RedWing: A Mobile Malware-as-a-Service Operation

MITRE Techniques

• [T1660 ] Phishing – Malicious APKs are delivered via fake mobile-targeted sites and app-store lookalikes (‘host external phishing sites to download malicious APKs’).
• [T1624.001 ] Event Triggered Execution: Broadcast Receivers – The malware creates receivers to handle SMS and outgoing call events (‘creates a broadcast receiver to receive SMS events and outgoing calls’).
• [T1655.001 ] Masquerading: Match Legitimate Name or Location – It impersonates legitimate app stores such as Google Play to appear trusted (‘impersonating Google Play icon as an extension’).
• [T1516 ] Input Injection – RedWing simulates taps, swipes, clicks, and text entry to control the device (‘mimic user interaction, perform clicks and various gestures, and input data’).
• [T1406.002 ] Obfuscated Files or Information: Software Packing – It dynamically loads encrypted payload components from assets (‘Loads the encrypted dex dynamically from its assets’).
• [T1417.001 ] Input Capture: Keylogging – The malware captures typed input and keystrokes (‘It has a keylogger feature’).
• [T1417.002 ] Input Capture: GUI Input Capture – It captures the displayed UI to observe sensitive on-screen information (‘It is able to get the shown UI’).
• [T1517 ] Access Notifications – It monitors notifications and SMS-related content (‘Can listen to the notifications’).
• [T1426 ] System Information Discovery – The malware collects device information such as model and Android version (‘It gets device info such as device name, Android version etc’).
• [T1418 ] Software Discovery – It enumerates installed applications on the device (‘Malware collects installed application package list’).
• [T1513 ] Screen Capture – It records the screen and sends visual data to the C2 (‘Malware can record screen content’).
• [T1512 ] Capture Camera – It activates the camera to take photos (‘Malware opens camera and takes pictures’).
• [T1429 ] Audio Capture – It records ambient audio through the microphone (‘Malware captures Audio recordings’).
• [T1616 ] Call Control – It can initiate or forward calls from the victim device (‘Malware can make calls’).
• [T1636.002 ] Protected User Data: Call Log – It steals call logs from the device (‘Malware steals call logs’).
• [T1636.003 ] Protected User Data: Contact List – It exports the victim’s contacts (‘It exports the device’s contacts’).
• [T1636.004 ] Protected User Data: SMS Messages – It steals SMS messages from the infected device (‘Steals SMSs from the infected device’).
• [T1437.001 ] Application Layer Protocol: Web Protocols – The malware communicates with its servers over HTTP (‘Uses HTTP protocol to communicate with C&C servers’).
• [T1481.002 ] Web Service: Bidirectional Communication – It uses WebSocket for command polling and session control (‘It uses websocket communication to poll the TA’s server and get the commands to execute’).
• [T1646 ] Exfiltration Over C2 Channel – Stolen data is sent back through the command-and-control channel (‘Sending exfiltrated data over C&C server’).
• [T1582 ] SMS Control – The malware reads and manipulates SMS to intercept verification messages (‘It can read SMS messages’).