General News

Tricky HijackRAT Malware Uninstalls 8 Korean Mobile Bank Apps

The mobile world will continue to witness attack from unscrupulous malware developers. 

This time, it’s  Android HijackRAT malware which has fake utilities capable of replacing original mobile banking apps. This new attack imitates “Google Service Framework.”

Internet security researchers, Jinjian Zhai and Jimmy Su of FireEye call it the most advanced threat to mobile bank application.
Two Decades of Malware
Infographic source:

“We found the hacker has designed a framework to conduct bank hijacking…Right now, eight Korean banks are recognised by the attacker, yet the hacker can quickly expand to new banks with just 30 minutes of work.”
The Fake “Google Service Framework” icon in the home screen. Source: FireEye
What is HijackRAT?

HijackRAT is the newest malware attack on android operating system which pretends to be “Google Service Framework” thereby taking over the entire operating system to carry out a combination of dubious tricks on mobile banking applications.
This Android most advanced malware is a mobile bank app Trojan that suppresses any security wall built around Android in order to execute the master plan of its developers. 
In a cyber world, RAT stands for Remote Access Tool which gives someone permission to connect to your device in order to take total control over it.

It is also called Remote Access Trojan in hacking which is considered as one of the most dangerous virus which has the strength to basically carry out any task on your device.

Interestingly, when used as noun, rat means “a despicable person who has been deceitful or disloyal. This must have been the origin of the word into computer term.
What is Google Service Framework?

Let’s break this down into two:

  1. Google Service 
  2. Framework

An Application Framework is designed to lower the general issues faced during the development of applications. It is a template needed to build an application which are used in the graphical user interface (GUI), and other web-based applications.
The above component is what Google uses for a core functionality of its services like synchronized contacts, access to the latest user privacy settings, and higher quality, lower-powered location based services aimed at tracking data in order to monitor the effectiveness of its applications for a better user experience.
So, you’re right if you say Google Service Framework is the heartbeat of Android applications. All Google apps and a number of third party apps need this framework to work well.
Who developed HijackRAT?

The actual developer is not known, but IP addresses in the report say it emanated from Korea. The server IP is said to be, which the net researchers said it’s located in Hong Kong.
“Although the IP addresses we have captured don’t reveal who the attacker is, as the computer of the IP might be a victim as well,”FireEye report says.
However, it’s discovered that the malware developer and the victims are both Korean speakers. Already, South Korea has pointed accusing fingers at its neigbour.
Mode of Penetration 
First, it pretends to be a “Google Service Framework”, then kills an anti-virus application and takes other malicious actions. Any malware that has the power to kill anti-virus can conveniently execute any other dubious actions on any operating system.
HijackRAT was able to do this because it’s designed to look like “Google Service Framework”, one of the most powerful features the company uses for its operating system.
How Android HijackRAT works

FireEye explaines:
“A few seconds after the malicious app is installed, the Google Services” icon is clicked, the app asks for administrative privilege. Once activated, the uninstallation option is disabled and a new service named “GS” is started. The icon will show “App isn’t installed” when the user tries to click it again and removes itself from the home screen.”

The structure of the HijackRAT malware. Source: FireEye

New Threat to Mobile Banking: A sales pitch or sincere findings?

The research was carried out by Fireeye whose main job is conducting research on the next generation of cyber attacks, and how to stay protected.
Though, we’ve discovered in the past how security apps developers either raised false alarm, or sales-pitch findings about malware.
So, you want to know where this one belongs.
Hacking in Korea

In May 3, 2011, a North Korean defector,Jang Se-yul (a graduate of Mirim University), told Chosun Newspaper that hacking classes were taught by 25 Russian professors from the Frunze Military Academy. Mirim University now Pyongyang Automation University is one of the institutions that trains hackers in electronic warfare tactics.
The result of the research shows that eight South Korean banks have been targeted, particularly Android users. And the banks that are mentioned to have been affected have not refuted it.

Since this security breach report was published on July 1, 2014, military sources from South Korea have accused North Korea of doubling the number of government hackers it employed.

North Korea was alleged to have 5,900 tactical professionals in Pyongyang’s hacking unit, up from 3,000 in 2012. This number is said to put the country on the number one ladder of owners of cyber hackers. Other spy-ranking countries will never come out openly to tell the world the number of hackers under their umbrella, though.
Based on the hacking and counter-hacking as a result of diplomatic tensions between Pyongyang and Seoul, the fireeye discovery is a sincere research to put security experts around the world on their toes.

