The dangerous Android banking trojan that we first reported here at the beginning of 2017 has found its way to Google Play again, now stealthier than ever.
Subsequently dubbed BankBot, the banking trojan has been evolving throughout the year, resurfacing in different versions both on and outside Google Play. The variant we discovered on Google Play on September 4 is the first one to successfully combine the recent steps of BankBot’s evolution: improved code obfuscation, a sophisticated payload dropping functionality, and a cunning infection mechanism abusing Android’s Accessibility Service.
Misuse of Android Accessibility has been previously observed in a number of different trojans, mostly outside Google Play. Recent analyses from SfyLabs and Zscaler have confirmed that the crooks spreading BankBot managed to upload an app with the Accessibility-abusing functionality to Google Play, only without the banking malware payload.
The “complete puzzle” featuring the banking malware payload that managed to sneak into Google Play masqueraded as a game named Jewels Star Classic (it is important to note that the attackers misused the name of popular legitimate game series Jewels Star by the developer ITREEGAMER, which is in no way connected to this malicious campaign).
We have notified Google’s security team of the malicious app, installed by up to 5000 users before getting removed from the store.
When the unsuspecting user downloads Jewels Star Classic by the developer GameDevTony , they get a functioning Android game, only with some hidden extras – a banking malware payload lurking inside the game’s resources, and a malicious service waiting to be triggered after a pre-set delay.
he malicious service is triggered after 20 minutes from the first execution of Jewels Star Classic. The infected device shows an alert prompting the user to enable something named “Google Service” (note: the malicious alert appears independent of the user’s current activity, and with no apparent connection to the game).
After clicking on OK, which is the only way to stop the alert from appearing, the user is taken to the Android Accessibility menu, where services with accessibility functions are managed. Among legitimate ones, a new service named “Google Service” is listed, created by the malware. Clicking on it displays a description taken from Google’s original Terms of Service.
When the user decides to activate the service, a list of required permissions is displayed: Observe your actions, Retrieve window content, Turn on Explore by Touch, Turn on enhanced web accessibility and Perform gestures .
Clicking on OK grants accessibility permissions to the malware’s own accessibility service. By granting these permissions, the user gives the malware a free hand – almost literally – to carry out any tasks it needs to continue its malicious activity.
The malware uses this screen to cover its next steps – clicking on user’s behalf using the previously obtained accessibility permissions. While the user waits for the fictitious update to load, the malware carries out the following tasks:
After these tasks are successfully carried out, the malware can start working towards its next goal: stealing the victim’s credit card details. As opposed to other BankBot variants that target an extensive list of specific banking applications and impersonate their login forms in order to harvest entered credentials, this one focuses exclusively on Google Play – an app all Android users have preinstalled on their devices.
When the user launches the Google Play app, BankBot steps in and overlays the legitimate app with a fake form requesting user’s credit card details..
If users fall for the fake form and enter their credit card details, the attackers have essentially won. Thanks to BankBot setting itself as the default messaging app, it can intercept all SMS communication going through the infected device. This enables the attackers to bypass SMS-based two-factor authentication on the victim’s bank account – the last potential obstacle between them and the victim’s money.
In this campaign, the crooks have put together a set of techniques with rising popularity among Android malware authors – abusing Android Accessibility Service, impersonating Google, and setting a timer delaying the onset of malicious activity to evade Google’s security measures.
The techniques combined make it very difficult for the victim to recognize the threat in time. Because the malware impersonates Google and waits for 20 minutes before displaying the first alert, the victim has very little chance to connect its activity to the Jewel Star Classic app they’ve recently downloaded. On top of that, the many different names the malware uses throughout the infection process significantly complicate efforts to locate and manually remove it.
If you’re downloading many different apps from Google Play and elsewhere, you might want to check if you haven’t reached for this malware.
Checking your device for Jewels Star Classic is not enough, as the attackers frequently change up the apps misused for BankBot’s distribution. To see if your device has been infected, we recommend you look for the following indicators:
If you find any of the mentioned indicators, your device may well have been infected with this BankBot variant.
To manually clean your device, you would first need to disable device administrator rights for “System update”, then proceed to uninstalling both “Google Update” and the associated trojanized app.
However, finding which trojanized app started the infection (like, in this case, Jewels Star Classic) is tricky due to the 20 minute delay of malicious activity, as well as the fact that the app works as expected. To detect and remove the threat with all its components, we recommend using a reliable mobile security solution.
ESET security products detect and block this variant of BankBot as Android/Spy.Banker.LA
Ref: https://blog.eset.co.th/2017/09/27/โทรจัน-bankbot-ย้อนกลับมาใน-google-play-พ/
©1999-2024 eideas.co,.ltd. all rights reserved www.eideas.co.th