In this blog we will look at how threat actors are bypassing the "Restricted Settings" security measure introduced by Google in Android 13 to help protect against malware by taking a closer look at SecuriDropper, the first example of a widely distributed dropper bypassing this security measure.

Droppers are a specific category of malware whose main purpose is to install a payload on an infected device. The use of droppers allows actors to separate the development and execution of an attack from the installation of the malware. This can also be a businness endeavour in itself, as many actors choose to focus on developing droppers that can be sold to other criminals as part of what is commonly defined as MaaS (Malware-as-a-Service).

No wonder then that Android Droppers have emerged as the preferred method for deploying malware onto unsuspecting users' devices. Malware actors are focusing more and more energy and effort on this aspect of their distribution strategies to increase their reach as much as possible.

Droppers and the actors behind them are in a constant state of evolution as they strive to outwit evolving security measures. 

In Android 13, Google responded with their latest salvo in this ongoing battle by introducing restrictions on the privileges granted to sideloaded applications, a change we discussed in our 2022 mobile threat landscape update. Google calls this feature "Restricted Settings".

Sideloaded applications are applications which are loaded onto the device from sources other than official app stores (such as the Google Play Store). Because sideloaded apps are not subject to the same checks as apps submitted for publication in official app stores, this method of loading apps onto devices is seen as attractive to malware developers.

When we initially analysed the new Restricted Setting feature, we theorised that if a sideloaded app was able to use a "session-based" installer, it would bypass the restrictions. Consequently, this solution, while a significant step, does not prevent cybercriminals from acquiring the necessary privileges and permissions for their malicious intentions.

Up to this point, we did not see underground actors adopt this approach at scale. It remained the domain of theories and proof of concepts.

Recently, this has changed. We have observed a new Dropper-as-a-Service (DaaS) offering that bypasses Restricted Settings using the method we identified back in 2022. We've named this dropper family SecuriDropper.

Roughly at the same time, our researchers also noticed a new advertisement in cybercrime forums for the Zombinder service, which also claims to bypass Restricted Settings.

In the next part of this article, we will examine SecuriDropper, including its observed payloads. Next, we will take a closer look at the Zombinder service.

Dropper-as-a-Service (DaaS) is a kind of service that is gaining quite a lot of momentum in the cyber underground. DaaS offers a two-staged infection process, which in the case of SecuriDropper allows cybercriminals to bypass any security solutions including Android 13's Restricted Settings without being detected.

public static String TargetBaseid = <app_package_name>;
protected void onCreate(Bundle bundle0) {
    super.onCreate(bundle0);
    Context context0 = this.getApplicationContext();
    this.mContext = context0;
    if (InstallActivity.isAppAvailable(context0, InstallActivity.TargetBaseid)) {
        Intent intent0 =          this.getPackageManager().getLaunchIntentForPackage(InstallActivity.TargetBaseid);
        intent0.addFlags(0x10000000);
        intent0.addFlags(0x20000000);
        this.startActivity(intent0);
        this.finish();
        return;
     }
...
}

this.upbtn = (Button)this.findViewById(0x7F05000F);
default: {
 this.titleview.setText("Something went wrong.");
 this.decripview.setText("We encountered a problem. To fix it, please tap \'Reinstall\' below.");
 this.upbtn.setText("Reinstall");
 this.upbtn.setOnClickListener(new View.OnClickListener() { ...
 public void onClick(View view0) {
    if(!InstallActivity.this.checkPermissions()) {
         InstallActivity.this.requestPermissions();
         return;
     }
     worker.install(InstallActivity.this.getApplicationContext());
 }

After the session-based installation, the malicious application operates according to its intended purpose, successfully requesting the essential permissions while prompting users to enable AccessibilityService, which is possible due to the circumvention of Android 13's "Restricted Setting" feature.

ThreatFabric researchers continuously track the activity of SecuriDropper. The dropper has been observed camouflaging itself as a legitimate application spanning various categories, from social apps to productivity tools.

In our investigation into the payloads deployed through SecuriDropper we uncovered malware families belonging to two different malware categories: Spyware and Banking Trojans.

ThreatFabric unveiled a campaign of SpyNote samples distributed through phishing websites, deployed by SecuriDropper. SpyNote needs AccessibilityService permissions to function (a defining feature within SpyNote among spyware families): it uses it to capture sensitive information, including text messages, call logs, and even screen recordings.

Given this requirement, it is no surprise that a SpyNote campaign would use SecuriDropper as its dropper: without it it would not be able to obtain the required permissions as Restricted Settings is intended to prevent sideloaded apps from obtaining this often abused permission.

Our investigation on SecuriDropper also unveiled the use of this dropper family to distribute Banking Trojans through deceptive websites and third-party platforms.

Zombinder got its name due to its peculiarity of "gluing" together a legitimate application with code responsible for installing a payload on an infected device. In effect, Zombiner piggybacks a dropper on the back of a legitimate app. These Zombinder builders are available at a price point of $1000.

What is interesting about recent advertisements, is that purchasers of the Zombinder service also gain access to a dropper builder, which consists only of the dropper capability (without the "gluing" feature). Interestingly, this description fits quite well with the features of SecuriDropper.

However, at the time of writing this blog, we do not possess definitive information to establish a direct connection between SecuriDropper and the advertised Zombinder service. ThreatFabric researchers will continue to closely monitoring both the SecuriDropper and Zombinder services.

In our exploration of droppers bypassing Android 13 restrictions, we have witnessed the evolution of the mobile security landscape. As Android continues to raise the bar with each iteration, cybercriminals, too, adapt and innovate.

Dropper-as-a-Service (DaaS) platforms have emerged as potent tools, allowing malicious actors to infiltrate devices to distribute spyware and banking Trojans. These malicious payloads, once unleashed, can compromise users' privacy and financial security.

Securidropper is evidence that underground actors have independently discovered a method of bypassing Android 13's Restricted Settings feature first identified in May of this year by ThreatFabric researchers.

Moreover, the emergence of services like Zombinder are indications of a booming market in cybercrime, offering builders and tools for evading Android 13's defenses. It is a testament to the resourcefulness of those seeking to exploit security vulnerabilities for their gain.

SecuriDropper and Zombinder are reminders for organisations that rely on or conduct business through mobile channels that it is critically important to stay abreast of developments.