# A Look Into The New Strain Of BankBot **[fortinet.com/blog/threat-research/a-look-into-the-new-strain-of-bankbot.html](https://www.fortinet.com/blog/threat-research/a-look-into-the-new-strain-of-bankbot.html)** Threat Research By [Dario Durando | September 19, 2017](https://www.fortinet.com/blog/search?author=Dario+Durando) ## Introduction September 19, 2017 BankBot is a family of Trojan malware targeting Android devices that surfaced in the second half of 2016. The main goal of this malware is to steal banking credentials from the victim’s device. It usually impersonates flash player updaters, android system tools, or other legitimate applications. Once installed, it hides itself and then tricks the user into typing his or her credentials into fake bank web pages that have been injected onto the device’s screen. The original code of BankBot was divulged on a Russian forum in late 2016, and you can [read more about that here.](https://blog.fortinet.com/2017/04/26/bankbot-the-prequel) Over the past few months, new strains of this infamous Android malware family have surfaced in third-party APK markets, as well as in the official Google Play store. FortiGuard Labs decided to analyze some of them, and in this report, I will discuss its evolution over the past 10 months. ## Analysis ----- In most cases, the application poses as a Flash Player or some kind of Android System tool. Upon installation, it requires a very large number of permissions that look very suspicious. Moreover, from the Manifest we can see that the application is predisposed to ask for even more permissions upon execution. Figure 1: Permissions In addition, the classes in the .dex files are usually named using random words that are connected in some way, as if they were picked in succession from a glossary. This is the only sort of obfuscation present in the application and it does not do a great job at it. Figure 2: Classes ----- This specific version of Bankbot has a relatively low detection rate, at around 15-20 hits on VirusTotal. This is in spite of the fact that it uses no obfuscation procedures to hide strings or functionalities. Figure 3: VirusTotal Detections Figure 4: Admin Request Once installed, the application demands Device Admin privileges. In most cases, this request is accompanied by an explanation in Turkish, which suggests that Turkey is the targeted region for this malware campaign. Once these privileges have been obtained, the application hides by deleting its icon. It then sends device information to the CC server, such as like IMEI, contacts, and SMS messages sent and received. The application also checks to see if any apps from Turkish financial institutions has been installed on the device. If so, it then displays a webview downloaded from the server of the specific banking site spoofing-page. Figure 5: Set WebView Injection ----- Figure 6: Bank Apps While the banking apps that we checked vary from sample to sample, this campaign seems to be primarily targeting Turkish financial institutions, with some Russian exceptions. It is interesting to note that even when all of the applications are Turkish, the two apps checked in the original version of BankBot (privatbank and ru.mw) never disappear. Apparently, the authors of this campaign were over-excited with the Ctrl + C and Ctrl + V when copying and pasting code from the original malware and did not think to clean the code before repurposing it. In fact, the code of this sample is very much similar to the code leaked in December 2016, with very few modifications. The two biggest and most evident differences are: Firstly, the injection technique supports more than the two test applications of the published tutorial. And second, it performs a check on all outgoing calls, comparing the number to a hardcoded list of numbers. ----- Figure 7: Telephone Number List After a quick web search, it was easy to determine that all of these phone numbers it is searching for are help-lines connected to a number of Turkish financial institutions. The author of the malware made sure to hardcode multiple ways in which a number could be formatted (with and without country code, and with and without multiple leading zeros). Figure 8: Numbers Format If the number called by the victim corresponds to any number on the list, the application shuts down the call immediately by calling setResultData(null) on the broadcastReceiver. ----- Figure 9: Exit Call ## Conclusion The BankBot family has never been famous for having advanced code. These new campaigns that resurface from time to time tend to confirm that trend. However, this is not the problem with this malware. The ease with which anyone can obtain and modify it to create an attack is the main reason why this family remains a real threat. The samples