GoKawiilA new Android malware strain called Mantax Otax combines ransomware and spyware capabilities to encrypt files, steal sensitive data, and spam and harass victims.
Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, targeting users with phishing and social engineering messages.
After installation, the malware requests permission to use the Accessibility service, which gives it extensive control over compromised devices.
Next, it retrieves its command-and-control infrastructure (C2) domain from GitHub and sends back victim details such as location, carrier, Android version, and device ID. The C2 may send commands through Firebase or WebSockets for execution.
According to Zimperium, Indonesian operators distribute the malware through malicious APKs hosted outside Google Play, Android’s official app store, using phishing and social engineering messages to target victims.
Encrypting older Androids
According to mobile security company Zimperium, Mantax Otax encrypts devices running older Android versions. It searches shared storage and encrypts targeted file types using a victim-specific AES key obtained from the C2 server.
The malware then deletes the original files and adds the ‘.enc’ extension to the encrypted copies.
Mantax Otax also replaces local images with ransom notices and opens a full-screen Firebase-hosted chat to facilitate ransom payment negotiations.
Replacing users' images (left) with ransom notes (right)
... continue reading