reverse engineering Archives

AppWizard

August 5, 2025

New Android Malware Poses as SBI Card and Axis Bank Apps to Steal Financial Data

McAfee’s Mobile Research Team has identified a malware campaign targeting Android users in India, specifically Hindi speakers. The malware disguises itself as legitimate financial applications from banks like SBI Card, Axis Bank, and IndusInd Bank. It is distributed through phishing websites that mimic official banking portals and uses authentic assets to appear credible. The malware has dual functionality: it exfiltrates personal and financial data and mines Monero cryptocurrency using the XMRig tool, activated remotely via Firebase Cloud Messaging (FCM). It masquerades as a Google Play update, prompting users to install it, which leads to data theft. Upon installation, the malware presents a fake Google Play interface and requests sensitive information, which is sent to a command-and-control server. After data submission, users see a misleading confirmation page. The malware employs a multi-stage dropper to evade detection, with remote activation capabilities that keep it dormant until triggered. Phishing sites promote the malicious APK through SMS, WhatsApp, or social media. McAfee has reported these threats to Google, resulting in the blocking of the associated FCM account. All variants are classified as high-risk, with infections primarily in India but some in other regions. Users are advised to download apps only from Google Play and to be cautious with unsolicited links. Indicators of Compromise (IOCs) include specific APKs for various credit cards and phishing site URLs related to the campaign.

Winsage

August 4, 2025

North Korea Hiding Malware Within JPEG Files to Attack Windows Systems Bypassing Detections

Security researchers at Genians Security Center discovered a new variant of the RoKRAT malware linked to the North Korean APT37 threat group. This malware uses steganography to hide malicious payloads within JPEG files, allowing it to evade traditional antivirus detection. It is typically distributed through malicious shortcut files within ZIP archives, often disguised as legitimate documents. The malware employs a two-stage encrypted shellcode injection method, utilizing PowerShell and batch scripts to execute its payloads in memory. It collects system information, documents, and screenshots, exfiltrating data via compromised cloud APIs. The command and control accounts associated with the malware are linked to Russian email services. Variants of RoKRAT have evolved to include different injection methods and reference specific PDB paths. Indicators of compromise include various MD5 hashes associated with the malware.

AppWizard

July 16, 2025

Konfety Android Malware Exploits ZIP Tricks to Masquerade as Legit Apps on Google Play

Security researchers from zLabs have identified a new version of the Konfety Android malware that uses advanced ZIP-level modifications to avoid detection and mimic legitimate apps on the Google Play Store. The malware employs an "evil-twin" strategy, distributing malicious versions with the same package names as harmless apps. It manipulates the APK's ZIP structure to disrupt reverse engineering tools, allowing it to evade analysis. The installation process on Android can handle these malformed packages without raising alarms. Konfety features a dynamic code loading mechanism, hiding a secondary Dalvik Executable (DEX) file that is decrypted at runtime, which contains malicious components. It integrates with the CaramelAds SDK for ad fraud, while disguising its activities through geofencing and icon concealment. The malware has been linked to previous campaigns and uses decoy applications on the Play Store for camouflage. Upon execution, it redirects users to fraudulent websites, leading to unwanted app installations and compromising user privacy. The threat actors behind Konfety continuously update their tactics to evade detection, highlighting the growing sophistication of Android malware. Users are advised to scrutinize app sources and monitor network activity to mitigate risks.

AppWizard

July 15, 2025

This Android malware poses as real apps to take you to dangerous sites and flood your phone with spam

A new variant of the Konfety malware targets high-end Android devices using sophisticated evasion techniques, including distorted APK files to avoid detection. This version disguises itself as legitimate applications, imitating popular apps on the Google Play Store. It employs an 'evil twin' tactic, emphasizing the need to download software only from trusted publishers and avoiding third-party APKs. The malware can redirect users to harmful websites, install unwanted software, and generate misleading notifications. It displays ads through the CaramelAds SDK and can exfiltrate sensitive data such as installed applications and network configurations. Konfety can conceal its app icon and name, using geofencing to alter behavior based on location, and employs an encrypted DEX file to hide services. To evade analysis, it manipulates APK files to appear encrypted, causing misleading prompts during inspection, and compresses critical files with BZIP, leading to parsing failures. Users are advised to avoid sideloading apps, ensure Google Play Protect is enabled, and consider installing a reputable antivirus to enhance security.

