Mazar Bot actively targeting Android devices and wiping them

The admin privileges allow the threat actors to perform the following operations:

• Gain boot persistence to help survive device restarts
• Send and Read your SMS messages
• Make Calls to your contacts
• Read the phone’s state
• Plague phone’s control keys
• Infect your Chrome browser
• Change phone settings
• Force the phone into sleep mode
• Query the network status
• Access the Internet
• Wipe your device’s storage (the most critical capabilities of all)

The researchers at Heimdal Security observed that Mazar BOT is also able to download and install a legitimate TOR Android app on the infected device, even without the user’s interaction.

“In the next phase of the attack, the infection will unpack and run the TOR application, which will then be used to connect to the following server: http: // pc35hiptpcwqezgs [.] Onion.

After that, an automated SMS will be sent to the number 9876543210 (+98 is the country code for Iran) with the text message: “Thank you”. The catch is that this SMS also includes the device’s location data.” continues the post.

The mobile malware can use the Tor app to surf the Internet anonymously. The experts also noticed that Mazar BOT also installs an Android app called Polipo Proxy which acts as a local proxy for the user’s traffic. The Polipo Proxy could be used by attackers malware’s author to spy on victim’s Web traffic and carry out Man-in-the-Middle (MitM) attacks.

The experts believe that the Mazar BOT is operated by a Russian cyber criminal gang, it is curious that the malware cannot be installed on Android smartphones in Russia. The analysis of the source code of the malware revealed the presence of instructions on how to stop the malware installation process on phone configured with the Russian language.

Another clue that suggests the involvement of Russian bad actors is that the Mazar BOT is offered for sale on several Russian underground forums.

In order to protect mobile devices from this threat follow these simple suggestions:

1. Don’t click on links in SMS or MMS messages sent to your phone.
2. Go to Settings → Security → Disable the option “Allow installation of apps from sources other than the Play Store.”
3. Install and keep an up-to-date Anti-virus solution on your Android device.
4. Avoid unsecured Wi-Fi hotspots and keep your Wi-Fi turned OFF when not in use.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(Security Affairs – Apple iPhone, hacking)

[adrotate banner=”13″]

[adrotate banner=”5″]