Skygofree is a mobile Hollywood spy.

[DronVR]

Skygofree is a mobile Hollywood spy.

Most trojans are similar to each other: sneaking onto devices, they steal the payment data of its owner, obtain cryptocurrency for attackers, or encrypt data to demand a ransom. But sometimes there are instances whose capabilities make you remember Hollywood films about spies.

One of these cinematic trojans was the recently discovered Android malware Skygofree (by the way, the Trojan is not related to the Sky Go service: the malware was named this way by the combination of letters in one of the domains it used).

It is full of different functions, including unique ones that we have not seen anywhere else.

• For example, he can track the location of a device and enable sound recording when the owner is near certain coordinates.

In practice, this means that attackers can begin to listen to the victim’s surroundings, say when she enters the office or visits a friend’s financial director.

• Another interesting technique that Skygofree has mastered is to quietly connect an infected smartphone or tablet to Wi-Fi networks, which are under the complete control of intruders.

Even if the owner of the device turned off Wi-Fi on the device at all. This allows you to collect and analyze victim traffic.

In other words, someone will know exactly what sites the victim visited and which logins, passwords and card numbers you entered.

• The malware has a couple of functions that make it easier to work in standby mode.

So, the latest version of Android can automatically stop inactive processes to save battery power, but Skygofree bypasses this by periodically sending notifications to the system. And on smartphones of one of the largest manufacturers, which, when the screen is turned off, stop all applications except selected ones, Skygofree adds itself to the list of these favorites.

• Also, the malware can monitor the work of popular applications like Facebook Messenger, Skype, Viber, WhatsApp.

Moreover, in the latter case, the developers were again savvy - the trojan reads correspondence on WhatsApp through “Accessibility Services”. This tool is for users with low vision or hearing, attackers can use to control an infected device. This is a kind of "digital eye" that reads what is displayed on the screen - in the case of Skygofree, it collects text messages from WhatsApp. Accessibility Services can be used only with the permission of the user, but the malware hides the request for this permission behind some other, seemingly harmless request.

Finally, Skygofree can secretly turn on the front camera and take a picture when the user unlocks the device, and one can only guess how the criminals will use these photos.
However, the authors of the innovative Trojan did not disdain banal functions either: Skygofree also knows how to intercept calls, SMS, calendar entries and other user data.

Personal spy instead of fast Internet.
They discovered Skygofree recently, at the end of 2017, however, judging by the results of the analysis, attackers have been using it since 2014 and are constantly improving it. In three years, it has grown from a simple malware to a multifunctional spy tool.

The malware is spread over the Internet using fake websites of mobile operators. On them, attackers offer to install Skygofree under the guise of an update that will increase the speed of mobile Internet access. If a visitor gets caught and downloads an infection, the trojan shows a notification about the allegedly started setup, hides from the user and requests further instructions from the command server. Depending on the answer, it can download a very different [DLMURL="https://securelist.ru/threats/payload-glossary/"] payload [/ DLMURL] - attackers provided solutions for almost all occasions.

​

Source: @departamentK ​