SecuriDropper Uses Session-Based Installation to Bypass Android 13 Restricted Settings
Summary
ThreatFabric reports that SecuriDropper uses session-based package installation to bypass Android 13 Restricted Settings and deliver SpyNote spyware and banking trojans, including Ermac. Researchers say they cannot confirm a direct link to Zombinder.
Key points
- SecuriDropper is a dropper-as-a-service that ThreatFabric observed bypassing Android 13 Restricted Settings by using the session-based installation method associated with app marketplaces.
- The dropper requests external storage and package installation permissions, then prompts users to reinstall a payload and enable AccessibilityService.
- ThreatFabric observed SecuriDropper disguised as legitimate apps and distributing SpyNote spyware, which can use AccessibilityService to access sensitive information.
- The researchers also found banking trojans delivered through deceptive websites and third-party platforms, including Ermac samples distributed via Discord.
- Zombinder was advertised as a service with builders capable of bypassing Android 13 restrictions, but ThreatFabric said it had no definitive evidence linking it to SecuriDropper.
Article Details
- Attack Vectors
- SecuriDropper is distributed disguised as a seemingly legitimate application, including through phishing websites, deceptive websites, third-party platforms, and Discord.
- After installation, the dropper requests external-storage and package-installation permissions, then uses a session-based installation method to install a payload and bypass Android 13 Restricted Settings.
- The dropper prompts users to tap “Reinstall” and enable permissions, including AccessibilityService access for the payload.
- Reported payloads include SpyNote spyware and Ermac banking Trojan samples.
- Defensive Notes
- Treat apps distributed outside official app stores as higher risk; the article notes that sideloaded apps are not subject to the same checks as apps submitted to official stores.
- Be cautious of apps that request external-storage or package-installation permissions and prompt users to reinstall an application or enable AccessibilityService.
- Android 13 Restricted Settings is described as restricting sideloaded apps from directly requesting Accessibility and Notification Listener access, but the article reports that session-based installation can bypass this protection.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 13daf7b94124c142d509b036516eb3d532c22696574d8cd5d65aa9d636c293a9 | SHA-256 hash of an Ermac.C dropped payload sample listed in the article. |
| SHA256 | 22630eee4fdf1958e6c98721f0ccc522b2413a6f6c49f315f34c45726bf18b2d | SHA-256 hash of a SpyNote.D dropped payload sample listed in the article. |
| SHA256 | 2f64dd679494bdfba962bdc8ec6fb5e13ec4c754f12d494291442dc3e4862a93 | SHA-256 hash of a SecuriDropper sample listed in the article. |
| SHA256 | 68234450d90668909697893a76fc4a0791b35ba3f7bfc4d9d14f2866706019f3 | SHA-256 hash of a SecuriDropper sample listed in the article. |
MITRE ATT&CK
T1407SecuriDropper installs a secondary payload on the device using a session-based package installation method.T1412The article reports that SpyNote captures text messages.T1413The article reports that SpyNote captures call logs.T1476SecuriDropper is distributed to victims as an app disguised as legitimate software, including through phishing and deceptive websites and third-party platforms.T1513The article reports that SpyNote captures screen recordings.
Malware
ERMACAn intriguing aspect of our findings centres around the Ermac malware family, a notable player within the realm of Banking Trojans.SecuriDroppermeasure introduced by Google in Android 13 to help protect against malware by taking a closer look at SecuriDropper, the first example of a widely distributed dropper bypassing this security measure.SpyNoteRecently, a significant surge in the activity of SpyNote, a renowned spyware family with potent Remote Access Trojan (RAT) capabilities, has caught our attention.
Vendors
Products
Android 13at how threat actors are bypassing the "Restricted Settings" security measure introduced by Google in Android 13 to help protect against malware by taking a closer look at SecuriDropper, the first example of a widelyDiscordWhat sets this discovery apart is the deployment of Ermac samples via the Discord platform, a widely known and legitimate communication channel, primarily used by gamers and diverse online communities.