MalBus Actor Changed Market from Google Play to ONE Store

McAfee Mobile Research details a MalBus Android malware variant distributed through South Korea's ONE Store (and also via Google Play) that uses an embedded downloader (libmovie.so) to fetch RC4-encrypted ELF payloads, dynamically load native libraries, and provide C2-driven functions including SMS/MMS capture, local TCP control on port 1111, and runtime loading of updated native modules; the report includes observed infected app versions, behavioral analysis, and multiple SHA-256 hashes for the APKs and payloads.