{"id":82313,"date":"2017-11-20T04:00:36","date_gmt":"2017-11-20T12:00:36","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=82313"},"modified":"2025-05-27T20:48:56","modified_gmt":"2025-05-28T03:48:56","slug":"android-malware-appears-linked-to-lazarus-cybercrime-group","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/","title":{"rendered":"Android Malware Appears Linked to Lazarus Cybercrime Group"},"content":{"rendered":"

This blog was written by Inhee Han.\u00a0<\/em><\/p>\n

The McAfee Mobile Research team recently examined a new threat, Android malware that contains a backdoor file in the executable and linkable format<\/a> (ELF). The ELF file is similar to several executables that have been reported to belong to the Lazarus<\/a> cybercrime group. (For more on Lazarus, read this post <\/a>from our Advanced Threat Research Team.)<\/p>\n

The malware poses as a legitimate APK, available from Google Play, for reading the Bible in Korean. The legit app has been installed more than 1,300 times. The malware has never appeared on Google Play, and we do not know how the repackaged APK is spread in the wild.<\/p>\n

\"\"<\/a><\/p>\n

Figure 1: Description of the legitimate app on Google Play.<\/em><\/p>\n

\"\"<\/a><\/p>\n

Figure 2: An overview of the malware\u2019s operation. <\/em><\/p>\n

Comparing Certificates<\/h2>\n

The repackaged APK has been signed by a different certificate from the legitimate APK. We can see the differences in the following two screen captures:<\/p>\n

\"\"<\/a><\/p>\n

Figure 3: The certificate of the malicious, repackaged APK.<\/em><\/p>\n

\"\"<\/a><\/p>\n

Figure 4: The certificate of the legitimate APK.<\/em><\/p>\n

Once the malicious APK installs its code, it attempts to execute the backdoor ELF from \u201cassets\/while.\u201d If the ELF successfully executes, it turns the device into a bot.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Figure 5. The main function for executing the backdoor ELF.<\/em><\/p>\n

 <\/p>\n

Analyzing the Backdoor<\/strong><\/h3>\n

Once the backdoor ELF starts, it turns into a zombie process to protect itself. It remains as a zombie even if the parent process terminates, as long as the \u201cdex\u201d execute() method has been implemented successfully.<\/p>\n

\"\"<\/a><\/p>\n

Figure 6. The malware turns itself into a zombie process.<\/em><\/p>\n

The malware contains a list of IP addresses of control servers. The list is encoded and written to the file \/data\/system\/dnscd.db.<\/p>\n

\"\"<\/a><\/p>\n

The preceding table lists information for each of the IP addresses. None of these is available now.<\/p>\n

\"\"<\/a><\/p>\n

Figure 7. The flow of writing the encoded control server IPs to a file.<\/em><\/p>\n

The IP address array is encoded by a simple routine when it is loaded into memory from the read-only data section; that encoded data is written to the file \/data\/system\/dnscd.db. The decoded file is then loaded into memory to select an IP address to connect to.<\/p>\n

One of control servers is selected randomly immediately before the backdoor process attempts to connect to its address. The attempt is performed repeatedly to successfully connect with one of the control servers.<\/p>\n

\"\"<\/a><\/p>\n

Figure 8. The malware creates a socket and connects to a randomly selected control server.<\/em><\/p>\n

Once connected with a control server, the malware begins to fill the buffer using a callback beacon. Figure 9 shows a part of the message-generating code. Several fields of the packet are hardcoded, particularly the bytes at offsets 0, 4, and 5. After we realized that the message only pretended to use the SSL handshake protocol, we understood the meaning of the hardcoded bytes. The byte at offset 0 is the handshake type; offsets 4 and 5 are the SSL version of the handshake layer, a part of transport layer security.<\/p>\n

\"\"<\/a><\/p>\n

Figure 9. A part of the function for generating a callback beacon.<\/em><\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Figure 10. Transferring data to be used as the callback beacon to the control server.<\/em><\/p>\n

After the message is generated, it sends the following packet (Figure 11) to the control server as a callback beacon. There is a randomly selected well-known domain in the packet where the server name indicator field is placed as a field of extension data. We suspect this is an evasion technique to avoid detection by security solutions looking for suspicious behaviors.<\/p>\n

