Riltok, a banking Trojan known for its activity on entities in Russia, appears to have been renewed and has now begun to spread to countries in Europe.
So far, the malware has been observed to have turned its attention to France at a rate of 4%, and even smaller rates in Italy, Ukraine, and the United Kingdom. However, its main target, accounting for 90% of its victims, remains Russia, Kaspersky in a blog post on June 25.
Riltok is distributed from infected devices via SMS, often disguised as apps for popular free advertising services in Russia. The victim initially receives an SMS containing a malicious link, which seemingly leads to a popular free advertising app.
The user is then prompted to download a “new version” of the application, which is actually the Trojan. In order to install said version, the victim must allow the installation of applications from unknown sources in the device settings.
Riltok asks the user for permission to use special features of the AccessibilityService and if the user ignores or rejects this request, it will continue to appear on the device screen indefinitely.
When the Trojan obtains the privileges it desires, it sets itself as the default SMS application before disappearing from the device's screen.
Once a device is infected, the malicious software actively communicates with the Command and Control servers and receives various commands.
According to reports from researchers examining the malware, it sends data about the device, including the IMEI, phone number, country, mobile carrier, phone model, root permission availability, operating system version, device contacts list, installed apps list, and incoming sms.
