Qwizzserial Stealer

Qwizzserial is a Kotlin‑based Android stealer trojan that has infected nearly 100,000 devices—particularly in Uzbekistan—by masquerading as legitimate financial or governmental apps shared via Telegram. Its primary aim is to harvest banking credentials, intercept SMS-based 2FA codes, and exfiltrate this data through Telegram bots or HTTP servers.

---

Threat Type Overview

Attribute	Details
Threat type	Android malware, SMS stealer trojan
Detection names	Avast-Mobile: Android:Evo-gen [Trj], Combo Cleaner: Android.Riskware.InfoStealer.BX, ESET‑NOD32: Android/Spy.Banker.CQZ, Kaspersky: HEUR:Trojan-Banker.AndroidOS.Mamont.ak
Associated domains	Telegram bot endpoints, HTTP POST gate servers (e.g., llkjllj[.]top)
Symptoms of infection	Persistent permission requests for SMS/phone, appearance of fake data‑entry forms, performance slowdowns, unusual battery/data use, disappearance of icons or UI glitches
Damage & distribution	Intercepts SMS 2FA, harvests banking/card info, steals installed app and SIM data, uses phishing forms, malvertising, deceptive Telegram channels, scam sites
Danger level	High—financial and identity theft threat
Removal tool	SpyHunter (download from https://www.enigmasoftware.com/products/spyhunter/?ref=ywuxmtf)

---

Detailed Evaluation

How I Got Infected

Users encounter seemingly innocuous apps—like “Presidential Support” or “Finans yordam” (Financial Assistance)—shared via Telegram channels posing as official services. These APKs prompt repeatedly for SMS/phone permissions until granted, allowing the malware to embed itself deeply.

What Does It Do

1. Permission abuse: Gains READ_SMS, RECEIVE_SMS, READ_PHONE_STATE, CALL_PHONE permissions.
2. Phishing forms: Displays fake screens asking for phone numbers and bank card details, which it transmits to attackers via Telegram bots or HTTP POST.
3. SMS harvesting: Intercepts 2FA codes and sensitive banking messages, using regex filters for balance/transaction alerts over 500,000 UZS (~$38‑39).
4. Persistence: Disables battery optimization to remain active—even in background—via repeated prompts.

Should You Be Worried

Absolutely. Qwizzserial steals login, card, and SMS codes, enabling attackers to bypass security. It has already extorted USD 62,000 in just three months, and its mutated variants are increasingly difficult to detect.

Manual Removal for Qwizzserial Stealer (For advanced users)

Step 1: Enter Safe Mode with Networking

Since info-stealers may resist removal while active, booting into Safe Mode helps disable their execution.

1. Windows 10/11:
   • Press Win + R, type msconfig, and hit Enter.
   • Go to the Boot tab and check Safe boot → Network.
   • Click Apply → OK and restart your PC.
2. Windows 7/8:
   • Restart your PC and keep pressing F8 before Windows loads.
   • Select Safe Mode with Networking and press Enter.

---

Step 2: End Malicious Processes in Task Manager

1. Press Ctrl + Shift + Esc to open Task Manager.
2. Look for suspicious processes (e.g., randomized names, high CPU usage, or unknown apps).
3. Right-click on them and select End Task.

Common info-stealer process names include StealC.exe, RedLine.exe, Vidar.exe, or generic system-like names.

---

Step 3: Uninstall Suspicious Programs

1. Press Win + R, type appwiz.cpl, and hit Enter.
2. Look for unknown or recently installed suspicious software.
3. Right-click the suspect entry and select Uninstall.

---

Step 4: Delete Malicious Files and Registry Entries

Info-stealers leave behind hidden files and registry keys to ensure persistence.

1. Open File Explorer and navigate to:
   • C:\Users\YourUser\AppData\Local
   • C:\Users\YourUser\AppData\Roaming
   • C:\ProgramData
   • C:\Windows\Temp
   Delete any unfamiliar folders with random names.
2. Open Registry Editor:
   • Press Win + R, type regedit, and press Enter.
   • Navigate to:
     • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run
     • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
     • HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce
     • HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
   • Look for randomized or suspicious registry keys (e.g., StealerLoader, Malware123).
   • Right-click and delete any malicious entries.

---

Step 5: Clear Browser Data and Reset DNS

Since info-stealers target browsers, you need to clear stored credentials.

Clear Browsing Data

1. Open Chrome, Edge, or Firefox.
2. Go to Settings → Privacy and Security → Clear Browsing Data.
3. Select Passwords, Cookies, and Cached files and click Clear Data.

Reset DNS

1. Open Command Prompt as Administrator.
2. Type the following commands, pressing Enter after each:bashCopyEditipconfig /flushdns ipconfig /release ipconfig /renew
3. Restart your computer.

---

Step 6: Scan for Rootkits

Even after manual removal, some info-stealers may hide as rootkits.

1. Download Malwarebytes Anti-Rootkit or Microsoft Safety Scanner.
2. Run a deep scan and remove any detected threats.

---

Step 7: Change All Passwords & Enable MFA

Since info-stealers extract credentials, immediately update passwords for:

• Email accounts
• Banking and finance sites
• Social media
• Cryptocurrency wallets
• Business and work logins

Enable two-factor authentication (2FA) to prevent unauthorized access.

---

Method 2: Automatically Removing Qwizzserial Stealer Using SpyHunter (Recommended)

(For users who want a fast, hassle-free solution)

SpyHunter is a professional anti-malware tool capable of detecting and removing info-stealers, trojans, keyloggers, and spyware.

Step 1: Download SpyHunter

Click here to download SpyHunter

Step 2: Install and Launch SpyHunter

1. Locate the SpyHunter-Installer.exe file in your Downloads folder.
2. Double-click to start the installation.
3. Follow the on-screen instructions and launch SpyHunter after installation.

Step 3: Perform a Full System Scan

1. Click “Start Scan” to analyze your system.
2. SpyHunter will detect any info-stealers, trojans, or keyloggers.
3. Click “Remove” to delete all detected threats.

Step 4: Enable Real-Time Protection

• Go to Settings and enable Real-Time Malware Protection to prevent future infections.

---

Prevention Tips: How to Stay Safe from Info-Stealers

• Avoid Cracked Software & Torrents – They are a major infection source.
• Use Strong, Unique Passwords – Utilize a password manager.
• Enable Two-Factor Authentication (2FA) – Reduces the risk of stolen credentials being misused.
• Keep Software & OS Updated – Patches fix security vulnerabilities.
• Be Wary of Phishing Emails – Do not open attachments from unknown senders.
• Use an Antivirus or Anti-Malware Tool – A good tool like SpyHunter helps detect and remove threats.

---

Conclusion

Qwizzserial represents a well-organized, evolving threat engineered to exploit SMS‑based authentication heavily used in Central Asia. Its deceptive distribution, stealthy permission escalation, and data exfiltration make it a high-risk malware. Removal using SpyHunter is strongly advised for anyone affected.