Dendroid (malware): Difference between revisions
Content deleted Content added
added category |
c/e |
||
| Line 1: | Line 1: | ||
'''Dendroid''' is |
'''Dendroid''' is [[malware]] that affects Android OS and targets the mobile platform.<ref>http://www.symantec.com/connect/blogs/android-rats-branch-out-dendroid</ref> |
||
It was first discovered in early of 2014 by Symantec and appeared |
It was first discovered in early of 2014 by Symantec and appeared in the underground for sale for $300.<ref>http://securityaffairs.co/wordpress/22848/cyber-crime/dendroid-new-android-rat.html</ref> |
||
Some things were noted in Dendroid, such as being able to hide from emulators at the time.<ref>https://www.bluecoat.com/security-blog/2014-05-27/dendroid-under-hood-%E2%80%93-look-inside-android-rat-kit</ref> |
Some things were noted in Dendroid, such as being able to hide from emulators at the time.<ref>https://www.bluecoat.com/security-blog/2014-05-27/dendroid-under-hood-%E2%80%93-look-inside-android-rat-kit</ref> |
||
When first discovered in 2014 it was one of the most sophisticated Android |
When first discovered in 2014 it was one of the most sophisticated Android [[Remote administration software|remote administration tool]]s known at that time.<ref>https://www.helpnetsecurity.com/2014/03/07/dendroid-spying-rat-malware-found-on-google-play/</ref> |
||
It was one of the first Trojan |
It was one of the first [[Trojan horse (computing)|Trojan application]]s to get past Google's Bouncer and caused researchers to warn about it being easier to create Android malware due to it.<ref>http://www.pcworld.com/article/2105500/new-crimeware-tool-dendroid-makes-it-easier-to-create-android-malware-researchers-warn.html</ref> |
||
It also seemed to follow in the footsteps of Zeus and SpyEye by having simple |
It also seemed to follow in the footsteps of [[Zeus (malware)|Zeus]] and SpyEye by having simple-to-use [[Command and control (malware)|command and control]] panels.<ref>https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=718</ref> |
||
The code appeared to be leaked somewhere around 2014<ref>http://www.securityweek.com/source-code-android-rat-dendroid-leaked-online</ref> |
The code appeared to be leaked somewhere around 2014.<ref>http://www.securityweek.com/source-code-android-rat-dendroid-leaked-online</ref> |
||
It was noted that an [[File binder|apk binder]] was included in the leak which provided a simple way to bind |
It was noted that an [[File binder|apk binder]] was included in the leak, which provided a simple way to bind Dendroid to legitimate applications. |
||
It is capable of: |
|||
* |
* Deleting call logs |
||
* Opening web pages |
* Opening web pages |
||
* Dialing any number |
* Dialing any number |
||
| Line 18: | Line 18: | ||
* Upload images, video |
* Upload images, video |
||
* Opening an application |
* Opening an application |
||
* Able to perform |
* Able to perform a [[denial-of-service attack]] attack |
||
* Can change the command and control server<ref>http://thehackernews.com/2014/03/symantec-discovered-android-malware.html</ref> |
* Can change the command and control server<ref>http://thehackernews.com/2014/03/symantec-discovered-android-malware.html</ref> |
||
==See also== |
==See also== |
||
* [[Botnet]] |
* [[Botnet]] |
||
* [[Command and control (malware)]] |
|||
* [[Denial-of-service attack]] |
|||
* [[File binder]] |
|||
* [[Shedun]] |
* [[Shedun]] |
||
* [[Trojan horse]] |
|||
* [[Zombie (computer science)]] |
* [[Zombie (computer science)]] |
||
* [[Zeus (malware)]] |
|||
==References== |
==References== |
||
Revision as of 07:31, 28 September 2016
Dendroid is malware that affects Android OS and targets the mobile platform.[1]
It was first discovered in early of 2014 by Symantec and appeared in the underground for sale for $300.[2] Some things were noted in Dendroid, such as being able to hide from emulators at the time.[3] When first discovered in 2014 it was one of the most sophisticated Android remote administration tools known at that time.[4] It was one of the first Trojan applications to get past Google's Bouncer and caused researchers to warn about it being easier to create Android malware due to it.[5] It also seemed to follow in the footsteps of Zeus and SpyEye by having simple-to-use command and control panels.[6] The code appeared to be leaked somewhere around 2014.[7] It was noted that an apk binder was included in the leak, which provided a simple way to bind Dendroid to legitimate applications.
It is capable of:
- Deleting call logs
- Opening web pages
- Dialing any number
- Recording calls
- SMS intercepting
- Upload images, video
- Opening an application
- Able to perform a denial-of-service attack attack
- Can change the command and control server[8]
See also
References
- ^ http://www.symantec.com/connect/blogs/android-rats-branch-out-dendroid
- ^ http://securityaffairs.co/wordpress/22848/cyber-crime/dendroid-new-android-rat.html
- ^ https://www.bluecoat.com/security-blog/2014-05-27/dendroid-under-hood-%E2%80%93-look-inside-android-rat-kit
- ^ https://www.helpnetsecurity.com/2014/03/07/dendroid-spying-rat-malware-found-on-google-play/
- ^ http://www.pcworld.com/article/2105500/new-crimeware-tool-dendroid-makes-it-easier-to-create-android-malware-researchers-warn.html
- ^ https://www.mysonicwall.com/sonicalert/searchresults.aspx?ev=article&id=718
- ^ http://www.securityweek.com/source-code-android-rat-dendroid-leaked-online
- ^ http://thehackernews.com/2014/03/symantec-discovered-android-malware.html