Trend Micro Detects Botnet That Can Attack Android Systems

This content has been archived. It may no longer be relevant.

The Botnet that can mine cryptocurrencies has been found recently; it is exploiting the Debug Bridge of Android. Botnet arrives via ADB ports and spreads through SSH. The attack is similar to the Satori Botnet variant that takes the benefit of the exposed ADB port. The botnet is designed to spread infection from host to various other systems that were earlier associated with the host through SSH. SSH connects an extensive range of devices mainly through the internet and makes the device susceptible.

It is found that the Android devices that make use of ADB are more suspectable to malware attacks. The Botnet is planned to regulate the flaws in the installed apps in the majority of the Android mobiles and Tablets.

The Botnet is live mostly in a nation like South Korea and 21 others and is found by Trend Micro. The attack starts after the attacked system’s directory gets changed by command Shell of ADB to “/data/local/tmp.” The reason behind this is the .tmp files do not need permission to execute as by default it is set like that. The malware infection takes place through another mechanism that utilizes SSH. Any system that was previously connected to the first victim gets recognized as a known machine and starts communicating with each other without any need for authentication. The presence of SSH connection means malware can use it abusively.

The first victim acquires all the known machines from IPv4 address and installs the same miner as done on the first victim machine. The spreaders send the malware to attack another device whoever contacts the first machine.

As soon as the botnet understands the system it entered is a honeypot, it makes use of the wget command to get the payload of three separate miners. The malware exploits the prey depending on the hardware, structural design, CPU type, and manufacturer of the system. It is also found that the script used by the malware enhances the memory of the host by using the HugePages. It mainly increases the mining output.

In a previous couple of years, there is an unceasing upsurge in the malicious attacks to the innocent crypto user’s system to exploit them. Trend Micro reported another Botnet case last year which they named as Satoshi Variant.