Subj : This dangerous new Android malware looks to hide from detection w
To   : All
From : TechnologyDaily
Date : Wed Jul 16 2025 15:15:07

This dangerous new Android malware looks to hide from detection with 
distorted APKs

Date:
Wed, 16 Jul 2025 14:00:00 +0000

Description:
Distorted APKs make analysis and reverse engineering almost impossible, 
experts warn.

FULL STORY
======================================================================zLabs 
spots new version of the Konfety Android malware This version uses distorted 
APKs to avoid being detected and analyzed It also uses the "evil twin" tactic 
to remain hidden in plain sight 

The infamous Konfety Android malware has apparently been updated, with new 
versions hiding in plain sight through tampered APK structure, experts have 
warned. 

Security researchers zLabs have found new Konfety variants were adopting 
increasingly advanced techniques to evade detection and hinder reverse 
engineering efforts. 

In ZIP files (which APKs are based on), every file includes a so-called 
General Purpose Bit Flag, a two-byte field that stores metadata about how the 
file should be handled (either 0 or 1). One of the bits in the flag indicates 
if the file is encrypted or not. 

 Norton 360 with Genie 

Todays cyberthreats are more sophisticated and scams are harder to detect. 
Thats why we made our all-in-one security more powerful to keep you safer 
online. Norton 360 now with Genie AI-powered scam detection. Advanced tech 
for advanced threats starting at $29.99 the first year. View Deal Evil twins 
and dual-app deception 

In Konfetys case, the attackers intentionally set bit 0 to 1, even though the 
file wasnt actually encrypted, causing decompression tools to misinterpret 
the files, analysis tools to crash thinking it was unreadable or corrupted, 
and reverse engineers to waste time troubleshooting. 

But thats not all. Each file entry in a ZIP archive also includes a 
compression method identifier (0x000 for no compression, 0x000C for an 
uncommon compression standard, etc.) 

With Konfety, the attackers managed to declare files compressed using 0x000C, 
which wasnt really the case. Since the files cant decompress properly, it 
leads to partial extraction, parsing errors, or even crashes, which 
complicates reverse-engineering and analysis. 

There are other ways Konfety tries to hide and maintain persistence. zLabs 
said that the attackers are also using so-called dual-app deception, in which 
theres a legitimate app on major app stores, and a malicious one elsewhere. 

The app also hides its icon when installed, and applies geofencing to make 
sure certain analysts and researchers cant get to it. 

Konfety works by using CaramelAds SDK to fetch ads, deliver payloads, and 
maintain communication with attacker-controlled servers. It redirects users 
to malicious websites, prompts unwanted app installs, and triggers persistent 
spam-like browser notifications. 

The threat actors behind Konfety are highly adaptable, consistently altering 
their targeted ad networks and updating their methods to evade detection, the 
researchers warned. 

This latest variant demonstrates their sophistication by specifically 
tampering with the APK's ZIP structure. This tactic is designed to bypass 
security checks and significantly complicate reverse engineering efforts, 
making detection and analysis more challenging for security professionals. 

 Via BleepingComputer You might also like This dangerous new malware is 
hitting iOS and Android phones alike - and it's even stealing photos and 
crypto Take a look at our guide to the best authenticator app We've rounded 
up the best password managers



======================================================================
Link to news story:
https://www.techradar.com/pro/security/this-dangerous-new-android-malware-look
s-to-hide-from-detection-with-distorted-apks


--- Mystic BBS v1.12 A47 (Linux/64)
 * Origin: tqwNet Technology News (1337:1/100)

.