{"id":11368,"date":"2016-02-22T10:00:26","date_gmt":"2016-02-22T15:00:26","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=11368"},"modified":"2017-09-24T08:09:02","modified_gmt":"2017-09-24T12:09:02","slug":"acecard-android-trojan","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/acecard-android-trojan\/11368\/","title":{"rendered":"Android trump card: Acecard"},"content":{"rendered":"<p>It seems that there is now a typical scenario for malware evolution. First cybercriminals release a skeleton with basic functions \u2014 that piece of malware behaves quietly, showing almost no malicious activity. Usually it comes in sight of several anti-virus companies shortly after it\u2019s release, but the researchers treat it like yet another piece of potentially malicious code: nothing of particular interest.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022923\/acecard-banking-trojan-FB.jpg\"><img decoding=\"async\" class=\"aligncenter wp-image-11370 size-full\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022923\/acecard-banking-trojan-FB.jpg\" alt=\"Acecard - the most dangerous Android banking trojan\" width=\"1280\" height=\"1280\"><\/a><\/p>\n<p>After some time the trojan (yes, it\u2019s usually a trojan) gets additional functionallity and becomes capable of doing way more harm than the first version potentially could. During the third step, the massive attack campaign begins: thousands of devices get infected and then the trojan does it\u2019s dirty job. The amount of damage dealt depends on the type of the trojan \u2014 it can turn out to be either <a href=\"https:\/\/www.kaspersky.com\/blog\/ransomware-10-tips\/10673\/\" target=\"_blank\" rel=\"noopener nofollow\">ransomware<\/a> asking for up to several hundred dollars, or a banking trojan stealing whatever it can get from your credit cards, spying tool on you, etc.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022915\/acecard-timeline-en.png\"><img decoding=\"async\" class=\"aligncenter wp-image-11375 size-full\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022915\/acecard-timeline-en.png\" alt=\"Acecard Android banking trojan development timeline\" width=\"1280\" height=\"800\"><\/a><\/p>\n<p>For example, this was the exact scenario for <a href=\"https:\/\/www.kaspersky.com\/blog\/asacub-trojan\/11108\/\" target=\"_blank\" rel=\"noopener nofollow\">Asacub<\/a>, which had first emerged as a rather simple phishing program and then turned into a banker with capabilities that of a heavy weapon. And now Acecard has followed a similar path. This malware seems to be even more serious bad news than Asacub.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">Evolution of <a href=\"https:\/\/twitter.com\/hashtag\/Asacub?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#Asacub<\/a> trojan: from small fish to ultimate weapon \u2013 <a href=\"https:\/\/t.co\/lLv0pY4lol\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/lLv0pY4lol<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/infosec?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#infosec<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/mobile?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#mobile<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/banking?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#banking<\/a> <a href=\"https:\/\/t.co\/gAM3zzy7aC\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/gAM3zzy7aC<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/689836995196129281?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">January 20, 2016<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Acecard is an Android banking trojan family consisting of several modifications of the same trojan. As with most of banking trojans, it performs by overlaying mobile banking applications with it\u2019s own phishing forms that the unsuspecting user would be eager to fill in with their credit card data. Once a user presses \u2018Submit\u2019 (or a similar action) \u2014 the data is stolen, and the malefactors either forward the money from the card to their phony accounts or sell the data to a third party.<\/p>\n<p>Acecard stands out from the crowd for two main reasons. First of all, common banking trojans are usually capable of overlaying no more than a few mobile banking apps, while Acecard is familiar with about 30 different banks and payment systems. Acecard can also receive a command from the command-and-control server to overlay ANY application, so the amount of attacked apps may be even higher.