RedDrop malware: Μετά από τόσα χρόνια blogging μπορούμε να υπερηφανευόμαστε για το ότι δεν χρησιμοποιήσαμε ποτέ conditions σαν το “Προσοχή” σε τίτλους αν δεν υπάρχει σοβαρός λόγος. Το RedDrop malware για Android που ανακαλύφθηκε πρόσφατα είναι ένας πολύ σοβαρός λόγος.
Το κακόβουλο λογισμικό λειτουργεί “υπογείως” κλέβει ευαίσθητα data from the infected devices (including recorded phone calls) and stores them in Cloud storage accounts.
But it does not only do that…
RedDrop acts as a spyware spyware, collecting information from the device, as well as recording from the victim's environment, of course with all the data included in the device: photos, contacts, notes, stored Wi-Fi networks and nearby hotspots.
Researchers from the security company Wandera, who revealed it, refer to it as "one of the most advanced malware for Android". When RedDrop is installed no one realizes that their device is infected until they get the first bill…
Malware sends secret SMS messages to a service that charges them, in addition to all of the spyware activities mentioned above. The security company reports that malicious software is so smart that immediately after sending an SMS, it takes care to hide all the evidence of the messages that have been sent.
In total, 53 applications used to distribute malware have been discovered.
RedDrop distributes these games: Space Game Free, Video Blocker, Cosmos FM, Plus Italy, Paint It Hot Tone and Ninja Slice. None of these apps comes from the official Google Play Store, but from Third Party Stores.
However, in order to direct the user to malware, the researchers found that scammers use a complex network that contains over 3.000 domains linked together in an effort to bypass and prevent detection techniques to increase the chances of malware software successfully on a device.
The initial download is simply a dropper, which when opened and run, will connect to a command and control (C&C) server to download additional files.
When installed spyware starts collecting the data mentioned above and saves it to Dropbox or Google Drive. At the same time it starts to use SMS sending.
The combination of actions of these is extremely destructive, both for the victim's privacy and for his financial situation.
Currently, it is not known exactly what the RedDrop team is (except for obvious financial gain), but their interest in data theft and sound recordings from infected devices indicates interest in espionage. As the team seems to have enough human resources that is capable of deploying too many applications, it also maintains sophisticated malware.
