BankBot and BankBotAlpha – Banking Android Malware

BankBot is a malware targeting Android OS, and has appeared in the Google Play Store in different forms, often impersonating well-known application icons or names.The predecessor of this malware, BankBotAlpha, was first published back on December 19th, 2016, in a Russian forum as a new initiative to build an Android banker from scratch. The complete code for this malware and its command and control (C&C) panel in PHP is available online. As of April 2017, there are 141 variants as reported by Fortinet in their analysis of this malware. All variants use the internal name com.example.livemusay.myapplication with the known names and icons used by the malware being:

Admin privileges are gained via system prompt to user for Application Permissions. These are used to collect information like IMEI, bank applications present on the device, OS version, presence of root, and other sensitive functions.It is claimed that injection works in versions of Android up to 6.0 (Marshmallow).

When an infected device runs a targeted banking application, the malware takes control and replaces the actual screen of the application with their own phishing page which imitates the original application. Cautious users may be able to determine the difference, but many users will not be able to. The example below shows an example Qiwi Wallet phishing screen vs. an actual Qiwi wallet screen.

Once the user inputs their credentials, their data is sent to the C&C, where it is saved in a database. All the data is sent to the C&C server through SMS and HTTP protocol.

From a general point of view, BankBot and BankBotAlpha are very similar in their action and in code, still the difference between them is that BankBot packs more features than the alpha version, with AV detection, a higher number of banking apps controlled, messaging applications monitored, sometimes even obfuscation.

Enabling the TSCritical targets in your user policy will add protection against Bankbot and BankBotAlpha while devices are connected to your ThreatSTOP DNS and IP Firewall Services protected network. If you do not have a ThreatSTOP account  for a free trial.

If you do have a ThreatSTOP account, instructions to add targets to DNS or IP Firewall policies are available on the ThreatSTOP Documentation Hub, or contact our  team.