ThreatFabric හි පර්‍යේෂ්කයන් විසින් Android apps 226කට බලපාන Alien නම් නව Android Malware එකක් හඳුනාගෙන ඇත. මෙය මීට පෙර වාර්තා වූ Cerberus නම් Malware එක ආශ්‍රයෙන් නිමවූවකි. ThreatFabric පර්යේෂකයන්‍ට අනුව Cerberus නිර්මාපකයන් විසින් එහි කේතය නිකුත් කර ඇති අතර එය භාවිතා කරමින් Alien Malware එක නිමවා ඇත්තේ Google Play Protect මඟින් එය හදුනා නොගන්නා ආකාරයටය. නමුත් Alien Malware එක නිමවීමට භාවිතා කල Cerberus Malware එක Google Play Protect හරහා හඳුනා ගනී.

මෙම නව Alien Malware එක සතුව ඉතාමත් දරුණු ගණයේ හැකියාවන් පවතී. ThreatFabric පර්යේෂකයන්ට අනුව පහත දැක්වෙන හානිකර හැකියාවන් මෙම Malware එක සතුව පවතී

  • Keylogging
  • Remote access
  • SMS harvesting
    SMS listing, forwarding, sending
  • Device info collection
  • Contact list collection
  • Application listing
  • Location collection
  • Overlaying:
    Dynamic (Local injects obtained from C2)
    Targets list update
  • Calls
    USSD request making
    Call forwarding
  • Remote actions
    App installing, starting, removal
    Showing arbitrary web pages
    Screen-locking
  • Notifications
    Push notifications
  • C2 Resilience
    Auxiliary C2 list
  • Self-protection:
    Hiding the App icon
    Preventing removal
    Emulation-detection
  • Modular Architecture

මේ වන විට මෙම Malware එක ස්පාඤ්ඤය, තුර්කියම, ජර්මනිය, ඇමරිකා එක්සත් ජනපදය, ඉතාලිය, ප්‍රංශය, පෝලන්තය, ඕස්ට්‍රේලියාව, එක්සත් රාජධානිය සහ ඉන්දියාව යන රටවල විශාල වශයෙන් පැතිරෙමින් පවතී. TreatFabric මඟින් මේ වන විට නිකුත් කර ඇති වාර්තාවේ සඳහන් වන ආකාරයට පහත දැක්වෙන රටවල් 15 තුල වැඩි වශයෙන් මෙය වාර්තා වේ.

alien malware countries
Image: ThreatFabric

Alien Malware එකේ ප්‍රධාන ඉලක්කය වී ඇත්තේ බැංකුකරණ යෙදවුම්‍ වන අතර මේ වන විට ThreatFabric විසින් මෙහි බලපෑමට යටත් වූ Android යෙදවුම් 226ක් හඳුනාගෙන ඇති අතර Kotak – 811 & Mobile Banking, HDFC Bank MobileBanking, SBI Anywhere, සහ iMobile by ICICI Bank යනු ඒවා අතරින් කිහිපයක් වේ.

මෙහි ඇති භායනකම තත්වය වන්නේ මේ හරහා Google Authenticator App එකේ ඇති 2FA කේතය පවා මෙහි නිර්මාපකයන්ට ලබා ගැනීමේ හැකියාව පැවතීමයි. මෙම හැකියාව Cerberus Malware එක සතුවද පැවතුනි.

මේ වන විට ThreatFabric විසින් ප්‍රකාශයට පත් කර ඇති Android යෙදවුම් 226 පහත දැක්වේ.

