Bankbot Returns On Play Shop – A Never Ending Android Malware Story

Even later thence many efforts yesteryear Google for making its Play Store away from malware, shady apps somehow managed to fool its anti-malware protections too infect people amongst malicious software.

H5N1 squad of researchers from several safety firms has uncovered 2 novel malware campaigns targeting Google Play Store users, of which i spreads a novel version of BankBot, a persistent theatre unit of measurement of banking Trojan that imitates existent banking applications inwards efforts to pocket users' login details.

BankBot has been designed to display faux overlays on legitimate banking concern apps from major banks around the world, including Citibank, WellsFargo, Chase, too DiBa, to pocket sensitive information, including logins too credit bill of fare details.

With its original purpose of displaying faux overlays, BankBot has the mightiness to perform a wide make of tasks, such equally sending too intercepting SMS messages, making calls, tracking infected devices, too stealing contacts.

Google removed at to the lowest degree iv previous versions of this banking trojan from its official Android app shop platform before this year, merely BankBot apps ever made their ways to Play Store, targeting victims from major banks around the world.

The bit travail spotted yesteryear researchers non exclusively spreads the same BankBot trojan equally the showtime travail merely besides Mazar too Red Alert. This travail has been described inwards especial on performed yesteryear the mobile threat intelligence squad at Avast inwards collaboration amongst ESET too SfyLabs, the latest variant of BankBot has been hiding inwards Android apps that set equally supposedly trustworthy, innocent-looking flashlight apps.

First spotted yesteryear the researchers on thirteen October, the malicious BankBot apps uses special techniques to circumvent Google's automated detection checks, such equally starting malicious activities 2 hours later the user gave device admin rights to the app too publishing the apps nether unlike developer names.

After tricking victims into downloading them, the malicious apps banking concern gibe for the applications that are installed on the infected device against a hard-coded, listing of 160 mobile apps.

According to the researchers, this listing includes apps from Wells Fargo too Chase inwards the U.S., Credit Agricole inwards France, Santander inwards Spain, Commerzbank inwards Federal Republic of Federal Republic of Germany too many other fiscal institutions from around the world.

If it finds i or to a greater extent than apps on the infected smartphone, the malware downloads too installs the BankBot APK from its command-and-control server on the device, too tries to describe a fast i on the victim into giving it administrator rights yesteryear pretending to move a Play Store or organization update using a similar icon too packet name.

Once it gets the admin privileges, the BankBot app displays overlay on the exceed of legitimate apps whenever victims launch i of the apps from the malware's listing too pocket whatever banking information the victim's types on it.

The Avast Threat Labs has besides provided a video demonstration spell testing this machinery amongst the app of the local Czech Airbank. You tin come across how the app creates an overlay inside milliseconds too tricks the user into giving out their banking concern details to criminals.

Since many banks usage two-factor-authentication methods for secure transactions, BankBot includes functionality that allows it to intercept text messages, allowing criminals behind BankBot to pocket mobile transaction issue (mTAN) sent to the customer's telephone too transfer coin to their accounts.

Here's i of import matter to banknote is that Android machinery blocks apps installation from exterior the Play Store. Even if you lot convey already permitted installation from unknown sources, Google even thence requires you lot to press a push clit to proceed such installations.

"Unlike this newer version of BankBot, droppers from previous campaigns were far to a greater extent than sophisticated," the researchers note. "They applied techniques such equally performing clicks inwards the background via an Accessibility Service to enable the installation from unknown sources."

The latest BankBot version does non utilize this Accessibility Service feature due to Google's recent motion of blocking this feature for all applications, except those designed to render services for the blind.

Google has already removed all recently-discovered BankBot apps later beingness notified yesteryear the researchers.

Although it is a never-ending concern, the best agency to protect yourself is ever to move vigilant when downloading apps fifty-fifty from Google's official Play store. So, ever verify app permissions too reviews before downloading an app from Google Play Store.

Even though the BankBot apps made it agency into the Play Store, its payload was downloaded from an external source. So, don't let whatsoever unknown third-party APK to move installed on your smartphone.

To produce so, Go to Settings → Security too and thence Turn OFF "Allow installation of apps from sources other than the Play Store."

Most importantly, move careful which apps you lot make administrative rights to, equally it is powerful too tin render a amount app command of your device.

Share This :