However, reviewing the AndroidManifest.xml file gives clues about the malicious additions. On installation and execution this app looks similar to the legitimate Zoom application.

Take pictures from the front/back camera.On a high level DroidJack has the following capabilities:

DroidJack infested apps are common and we have written blogs in more depth about such fake apps in the past. These apps do not contain any Zoom related assets (icons and other UI elements) as we have seen in other such fake apps. We saw few instances where the Android Remote Administration Tool (RAT) DroidJack embedded apps were named as Zoom.

hp://c./apk/cr.html (Hard-coded in the sample we analyzed).

This link was not accessed during our analysis, however there are multiple suspicious links and malicious apk files associated with this domain:īelow are few suspicious links listed by VirusTotal for this domain: This library file contains the following link: We saw this library file on the device (post app installation) in a hidden folder: This malware contains a library file in the assets folder: The malware communicates with the following domains that have malicious indicators:ĭevice specific information that is exfiltrated during network communication includes: This appears to be an app that is repackaged to look like the ‘Zoom’ app, but there are no other similarities: The login screen when translated says “Mobile Cloud Office”. Later we see a login screen, but its not for Zoom. Case IĪfter installation and execution the first thing we see are full screen advertisements: We examine a few such cases in this blog. SonicWall Capture Labs threats research team has observed malicious Android apps that use the name, user interface (UI) elements and parts of code of the legitimate Zoom app to infect unsuspecting users. We recently blogged about a malicious cryptominer that disguises itself as Zoom app. The video-conferencing app Zoom has enjoyed a surge in demand the last few months and this has caught the attention of malware writers. As a result, work from home related tools have seen an uptick in demand and usage. There has been a sharp rise in people working from home as a precautionary measure towards lowering the spread of Covid-19.

Zoom meeting app for android