Russian users are attacked by a banking Trojan Asacub

[НСК-СБ]

10:08 / September 15, 2018
Russian users are attacked by a banking Trojan Asacub

Infection occurs if the owner of the smartphone in the settings allowed installation from unknown sources.

Since the end of August this year, a large-scale campaign has been observed in Russia to infect Android-smartphones of users with the Asacub mobile banking trojan. By given Kaspersky Lab's daily victims of the trojan are about 40 thousand users. The malware is spread by phishing SMS messages with the offer to see photos or MMS at the specified link. When you go to the appropriate site and click on the download button, malware is downloaded to the device.

As a rule, a trojan disguises itself as an application for working with MMS or popular free classified ads services. Infection is carried out if the owner of the smartphone in the settings allowed installation from unknown sources. Next, the malware will request administrator rights and access to the accessibility service.

Asacub can steal money from a bank card tied to a phone number by sending SMS messages to transfer funds to another account using a card or mobile phone number. The victim will not be able to check the balance through the mobile bank or change the settings, since Asacub does not allow opening the banking application on the device.

Among other things, a malware can send information about an infected device and a contact list to its operators, make calls to numbers specified by attackers, close applications (usually anti-virus programs and banking applications), read and send SMS messages, etc.

The largest number of infections was recorded in Russia (98%), the list of affected countries also included Ukraine, Turkey, Germany, Belarus, Poland, Armenia, Kazakhstan, the USA, etc.
Russian users are attacked by a banking Trojan Asacub