New Mandrake Android Malware Variant Evades Detection on Google Play

Security researchers have uncovered a new iteration of Mandrake, a highly advanced Android malware designed for cyber espionage. This latest variant, discovered in April 2024 by Kaspersky, showcases significant improvements in obfuscation and evasion techniques, allowing it to remain undetected on Google Play for up to two years.

Evolution of Mandrake

Mandrake first came to light in May 2020 when Bitdefender analyzed its operations, revealing that it had been active for at least four years. The newly discovered version, detailed in a recent Kaspersky advisory, demonstrates the malware’s continued evolution and the threat actors’ adaptability.

Infiltration of Google Play

The updated Mandrake samples were found hidden within five applications on Google Play, accumulating over 32,000 downloads between 2022 and 2024. The most popular app, AirFS, garnered more than 30,000 installations before its removal in March 2024. This prolonged presence on the official Android app store highlights the sophisticated nature of the malware and the challenges faced by security measures.

Enhanced Obfuscation and Evasion Tactics

Key improvements in the latest Mandrake variant include:

• Relocation of malicious functions to obfuscated native libraries
• Implementation of certificate pinning for secure C2 communications
• Deployment of various tests to avoid detection on rooted or emulated devices

These enhancements make it significantly more difficult for cybersecurity experts to detect and analyze the malware.

Multi-Stage Infection Chain

The new Mandrake version employs a sophisticated multi-stage infection process:

1. Initial malicious activity is concealed within a native library
2. The first-stage library decrypts and loads the second-stage
3. The second stage initiates communication with the command-and-control (C2) server
4. If deemed relevant, the C2 server instructs the device to download and execute the core malware

The core malware is designed to steal user credentials and deploy additional malicious applications, expanding its reach and potential for damage.

Advanced Evasion Techniques

Mandrake’s evasion capabilities have become increasingly sophisticated, incorporating:

• Checks for emulation environments
• Detection of rooted devices
• Identification of analyst tools

These improvements pose significant challenges for cybersecurity professionals attempting to detect and analyze the malware.

Novel Encryption Approach

The threat actors behind Mandrake have also implemented a unique approach to data encryption and decryption, utilizing a combination of custom algorithms and standard AES encryption. This hybrid method further complicates efforts to understand and mitigate the malware’s operations.

Implications for Android Security

The prolonged presence of Mandrake on Google Play underscores the ongoing cat-and-mouse game between malware developers and security measures. As Kaspersky notes, “The Mandrake spyware is evolving dynamically, improving its methods of concealment, sandbox evasion, and bypassing new defense mechanisms.”

This case highlights that stricter controls for applications before publication in official marketplaces may inadvertently lead to developing more sophisticated, harder-to-detect threats. The cybersecurity community and app store operators must remain vigilant and continue to adapt their detection and prevention strategies to combat these evolving threats.

Protecting Against Mandrake and Similar Threats

While Google Play’s security measures continue to improve, users should take additional precautions:

1. Regularly update devices and applications
2. Be cautious when granting permissions to new apps
3. Use reputable mobile security solutions
4. Avoid downloading apps from unofficial sources

By staying informed and implementing these best practices, Android users can better protect themselves against sophisticated malware like Mandrake and other emerging cybersecurity threats.