Malicious “RedAlert - Rocket Alerts” application targets Israeli phone calls, SMS, and user information

This post details the analysis of a malicious Android application impersonating a legitimate rocket alert app. It describes how the attackers created a malicious website that offered a modified APK for download, which, when installed, collected sensitive user data including contacts, call logs, SMS, account information, and installed apps. The analysis includes the specific Android permissions requested by the malicious app, the structure of the malicious code within the APK, how stolen data is encrypted (AES with RSA public key) and uploaded to a command and control server, and the anti-analysis techniques employed (anti-debugging, anti-emulation, anti-test). It also provides IOCs such as the malicious download URL, C2 IP address, APK SHA-256 hash, and the public RSA key, along with recommendations for detection and protection.