Hidden Cobra Malware Infects Android Phones

The U.S. Department of Homeland Security and Federal Bureau of Investigation (FBI) are warning Android phone owners of two new Hidden Cobra malware that’s believed to be engineered by the  North Korean government. Avoid being infected with these malicious files by using DFNDR Security’s Full Virus Scan protection.

Read More: Dangerous New Android Malware Discovered

What This Malware Does to Androids
The two pieces of malware are known as HARDRAIN and BADCALL and they are capable of installing a remote access tool (RAT) payload on Android devices. The technology can make the affected Windows systems work as a proxy server that can gather information from your device.

The Hidden Cobra viruses can record your phone calls, take over your camera and take screenshots of your device, read data from the contact manager, download and upload data from your device, plus it can execute commands and check for open Wi-Fi channels. Hackers can later use this information to blackmail you as it gives them the capabilities to make your personal information public.

HARDRAIN: Part One
The two federal departments wrote that HARDRAIN is comprised of three executable files that install malware on your Android device. Two of these are dynamic link library (DLL) executables that alter your Windows Firewall in order to allow incoming malicious connections from cybercriminals to breach your device.

In essence, these files open up the door for malicious files masked as secure HTTPS sessions that appear to be legitimate to enter your device. The third file on HARDRAIN is an Executable Linkable Format (ELF) file that links up to hard-coded IP addresses and serves as a RAT program, paving the way for a further invasion of your privacy and exposing your personal data.

BADCALL: Part Two
The other piece of malware is BADCALL, which also uses three files to tap into your phone. Two of these are also Windows executables that disarm your firewall by altering a registry key. After doing so, BADCALL also turns the infected systems into proxy servers. These files allow illicit communication channels to reach your device in the form of encrypted HTTPS traffic.

Rounding up the three files that make up BADCALL, there is an Android Package Kit (APK) that also acts as a RAT program that can access your personal information, record sensitive conversations, capture text messages and screenshots through your device’s camera.