AbstractEmu is a very real threat

There's a nasty new strain of malware you need to be aware of that targets Android devices. Don't let the funny name fool you because AbstractEmu is a serious threat. Not only will it root an infected device, but it will allow the controller of the malware to take total control of the device. It will alter its settings and attempt to evade detection via a combination of anti-emulation checks and code abstraction.

The new strain was discovered by security researchers at Lookout Threat Labs. They discovered it bundled with a collection of legitimate utility apps distributed via the Google Play Store and other third-party app repositories.

Google has removed the malware from the Play Store at this point but not before several thousand people had already downloaded it. The malware remains available on a few different third-party repositories. If you're in the habit of picking up apps outside of the Play Store an extra measure of caution is prudent.

 

The team that discovered the new strain had this to say

"AbstractEmu does not have any sophisticated zero-click remote exploit functionality used in advanced APT-style threats, it is activated simply by the user having opened the app. As the malware is disguised as functional apps, most users will likely interact with them shortly after downloading.

By using the rooting process to gain privileged access to the Android operating system, the threat actor can silently grant themselves dangerous permissions or install additional malware -- steps that would normally require user interaction."

 

My perspective

Needless to say, the group behind AbstractEmu has some skill and some serious coding chops. Although the malware strain's removal from the Google Play Store has limited the rate of its spread you can bet the threat group will be on the lookout for other opportunities.

 

As Frank Barone would say: "Holy Crap"

 


By Denis Wilson

Cybersecurity Expert, Small Business Technology Consultant, Managed Services Provider, Managed IT Support

Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter

I am also a published author and speaker on cloud computing, work@home, and cybersecurity. I work extensively with business and professional associations to provide free small business technology education programs.

 

Contact me if you would like me to speak to your association