Malicious Android Trojan GravityRAT Reappears

The Android Trojan GravityRAT is back, disguised as an alleged secure chat app with free encryption. The app called SoSafe Chat is mainly advertised on social media and in other chats.

This is reported by Bleeping Computer. Accordingly, the Trojan, disguised as the fake end-to-end encrypted chat app, is now busy distributing Android spyware. Last year, the Trojan was distributed using an app called Travel Mate Pro. There are currently indications that the Trojan is quite targeted in India. However, in the past year, the infected devices showed up worldwide after a few weeks and the spread had increased rapidly. That could happen again now.

GravityRAT is a particularly dangerous Android Trojan. RAT stands for Remote Access Trojan, so it is used by operators to access the end device remotely. Once installed on a device, the spyware can perform a wide range of malicious behavior that enables threat actors to exfiltrate data, spy on the victim, and track their location.

That includes:

• Read SMS, call logs and contact details
• Changing or modifying system settings
• Read the current cellular network information, the phone number and serial number of the victim’s phone, the status of ongoing calls and a list of all phone accounts registered on the device
• Read or write the files on the device’s external storage
• Record audio
• Get information about the connected network
• Get the location of the device

Advice For Escape

In order not to fall for a fake app, you should take a few tips to heart. This includes never downloading apps from a download link that is distributed via advertising, phishing, or spam messages in chat networks, if possible. It is then better to search for the app yourself in the Google Play Store – but be careful: Apps that were infected with malware have also repeatedly appeared in the Google Store. A virus scanner on the device that detects suspicious traffic from malicious apps is, therefore, a good choice.