Android Malware Leverages .NET MAUI for Evasion Tactics

TL;DR

Cybercriminals are exploiting .NET MAUI to develop Android malware that evades detection by concealing malicious code within C# blob binaries. Recent campaigns, such as a fake IndusInd Bank app, have targeted users globally, emphasizing the need for vigilance and robust security measures.

New Android Malware Campaigns Utilize .NET MAUI for Evasion

Introduction

Researchers at McAfee have uncovered a sophisticated Android malware campaign that leverages the .NET MAUI framework to evade detection. This malware disguises itself as legitimate services to steal sensitive information from unsuspecting users.

Understanding .NET MAUI

.NET MAUI (Multi-platform App UI) is a cross-platform framework developed by Microsoft for building native mobile and desktop applications using C#. It allows developers to create apps that run on Android, iOS, Windows, and macOS from a single codebase, streamlining development and maintenance. This framework replaces Xamarin.Forms and provides a unified UI framework with platform-specific integrations.

Malware Tactics and Techniques

Cybercriminals are utilizing .NET MAUI to develop Android malware that evades detection by hiding core functions in C# blob binaries instead of traditional DEX files. One notable example is a fake IndusInd Bank app targeting Indian users. This malicious app steals personal and banking data via a hidden .NET MAUI payload.

“Unlike typical malicious apps, there are no obvious traces of harmful code in the Java or native code. Instead, the malicious code is hidden within blob files located inside the assemblies directory.” - [McAfee Report][1]

Multi-Stage Dynamic Loading

Another malware variant observed by experts targets Chinese-speaking users, stealing contacts, SMS, and photos through third-party app stores. This malware employs multi-stage dynamic loading, encrypting and loading its malicious payload in three steps:

1. First Stage: The app’s main activity, defined in AndroidManifest.xml, decrypts an XOR-encrypted file and loads it dynamically. This initial file acts as a loader for the next stage.
2. Second Stage: The dynamically loaded file decrypts another AES-encrypted file and loads it, serving as another layer of obfuscation.
3. Third Stage: The decrypted file contains code related to the .NET MAUI framework, which is then loaded to execute the main payload.

“The main payload is ultimately hidden within the C# code. When the user interacts with the app, such as pressing a button, the malware silently steals their data and sends it to the C2 server.” - [McAfee Report][1]

Evasion Techniques

The malware manipulates AndroidManifest.xml with excessive permissions to disrupt analysis and uses encrypted socket communication to hide stolen data. Disguised as various apps, it is widely distributed across alternative platforms.

Protection Measures

To protect against these evolving threats, users should:

• Avoid unofficial app sources.
• Use reputable security software.
• Keep their devices and apps updated.

Conclusion

The increasing use of .NET MAUI-based malware highlights the evolving tactics of cybercriminals. By employing techniques like hidden code blobs, multi-stage loading, encryption, and obfuscation, these threats can remain undetected for extended periods. Staying informed and vigilant is crucial for safeguarding against such cyber threats.

Additional Resources

For further insights, check:

• [McAfee Report on .NET MAUI Malware][1]
• [Security Affairs Article][2]