CloudSEK’s Customer Threat Research Team discovered a malware sample in the wild (ITW) that targeted the customers of Indian Banks.
Analyzing the APK’s using CloudSEK’s security search engine for mobile applications BeVigil we discovered source code, inner functionality of malware, permissions used and URL endpoints to which malware was communicating.
The malware was delivered upon submitting a form that requested information such as Name, Mobile Number and Email Address.
Analyzing the APK file we discovered the malware is capable of stealing Credit/Debit Card information, net banking passwords and SMS to read/submit One Time generated passwords on the victim’s behalf.
Note: We believe it is an ongoing activity since multiple samples targeting prominent banks from India were discovered in the last 3 months.
Information from Technical Analysis
The malicious app is tricking the victims into giving up their Card details and netbanking passwords by luring them using financial rewards.
The malicious app is using the official logo of Indian banks to trick victims into believing that the app is legitimate , which can be used to redeem reward points.
The app requires a number of permissions while being installed on an android device. Many of these permissions are classified in the dangerous permissions category.
These dangerous permissions include permission to read the device call logs, read contacts, read SMS, receive SMS, get and authenticate accounts.
These permissions allow the malware to steal sensitive information from the victim’s device, read and receive SMS, get information about the accounts being used on the device, use these accounts for authentication and even create new accounts.
The app uses intent filters with high priority to know about the device reboot to maintain persistence.
The high priority-999 allows the malware to know about the boot change as soon as there is any change. This allows the malware to restart its broadcast receiver to receive any kinds of broadcasts sent across the system by the device OS or other apps.
The malware is exfiltrating all the SMS and Call logs from the Victims device to its C2 server.
It is important to note that all the exfiltrated data is being encrypted before sending it to the C2 server.
Encryption Key used for Encryption
Command & Control
Based on the static code analysis of the malware, we can say that the malware is not just stealing data but could also be used to execute commands sent by the Threat Actor.
These commands can be sent by the attacker to the victim device to make the malware perform certain actions like uploading SMS, call logs to the C2 and even putting the device on Silent Mode.
As the malware takes the audio manager permission during install, putting the victim on silent mode is done just before the Threat Actor tries to use the victim’s credit card to make any purchase or transaction to make the victim not notice the OTP of transaction related SMS.
Once the SMS has been uploaded to the C2, the malware can also delete the SMS, so that the victims can not find the SMS whenever they check their phones.