How to Remove TsarBot Malware

Android users across the globe are facing an increasingly sophisticated cyber threat known as TsarBot – a multi-functional malware specifically engineered to steal financial information by targeting more than 750 banking, cryptocurrency, e-commerce, and social media applications.

This malicious trojan is a severe threat, especially in regions like Australia, France, India, Poland, the UAE, and the UK, where its campaigns have been detected. Allegedly developed by a Russian-speaking hacker, TsarBot demonstrates advanced manipulation of Android systems, making it particularly dangerous and hard to detect without proper security tools.

---

TsarBot Malware Threat Summary

Attribute	Details
Threat Name	TsarBot
Threat Type	Android malware, trojan, banking trojan, spyware
Detection Names	Avast-Mobile (Android:Evo-gen [Trj]), Combo Cleaner (Android.Trojan.Banker.ATD), ESET-NOD32 (A Variant Of Android/Spy.Agent.EBR), Kaspersky (HEUR:Trojan-Banker.AndroidOS.Agent.ue)
Symptoms of Infection	Unusual battery/data drain, slow device, settings modified, new apps installed
Damage	Stolen credentials, identity theft, financial loss, performance degradation
Distribution Methods	Fake apps, phishing emails, scam websites, malicious ads
Associated Domains	solphoton[.]io, solphoton[.]app, cashraven[.]online
Danger Level	Critical – due to remote control, SMS hijacking, and overlay-based data theft

What is TsarBot?

TsarBot is categorized as a banking trojan and functions by abusing the Android Accessibility Services, originally intended to assist users with disabilities. By exploiting these permissions, TsarBot gains almost complete control over a device – from mimicking user input (like swipes, taps, or typing) to launching applications, reading content, and executing fraudulent operations in the background.

The malware often disguises itself as a Google Play Services update, prompting users to enable Accessibility Services, which then hands over high-level control to the malware.

---

How Does TsarBot Work?

Once TsarBot infiltrates a device, it connects to its Command and Control (C&C) server to retrieve overlay templates targeting specific apps installed on the victim’s phone. These overlays mimic real login or payment screens. Once a victim inputs credentials, credit card numbers, or other personal data, the malware sends that information to cybercriminals. To avoid detection and redundancy, it removes successfully targeted apps from its list.

Additionally, TsarBot can remotely perform actions on the device using screen gestures – even while the screen is blacked out to hide activity from the user. It also intercepts SMS messages, allowing it to bypass two-factor authentication (2FA) or multi-factor authentication (MFA) protections.

With functionalities like keylogging, unlock pattern theft, and app launching, this trojan is a full-scale surveillance and fraud platform.

---

General Signs Your Android Device Has Malware

• Unusual battery drain
• Sluggish performance or overheating
• Annoying pop-up ads—even when not using a browser
• Unauthorized app installs or unfamiliar apps
• Unexpected spikes in data usage
• Redirects when browsing or locked browser tabs
• Sudden crashes or reboots
• Disabled antivirus or security settings

---

How to Check for Malware by Device Type

Android Phones & Tablets

Step 1: Boot into Safe Mode

• Hold the Power button until the power menu appears
• Long-press Power off, then tap Reboot to safe mode
• This disables third-party apps temporarily

Step 2: Check App List

• Go to Settings > Apps > See all apps
• Look for:
  • Apps you didn’t install
  • Apps with generic names (e.g., “Update Service” or “Security Tool”)
  • Apps with excessive permissions

Step 3: Use Google Play Protect

• Open Google Play Store
• Tap your profile icon > Play Protect
• Tap Scan

---

Android TV Devices

Step 1: Check Installed Apps

• Go to Settings > Apps
• Look for unrecognized or recently installed apps

Step 2: Review Sideloaded APKs

• Use a file manager (e.g., X-plore File Manager) to inspect sideloaded apps
• Avoid APKs from sources other than APKMirror or Google Play

Step 3: Scan Using Sideloaded Antivirus
You can install:

• Malwarebytes
• Bitdefender
  Use APKMirror to sideload if unavailable in Play Store

Step 4: Factory Reset if Infected

• Go to Settings > Device Preferences > Reset > Factory data reset

---

Android Emulators (e.g., BlueStacks, NoxPlayer, LDPlayer)

Step 1: Check Installed Apps

• Open emulator > Settings > Apps
• Remove unknown apps or those not installed via Play Store

Step 2: Install Antivirus Inside the Emulator

• Use Google Play in the emulator to install:
  • ESET Mobile Security
  • Malwarebytes

Step 3: Monitor Network Activity

• On PC: Use tools like Wireshark or GlassWire
• Or install a firewall app within the emulator

Step 4: Reset or Reinstall Emulator

• Reset to a clean snapshot or uninstall and reinstall the emulator

---

Section 3: Manual Removal Steps (All Devices)

1. Remove Suspicious Apps Manually

• Go to Settings > Apps > [App] > Uninstall
• If app is a device admin:
  • Settings > Security > Device admin apps
  • Disable admin rights, then uninstall

2. Clear App Data and Cache

• Settings > Storage > Cached data
• Settings > Apps > [App] > Storage > Clear Data & Cache

3. Revoke Dangerous Permissions

• Settings > Privacy > Permission Manager
• Revoke camera, SMS, and location access from unfamiliar apps

4. Check Accessibility & Admin Settings

• Settings > Accessibility > Installed Services
• Settings > Security > Device admin apps

---

Section 4: Preventing Future Malware Infections

• Avoid third-party app stores unless trusted (e.g., F-Droid, APKMirror)
• Enable Google Play Protect
• Keep system and apps up to date
• Use a VPN on public Wi-Fi
• Do not click unknown links in texts or emails
• Review app permissions before installation
• Enable Two-Factor Authentication (2FA) when available

---

Section 5: When to Perform a Factory Reset

Do this if:

• A malicious app cannot be removed
• Malware persists after antivirus scans
• Device performance is severely affected

How to Factory Reset:

• Settings > System > Reset > Factory data reset
• Back up important data before proceeding

---

Summary Checklist

Action	Device Type	Tools/Notes
Safe Mode	Phones/Tablets	Isolate third-party apps
App Audit	All	Settings > Apps
Antivirus Scan	All	Malwarebytes, Bitdefender
Factory Reset	All	Last resort step
Emulator Cleanup	Emulators	Reset or reinstall software
App Permission Review	All	Revoke unnecessary access

---

Bonus Tip: Use a Security Suite

For ongoing protection, consider installing a comprehensive mobile security suite that includes:

• Real-time scanning
• Anti-phishing tools
• VPN
• Call and SMS blocking
• App lock features

---

Conclusion

TsarBot is one of the most dangerous Android banking trojans in circulation today. With its ability to masquerade as a system update, exploit Accessibility Services, hijack logins, intercept messages, and conduct full-device operations – it poses a major risk to any Android user, particularly those involved in mobile banking and cryptocurrency management.

Users in targeted regions must remain vigilant, avoid side-loading unknown apps, and carefully review permission requests. Given the level of access TsarBot demands and exploits, the consequences can range from minor annoyance to devastating financial and personal data losses.