GhostCtrl: Android appears to be the preferred target of viruses with new forms of malware capable of infecting more devices than are detected daily.
This time, security firm Trend Micro is warning about a new Android backdoor called GhostCtrl, which is a variant of the more famous OmniRAT that was discovered in late 2015 and affected a number of platforms including Windows, Linux, and Mac.
GhostCtrl infects Android devices and spreads as a standalone APK with names like App, MMS, WhatsApp or Pokemon GO. The malware has been discovered in three different versions, with the most advanced allowing the hacker to take full control of a device, including access rights and data transfer.
The malicious APK file asks for installation permission in a rather sneaky way. Even when the user cancels the “ask for install page” prompt, the message will still appear. The malicious APK file does not have an icon. Once it manages to install, a wrapper APK will launch a service that allows the malicious APK to run in the background.
The malware uses a service called com.android.engine which looks legitimate enough to the user that they won't think it's a scam. Once it infects a first device, GhostCtrl waits for commands by connecting to a C&C server on port 3176.
The infection allows the hacker to steal everything from the device including call logs, SMS files, contacts, phone numbers, SIM serial number, locations, and browser data. In addition, it can even steal camera data, and the worst part is that the hacker can start recording via the camera and then upload the content to the server, with all data encrypted in the process.
The virus creator can also send commands to the infected phone for more specific tasks such as resetting the password of a configured account or making the phone play different sound effects.
As with any malware, avoiding downloading APK files from untrusted sources is the main thing to do to stay safe.
