Red Warning 2.0: Novel Android Banking Trojan For Sale On Hacking Forums

The Recent discoveries of unsafe variants of the Android banking Trojan families, including Faketoken, Svpeng, as well as BankBot, introduce a pregnant threat to online users who may accept their login credentials as well as valuable personal information stolen.

Security researchers from SfyLabs accept at nowadays discovered a novel Android banking Trojan that is existence rented on many nighttime websites for $500 per month, SfyLabs' researcher Han Sahin told The Hacker News.

Dubbed Red Alert 2.0, the Android banking malware has been fully written from scratch, dissimilar other banking trojans, such equally BankBot as well as ExoBot, which were evolved from the leaked source code of older trojans.

The Red Alert banking malware has been distributed via many online hacking forums since concluding few months, as well as its creators accept continuously been updating the malware to add together novel functionalities inwards an test to become far a unsafe threat to potential victims.

Malware Blocks Incoming Calls from Banks

Like most other Android banking trojans, Red Alert has a large set out of capabilities such equally stealing login credentials, hijacking SMS messages, displaying an overlay on the plow over of legitimate apps, contact listing harvesting, amidst others.

Besides this, Red Alert actors accept likewise added an interesting functionality to its malware, similar blocking as well as logging all incoming calls associated alongside banks as well as fiscal associations.

This would potentially permit the Red Alert malware to preclude warnings of a compromised draw organisation human relationship to endure received past times the victims from their associated banks.

Malware Uses Twitter As Backup C&C Infrastructure

Another most interesting affair virtually Red Alert 2.0 is that it uses Twitter to preclude losing bots when its command as well as command server is knocked offline.

"When the bot fails to connect to the hardcoded C2 it volition think a novel C2 from a Twitter account," SfyLabs researchers said inwards a spider web log post. 

"This is something nosotros accept seen inwards the desktop banking malware globe before, but the showtime fourth dimension nosotros run into it happening inwards an Android banking trojan."

The Red Alert 2.0 is currently targeting victims from to a greater extent than than sixty banks as well as social media apps across the globe as well as plant on Android 6.0 (Marshmallow) as well as previous versions.

Here's How the Red Alert 2.0 Trojan Works:

Once installed on victim's telephone via the third-party app store, the malware waits for the victim to opened upwardly a banking or social media app, whose interface it tin simulate, as well as in i lawsuit detected, the Trojan at nowadays overlays the master copy app alongside a simulated user interface.

The simulated interface as well as then informs the victim that at that topographic point is an mistake piece logging the user inwards as well as requests the user to re-authenticate his/her account.

As presently equally the user enters the credentials into the simulated user interface, Red Alert records them as well as sends them to the attacker-controlled command as well as command (C&C) server to endure used past times the attackers to hijack the account.

In representative of banking apps, the recorded information is existence used past times attackers to initiate fraudulent transactions as well as drain the victim's depository fiscal establishment account.

Since Red Alert 2.0 tin likewise intercept SMS text messages received past times the infected smartphone, the trojan could piece of job around two-factor authentication techniques that otherwise are designed to limit such attacks.

Ways to Protect Yourself Against Such Android Banking Trojans

The easiest agency to preclude yourself from existence a victim of i such mobile banking Trojan is to avoid downloading apps via third-party app stores or links provided inwards SMS messages or emails.

Just to endure on the safer side, become to Settings → Security as well as brand certain "Unknown sources" selection is turned off on your Android device that blocks installation of apps from unknown sources.

Most importantly, verify app permissions earlier installing whatever app, fifty-fifty from official Google Play Store, as well as if you lot uncovering whatever application asking to a greater extent than than what it is meant for, but create non install it.

It is e'er a expert persuasion to install an anti-virus app from a reputed vendor that tin honour as well as block such Trojan earlier it tin infect your device.

Also, e'er cash inwards one's chips on your arrangement as well as apps up-to-date.

Share This :