Fluhorse: Flutter-Based Android Malware Targets Credit Cards and 2FA Codes

Cybersecurity researchers have shared the interior workings of an Android malware relatives identified as Fluhorse.

The malware “represents a significant shift as it incorporates the malicious parts immediately in just the Flutter code,” Fortinet FortiGuard Labs researcher Axelle Apvrille said in a report revealed previous week.

Fluhorse was to start with documented by Check out Position in early Could 2023, detailing its attacks on users situated in East Asia as a result of rogue apps masquerading as Etcetera and VPBank Neo, which are popular in Taiwan and Vietnam. The original intrusion vector for the malware is phishing.

The greatest intention of the application is to steal credentials, credit card specifics, and two-component authentication (2FA) codes received as SMS to a remote server less than the management of the danger actors.

The most recent results from Fortinet, which reverse-engineered a Fluhorse sample uploaded to VirusTotal on June 11, 2023, suggest that the malware has progressed, incorporating supplemental sophistication by concealing the encrypted payload in a packer.

“Decryption is performed at the native amount (to harden reverse engineering) making use of OpenSSL’s EVP cryptographic API,” Apvrille defined. The encryption algorithm is AES-128-CBC, and its implementation takes advantage of the exact hard-coded string for the critical and initialization vector (IV).”

The decrypted payload, a ZIP file, incorporates inside of it a Dalvik executable file (.dex), which is then mounted on the system to pay attention to incoming SMS messages and exfiltrate them to the remote server.

“Reversing Flutter applications statically is a breakthrough for anti-virus researchers, as, however, much more malicious Flutter apps are anticipated to be produced in the potential,” Apvrille reported.

Located this post appealing? Stick to us on Twitter  and LinkedIn to study a lot more unique material we put up.

Some parts of this article are sourced from:
thehackernews.com