Package name App name
com.coinbase.android Coinbase – Buy & Sell Bitcoin. Crypto Wallet
piuk.blockchain.android Blockchain Wallet. Bitcoin, Bitcoin Cash, Ethereum
com.bbva.bbvacontigo BBVA Spain
com.bankinter.launcher Bankinter Móvil
es.bancosantander.apps Santander
es.univia.unicajamovil UnicajaMovil
es.cm.android Bankia
es.evobanco.bancamovil EVO Banco móvil
com.kutxabank.android Kutxabank
com.rsi ruralvía
com.akbank.android.apps.akbank_direkt Akbank
com.garanti.cepsubesi Garanti BBVA Mobile
com.finansbank.mobile.cepsube QNB Finansbank Mobile Banking
com.connectivityapps.hotmail Connect for Hotmail & Outlook: Mail and Calendar
com.teb CEPTETEB
com.ykb.android Yapı Kredi Mobile
finansbank.enpara Enpara.com Cep Şubesi
com.tmobtech.halkbank Halkbank Mobil
com.kuveytturk.mobil Kuveyt Türk
com.ziraat.ziraatmobil Ziraat Mobile
com.pozitron.iscep İşCep - Mobile Banking
com.vakifbank.mobile VakıfBank Mobil Bankacılık
es.ibercaja.ibercajaapp Ibercaja
com.abnamro.nl.mobile.payments ABN AMRO Mobiel Bankieren
pl.pkobp.iko IKO
pl.mbank mBank PL
pe.com.interbank.mobilebanking Interbank APP
jp.co.rakuten_bank.rakutenbank 楽天銀行 -個人のお客様向けアプリ
com.sbi.sbifreedomplus -
it.copergmps.rt.pf.android.sp.bmps Banca MPS
com.google.android.gm Gmail
com.mail.mobile.android.mail mail.com mail
it.bnl.apps.banking BNL
it.ingdirect.app ING Italia
com.yahoo.mobile.client.android.mail Yahoo Mail – Organized Email
com.db.mm.norisbank norisbank App
com.db.pbc.miabanca La Mia Banca
eu.unicreditgroup.hvbapptan HVB Mobile Banking
de.commerzbanking.mobil Commerzbank Banking - The app at your side
de.fiducia.smartphone.android.banking.vr VR Banking Classic
de.postbank.finanzassistent Postbank Finanzassistent
com.targo_prod.bad TARGOBANK Mobile Banking
de.comdirect.android comdirect mobile App
de.dkb.portalapp DKB-Banking
com.starfinanz.smob.android.sfinanzstatus Sparkasse Ihre mobile Filiale
de.consorsbank Consorsbank
com.finanteq.finance.ca CA24 Mobile
com.boursorama.android.clients Boursorama Banque
com.caisseepargne.android.mobilebanking Banque
com.cm_prod.bad Crédit Mutuel
com.ingdirectandroid -
fr.lcl.android.customerarea Mes Comptes - LCL
fr.banquepopulaire.cyberplus Banque Populaire
fr.creditagricole.androidapp Ma Banque
mobi.societegenerale.mobile.lappli L'Appli Société Générale
au.com.nab.mobile NAB Mobile Banking
com.cibc.android.mobi CIBC Mobile Banking®
com.grppl.android.shell.cmblloydstsb73 -
com.grppl.android.shell.halifax Halifax: the banking app that gives you extra
org.stgeorge.bank St.George Mobile Banking
com.att.mywireless -
com.chase.sig.android Chase Mobile
com.clairmail.fth Fifth Third Mobile Banking
com.csam.icici.bank.imobile iMobile by ICICI Bank
com.unicredit Mobile Banking UniCredit
it.popso.scrignoapp -
com.microsoft.office.outlook Microsoft Outlook: Organize Your Email & Calendar
com.infonow.bofa Bank of America Mobile Banking
com.konylabs.capitalone Capital One® Mobile
com.suntrust.mobilebanking SunTrust Mobile App
com.usaa.mobile.android.usaa USAA Mobile
com.usbank.mobilebanking U.S. Bank - Inspired by customers
com.wf.wellsfargomobile Wells Fargo Mobile
com.bmo.mobile BMO Mobile Banking
it.nogood.container UBI Banca
com.rbc.mobile.android RBC Mobile
com.latuabancaperandroid Intesa Sanpaolo Mobile
com.ingbanktr.ingmobil ING Mobil
com.magiclick.odeabank Odeabank
posteitaliane.posteapp.apppostepay Postepay
tr.com.sekerbilisim.mbank ŞEKER MOBİL ŞUBE
