UBEL Android Malware, an Upgraded Version of Oscorp

Oscorp is one of the first Android families to be identified in 2021. Malware researchers came across it in January, and they quickly dissected the payload to release full details about the threat's features and potential. However, it seems that the authors of the Oscorp implant have not been inactive – they seem to be back with a new piece of malware for Androids. The new threat, dubbed the UBEL Android Malware, packs even more features than its predecessor. It once again specializes in targeting customers of financial institutions by using a wide range of phishing pages, overlays, and other tricks to bypass two-factor authentication and other security measures.

The UBEL implant is being actively promoted on underground hacking forums. The authors of the threads advertise it as the 'UBEL ANDROID BANKING BOTNET,' and they are actively hiring affiliates. While details about the potential 'deals' are not present, it is likely that their customers will need to pay a fraction of the stolen funds to the criminals.

The UBEL Android Malware even has a demonstration video, which shows how the backend of the implant works. Once deployed, the UBEL Android Malware will ask the user to grant it permissions to use the Accessibility Services – a trick that just about any high-profile Android implant abuses. In addition to this, the malware will also:

• Spawn a system alert window, which prompts the user to grant the app permissions. These are not ordinary alerts, and they are difficult to close – users might feel forced to agree with everything in order to get rid of them.
• Record audio.
• Intercept, read, and send SMS messages.
• Install additional apps.
• Remove apps.
• Automatic startup.

The criminals are also abusing a relatively novel technique to communicate with their victims in real-time. Of course, they do not reveal their true identity – they may pose as bank officials in order to try to convince the user to perform specific actions. The malware allows the operators to insert window overlays when specific conditions are met (e.g., visiting the bank's site,) monitor the user's activity, simulate gestures and taps, and more.

Android banking Trojans and malware like this one are being released into the wild every few months. Cybercriminals are actively pursuing Android devices, because millions of users are relying on them to manage their funds and sensitive information. You should keep your Android tablet or smartphone secure by using a reputable antivirus application.