How To Protect Your Android Device From The New DawDropper Banking Dropper?

On July 29, TrendMicro, a well-known security firm, detailed about a new Android malware dubbed as DawDropper banking dropper in a post. This proved once again that Google Play Store is still an attractive platform for cybercriminals to covertly carry out their tasks. The reason could be that attackers found this technique would help them in evading detections. If this trend continues, then the result could be more concerning. This lets multiple cybercriminal groups operate and help each other and create their own dropper-as-a-service (DaaS) model. This is highly important to be aware of such malware activities and protect your Android device from the new DawDropper banking dropper.

We have created this post to let you know how to protect your android device from the new DawDropper banking dropper.

About The New DawDropper Banking Dropper:

TrendMicro says that their security research team found the New DawDropper banking dropper in a malicious campaign in late 2021. The team said that they found that the dropper was being served in several Android apps pretending as a legitimate Video Motion, Document Scanner Pro, Conquer Darkness, simpli Cleaner, and Unicc QR Scanner.

Threat actors use DawDropper to download and install more sophisticated payloads like Octo malware, a modular and multistage malware that is capable of stealing banking information, intercepting text messages, and hijacking infected devices. Upon launching Octo malware on the victim’s machine, the malware will get the preliminary permission of the device and gather and upload sensitive information such as banking credentials, email addresses and passwords, and PINs to its command and control server.

It’s also said that Octo malware uses virtual network computing (VNC) services to record a user’s screen to capture the information. The analysis also says that the malware turns the screen black by switching the device’s backlight off and muting the sounds to cover its tasks from the user’s eyes. Please see the complete technical analysis in this blog.

Based on our observation, DawDropper has variants that drop four types of banking trojans, including Octo, Hydra, Ermac, and TeaBot. All DawDropper variants use a Firebase Realtime Database, a legitimate cloud-hosted NoSQL database for storing data, as their command-and-control (C&C) server and host malicious payloads on GitHub.

List Of Apps Infected With DawDropper Banking Dropper

The report says that total 17 apps were found infected in Google Play Store.  Please see this picture to see the list.

How To Protect Your Android Device From The New DawDropper Banking Dropper?

You can protect your Android device from the new DawDrepper banking dropper in many places. 

1. Block all the IOCs on your EndPoint and web proxy boxes.
2. Don’t install apps from unknown sources.
3. Scan your device in Google Play Protect to ensure no malicious apps were installed.
4. Delete or Install all the apps catch in the Google Play Protect scan.
5. Use a good premium Antivirus or Antimalware software on your devices. 

IOCs Of DawDropper Banking Droppe And Their Payloads

IOCs shared by TrendMicro are as below. Please

DawDropper

Github Repository

Octo Payload

Ermac Payload

Hydra Payload

Teabot Payload

We hope this post will help you know how to protect your android device from the new DawDropper banking dropper. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this

• How To Fix CVE-2022-20623- A Denial Of Service Vulnerability In Cisco Nexus 9000 Series Switches
• Explore Package Management In Linux
• How Does The Log4j Vulnerability Work In Practical?
• How To Protect Your Company From This npm Supply Chain Attack
• A Detailed Understanding Of What Exactly Cryptocurrency Is And How Does It Work