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">~2M attempts to steal money via online access to bank accounts in 2015 <a href=\"https:\/\/twitter.com\/hashtag\/KLReport?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#KLReport<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/banking?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#banking<\/a> <a href=\"https:\/\/t.co\/dEGpO9RNV0\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/dEGpO9RNV0<\/a> <a href=\"https:\/\/t.co\/igmson8TOb\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/igmson8TOb<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/676767500848267264?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">December 15, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>Second, it does not limit itself with only banking apps. Acecard can be also used for phishing in mobile social networking apps (Facebook, Twitter, Instagram), instant messengers (WhatsApp, Viber, Skype), and, more interestingly, the PayPal app and the Gmail client. It also is up to overlaying Google Play Store and Google Play Music with phishing windows.<\/p>\n<div id=\"attachment_11374\" style=\"width: 1290px\" class=\"wp-caption aligncenter\"><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022916\/acecard-overlays.jpg\"><img decoding=\"async\" aria-describedby=\"caption-attachment-11374\" class=\"wp-image-11374 size-full\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022916\/acecard-overlays.jpg\" alt=\"Acecard trojan phishing overlays\" width=\"1280\" height=\"1280\"><\/a><p id=\"caption-attachment-11374\" class=\"wp-caption-text\">Acecard trojan has dozens of fake \u2018faces\u2019<\/p><\/div>\n<p>Acecard is distributed not by the usual email spam but by disguising as something potentially useful; for example, pretending to be the Adobe Flash. Here we\u2019d rather remind you that Flash for Android was discontinued back in 2012, so there is NO genuine Flash Player for Android nowadays. But that\u2019s not the only distribution channel \u2014 our researchers have found a trojan that downloads Acecard in Google Play Store.<\/p>\n<blockquote class=\"twitter-tweet\" data-width=\"500\" data-dnt=\"true\">\n<p lang=\"en\" dir=\"ltr\">How to protect your money from online fraud \u2013 <a href=\"https:\/\/t.co\/LRBlkaC1V0\" target=\"_blank\" rel=\"noopener nofollow\">https:\/\/t.co\/LRBlkaC1V0<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/banking?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#banking<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/onlineshopping?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#onlineshopping<\/a> <a href=\"https:\/\/twitter.com\/hashtag\/ecommerce?src=hash&amp;ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">#ecommerce<\/a> <a href=\"https:\/\/t.co\/rqrqgXkDGK\" target=\"_blank\" rel=\"noopener nofollow\">pic.twitter.com\/rqrqgXkDGK<\/a><\/p>\n<p>\u2014 Kaspersky (@kaspersky) <a href=\"https:\/\/twitter.com\/kaspersky\/status\/676414920372670464?ref_src=twsrc%5Etfw\" target=\"_blank\" rel=\"noopener nofollow\">December 14, 2015<\/a><\/p><\/blockquote>\n<p><script async src=\"https:\/\/platform.twitter.com\/widgets.js\" charset=\"utf-8\"><\/script><\/p>\n<p>For the first time Acecard was detected in February 2014 \u2014 and back then, as we have mentioned before, it was showing no malicious activity. It took the cybercriminals about a year and a half to tune Acecard into real threat, adding new functions from one version to the next. Our experts have detected more then 10 different versions of this malware, each new build gaining more and more malicious abilities. The modern versions are so powerful, that Roman Unuchek, Senior Malware Analyst at Kaspersky Lab <a href=\"https:\/\/securelist.com\/blog\/research\/73777\/the-evolution-of-acecard\/\" target=\"_blank\" rel=\"noopener\">called<\/a> Acecard <em>\u2018one of the most dangerous threats to users today\u2019<\/em>.