Ames Computers / Walden Systems

     BusyGasper spyware that is loaded with a hundred tools ranging from device sensor listeners, motion detectors and the ability to process a user's screen taps all used to steal data. The mobile malware was detected by researchers at Kaspersky Lab in early 2018 and have been active since May 2016. So far, the infected devices seem to be in Russia. The author of the malware author is unknown but the FTP server used as the hacker's command and control ( C2 ) is located on the free Russian web hosting service Ucoz. BusyGasper is unique in that it supports the IRC protocol, something rare in Android malware. The malware can be directed to log into the the victim's email inbox, parse emails in a special folder for commands and save any payloads to a device all from an email attachment. The authors of the malware have developed keylogger based on screen taps. BusyGasper maps device screens assigning values to the layout area of the keyboard and can calculate pressed characters by matching given values with hardcoded ones.

     Analysis of BusyGasper revealed two parts. The first part is installed on the device and allows the hacker to issue instructions to the malware via the IRC protocol, such as a command to download the malware from the FTP server. The first part uses complex, intent based communication between its components to broadcast commands. The second part adds more functionality, including the ability to run commands remotely on the phone. Hackers can send a coded text messages that will trigger remote execution.