How To Protect Your Android Device From The New DawDropper Banking Dropper?

On July 29, TrendMicro, a well-known security firm, detailed about a new Android malware dubbed as DawDropper banking dropper in a post. This proved once again that Google Play Store is still an attractive platform for cybercriminals to covertly carry out their tasks. The reason could be that attackers found this technique would help them in evading detections. If this trend continues, then the result could be more concerning. This lets multiple cybercriminal groups operate and help each other and create their own 

 model. This is highly important to be aware of such malware activities and protect your Android device from the new DawDropper banking dropper.

We have created this post to let you know how to protect your android device from the new DawDropper banking dropper.

About The New DawDropper Banking Dropper:

TrendMicro says that their security research team found the New DawDropper banking dropper in a malicious campaign in late 2021. The team said that they found that the dropper was being served in several Android apps pretending as a legitimate Video Motion, Document Scanner Pro, Conquer Darkness, simpli Cleaner, and Unicc QR Scanner.

Threat actors use DawDropper to download and install more sophisticated payloads like Octo malware, a modular and multistage malware that is capable of stealing banking information, intercepting text messages, and hijacking infected devices. Upon launching Octo malware on the victim’s machine, the malware will get the preliminary permission of the device and gather and upload sensitive information such as banking credentials, email addresses and passwords, and PINs to its command and control server.

It’s also said that Octo malware uses virtual network computing (VNC) services to record a user’s screen to capture the information. The analysis also says that the malware turns the screen black by switching the device’s backlight off and muting the sounds to cover its tasks from the user’s eyes. Please see the complete technical analysis in this blog.

Figure 1: Picture of DawDropper infection chain created by TrendMicro

Based on our observation, DawDropper has variants that drop four types of banking trojans, including Octo, Hydra, Ermac, and TeaBot. All DawDropper variants use a Firebase Realtime Database, a legitimate cloud-hosted NoSQL database for storing data, as their command-and-control (C&C) server and host malicious payloads on GitHub.

List Of Apps Infected With DawDropper Banking Dropper

The report says that total 17 apps were found infected in Google Play Store.  Please see this picture to see the list.

Figure 2: List of Apps infected with DawDropper Banking Dropper taken from TheHackersNews

How To Protect Your Android Device From The New DawDropper Banking Dropper?

You can protect your Android device from the new DawDrepper banking dropper in many places. 

IOCs Of DawDropper Banking Droppe And Their Payloads

IOCs shared by TrendMicro are as below. Please

DawDropper

Github Repository

Octo Payload

Ermac Payload

Hydra Payload

Teabot Payload

We hope this post would help you know how to protect your android device from the new DawDropper banking dropper. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this

You may also like these articles: