MantaxOtax Android Malware Blends Ransomware with Covert Spyware
The MantaxOtax Android malware has emerged as a sophisticated dual-threat, combining file encryption for ransom with extensive data exfiltration capabilities, targeting Indonesian users.
A new Android malware strain, dubbed MantaxOtax, has been identified by researchers at Zimperium's zLabs, exhibiting a dangerous combination of ransomware and advanced spyware functionalities. This dual-purpose threat encrypts user files, demanding a ransom for their recovery, while simultaneously exfiltrating sensitive personal data from infected devices. The malware's capabilities extend to stealing contacts, call logs, SMS messages, credentials, and location data, posing a significant risk to user privacy and security.
Upon installation, MantaxOtax aggressively seeks elevated privileges, requesting device administrator rights, followed by access to SMS, contacts, audio, images, and crucially, Android Accessibility services. This broad access allows the malware to exert significant control over device interactions and data. The malware dynamically resolves its command-and-control (C2) server domain from a GitHub repository, a tactic that enables its operators to quickly shift infrastructure if a domain is blocked, thereby enhancing its resilience against takedown efforts.
The ransomware component of MantaxOtax operates differently based on the Android version. On Android 9 and earlier, it recursively scans and encrypts files in shared external storage using AES encryption, securely deleting the originals and leaving behind .enc files. Each encryption key is unique to the device, fetched from the C2 server using the device's Android ID, ensuring that no two victims share the same decryption key. However, on Android 10 and later, the implementation of Scoped Storage by Google significantly limits the malware's encryption scope to the app's own external files directory, reducing the potential impact of the ransomware.
To ensure victims are aware of the ransom demand, MantaxOtax overwrites existing image files with ransom-themed graphics. A chat interface then appears on the screen for negotiation, with these communications routed through Firebase. A misconfiguration in the server setup reportedly left some of these extortion dialogues exposed, offering a potential insight into the attackers' operations. Furthermore, a separate routine masquerades as a system lock process, restricting device access while simultaneously intercepting the user's PIN entry.
Beyond its ransomware capabilities, MantaxOtax functions as a potent spyware. It collects a wide array of sensitive information, including app inventories, hardware details, precise location data, browser history, notifications, contacts, call logs, and SMS messages, notably including one-time passwords (OTPs) crucial for multi-factor authentication. It also harvests gallery content, linked Google accounts, and through Accessibility services, can extract WhatsApp profiles and messages, as well as Telegram credentials and chat histories.
The malware leverages Android's MediaProjection API to capture screenshots and record the device screen in near real-time, streaming the content to the Catbox file host and sending the resulting links back to its operators. It also possesses the ability to take silent photos using either the front or rear camera. Zimperium's analysis, based on language indicators and recovered victim files, strongly suggests that Indonesian users are the primary target of this campaign.
Further analysis revealed a second version of MantaxOtax that transitioned to WebSocket communications and introduced persistent screen locking, application blocking, and a transparent overlay that intercepts all touch input, effectively rendering the device unusable until demands are met. Other variants focus on wearing down the victim through repeated alert dialogues, full-screen video overlays, rapidly spawning image popups, and text-to-speech functionalities that vocalize the attacker's messages.
The emergence of MantaxOtax follows closely on the heels of THost9, another Android trojan reported recently that employed sophisticated techniques like cloning banking apps within isolated work profiles to obscure the link between malware alerts and subsequent fraudulent activities. The dual nature of MantaxOtax, combining destructive encryption with pervasive surveillance, marks a significant escalation in the sophistication of mobile threats.