Loading malware…
Red Alert 2.0 is an Android banking trojan designed to steal banking credentials and other sensitive account information. It is distributed through third-party application stores as counterfeit legitimate applications, including messaging, media-player, social-media, and VPN applications, and as purported Android or Flash Player updates. Observed targeting included devices running Android versions through 6.0. The malware was advertised for sale on criminal forums.
Red Alert 2.0 identifies running applications and presents deceptive overlays imitating targeted applications to capture login credentials. Captured credentials are transmitted to attacker-controlled command-and-control infrastructure, with HTTP used for command-and-control communications. The malware can collect contact lists and call logs, collect and intercept SMS messages, forward intercepted messages to attackers, and send SMS messages from infected devices. It also blocks incoming calls from banks, interfering with fraud-verification communications and helping attackers delay discovery of unauthorized activity.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
Once a user downloads one of these malicious apps into his or her devices and opens it, a popup overlay will appear prompting the user to enter their login credentials.
A malicious application could create an application overlay window on top of a running legitimate application.
A malicious application could create an application overlay window on top of a running legitimate application.
Once the user installs the flash player, it requests the user to activate the device administrator.
The malware, Red Alert 2.0, tricks users into downloading it by hiding in third-party app stores as fake versions of legitimate applications such as WhatsApp, Viber, and updates for both Android and Flash Player.
Red Alert 2.0 will block incoming calls from banks, presumably to block verification attempts.
Whenever the victim launches the target application, the malware will create an overlay of the legitimate application and request the user to provide credentials.
Once the payload is installed in the app, it gathers all information from the victim’s device and sends it to the C2 server.
Whenever the victim launches the target application, the malware will create an overlay of the legitimate application and request the user to provide credentials.
The credentials are sent to the attacker’s command-and-control (C&C) server.
AbstractEmu can use HTTP to communicate with the C2 server; AhRat can communicate with the C2 using HTTPS requests; BRATA can use both HTTP and WebSockets to communicate with the C2 server; LightSpy has used both HTTPS and Websockets to communicate with the C2.
But once the application is installed on the mobile device it contacts its C2 server and requests the user to update the flash player to install an additional payload.
Once the payload is installed in the app, it gathers all information from the victim’s device and sends it to the C2 server.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.