A New Android Banking Trojan Masquerades as Utility and Banking Apps in India

Authored by Dexter Shin

Through the years, cyber threats focusing on Android gadgets have change into extra refined and protracted. Lately, McAfee Cellular Analysis Group found a brand new Android banking trojan focusing on Indian customers. This malware disguises itself as important providers, similar to utility (e.g., fuel or electrical energy) or banking apps, to get delicate data from customers. Most of these providers are important for every day life, making it simpler to lure customers. We’ve beforehand noticed malware that masquerades as utility providers in Japan. As seen in such instances, utility-related messages, similar to warnings that fuel service will disconnect quickly until the invoice is checked, may cause important alarm and immediate instant motion from the customers.

We’ve recognized that this malware has contaminated 419 gadgets, intercepted 4,918 SMS messages, and stolen 623 entries of card or bank-related private data. Given the energetic malware campaigns, these numbers are anticipated to rise. McAfee Cellular Safety already detects this risk as Android/Banker. For extra data, go to McAfee Cellular Safety

Phishing by way of messaging platforms like WhatsApp

As of 2024, India is the nation with the best variety of month-to-month energetic WhatsApp customers. This makes it a first-rate goal for phishing assaults. We’ve beforehand launched one other Banker distributed by way of WhatsApp. Equally, we suspect that the pattern we not too long ago discovered additionally makes use of messaging platforms to achieve particular person customers and trick them into putting in a malicious APK. If a person installs this APK, it’s going to permit attackers to steal the sufferer’s monetary knowledge, thereby undertaking their malicious purpose.

Determine 1. Scammer messages reaching customers by way of Whatsapp (supply: reddit)

Contained in the malware

The malware we first recognized was pretending to be an app that allowed customers to pay their fuel payments. It used the emblem of PayRup, a digital cost platform for public service charges in India, to make it look extra reliable to customers.

Determine 2. Malware disguised as fuel payments digital cost app

As soon as the app is launched and the permissions, that are designed to steal private knowledge similar to SMS messages, are granted, it asks the person for monetary data, similar to card particulars or checking account data. Since this malware pretends to be an app for paying payments, customers are prone to enter this data to finish their funds. On the financial institution web page, you possibly can see main Indian banks like SBI and Axis Financial institution listed as choices.

Determine 3. Malware that requires monetary knowledge

If the person inputs their monetary data and tries to make a cost, the information is shipped to the command and management (C2) server. In the meantime, the app shows a cost failure message to the person.

Determine 4. Fee failure message displayed however knowledge despatched to C2 server

One factor to notice about this app is that it may well’t be launched instantly by the person by way of the launcher. For an Android app to look within the launcher, it must have “android.intent.class.LAUNCHER” outlined inside an <intent-filter> within the AndroidManifest.xml. Nonetheless, since this app doesn’t have that attribute, its icon doesn’t seem. Consequently, after being put in and launched from a phishing message, customers could not instantly notice the app continues to be put in on their machine, even when they shut it after seeing messages like “Financial institution Server is Down”, successfully retaining it hidden.

Determine 5. AndroidManifest.xml for the pattern

Exploiting Supabase for knowledge exfiltration

In earlier experiences, we’ve launched numerous C2 servers utilized by malware. Nonetheless, this malware stands out on account of its distinctive use of Supabase, an open-source database service. Supabase is an open-source backend-as-a-service, just like Firebase, that gives PostgreSQL-based database, authentication, real-time options, and storage. It helps builders shortly construct functions with out managing backend infrastructure. Additionally, it helps RESTful APIs to handle their database. This malware exploits these APIs to retailer stolen knowledge.

Determine 6. App code utilizing Supabase

A JWT (JSON Net Token) is required to make the most of Supabase by way of its RESTful APIs. Curiously, the JWT token is uncovered in plain textual content inside the malware’s code. This offered us with a singular alternative to additional examine the extent of the information breach. By leveraging this token, we have been in a position to entry the Supabase occasion utilized by the malware and achieve invaluable insights into the size and nature of the information exfiltration.

Determine 7. JWT token uncovered in plaintext

Throughout our investigation, we found a complete of 5,558 information saved within the database. The primary of those information was dated October 9, 2024. As beforehand talked about, these information embody 4,918 SMS messages and 623 entries of card data (quantity, expiration date, CVV) and financial institution data (account numbers, login credentials like ID and password).

Determine 8. Examples of stolen knowledge

Uncovering variants by package deal prefix

The preliminary pattern we discovered had the package deal identify “gs_5.buyer”. Via investigation of their database, we recognized 8 distinctive package deal prefixes. These prefixes present essential clues in regards to the potential rip-off themes related to every package deal. By inspecting the package deal names, we are able to infer particular traits and sure focus areas of the varied rip-off operations.

Based mostly on the package deal names, it appears that evidently as soon as a rip-off theme is chosen, no less than 2 totally different variants are developed inside that theme. This variability not solely complicates detection efforts but in addition will increase the potential attain and influence of their rip-off campaigns.

Cellular app administration of C2

Based mostly on the knowledge uncovered to this point, we discovered that the malware actor has developed and is actively utilizing an app to handle the C2 infrastructure instantly from a tool. This app can ship instructions to ahead SMS messages from the sufferer’s energetic telephones to specified numbers. This functionality differentiates it from earlier malware, which usually manages C2 servers by way of net interfaces. The app shops numerous configuration settings by way of Firebase. Notably, it makes use of Firebase “Realtime Database” somewhat than Firestore, possible on account of its simplicity for primary knowledge retrieval and storage.

Determine 9. C2 administration cell utility

Conclusion

Based mostly on our analysis, we’ve confirmed that 419 distinctive gadgets have already been contaminated. Nonetheless, contemplating the continuous improvement and distribution of latest variants, we anticipate that this quantity will steadily improve. This pattern underscores the persistent and evolving nature of this risk, emphasizing the necessity for cautious commentary and versatile safety methods.

As talked about initially of the report, many scams originate from messaging platforms like WhatsApp. Due to this fact, it’s essential to stay cautious when receiving messages from unknown or unsure sources. Moreover, given the clear emergence of varied variants, we advocate utilizing safety software program that may shortly reply to new threats. Moreover, by using McAfee Cellular Safety, you possibly can bolster your protection towards such refined threats.

Indicators of Compromise (IOCs)

APKs:

Domains:

• https[://]luyagyrvyytczgjxwhuv.supabase.co

Firebase:

• https[://]call-forwarder-1-default-rtdb.firebaseio.com

Introducing McAfee+

Identification theft safety and privateness in your digital life

Obtain McAfee+ Now