{"id":86363,"date":"2018-06-05T19:10:33","date_gmt":"2018-06-05T13:40:33","guid":{"rendered":"https:\/\/blogs_admin.quickheal.com\/?p=86363"},"modified":"2018-06-08T10:46:12","modified_gmt":"2018-06-08T05:16:12","slug":"quick-heal-detects-another-banking-trojan-imitating-popular-banking-apps-india","status":"publish","type":"post","link":"https:\/\/www.quickheal.com\/blogs\/quick-heal-detects-another-banking-trojan-imitating-popular-banking-apps-india\/","title":{"rendered":"Quick Heal detects banking Trojans imitating popular social media and banking apps in India"},"content":{"rendered":"

Quick Heal Security Labs has spotted two banking Trojan malware. These malware imitate some popular social and banking apps. While doing so, they gain access to some security permissions on the infected device which allow them to steal the user\u2019s banking credentials. The malware are able to do this by displaying a fake window that asks for a debit\/credit card number.<\/p>\n

Technical analysis of the first banking Trojan that imitates social media apps
\n<\/strong><\/p>\n

App<\/strong> name<\/strong>: Adobe Flash Player (fake)
\nPackage<\/strong> Name<\/strong>: com.note.donote
\nMD5<\/strong>: ef3a283136bd24e745c43619118d4ff2
\nSize<\/strong>: 520 KB<\/p>\n

The banking Trojan masks itself with the icon of Adobe Flash Player to trick users. If installed, it asks for Device Administrator rights. If the user selects \u2018Cancel’, it will keep asking for the permission until the user selects the ‘Activate’ button. Post this, it hides its icon.<\/p>\n

\"\"
Fig 1. Asking for Device Admin permission<\/figcaption><\/figure>\n

After gaining the device administrator rights, the malware sends a text message to a premium rated number containing the device ID without user’s permission.<\/p>\n

\"\"
Fig 2. User balance deduction and sending device info via SMS<\/figcaption><\/figure>\n

In the background, the Trojan searches for the most frequently used apps. The malware has maintained two lists. One list mostly comprises the social and browsing apps it imitates.<\/p>\n

Popular<\/strong> applications <\/strong>maintained in the first list<\/strong><\/p>\n

    \n
  1. com.whatsapp<\/li>\n
  2. com.skype.raider<\/li>\n
  3. com.facebook.katana<\/li>\n
  4. com.instagram.android<\/li>\n
  5. com.android.chrome<\/li>\n
  6. com.twitter.android<\/li>\n
  7. com.android.calendar<\/li>\n
  8. jp.naver.line.android<\/li>\n
  9. com.android.vending<\/li>\n
  10. com.viber.voip<\/li>\n<\/ol>\n

    When a user opens any of these applications, the Trojan displays a fake window asking for a debit\/credit card number. Until the user provides this number, the malware does not allow access to Google Play or other apps (mentioned in the list above).<\/p>\n

    \"\"
    Fig 3. Overlaying social and browsing apps with a window asking for a debit\/credit card number<\/figcaption><\/figure>\n
    \"\"
    Fig 4. Posting card details on a URL<\/figcaption><\/figure>\n

    If the user enters the card number, the banking Trojan collects this information and sends it to a malicious server (<\/strong>h<\/strong>xx<\/strong>p:\/\/nikorg.com\/1\/<\/strong>)<\/strong><\/p>\n

    The other list comprises 60 banking and finance related apps. When a user opens any of these apps, the Trojan displays an overlay web page and does not allow the user to perform any activity until the user stops it.<\/p>\n

    At the time of our analysis, the malicious server was unable to show the similar page related to the app imitated by the Trojan. However, it displayed a blank white page over the app.<\/p>\n

    \"\"
    Fig 5. Overlaying bank application with the web page<\/figcaption><\/figure>\n
    \"\"
    Fig 6. Apps of banks with overlaying web URLs<\/figcaption><\/figure>\n

    Popular<\/strong> applications <\/strong>maintained in the second list<\/strong><\/p>\n

      \n
    1. pl.mbank (mBank PL)<\/li>\n
    2. com.db.mm.deutschebank (Meine Bank)<\/li>\n
    3. pl.ing.ingmobile (ING Bankieren)<\/li>\n
    4. com.konylabs.cbplpat (Citi Handlowy )<\/li>\n
    5. com.paypal.android.p2pmobile (paypal)<\/li>\n
    6. com.commbank.netbank (CommBank )<\/li>\n<\/ol>\n

      The Trojan malware also steals incoming messages which may be an OTP or any other information and sends them to the malicious server.<\/p>\n