If it happened to South Korea, any other country may as well be a target.

10 Bad Strengths of HijackRAT Malware

  1. It cunningly looks like “Google Service Framework”, but it not related or has any affiliation to Google Play Store. 
  2. It takes over the remote access tool (RAT) to perform its tasks. 
  3. It steals private data on Android device. 
  4. It gains access to banking credentials after crashing the installed anti-virus software. 
  5. It steals SMS and can send SMS. 
  6. It hijacks contact lists. 
  7. It initiates malicious app updates because it usurps the real service framework which is passage for this kind of action to be successfully executed. 
  8. It scans for banking apps installed on the phone. 
  9. It can also replace original and real banking applications with fake ones with utilities similar to the original bank apps. 
  10. It disables any mobile security app installed on a compromised device.

According to the FireEye Researchers, “we’ve seen android malware that execute privacy leakage, banking credential theft, or remote access separately, but this sample takes android malware to a new level by combining all of those activities into one app.”
Who and what are the targets?

Android operating system users are the current target.
HijackRAT Malware Versus Google’s Market Security Bouncer?

Yes, it is. It has been able to copy exactly the functionality of service framework in the Android operating system.
Bouncer is an Android protective measure introduced by Google aimed at providing automatic scanning of android market for potentially malicious software without disrupting the user experience.
On February 2, 2012, VP of Engineering, Android, Hiroshi Lockheimer explains how Android Market Security Bouncer works:
“Once an application is uploaded, the service immediately starts analyzing it for known malware, spyware and Trojans. It also looks for behaviour that indicates an application might be misbehaving, and compares it against previously analyzed apps to detect possible red flags. We actually run every application on Google’s cloud infrastructure and stimulate how it will run on an android device to look for hidden, malicious behaviour. We also analyze new developer accounts to help prevent malicious and repeat-offending developers from coming back.”
How to Avoid Malware

The invention of different malwares has shown that no security approach is foolproof. That’s why you need to consider mobile banking security best practices whenever you’re online.

Since the official release of the bank security threat report on July 1, we’re yet to see any preventive measures against Android HijackRAT Malware.
However, the National Fraud Intelligence Bureau (NFIB)advises mobile users on all platforms to take precautions before downloading any app.
And the easiest ways to be a victim of mobile malware are:
  • If you always visit and download files and other materials from suspicious websites, you may soon be a victim. 
  • If your choice of downloads is third-party android stores, you may be opening your device for malware intrusion.

Juniper Networks once said, “Third party market places have become a favoured distribution channel for malware writers. Third-party application stores are the leading source of the most common type of android malware, fake installers, which pose as legitimate applications.”

  • Even if you’re downloading from Google Play Store and you failed to carefully read the permissions of any programme before installing, an app might have followed the guidelines of Google, but could still be requesting to gain access to your privacy in unusual ways. 
  • You discovered that your device is malware-infected and continue to use it without taking security measures like formatting it, or reporting suspicious activities in your account to your bank; you’re a victim in the waiting.
  • If you jettisoned Android upgrade to the latest version, it means you might be carrying the former security loopholes around.
There have been several security breaches in android operating system. Whenever there’s one, Google would fix. In 2013 a fake BBM app for Androidfound its way into the Google Play store, and before it was removed from the store, it has secured more 100, 000 downloads. That’s why it’s advisable to always update your Android operating system.
  • If you don’t care about installing a trust worthy anti-virus app on your device, it means your device is a free for all. Some of the features of some of the anti-virus include anti-theft protection, safer web browsing, device tracking, remote wiping, and information about which app has access to your information.
However, you should know that there is no absolute privacy on the web-if your browser isn’t monitoring you, the anti-virus provider is doing so.

But the bottom line is: it’s safer being in the hands of your browser and a thrust-worthy anti-virus provider than cybercriminal that can wipe off your entire account within seconds.


About the author



Click here to post a comment

Your email address will not be published. Required fields are marked *

  • Thanks for this info. This is to let security experts know that much still need to be done in order to safeguard the mobile app world,and mobile banking.

    Malware developers are always at work.