<\/p>\n<p>And then, in May 2015, the attacks began. During the time interval from May to September 2015 more than 6,000 users were attacked. Acecard is single-handedly responsible for a massive increase in the number of banking cyberattacks in Australia, it\u2019s other victims primarily reside in Russia, Germany, Austria and France. Meanwhile, the cybercriminals behind Acecard most likely are Russian-speaking.<\/p>\n<p><a href=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022919\/acecard-map-en.png\"><img decoding=\"async\" class=\"aligncenter wp-image-11373 size-full\" src=\"https:\/\/media.kasperskydaily.com\/wp-content\/uploads\/sites\/92\/2016\/02\/06022919\/acecard-map-en.png\" alt=\"Acecard Android banking trojan attacks map\" width=\"1280\" height=\"800\"><\/a><\/p>\n<p>In order to protect yourself from Acecard and other\u2019s of its kind, we suggest that you do the following:<\/p>\n<ol>\n<li>Pay attention to the apps you install. For example, Acecard doesn\u2019t show anything but the Flash Player logo while running, but that\u2019s the perfect time to recall that there is no Android Flash Player anymore.<\/li>\n<li>Don\u2019t download applications from nonofficial stores and even if you are using an official store don\u2019t download apps that you don\u2019t trust and don\u2019t really need. Hackers can bypass Google Play\u2019s security and your new kitty wallpaper app can turn out to be infected.<\/li>\n<li>Use a good security solution. <a href=\"http:\/\/app.appsflyer.com\/com.kms.free?pid=smm&amp;c=kd-ru\" target=\"_blank\" rel=\"noopener nofollow\">Kaspersky Internet Security for Android<\/a> detects all known versions of Acecard and thus would serve as a good enough protection against Acecard as well as other malware families.<\/li>\n<\/ol>\n","protected":false},"excerpt":{"rendered":"<p>Acecard is one of the most advanced banking trojans. It\u2019s capable of overlaying more than 30 banks\u2019 and financial systems\u2019 apps and is spread via Google Play.<\/p>\n","protected":false},"author":696,"featured_media":11371,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[5,2683],"tags":[1444,105,1379,734,93,183,36,4216,1445],"class_list":{"0":"post-11368","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-news","8":"category-threats","9":"tag-acecard","10":"tag-android","11":"tag-banker","12":"tag-banking-trojans","13":"tag-cybercriminals","14":"tag-google-play","15":"tag-malware-2","16":"tag-mwc16","17":"tag-play-store"},"hreflang":[{"hreflang":"x-default","url":"https:\/\/www.kaspersky.com\/blog\/acecard-android-trojan\/11368\/"},{"hreflang":"en-us","url":"https:\/\/usa.kaspersky.com\/blog\/acecard-android-trojan\/6745\/"},{"hreflang":"en-gb","url":"https:\/\/www.kaspersky.co.uk\/blog\/acecard-android-trojan\/6806\/"},{"hreflang":"es-mx","url":"https:\/\/latam.kaspersky.com\/blog\/acecard-android-trojan\/6723\/"},{"hreflang":"es","url":"https:\/\/www.kaspersky.es\/blog\/acecard-android-trojan\/7789\/"},{"hreflang":"it","url":"https:\/\/www.kaspersky.it\/blog\/acecard-android-trojan\/7557\/"},{"hreflang":"ru","url":"https:\/\/www.kaspersky.ru\/blog\/acecard-android-trojan\/10960\/"},{"hreflang":"pt-br","url":"https:\/\/www.kaspersky.com.br\/blog\/acecard-android-trojan\/6016\/"},{"hreflang":"ja","url":"https:\/\/blog.kaspersky.co.jp\/acecard-android-trojan\/10475\/"},{"hreflang":"ru-kz","url":"https:\/\/blog.kaspersky.kz\/acecard-android-trojan\/10960\/"},{"hreflang":"en-au","url":"https:\/\/www.kaspersky.com.au\/blog\/acecard-android-trojan\/11368\/"},{"hreflang":"en-za","url":"https:\/\/www.kaspersky.co.za\/blog\/acecard-android-trojan\/11368\/"}],"acf":[],"banners":"","maintag":{"url":"https:\/\/www.kaspersky.com\/blog\/tag\/acecard\/","name":"Acecard"},"_links":{"self":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/users\/696"}],"replies":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/comments?post=11368"}],"version-history":[{"count":1,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11368\/revisions"}],"predecessor-version":[{"id":18839,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/posts\/11368\/revisions\/18839"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media\/11371"}],"wp:attachment":[{"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/media?parent=11368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/categories?post=11368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.kaspersky.com\/blog\/wp-json\/wp\/v2\/tags?post=11368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}