      \"\"
      Fig 7. Sending incoming messages to a URL<\/figcaption><\/figure>\n

       <\/p>\n

      Technical analysis of the second banking Trojan that imitates banking apps<\/strong><\/p>\n

      App<\/strong> name<\/strong>: Update
      \nPackage<\/strong> name<\/strong>: anubis.bot.myapplication
      \nMD5<\/strong>: cc76a822b8bd66350a78db70998650ca
      \nSize<\/strong>: 149kb<\/p>\n

      While installing the app, it asks user to enable Google Play service. And if enabled, it hides. Once it is done, the malicious app hides its icon and if a user in-between turns off the Google Play service then it keeps on showing the message to enable the Google Play service in a loop and also restricts the user from starting any other activity on the device.<\/p>\n

      \"\"
      Fig 8. Malicious app icon<\/figcaption><\/figure>\n
      \"\"
      Fig 9. Repeatedly asking for Google pro service permission<\/figcaption><\/figure>\n

      In the background, the malware it keeps searching the mentioned app\u2019s name on the list. If found, it shows a notification on behalf of the particular app and shows a similar login page and steals user\u2019s credentials.<\/p>\n

      \"\"
      Fig 10. Creates a notification message according to the app maintained in the list of the malware<\/figcaption><\/figure>\n

      At the time of analysis, the C&C server (hxxp:\/\/46.254.16.53)<\/strong> was not functional. So, we were unable to monitor the dynamic activity of the app.<\/p>\n

      The banking Trojan uses commands to get the user’s personal information such as contacts, messages (to get the OTP), location details, etc.<\/p>\n

      \"\"
      Fig 11. Stealing personal information’s using commands<\/figcaption><\/figure>\n
      \"\"
      Fig 12. Names of apps of banks in India<\/figcaption><\/figure>\n

      There are other apps mentioned in the list that related to banking, shopping and cryptocurrency.<\/p>\n

      Some of the famous Indian banking applications are:<\/strong><\/p>\n

        \n
      1. com.sbi.SBIFreedomPlus (SBI Anywhere personal)<\/li>\n
      2. com.csam.icici.bank.imobile (ICICI iMobile)<\/li>\n
      3. in.co.bankofbaroda.mpassbook (Baroda mPassbook)<\/li>\n
      4. com.unionbank.ecommerce.mobile.android (Union Bank Mobile)<\/li>\n
      5. com.axis.mobile (Axis Bank)<\/li>\n
      6. hdfcbank.hdfcquickbank (HDFC Bank MobileBanking LITE)<\/li>\n<\/ol>\n

        One unique activity performed by this app is that it checks whether a user’s Google Play protection service is ON or OFF. Accordingly, it sends information to the malicious server.<\/p>\n

        \"\"
        Fig 13. Checking for Google Play Protection<\/figcaption><\/figure>\n

        Quick Heal<\/strong><\/a> successfully detects <\/strong>these banking Trojans <\/strong>as<\/strong>:<\/strong><\/p>\n

          \n
        1. Android.Marcher.C<\/li>\n
        2. Android.Asacub.T<\/li>\n<\/ol>\n

          \u00a0<\/strong>Tips to stay safe from Android Banking Trojans<\/strong><\/p>\n

            \n
          1. Avoid downloading apps from third-party app stores or links provided in SMSs or emails.<\/li>\n
          2. Always keep \u2018Unknown Sources\u2019 disabled. Enabling this option allows installation of apps from unknown sources.<\/li>\n
          3. Verify app permissions before installing any app even from official stores such as Google Play.<\/li>\n
          4. Keep Play Protection service ‘ON’.<\/li>\n
          5. Install a reliable mobile security app that can detect and block fake and malicious apps before they can infect your device.<\/li>\n
          6. Always keep your device OS and mobile security app up-to-date.<\/li>\n<\/ol>\n

            Subject Matter Experts<\/strong><\/p>\n

            Rupali Parate, Anand Kumar Singh | Quick Heal Security Labs<\/p>\n","protected":false},"excerpt":{"rendered":"

            Quick Heal Security Labs has spotted two banking Trojan malware. These malware imitate some popular social and banking apps. While doing so, they gain access to some security permissions on the infected device which allow them to steal the user\u2019s banking credentials. The malware are able to do this by displaying a fake window that […]<\/p>\n","protected":false},"author":12,"featured_media":86365,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-86363","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86363"}],"collection":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/comments?post=86363"}],"version-history":[{"count":10,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86363\/revisions"}],"predecessor-version":[{"id":86382,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/posts\/86363\/revisions\/86382"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media\/86365"}],"wp:attachment":[{"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/media?parent=86363"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/categories?post=86363"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickheal.com\/blogs\/wp-json\/wp\/v2\/tags?post=86363"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}