com.commbank.netbank CommBank
com.android.vending Google Play
es.liberbank.cajasturapp Banca Digital Liberbank
www.ingdirect.nativeframe ING España. Banca Móvil
com.cajasur.android Cajasur
com.tecnocom.cajalaboral Banca Móvil Laboral Kutxa
com.db.pbc.mibanco Mi Banco db
net.inverline.bancosabadell.officelocator.android Banco Sabadell App. Your mobile bank
com.bbva.netcash BBVA Net Cash | ES & PT
es.bancosantander.empresas Santander Empresas
com.paypal.android.p2pmobile PayPal Mobile Cash: Send and Request Money Fast
pl.bzwbk.bzwbk24 Santander mobile
es.caixageral.caixageralapp Banco Caixa Geral España
alior.bankingapp.android Usługi Bankowe
eu.eleader.mobilebanking.pekao Pekao24Makler
eu.eleader.mobilebanking.pekao.firm PekaoBiznes24
com.facebook.katana Facebook
com.imaginbank.app imaginBank - Your mobile bank
com.whatsapp WhatsApp Messenger
com.snapchat.android Snapchat
com.twitter.android Twitter
org.telegram.messenger Telegram
com.instagram.android Instagram
com.viber.voip Viber Messenger - Messages, Group Chats & Calls
es.lacaixa.mobile.android.newwapicon CaixaBank
softax.pekao.powerpay PeoPay
com.ebay.mobile eBay: Buy, sell, and save money on home essentials
com.amazon.mshop.android.shopping -
com.getingroup.mobilebanking Getin Mobile
wit.android.bcpbankingapp.millenniumpl -
com.konylabs.cbplpat Citi Handlowy
es.caixagalicia.activamovil ABANCA- Banca Móvil
com.moneybookers.skrillpayments.neteller NETELLER - fast, secure and global money transfers
com.pcfinancial.mobile Simplii Financial
com.td TD Canada
cz.csob.smartbanking ČSOB Smartbanking
com.airbitz Bitcoin Wallet - Airbitz
clientapp.swiftcom.org ePayments: wallet & bank card
de.number26.android N26 — The Mobile Bank
au.com.ingdirect.android ING Australia Banking
com.payoneer.android Payoneer – Global Payments Platform for Businesses
com.cimbmalaysia CIMB Clicks Malaysia
eu.eleader.mobilebanking.invest plusbank24
com.moneybookers.skrillpayments Skrill - Fast, secure online payments
com.mycelium.wallet Mycelium Bitcoin Wallet
uk.co.santander.santanderuk -
com.aff.otpdirekt OTP SmartBank
com.kasikorn.retail.mbanking.wap K PLUS
com.krungsri.kma KMA
com.scb.phone SCB EASY
com.netflix.mediaclient Netflix
com.bendigobank.mobile Bendigo Bank
com.citibank.citibankmy -
com.konylabs.hongleongconnect -
org.banksa.bank BankSA Mobile Banking
org.bom.bank Bank of Melbourne Mobile Banking
at.volksbank.volksbankmobile Volksbank hausbanking
net.bnpparibas.mescomptes Mes Comptes BNP Paribas
com.ocito.cdn.activity.creditdunord Crédit du Nord pour Mobile
pl.bph BusinessPro Lite
pt.bancobpi.mobile.fiabilizacao BPI APP
pt.novobanco.nbapp NB smart app
pt.santandertotta.mobileparticulares Santander Particulares
com.bankofqueensland.boq BOQ Mobile
fr.laposte.lapostemobile La Poste - Services Postaux
com.cic_prod.bad CIC
com.fortuneo.android Fortuneo, mes comptes banque & bourse en ligne
nz.co.asb.asbmobile ASB Mobile Banking
pl.bzwbk.ibiznes24 iBiznes24 mobile
pl.millennium.corpapp -
net.garagecoders.e_llavescotiainfo ScotiaMóvil
com.credemmobile -
it.carige Carige Mobile
eu.inmite.prj.kb.mobilbank Mobilni Banka
jp.co.netbk 住信SBIネット銀行
au.com.cua.mb CUA Mobile Banking
com.advantage.raiffeisenbank -
com.bankaustria.android.olb Bank Austria MobileBanking
com.barclays.android.barclaysmobilebanking Barclays
com.bochk.com BOCHK
com.htsu.hsbcpersonalbanking HSBC Mobile Banking
com.anz.android.gomoney ANZ Australia