\"\"<\/a><\/p>\n

Figure 11. A captured packet from the callback beacon.<\/em><\/p>\n

\"\"<\/a><\/p>\n

Figure 12. The list of legitimate (well-known) domains in the binary.<\/em><\/p>\n

After sending the callback beacon, the malware assigns global variables that contain device information which is transferred to the control server once it receives the command code 0x5249. Figure 13 shows the jump table for implementing commands and its pseudo code.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Figure 13. The jump table for implementing commands from the control server and the structure for receiving data.<\/em><\/p>\n

The functions are described in the following table. Command code and arguments arrive as structured data from the control server, as shown in Figure 13. The command code and arguments are assigned, respectively, to the CMD and DATA member variables of the received data structure.<\/p>\n

\"\"<\/a><\/p>\n

After performing commands received from the control server, the malware returns the results to the control server using the codes in Figures 14 and 15. Before transferring the results, the return code and data are stored in a structure described in the following pseudo code.<\/p>\n

\"\"<\/a><\/p>\n

\"\"<\/a><\/p>\n

Figures 14 and 15. The codes and data structure returned to the control server.<\/em><\/p>\n

Similarities to Lazarus Malware<\/strong><\/h2>\n

In Figure 16, the function on the left is from the backdoor ELF we have analyzed. On the right, we see procedures found in several executables used by the Lazarus Group in various attacks.<\/p>\n

\"\"<\/a><\/p>\n

Figure 16. <\/em>Similar functions to the executable used in the Sony Pictures attack.<\/em><\/p>\n

Both functions look very similar. And the hexadecimal seeds for generating a key for encryption and decryption are the same. Both functions are also used to generate a message encryption and decryption key between the victim and control server. Figure 17 shows the functions of both the backdoor ELF and an executable recently used by the Lazarus Group. The function connects to the control server, and generates a disguised SSL ClientHello packet. Then the generated packet is sent to the control server as callback beacon.<\/p>\n

\"\"<\/a><\/p>\n

Figure 17. The functions to establish a connection to the control server (ELF on the left).<\/em><\/p>\n

The function in Figure 18 generates a disguised ClientHello packet to use as a callback beacon.<\/p>\n

\"\"<\/a><\/p>\n

Figure 18. Generating the disguised ClientHello packet (ELF on the left).<\/em><\/p>\n

Both backdoors use same protocol, as we confirmed when analyzing the function for receiving a message from the control server. Figure 19 shows the protocol for transferring a message between the backdoor and the control server.<\/p>\n

\"\"<\/a><\/p>\n

Figure 19. The receive message function included in the checking protocol (ELF on the left).<\/em><\/p>\n

To transfer a message from the source, the malware first sends a five-byte message to the destination. The message contains information on the size of the next packet, a hardcoded value, and the type of message. The hardcoded value is 0x0301 and the type of message can be between 0x14\u20130x17. The message type can also be used to check the validation of the received packet. The following is pseudo code from the receive function:<\/p>\n

\"\"<\/a><\/p>\n

Figure 20. The five-byte packet sent before the source sends its primary message.<\/em><\/p>\n

\"\"<\/a><\/p>\n

Figure 21. Pseudo code from the receive message function.<\/em><\/p>\n

\u00a0<\/strong>Conclusion<\/strong><\/h2>\n

The security industry keeps an eye on the Lazarus Group, and McAfee Mobile Security researchers actively monitor for mobile threats by Lazarus and other actors. We compared our findings with the threat intelligence research of our Advanced Threat Research team, which studies several groups and their techniques. Due to the reuse of recent campaign infrastructure, code similarities, and functions such as the fake transport layer security, these tactics match many we have observed from the Lazarus Group.<\/p>\n

We do not know if this is Lazarus\u2019 first activity on a mobile platform. But based on the code similarities we can say it with high confidence that the Lazarus Group is now operating in the mobile world.<\/p>\n

 <\/p>\n

McAfee Mobile Security detects this malware as \u201cAndroid\/Backdoor.\u201d Always keep your mobile security application updated to the latest version. And never install applications from unverified sources. This habit will reduce the risk of infection by malware.<\/p>\n

