Update (): We have investigated the domain and uncovered some interesting historical details. The choice of domains is likely not random, as it could indicate what the attackers might target next (the Google TeamSupport application is a business-to-business collaborative platform that is also surging during the COVID-19 isolation). The malware tries to download its main payload from a command-and-control infrastructure at tcp//:4444 While the user interface is identical with the original application, it comes with extra “functionality” that the user did not sign up for. This piece of malware has components injected in the repackaged Zoom application, as shown in figure 1 below. The samples documented in this article spread outside of the Google Play Store and exclusively target users who sideload applications on their Droids.Īnalyzed sample: 30a1a22dcf7fa0b62809f510a43829b1 It did not take long for cyber-criminals to re-package it, disseminate it on third-party markets and wait for new victims to install it. Zoom has been in the spotlight lately as one of the booming applications for video conferencing, despite its issues with end-to-end encryption and liberalized data sharing with Facebook.
It was just a matter of time until cyber-criminals started to trick users into installing tainted video-conferencing apps to capitalize on the expanded pool of users. Many have turned to video-conferencing software to keep businesses open, to attend classes or just to stay connected. Most of the world’s population has been under lockdown for more than two weeks, forced to work from the safety of their own homes.
0 kommentar(er)
