Looks like Remote Administration Trojan (RAT), threat named Cajino using Baidu Cloud Push, a new way to communicate with server, wasn't only on alternative Android markets. Trojan was found on official Google Play Store with more than 50.000 downloads for more than a month.
 |
| Cajino available on Google Play Store |
"Some samples, under a certain developer, were signed during November 2014, and were available in Google Play since December. The apps were available in the main market until late January, when Google removed them. It seems that some others were available from September until late January." - Eleven Paths
How it looks today?
After few days I published post on my blog, detection rate for this RAT wasn't as suspected, only 4 antivirus vendors detected it.
Hmm after few days detection rate is still poor for #Android #backdoor using #Baidu Cloud Push http://t.co/Hkoraqncbb pic.twitter.com/UUbgyt9TRX
— Lukas Stefanko (@LukasStefanko) March 20, 2015 These days detection of this threat is getting better.
Cajino is still available for unduh from alternative Android markets.
Application is still available to unduh from attackers webpage hxxp://guangzhouhan1.dothome.co.kr/music.apk.
Application is still available to unduh from attackers webpage hxxp://guangzhouhan1.dothome.co.kr/music.apk.
Credits for discovering Cajino Trojan on Google Play Store belongs to security researchers from Eleven Paths.
NEW MD5:
14885b84914651da4990586b36022900
eedc44e72023e75c024ff22e6423a4d6
5ba62baeda7264c83fe57e1b2b1f2533
3853b2b74c0f68bfb4ca5b080df9addd
eedc44e72023e75c024ff22e6423a4d6
5ba62baeda7264c83fe57e1b2b1f2533
3853b2b74c0f68bfb4ca5b080df9addd
Komentar
Posting Komentar