AppWizard

July 15, 2025

Konfety Android Malware on Google Play Uses ZIP Manipulation to Imitate Legitimate Apps

Zimperium’s zLabs security research team has identified a new variant of the Konfety Android malware, which employs advanced evasion techniques to bypass security analysis tools while executing fraudulent advertising operations globally. The Konfety malware family, first recognized during a mobile advertising fraud campaign in 2024, initially involved over 250 decoy applications on the Google Play Store and was responsible for 10 billion fraudulent ad requests daily. The malware uses sophisticated ZIP-level manipulation tactics to disrupt analysis tools, including misleading the General Purpose Flag within the APK’s ZIP structure to trigger password prompts and declaring an unsupported compression method in the AndroidManifest.xml file to crash analysis tools. Additionally, it utilizes dynamic code loading and obfuscation to hide malicious functionality, embedding executable code within encrypted assets and maintaining a benign appearance during installation. The malware has developed a command-and-control infrastructure that initiates contact through a sequence of network requests after user agreement acceptance. It also employs stealth techniques to conceal its application icon and name, complicating user identification and removal. Behavioral detection systems can identify malicious activity by monitoring application behavior patterns and network communications.

AppWizard

June 23, 2025

Mario Kart 64 Has Been Ported To PC

SpaghettiKart is a PC port of the classic game Mario Kart 64, developed by Harbour Masters. It requires users to provide their own ROM and does not use any original game code. The project is still in progress, with some features not fully implemented and a rare crash affecting a small number of users. The developers expressed gratitude to various contributors and communities that supported the project. SpaghettiKart is available for download for players interested in experiencing the game.

AppWizard

June 21, 2025

An unofficial PC port of Mario Kart 64 is now available for download

The NES emulator, 3dSen, was fully released today, and a fan-driven project called SpaghettiKart, a PC version of Mario Kart 64, has also been unveiled. SpaghettiKart is created through reverse engineering and features clean code without any lines from the original game, allowing for public sharing. It requires players to generate the O2R from their own ROMs and currently supports only the US version of Mario Kart 64. Compatibility with Mario Kart 64 HD is uncertain, and while future enhancements like Path Tracing effects and an HD Texture Pack are hoped for, they have not been confirmed. SpaghettiKart includes unique PC-only features such as a Track Editor, Custom Track Importer, Crystal Clear Audio, Harder CPUs, and Freecam. It is available for download with an installation guide.

AppWizard

June 20, 2025

GodFather Android Malware Uses On-Device Virtualization to Hijack Legitimate Banking Apps

Zimperium zLabs has identified a new version of the GodFather Android banking malware that uses on-device virtualization to infiltrate legitimate banking and cryptocurrency applications. This malware creates an isolated virtual environment on the victim's device, allowing attackers to observe and manipulate user interactions in real time. It employs a malicious host application with a virtualization framework that downloads and executes a copy of the targeted app, capturing credentials and sensitive information. GodFather targets nearly 500 applications globally, particularly focusing on Turkish financial institutions. It utilizes evasive tactics, including ZIP manipulation and obfuscation, to evade detection and installs its payload through a session-based dropper technique. The malware retains traditional overlay attacks and has extensive remote control capabilities, posing a significant threat to mobile security and user trust.

Winsage

May 31, 2025

New Malware Compromise Microsoft Windows Without PE Header

A new strain of malware has been operating undetected on Windows systems for several weeks, utilizing advanced evasion techniques that corrupt its Portable Executable (PE) headers to avoid detection. Security researchers discovered this malware embedded in the memory of a compromised system during an investigation, using a 33GB memory dump that revealed its presence in a dllhost.exe process with process ID 8200. The malware, classified as a Remote Access Trojan (RAT) by Fortinet, employs batch scripts and PowerShell commands for its attack and has capabilities for screenshot capture, remote server functionality, and system service manipulation. Its command and control infrastructure uses encrypted communications, complicating detection efforts. The malware's distinctive feature is the deliberate corruption of DOS and PE headers, which hinders reverse engineering and complicates the reconstruction of the executable from memory dumps. Researchers had to manually locate the malware’s entry point and resolve complex import tables for it to function in a controlled environment.

AppWizard

May 20, 2025

Preventing App-Based Threats on Android Devices

By 2025, the Android platform faces increasingly sophisticated app-based threats, including ransomware, fake apps, social engineering, and remote access attacks. Cybercriminals exploit Android's open architecture, prompting the need for advanced security measures. Android's security architecture includes: 1. Google Play Protect: Scans applications before installation using real-time machine learning to detect emerging malware and deceptive tactics. 2. Application Sandboxing: Isolates apps to prevent data access between them, utilizing Linux permissions and SELinux policies. 3. App Signing and Code Integrity: Requires cryptographic signatures for apps, complicating the introduction of rogue certificates and runtime modifications. Advanced protections include Runtime Application Self-Protection (RASP) for high-security apps, which monitors behavior in real time, and secure coding practices that encourage regular code reviews, strong authentication, and data encryption. User vigilance is crucial, emphasizing responsible downloading, limiting permissions, keeping software updated, enabling two-factor authentication, and being cautious with public Wi-Fi. Google continuously updates security measures, ensuring older devices receive new protections, while collaboration with the security community aids in identifying and countering emerging threats.