Mobile dropper Trojan – HQWar: the higher it flies, the harder it drops

guest · Oct 2, 2019

HQWar: the higher it flies, the harder it drops
October 2, 2019
https://securelist.com/hqwar-the-higher-it-flies-the-harder-it-drops/93689/

Mobile dropper Trojans are one of today’s most rapidly growing classes of malware. In Q1 2019, droppers are in the 2nd or 3rd position in terms of share of total detected threats, while holding nearly half of all Top 20 places in 2018. Since the droppers’ main task is to deliver payload while sidestepping the protective barriers, and their developers are fully bent on countering detection, this is probably one of the most dangerous classes of malware.

One of the most dangerous and widely spread families of Trojan droppers is Trojan-Dropper.AndroidOS.Hqwar. Originally created as a MaaS infrastructure, today Hqwar is used for both small-scale attacks and big ones affecting thousands of users all over the world.

From the technical viewpoint, the dropper is a wrapper around the payload’s DEX file to be decrypted and loaded, comprising two classes.
As Hqwar doesn’t “drop” the APK file but only loads the code, there is no need for an app installation request which can potentially be declined by the user.
Click to expand...

Conclusion
Despite all the convenient features the dropper’s author has built into it, we believe Hqwar (and similar wrappers) may soon lose much of their popularity: their counter-detection mechanisms have become obsolete, while the structure of the APK file implies there are places that cannot be “littered”, allowing for timely detection of threats (exactly what Kaspersky’s protective solutions are for).
Click to expand...

Log in or Sign up

Mobile dropper Trojan – HQWar: the higher it flies, the harder it drops

guest Guest

Log in or Sign up

Mobile dropper Trojan – HQWar: the higher it flies, the harder it drops

guest Guest

Useful Searches