com.bankia.wallet Bankia Wallet
com.fusion.banking Bank Australia app
com.fusion.beyondbank Beyond Bank Australia
com.greater.greater -
com.bancsabadell.wallet Sabadell Wallet
es.bancosantander.wallet Santander Wallet
com.fullsix.android.labanquepostale.accountaccess La Banque Postale
com.cajamar.cajamar -
wit.android.bcpbankingapp.millennium -
enterprise.com.anz.shield ANZ Shield
com.fibabanka.mobile Fibabanka Corporate Mobile
com.mobileloft.alpha.droid myAlpha Mobile
mbanking.nbg -
com.eurobankefg -
es.bancopopular.nbmpopular Popular
ktbcs.netbank Krungthai NEXT
com.bbva.bbvawallet BBVA Wallet Spain. Mobile Payment
com.bancomer.mbanking BBVA México (Bancomer Móvil)
ar.com.santander.rio.mbanking Santander Argentina
com.mercadolibre Mercado Libre: compra fácil y rápido
es.santander.money Santander Money Plan
com.dhanlaxmi.dhansmart.mtc Dhanlaxmi Bank Mobile Banking
com.infrasofttech.centralbank -
com.infrasofttech.mahabank -
com.msf.kbank.mobile Kotak - 811 & Mobile Banking
com.sbi.sbanywherecorporate -
com.snapwork.hdfc HDFC Bank MobileBanking
com.samba.mb SambaMobile
eu.netinfo.colpatria.system Scotiabank Colpatria
com.todo1.mobile Bancolombia App Personas
org.westpac.bank Westpac Mobile Banking
au.com.suncorp.suncorpbank -
au.com.pnbank.android P&N BANKING APP
com.ing.mobile ING Bankieren
com.tfkb Türkiye Finans Mobile Branch
finansbank.enpara.sirketim Enpara.com Şirketim Cep Şubesi
com.google.android.play.games Google Play Games
com.icomvision.bsc.tbc TBC Bank
com.citi.citimobile Citi Mobile®
com.tdbank TD Bank (US)
com.unionbank.ecommerce.mobile.android Union Bank Mobile Banking
com.comarch.security.mobilebanking ING Business
de.sdvrz.ihb.mobile.secureapp.sparda.produktion SpardaSecureApp
au.com.bankwest.mobile Bankwest
com.hsbc.hsbcnet HSBCnet Mobile
com.nearform.ptsb permanent tsb
org.banking.bom.businessconnect Bank of Melbourne Business App
org.banking.bsa.businessconnect BankSA Business App
org.banking.stg.businessconnect St.George Business App
org.westpac.col Westpac Corporate Mobile
ca.bnc.android National Bank of Canada
ca.servus.mbanking Servus Mobile Banking
co.bitx.android.wallet Luno: Buy Bitcoin, Ethereum and Cryptocurrency
com.acceltree.mtc.screens Alawwal Mobile
enbd.mobilebanking Emirates NBD
lt.spectrofinance.spectrocoin.android.wallet Bitcoin Wallet by SpectroCoin
com.skype.raider Skype - free IM & video calls
com.barclaycardus Barclays US
com.grppl.android.shell.bos -
com.rbs.mobile.android.natwest NatWest Mobile Banking
com.rbs.mobile.android.rbs Royal Bank of Scotland Mobile Banking
tsb.mobilebanking TSB Bank Mobile Banking
net.inverline.bancosabadell.officelocator.activobank ActivoBank

As always, the easiest way you can stay safe from such malware attacks is to not install apps from unknown sources. As an extra measure, it is recommended to keep the option to install apps from external sources disabled in your phone’s settings.

මේ වන විට ඉන්දියාව මෙම Malware එකේ වැඩිම බලපෑමට ලක් වූ රටවල් 10 අතර සිටින අතර ශ්‍රී ලංකාවද මෙහි බලපෑමට ලක්වීමට බොහෝ සෙයින් ඉඩකඩ ඇත. එබැවින් ඔබගේ දුරකථනයේ මේ වන විට install apps from external sources නම් option එක ක්‍රියා විරහිත කර Google Play හරහා පමණක් අදාල යෙදවුම් ස්ථාපනය කරගන්නා මෙන් Android වැඩකාරයෝ අපි නිර්දේශ කර සිටින අතර මෙවැනි Malware වල බලපෑම් වලින් වැලකී සිටින ආකාරය පිළිබඳ මීට පෙර අප විසින් ගෙන ආ ලිපිය කියවීමෙන් ඔබට තවත් ආරක්ෂිත ක්‍රියාමාර්ග ගත හැක.

Source: ThreatFabric