New Android Banking Malware MMRat Leverages Protobuf Serialization for Data Exfiltration

In a recent development, a novel Android banking malware named MMRat has emerged, harnessing an uncommon method of communication known as protobuf data serialization to streamline the process of data theft from compromised devices.

Trend Micro first identified MMRat in late June 2023. Remarkably, this malware has initially targeted users in Southeast Asia, successfully avoiding detection by popular antivirus scanning services like VirusTotal.

Although the precise method of MMRat’s initial distribution to victims remains uncertain, researchers have discovered that the malware is disseminated through deceptive websites posing as legitimate app stores. Unsuspecting victims download and install malicious apps carrying MMRat, often camouflaged as official government or dating applications. During installation, these apps request and acquire risky permissions, including access to Android’s Accessibility service.

Once infiltrated, MMRat capitalizes on the Accessibility feature to secure additional permissions, granting it the capability to execute a wide range of malicious actions on the compromised device.

Key Capabilities of MMRat Include:

• Gathering network, screen, and battery information.
• Exfiltrating the user’s contact list and list of installed apps.
• Capturing user input via keylogging.
• Extracting real-time screen content using the MediaProjection API.
• Recording and live-streaming camera data.
• Storing screen data as text form dumps for transmission to the C2 server.
• Self-uninstalling to erase all traces of infection.