Categories: MalwareSecurity

TheAndroid.DDoS.1.origin, a new malware detected on Android mobile

In line with expectations a new cyber threat is menacing the mobile, in particular the most diffused OS, Android. The Russian anti-virus vendor Doctor Web has detected a new malware, dubbed  TheAndroid.DDoS.1.origin, that target Android mobile allowing the attacker to carry out mobile denial of service attacks.

Currently is not known how the trojan has infected mobile devices but security experts believe that it appears to disguise itself as a legitimate Google Play, adopting a social engineering technique.

The malicious code is very cunning, it works silently in background, hidden to the mobile user, and once the victim has been infected it contacts the Command & Control server communicating a series of information on the devices such as its phone number. The phone number is used by hackers to send commands to the device via SMS.

TheAndroid.DDoS.1.origin malware creates an icon on the desktop equal to the Google Play one, when user clicks on it the malicious code is executed, but the shortcut also opens the legitimate Google Play in order to avoid raising any suspicion.

One of the principal features of the malware is its capability to transform the mobile device in a bot to conduct DDoS attack, once the C&C server send to the phone the DDoS command , TheAndroid.DDoS.1.origin starts to flood the target address with data packets.

Doctor Web blog post states:

Activities of the Trojan can lower performance of the infected handset and affect the well-being of its owner, as access to the Internet and SMS are chargeable services. Should the device send messages to premium numbers, malicious activities will cost the user even more.

Another monetization schema implemented by criminals consists to sending out SMS messages to certain numbers to sign up the victim for premium mobile services, SMS can be sent to premium rate numbers charging the fraudsters’ wallet.

To avoid similar cyber threat it is fundamental that mobile users follow few simple best practices such as never jailbreak the phone neither download applications from third part Appstore and of course install a security software also on the mobile. Another valid suggestion for user is to be sure of the content he download verifying its reputation controlling app rating and user reviews, and of course be aware of any request the apps make asking for various permissions.

Pierluigi Paganini

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

A new Mirai botnet variant targets DigiEver DS-2105 Pro DVRs

Akamai researchers discovered a new Mirai botnet variant targeting a vulnerability in DigiEver DS-2105 Pro…

12 hours ago

A ransomware attack disrupted services at Pittsburgh Regional Transit

A ransomware attack on Pittsburgh Regional Transit (PRT) was the root cause of the agency's…

13 hours ago

A cyber attack hit Japan Airlines delaying ticket sales for flights

A cyberattack hit Japan Airlines (JAL), causing the suspension of ticket sales for flights departing…

17 hours ago

Apache fixed a critical SQL Injection in Apache Traffic Control

Apache Software Foundation (ASF) addressed a critical SQL Injection vulnerability, tracked as CVE-2024-45387, in Apache Traffic…

1 day ago

BellaCPP, Charming Kitten’s BellaCiao variant written in C++

Iran-linked APT group Charming Kitten has been observed using a new variant of the BellaCiao…

1 day ago

DMM Bitcoin $308M Bitcoin heist linked to North Korea

Japanese and U.S. authorities attributed the theft of $308 million cryptocurrency from DMM Bitcoin to…

2 days ago

This website uses cookies.