Fake Israeli Red Alert App Uses SMS Phishing to Spread Android Spyware
Summary
CloudSek analyzes a trojanized Israeli Red Alert app distributed by SMS links. The Android malware disguises itself as the legitimate alert app, collects SMS, contacts and GPS data, and sends it to attacker-controlled infrastructure.
Key points
- The trojanized app is distributed through SMS phishing links and sideloaded as an APK, outside the Google Play Store.
- It mimics the official app’s alert interface while requesting access to SMS, contacts and location.
- The loader uses Android Package Manager hooks to spoof the app’s signature and installer, and dynamically loads a hidden payload.
- Collected messages, contacts and GPS data are staged locally and sent via HTTP POST to an identified command-and-control endpoint.
- The report provides APK and payload hashes, distribution links, network indicators and infrastructure details for investigation.
- Recommended responses include isolating suspected devices, blocking identified infrastructure, restricting sideloading and factory-resetting infected devices.
Article Details
- Attack Vectors
- SMS phishing (smishing) distributes a trojanized Red Alert APK and directs victims to sideload it outside Google Play.
- The app requests SMS, Contacts, and Location permissions, then stages collected data and sends it through repeated HTTP POST requests.
- The loader dynamically extracts and loads the umgdn asset and hooks Android package-manager calls to spoof the app's signing certificate and installer.
- Defensive Notes
- Quarantine suspected devices, revoke administrator privileges granted to the app, and perform a factory reset; do not restore from a backup made after infection.
- Block the reported C2 domain and IP addresses, and investigate periodic outbound HTTP POST traffic.
- Use MDM to prohibit sideloading, restrict installations to managed Google Play, and audit applications requesting combinations of SMS, Contacts, Location, and SYSTEM_ALERT_WINDOW permissions.
- Warn users that official emergency-alert applications should not require access to SMS inboxes or full contact lists.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 104[.]21[.]64[.]137 | IP captured during execution and listed as proxy infrastructure facilitating the malware's C2 and exfiltration communications. |
| IPV4 | 172[.]67[.]137[.]156 | IP captured during execution and listed as infrastructure facilitating the malware's C2 and exfiltration communications; associated with redalert.me endpoints. |
| IPV4 | 216[.]45[.]58[.]148 | C2 and exfiltration infrastructure associated with api.ra-backup.com. |
| IPV4 | 44[.]200[.]176[.]254 | Secondary AWS IP captured during execution and listed as infrastructure facilitating the malware's C2 and exfiltration communications. |
| IPV4 | 44[.]208[.]242[.]141 | IP captured during execution and listed as part of the infrastructure facilitating the malware's C2 and exfiltration communications; also associated with api.pushy.me. |
| MD5 | 98294a2c838eaf63fe94cccf52af3ce8 | MD5 hash of the dynamically loaded umgdn payload. |
| MD5 | 9c6c67344fecd8ff8dbbee877aad7efc | MD5 hash of the malicious RedAlert.apk sample. |
| SHA256 | 0cba66e78ddaeecfdd462c8cb39e443d083dc58c609b0edc73e8101e59ca91e8 | SHA-256 hash of the dynamically loaded umgdn payload. |
| SHA256 | 83651b0589665b112687f0858bfe2832ca317ba75e700c91ac34025ee6578b72 | SHA-256 hash of the malicious RedAlert.apk sample. |
| URL | hxxp[:]//bit[.]ly/3Ozydsn | Shortened link identified as a distribution link for the malicious app. |
| URL | hxxps[:]//api[.]ra-backup[.]com/analytics/submit[.]php | Malware data-submission endpoint used to exfiltrate staged victim data. |
| URL | hxxps[:]//api[.]tzevaadom[.]app | Backend API identified by the article as associated with the campaign. |
| URL | hxxps[:]//bit[.]ly/2O3fHEX | Shortened link identified as a distribution link for the malicious app. |
| URL | hxxps[:]//bit[.]ly/3GfZoys | Shortened link identified as a distribution link for the malicious app. |
| URL | hxxps[:]//www[.]shirideitch[.]com/wp-content/uploads/2022/06/RedAlert[.]apk | URL identified as a distribution source for the malicious RedAlert APK. |
Malware
Products
Androidutilizing dynamic proxy hooks to spoof the original application's 2014 signing certificate and evade Android's system integrity checks. The core payload, heavily obfuscated within the class, aggressively polls forGoogle Play Storethrough targeted SMS phishing (smishing). This delivery mechanism deliberately bypasses the Google Play Store—the sole legitimate repository for the authentic "Red Alert" app, which operates cleanly with onlyRed Alertmechanism deliberately bypasses the Google Play Store—the sole legitimate repository for the authentic "Red Alert" app, which operates cleanly with only basic notification access. By manipulating victims into
Countries
Irana critical threat vector directly exploiting the heightened civilian panic surrounding the current Israel-Iran kinetic conflict. Threat actors are capitalizing on the desperate need for real-time rocket alerts byIsraela critical threat vector directly exploiting the heightened civilian panic surrounding the current Israel-Iran kinetic conflict. Threat actors are capitalizing on the desperate need for real-time rocket alerts