---
title: SecuriDropper Android Malware
description: SecuriDropper is a widely distributed dropper-as-a-service that bypasses Android Restricted Settings.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [SecuriDropper Android Malware](https://blog.polyswarm.io/securidropper-android-malware)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Nov 17, 2023 6:27:39 PM

**Related Families:** SpyNote, Ermac

## **Executive Summary**

## SecuriDropper is a widely distributed dropper-as-a-service that bypasses Android Restricted Settings.

**Key Takeaways**

- SecuriDropper is a widely distributed dropper-as-a-service that bypasses Android Restricted Settings.
- It uses a two-stage infection process, with the first stage involving a seemingly benign app and the second involving the installation of a secondary payload.
- Secondary payloads often include spyware and banking Trojans. 
- SecuriDropper uses an Android API that allows it to mimic the use of a session-based installer, making it appear to be an app from the official Android store. 

**What is SecuriDropper?**

SecuriDropper is a widely distributed dropper-as-a-service that bypasses Android Restricted Settings. Restricted Settings, which imposes restrictions on the privileges granted to sideloaded apps, was introduced in Android 13 for anti-malware protection. ThreatFabric [reported](https://www.threatfabric.com/blogs/droppers-bypassing-android-13-restrictions) on SecuriDropper.

Restricted Settings prohibits sideloaded apps from directly requesting Accessibility settings and Notification Listener access. These two features are often abused by malware. However, the restrictions do not apply to apps downloaded from the official Android app store. The installation method used to load official versus sideloaded apps differs, allowing Android’s operating system to distinguish between sideloaded and official apps, with official apps using a “session-based” package installer. However, if a sideloaded app finds a way to use a session-based installer, it can potentially bypass these restrictions. SecuriDropper is among the first Android malware known to bypass restricted settings using this method.

SecuriDropper uses a two-stage infection process. In the first stage, a seemingly benign app is distributed, often disguised as another legitimate app. This app serves as the dropper. In the second stage, this dropper is responsible for installing a secondary payload, such as spyware or banking Trojans, on the victim’s mobile device. Since the tasks are performed separately, it is more difficult for security measures to detect the malicious payload. Unlike previous Android droppers, SecuriDropper uses a different Android API to install the new payload, using a session-based installer. This allows the installed payload to bypass Restricted Settings, as it appears to be an official app.

ThreatFabric noted some SecuriDropper samples were observed dropping SpyNote, a notorious spyware family with RAT capabilities. SecuriDropper was also observed dropping the Ermac banking trojan.

**IOCs **

**SecuriDropper**

 

PolySwarm has a sample of SecuriDropper.

 

[68234450d90668909697893a76fc4a0791b35ba3f7bfc4d9d14f2866706019f3](https://polyswarm.network/scan/results/file/68234450d90668909697893a76fc4a0791b35ba3f7bfc4d9d14f2866706019f3)

 

You can use the following CLI command to search for all SecuriDropper samples in our portal:

**$ polyswarm link list -f SecuriDropper**

 

**SpyNote**

 

PolySwarm has a sample of SpyNote.

 

[22630eee4fdf1958e6c98721f0ccc522b2413a6f6c49f315f34c45726bf18b2d](https://polyswarm.network/scan/results/file/22630eee4fdf1958e6c98721f0ccc522b2413a6f6c49f315f34c45726bf18b2d)

 

You can use the following CLI command to search for all SpyNote samples in our portal:

**$ polyswarm link list -f SpyNote**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or to subscribe.

Contact us at [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) | Check out our [blog](https://blog.polyswarm.io/) | [Subscribe](https://polyswarm.io/ransomwarereport/) to our reports.***

 

[View full post](https://blog.polyswarm.io/securidropper-android-malware)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2023-11-17T18:29:09.531Z",
  "datePublished" : "2023-11-17T18:27:39Z",
  "headline" : "SecuriDropper Android Malware",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/SecruDropper.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/securidropper-android-malware",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```