Daam virus infects Android phones, hacks into call records, change passwords; Govt issues warning

The government advisory also said that the 'Daam' virus is also capable of hacking phone call recordings, contacts, gaining access to camera, and modifying device passwords

‘Daam’ virus is capable of 'bypassing anti-virus programs and deploying ransomware on the targeted devices'

The Central government has issued an advisory against a malware called ‘Daam’ that infects Android phones. The virus can hack into your call records, contacts, history and camera, the Indian Computer Emergency Response Team or CERT-In, the national cyber security agency, said in its advisory.

The advisory has said that the ‘Daam’ virus is capable of “bypassing anti-virus programs and deploying ransomware on the targeted devices". The Android botnet gets distributed through third-party websites or applications downloaded from untrusted/unknown sources, the agency said.
In its advisory, the cyber security agency said when the ‘Daam’ virus gets into an Android phone, it tries to go around the security check of the device. After successfully bypassing the security check on an Android phone, the ‘Daam’ virus hacks into the sensitive data such as call records and history.
"Once it is placed in the device, the malware tries to bypass the security check of the device and after a successful attempt, it attempts to steal sensitive data, and permissions such as reading history and bookmarks, killing background processing, and reading call logs etc," the advisory said.

‘DAAM’ CAN MODIFY PASSWORDS

The government advisory also said that the 'Daam' virus is also capable of hacking phone call recordings, contacts, gaining access to camera, and modifying device passwords. Not just this, the virus can also take screenshot, steal SMSes, downloading/uploading files, etc. and transmitting to the C2 (command-and-control) server from the victim's device.

The malware, it said, utilises the AES (advanced encryption standard) encryption algorithm to code files in the victim's device. Due to this, other files get deleted from the storage and only the encrypted filed are left with “.enc" extension and a ransom note “readme_now.txt".

DO'S AND DON’TS TO AVOID SUCH ATTACKS

The cyber security agency had warned against browsing the “un-trusted websites" or clicking on "un-trusted links". No links should be clicked in any SMSes and emails. Keep your anti-virus updated, the advisory suggested.

It also suggested that users should be on the lookout for "suspicious numbers" that don't look like "real mobile phone numbers" as scammers often mask their identity by using email-to-text services to avoid revealing their actual phone number.

It said, "Genuine SMS messages received from banks usually contain sender ID [consisting of bank's short name] instead of a phone number in the sender information field."

It also asked users to exercise caution towards shortened URLs (uniform resource locators), such as those involving 'bitly' and 'tinyurl' hyperlinks like: "https://bit.ly/" "\nbit.ly" and "tinyurl.com/".