Indicators of Compromise:<\/strong><\/h2>\n

Hashes<\/em><\/span><\/h4>\n

12cc14bbc421275c3c6145bfa186dff<\/p>\n

24f61120946ddac5e1d15cd64c48b7e6<\/p>\n

8b98bdf2c6a299e1fed217889af54845<\/p>\n

9ce9a0b3876aacbf0e8023c97fd0a21d<\/p>\n

Domains<\/em><\/span><\/h4>\n

mail[.]wavenet.com.ar<\/p>\n

vmware-probe[.]zol.co.zw<\/p>\n

wtps[.]org<\/p>\n

IP addresses<\/em><\/span><\/h4>\n

110[.]45.145.103<\/p>\n

114[.]215.130.173<\/p>\n

119[.]29.11.203<\/p>\n

124[.]248.228.30<\/p>\n

139[.]196.55.146<\/p>\n

14[.]139.200.107<\/p>\n

175[.]100.189.174<\/p>\n

181[.]119.19.100<\/p>\n

197[.]211.212.31<\/p>\n

199[.]180.148.134<\/p>\n

217[.]117.4.110<\/p>\n

61[.]106.2.96<\/p>\n","protected":false},"excerpt":{"rendered":"

This blog was written by Inhee Han.\u00a0 The McAfee Mobile Research team recently examined a new threat, Android malware that…<\/p>\n","protected":false},"author":674,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[442],"tags":[37,76,4452,180,214],"coauthors":[3973],"class_list":["post-82313","post","type-post","status-publish","format-standard","hentry","category-mcafee-labs","tag-android","tag-cybercrime","tag-cybersecurity","tag-malware","tag-mobile-security1"],"acf":[],"yoast_head":"\nAndroid Malware Appears Linked to Lazarus Cybercrime Group<\/title>\n<meta name=\"description\" content=\"The McAfee Mobile Research team recently examined a new Android malware that contains a backdoor file in the executable and linkable format.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Android Malware Appears Linked to Lazarus Cybercrime Group\" \/>\n<meta property=\"og:description\" content=\"The McAfee Mobile Research team recently examined a new Android malware that contains a backdoor file in the executable and linkable format.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/\" \/>\n<meta property=\"og:site_name\" content=\"McAfee Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:author\" content=\"https:\/\/www.facebook.com\/McAfee\/\" \/>\n<meta property=\"article:published_time\" content=\"2017-11-20T12:00:36+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-05-28T03:48:56+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png\" \/>\n\t<meta property=\"og:image:width\" content=\"726\" \/>\n\t<meta property=\"og:image:height\" content=\"686\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"McAfee\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@McAfee\" \/>\n<meta name=\"twitter:site\" content=\"@McAfee\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"McAfee\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/\"},\"author\":{\"name\":\"McAfee\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\"},\"headline\":\"Android Malware Appears Linked to Lazarus Cybercrime Group\",\"datePublished\":\"2017-11-20T12:00:36+00:00\",\"dateModified\":\"2025-05-28T03:48:56+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/\"},\"wordCount\":1275,\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png\",\"keywords\":[\"android\",\"cybercrime\",\"cybersecurity\",\"malware\",\"mobile security\"],\"articleSection\":[\"McAfee Labs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/\",\"name\":\"Android Malware Appears Linked to Lazarus Cybercrime Group\",\"isPartOf\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png\",\"datePublished\":\"2017-11-20T12:00:36+00:00\",\"dateModified\":\"2025-05-28T03:48:56+00:00\",\"description\":\"The McAfee Mobile Research team recently examined a new Android malware that contains a backdoor file in the executable and linkable format.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage\",\"url\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png\",\"contentUrl\":\"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Blog\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Other Blogs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"McAfee Labs\",\"item\":\"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Android Malware Appears Linked to Lazarus Cybercrime Group\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#website\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"name\":\"McAfee Blog\",\"description\":\"Internet Security News\",\"publisher\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#organization\",\"name\":\"McAfee\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png\",\"width\":1286,\"height\":336,\"caption\":\"McAfee\"},\"image\":{\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/x.com\/McAfee\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/www.youtube.com\/McAfee\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa\",\"name\":\"McAfee\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4\",\"url\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"contentUrl\":\"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png\",\"caption\":\"McAfee\"},\"description\":\"We're here to make life online safe and enjoyable for everyone.\",\"sameAs\":[\"https:\/\/www.facebook.com\/McAfee\/\",\"https:\/\/www.linkedin.com\/company\/mcafee\/\",\"https:\/\/x.com\/McAfee\"],\"url\":\"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Android Malware Appears Linked to Lazarus Cybercrime Group","description":"The McAfee Mobile Research team recently examined a new Android malware that contains a backdoor file in the executable and linkable format.