ANDROIDOS_FAKEBANK.HRXK

This Android malware masquerades as Adobe Flash Player with a legitimate-looking icon.

It gathers the package names of installed applications including mobile banking apps and sends them to the remote server.

If any of installed app is a banking app, the malware appears over the launched banking application. The malware behaves like a lock screen, which cannot be terminated without the user entering their login credentials.

NOTES:

This Android malware masquerades as Adobe Flash Player with a legitimate-looking icon.

After downloading and installing the app, the user is requested to grant the application device administrator rights. This routine prevents it from being uninstalled from the device. The icon is then hidden from the user’s view, but the malware remains active in the background.

It intercepts SMS to send user SMS information to a remote server or via sending an SMS.

It then gathers the package names of installed applications including mobile banking apps and sends them to the remote server.

If any of installed app is a banking app, the malware appears over the launched banking application. The malware behaves like a lock screen, which cannot be terminated without the user entering their login credentials.