WAPDropper secretly subscribes to premium services

Security researchers warn of a new family of malware that is currently targeting cell phone users and quietly enrolling them in legitimate premium services.

Named WAPDropper, the malware is a multifunction dropper that can provide malware and uses machine learning technology to bypass CAPTCHA challenges that use image.

Cybersecurity Check Point spotted WAPDropper in a recent campaign and found that it was enrolling its victims in premium services from legitimate telecommunications providers in Malaysia and Thailand.

The malware analysis revealed that it has two modules, which can download and run other malware on a compromised device.

In the case of WAPDropper, there is a unit responsible for retrieving malware in a second step from the command and control server and another unit for obtaining the premium dialer.

The scheme for scammers to earn money is simple: many calls to premium numbers charge him of the victim.

CAPTCHA bypass

According to Check Point, WAPDropper administrators use a common tactic, integrating malware into applications available from unofficial stores.

Once on the victim's device, the malware communicates with the command and control server (C2) to download the program that makes the premium calls.

In one technical reference , the researchers report that the malware activity starts with collecting details from the infected device:

  • Device ID
  • MAC address
  • Subscriber ID
  • Device model
  • List of all installed applications
  • List of services running
  • Top activity package name
  • The screen is on
  • Notifications are enabled for this
  • This application can design overlays
  • Amount of free storage available
  • Total amount of RAM and available RAM
  • List of applications systemic

Then a web viewer starts to load landing pages for premium services and make a subscription.

If there is a CAPTCHA that uses images, Check Point reports that WAPDropper uses the services of a Chinese company called "Super Eagle", which provides image recognition solutions based on machine learning technology.

iGuRu.gr The Best Technology Site in Greecefgns

every publication, directly to your inbox

Join the 2.100 registrants.

Written by Anastasis Vasileiadis

Translations are like women. When they are beautiful they are not faithful and when they are faithful they are not beautiful.

Leave a reply

Your email address is not published. Required fields are mentioned with *

Your message will not be published if:
1. Contains insulting, defamatory, racist, offensive or inappropriate comments.
2. Causes harm to minors.
3. It interferes with the privacy and individual and social rights of other users.
4. Advertises products or services or websites.
5. Contains personal information (address, phone, etc.).