The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.
Introduction:
Many threat actors tend to gravitate towards using some type of remote access trojan (RAT) in their campaigns. RATs are a type of malware that is designed to allow the attacker to have control over an infected device. RATs are a popular choice for hackers to use due to their many capabilities from reconnaissance and data exfiltration to long-term persistence. Throughout the last couple of months, a new Android banking trojan has been making headlines. This trojan, known as MMRat, has been seen targeting mobile users in Asia and has been linked to bank fraud.
Information about MMRat:
Currently, there is not much information available on the history of malware or who created the RAT, but the first sighting of this malware was in late June 2023. The name MMRat comes from the com.mm.user package that the malware uses for different activities. Some of the things that this package is capable of are capturing user input and screen content, as well as command and control (C2). In addition, as of right now, the targets of this malware are countries in Southeast Asia. This conclusion was made based on the languages detected on the phishing pages such as Indonesian, Vietnamese, Singaporean, and Filipino.
How is MMRat spread?
The primary method of infection for MMRat is through phishing. At this time, it is still unclear how these phishing links are spread, but it is safe to assume that email and forums might be two common ways that these links are distributed. Specifically, it is a network of phishing sites that duplicate the qualities of official app stores. In these fake app stores, MMRat disguises itself as an official government application or a dating application.
From beginning to end, this malware attack completes a 7-step process which begins with its installation. At the end of the process, it uninstalls itself after a successful fraudulent transaction has taken place. This RAT possesses the ability to collect vast amounts of device data and personal information. These two fields of data, along with stolen credentials that they could have captured through the MMRat or other means, could help assist them in committing banking fraud.
How to protect against MMRat:
Like many other types of malware and RATs, the best way to protect against MMRat is through proper phishing training. With proper training, you can help keep your organization and employees better protected against the constantly emerging threats in the cyber landscape. Other steps that can be taken to protect against MMRat include, not downloading apps from unofficial app stores, carefully reading app reviews, and in the case of this trojan especially, reading all of the permissions an application is requesting access to. Reading permissions for any application is never fun and seems pointless, but it is important to read these as they explain exactly what features need to be used for the application to function. It can be assumed that in many of the reported cases of MMRat, the consumer did not properly read the permissions, and thus allowed the hacker access to their system.
Conclusion:
Although there have not yet been any reports of MMRat being discovered in countries outside of Southeast Asia, it does not mean we should keep our guard down. This RAT has proven to be a problem in Asia where it has been connected with banking fraud. Its many functionalities make this RAT extremely dangerous. We must take the measures needed to be ready for if and when this strain of malware begins to spread outside of Asia.
The author of this blog works at www.perimeterwatch.com.
Sources:
https://thehackernews.com/2023/08/mmrat-android-trojan-executes-remote.html
https://www.trendmicro.com/en_us/research/23/h/mmrat-carries-out-bank-fraud-via-fake-app-stores.html
https://www.hackread.com/mmrat-android-trojan-fake-app-store-bank-fraud/
