Reverse Engineering Trojan 'GhostClicker' pada Layanan Aksesibilitas Android

Decompiling GhostClicker: Dalvik Bytecode Analysis

Our reverse engineers unpacked the packer routines of sample sha256:4f8e91.... The malware masqueraded as an electric utility calculator.

Key Findings

• Subscribes to AccessibilityEvent.TYPE_VIEW_CLICKED
• Bypasses overlay warnings by injecting synthetic gestures at 200ms intervals
• Transmits keystrokes directly to command-and-control servers using encrypted websockets.