Researchers at Check Point have recently discovered a new malware threat that targets mobile device users. Dubbed WAPDropper, this is a multi-function bit of code that’s capable of being outfitted with a variety of payloads. At present, the hackers controlling WAPDropper have seen fit to include a premium dialer module, which gives the code the ability to sign the owner of the infected device up for a wide range of paid premium services.
If you’re unfortunate enough to wind up with this malware strain on your device, the first thing WAPDropper will do will be to gather information about your device.
The data it will steal includes:
- Device ID
- Mac Address
- Your Subscriber ID
- The make and model of your device
- A list of all the apps you have installed
- A list of all services that are running
- The topmost activity package name
- Whether or not the screen is currently turned on
- Whether or not notifications are enabled for each installed app
- Whether or not each installed app can draw overlays
- How much free storage space you’ve got
- And the total amount of RAM the device has, and how much RAM is currently available
Having gathered the information, it will then reach out to it Command and Control server and relay those details back to the hackers. Then it will download and install the premium dialer.
Many premium based services rely on image-based CAPTCHA challenges, and WAPDropper was designed to get around those via machine learning routines built into the code.
This is a highly advanced, incredibly capable malware strain that could see you racking up hefty monthly charges without even realizing it until you get the first month’s bill. If there’s a silver lining here, it lies in the fact that at least to this point, the campaign is only targeting victims in Malaysia and Thailand. That, at least for the moment, makes it somewhat limited in scope.
That’s small consolation for people living in those regions, of course, and that could change at any time. So this is definitely a threat to be aware of, especially if you live, work, or travel in the areas where it’s currently operational.