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"og_locale":"en_US","og_type":"article","og_title":"Android Malware Appears Linked to Lazarus Cybercrime Group","og_description":"The McAfee Mobile Research team recently examined a new Android malware that contains a backdoor file in the executable and linkable format.","og_url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/","og_site_name":"McAfee Blog","article_publisher":"https:\/\/www.facebook.com\/McAfee\/","article_author":"https:\/\/www.facebook.com\/McAfee\/","article_published_time":"2017-11-20T12:00:36+00:00","article_modified_time":"2025-05-28T03:48:56+00:00","og_image":[{"width":726,"height":686,"url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png","type":"image\/png"}],"author":"McAfee","twitter_card":"summary_large_image","twitter_creator":"@McAfee","twitter_site":"@McAfee","twitter_misc":{"Written by":"McAfee","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#article","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/"},"author":{"name":"McAfee","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa"},"headline":"Android Malware Appears Linked to Lazarus Cybercrime Group","datePublished":"2017-11-20T12:00:36+00:00","dateModified":"2025-05-28T03:48:56+00:00","mainEntityOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/"},"wordCount":1275,"publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png","keywords":["android","cybercrime","cybersecurity","malware","mobile security"],"articleSection":["McAfee Labs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/","url":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/","name":"Android Malware Appears Linked to Lazarus Cybercrime Group","isPartOf":{"@id":"https:\/\/www.mcafee.com\/blogs\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage"},"thumbnailUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png","datePublished":"2017-11-20T12:00:36+00:00","dateModified":"2025-05-28T03:48:56+00:00","description":"The McAfee Mobile Research team recently examined a new Android malware that contains a backdoor file in the executable and linkable format.","breadcrumb":{"@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#primaryimage","url":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png","contentUrl":"https:\/\/securingtomorrow.mcafee.com\/wp-content\/uploads\/2017\/11\/20171114-ELF-1.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/android-malware-appears-linked-to-lazarus-cybercrime-group\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Blog","item":"https:\/\/www.mcafee.com\/blogs\/"},{"@type":"ListItem","position":2,"name":"Other Blogs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/"},{"@type":"ListItem","position":3,"name":"McAfee Labs","item":"https:\/\/www.mcafee.com\/blogs\/other-blogs\/mcafee-labs\/"},{"@type":"ListItem","position":4,"name":"Android Malware Appears Linked to Lazarus Cybercrime Group"}]},{"@type":"WebSite","@id":"https:\/\/www.mcafee.com\/blogs\/#website","url":"https:\/\/www.mcafee.com\/blogs\/","name":"McAfee Blog","description":"Internet Security News","publisher":{"@id":"https:\/\/www.mcafee.com\/blogs\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.mcafee.com\/blogs\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.mcafee.com\/blogs\/#organization","name":"McAfee","url":"https:\/\/www.mcafee.com\/blogs\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2023\/02\/mcafee-logo.png","width":1286,"height":336,"caption":"McAfee"},"image":{"@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/x.com\/McAfee","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/www.youtube.com\/McAfee"]},{"@type":"Person","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/47851fdb92fad9456152405839c92efa","name":"McAfee","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.mcafee.com\/blogs\/#\/schema\/person\/image\/1ffadfeeda1f4f9e7891a81f27a9ecf4","url":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","contentUrl":"https:\/\/www.mcafee.com\/blogs\/wp-content\/uploads\/2020\/08\/Original-Logo-96x96.png","caption":"McAfee"},"description":"We're here to make life online safe and enjoyable for everyone.","sameAs":["https:\/\/www.facebook.com\/McAfee\/","https:\/\/www.linkedin.com\/company\/mcafee\/","https:\/\/x.com\/McAfee"],"url":"https:\/\/www.mcafee.com\/blogs\/author\/mcafee\/"}]}},"_links":{"self":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/82313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/users\/674"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/comments?post=82313"}],"version-history":[{"count":3,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/82313\/revisions"}],"predecessor-version":[{"id":214521,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/posts\/82313\/revisions\/214521"}],"wp:attachment":[{"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/media?parent=82313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/categories?post=82313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/tags?post=82313"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.mcafee.com\/blogs\/wp-json\/wp\/v2\/coauthors?post=82313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}