.com/blog:42
Pingback: https://www.diigo.com/user/daronsutler?query=hustlersdigest
Pingback: inverter with solar charger
Pingback: ambbet ทางเข้า
Pingback: dildo with torso
Pingback: fire cams
Pingback: real life cam
Pingback: robot sex doll
Pingback: longstocking
Pingback: jebakan tikus
Pingback: Commercial Decorators in Hertfordshire
Pingback: 메이저놀이터
Pingback: website design company
Pingback: agen777 slot
Pingback: click here
Pingback: Kshvid
Pingback: Vogue
Pingback: North American Bancard ISO Program
Pingback: Casinomaxi Giriş
Pingback: Kanken womens handbag India
Pingback: Dr Lisa Ramakrishnan
Pingback: custom bike pars
Pingback: Slot Siteleri
Pingback: water tap
Pingback: sarathi parivahan application status
Pingback: finesse perfumes
Pingback: melhores perfumes
Pingback: B2b markkinointi
Pingback: Windows Server 2012 Standard 64Bit
Pingback: classifieds
Pingback: 출장마사지
Pingback: 토닥이
Pingback: skyclinic
Pingback: webpage
Pingback: hack wordpress
Pingback: 강남 레깅스룸
Pingback: 가라오케 퍼펙트
Pingback: 출장 마사지
Pingback: 출장 마사지
Pingback: 길동출장
Pingback: 레깅스 룸
Pingback: marmite teapot
Pingback: encrypted messenger
Pingback: 6n7yj
Pingback: free classifieds
Pingback: 출장 마사지
Pingback: lcd screen sale
Pingback: 토닥이 퍼스트
Pingback: Tuofa CNC Machining
Pingback: 레깅스 룸
Pingback: nasal respiration
Pingback: gerenciamento da manutenção
Pingback: 출장 마사지
Pingback: Mobil Bahis
Pingback: 홍대토닥이
Pingback: best iso merchant program
Pingback: 일산토닥이
Pingback: MotoGP - Jorge Martin
Pingback: krajowy.biz
Pingback: اشتراك يوتيوب
Pingback: selling payment processing
Pingback: Nature meditation!Stress Relief Music
Pingback: gold ira leads