analyzed for this blogpost ranged from 3 months to less than a week old, showing that this malware family is still very much active and alive. The CC servers used by this version of Bankbot are not obfuscated, and many of them were taken down merely days after being set up. However, it seems that nearly every month a new version of this campaign hits some new country. While it does not last long, it invariably creates new victims. Over the past few months, we have detected more and more obfuscated versions of BankBot lurking in third-party APK stores as well as in the official Google Play store. Our customers are protected from this threat: Fortinet detects this malware as **Android/Bankbot.HH!tr and Android/Bankbot.AA!tr.** FortiGuard Labs has been monitoring this family since its first appearances in 2016, and will continue to track it and share its findings as new details come to light. -= FortiGuard Lion Team = ## Appendix ### Targeted Bank apps list ru.sberbankmobile ru.sberbank_sbbol ru.alfabank.mobile.android ru.alfabank.oavdo.amc ----- ru.mw ua.privatbank.ap24 com.ziraat.ziraatmobil com.ziraat.ziraattablet com.tmobtech.halkbank com.vakifbank.mobile com.pozitron.vakifbank com.akbank.android.apps.akbank_direkt com.akbank.softotp com.akbank.android.apps.akbank_direkt_tablet tr.com.sekerbilisim.mbank com.teb com.pozitron.iscep com.softtech.isbankasi com.ykb.android com.ykb.androidtablet com.tmob.denizbank com.tmob.tabletdeniz com.garanti.cepsubesi biz.mobinex.android.apps.cep_sifrematik com.htsu.hsbcpersonalbanking com.ingbanktr.ingmobil com.magiclick.odeabank com.finansbank.mobile.cepsube finansbank.enpara ----- com.pozitron.albarakaturk com.kuveytturk.mobil ## IOC ### URLS hXXp://b1k51 dot gdn hXXp://b1j3aas dot life hXXp://wechaatt dot gdn hXXp://10as05 dot gdn hXXp://ch0ck4 dot life hXXp://fatur1s dot life hXXp://b5k31 dot gdn hXXp://erd0 dot gdn hXXp://b1v2a5 dot gdn hXXp://b1502b dot gdn hXXp://elsssee dot gdn hXXp://kvp41 dot life hXXp://servertestapi dot ltd hXXp://taxii dot gdn hXXp://p0w3r dot gdn hXXp://4r3a dot gdn ### Hashes e5ac8b77e264c68a38be42bd16b1253b7cf96a1258444040ed6046c9096ecd08 451b4cf00e36bf164b4e721d02eab366caf85690d243a539eba5a4bbd1f9e5fa 48bd70850a04a26db239e47611ce7e660c2b08b2dd56d81ed7a608e2659e1d7c ----- 7960bb11e52516134774e8a262c6d78e5683ba9814015eb12b076e7d4e188c4b c5fbf3f7ddf354a99abbb7652254032d11682106d004373b509981c7a77d1bef f4db61ab1a314955e4134ec6fdcf9bd47ff8141928a1e467c052876327e4ef8b ab27065953ff7329c261a27149e2ce63e9a170714df7619b011db89eb5f68069 5126bd2a0e6b74178994c17102e4e18ffe1ab6f398a69225913f60eccef7a652 e56acc1eedc47854c89a02b93ae5bd078e91001dd85e2c7739b649beddbee885 aa63ce659eb3054f00656b2a4fa4bbc14f421d7b2ccb99d333f619613d75fc8f 20e838966993b73f2d65df993fb21d85ab186702a6b1732aba1ea3a98a79b22a f8de1e8ed70f77dd792035e0cdd3e5c026feece6790f6e2266f8d5f37198b8fa 43c26e071d22e3e14efb669705ba9113067894e9035a051b76b3632330ef8884 d7699cb3c4ec67f3cbe04701360da36622408b70b8d5ec413474d2a83b7172d9 a3ad2f7e3fc04db4e1c919f9df4235b8a1728ef4f4d2e5bb30905262719bbde5 453ba4a1d229049b6bd415192cafda79238a4f2b1e4d1450174903284a304d33 c59a2b3bdb8363d9610ed3bc5cd707ee25a2384e3e2e74bd1ad5bd16b69fa014 ee83ac9a851638f77693eea48ba8034c6d15e630ddb9ad19e204bfa3fe881dc6 26827b3db72e07ab7649bb21b89dbb5376fcf76de1849ae41265965f80d5ecf7 501e88a12be8fdba7d25472f08437308c313dd70aaeac4d162bbb6836ff4bc4a 09e897341d910b44884a9e6d9d2f0bc39dcf2a50e0f35062b07c5f946e5c5b66 876fa3268d5f15be13f9e6021133811062b90d6830f25b8b297be98f27d747f0 e02112cf09522ee7231229dabf331bf725531945d56865416355211d45ddb849 1ab4e5a08f4bf5f95b2462ee12da893851a715b5569603fb95d5f2f7bf2293de 38b5f8c4ddcb2b53aaa33d19efdb6ea6e489aafa0e906da57345c3ca5f01ffa7 c17cfc49391472ad0a85e0bde934bf289d1402c86cf8353ce5c9296c350a73d6 ef1ae5f0ed8a8216dda6ed2dec979e799bfd58fb548a8acb941407b950673ae9 db2d7ca6c1317e5697d0bc61f67bc38316888d20ee9dba32f7165bf23f177061 ----- fe26d6a0e3425d9622b2aef7c4199b0d9569f849453b12cb75ba42e5f002dd67 e3b764ba2795af097efc554331bd9c8a804b5a030dfd495cc8169ce331ac5cad 009220919c4ecf5e72f7be4886a454d11b951dbc488656a811cd7517ad4c0c35 804fc95f250dc275e805fdabd862bcc3a2b60796915c3da575722015f64adf4e 15d31751bd91ee0082f75f581f099e2f986a7c7ccc2748cdd8a0adf9320d748a 8a8fe94c0e4f3fcaaf1f49aa27b13908c01a7574d31a84d55683f9cd1854d211 27c4263d9030435a6f107878c0ba50998cf82d5852618b989acab9843df55d62 39de72ff4b93565cd25fa303b8f17dcaabff101c138a0a5282c747d15b70053f 31c33f8102669b5ffc117ebd076646cefb0ae6b7ea12d1779ebd9d64a2de70d3 f532275eb109ffb5ef35ec42c5445b6e9cdaadad099c977aab8841664cdab292 d2ffa12048169cf9eba113dbb47b78708e83d9b5e778276a40100617e0dbbbdc _[Sign up for weekly Fortinet FortiGuard Labs Threat Intelligence Briefs and stay on top of the](http://ftnt.net/2iT7Mcp%C2%A0)_ _newest emerging threats._ ### Related Posts Copyright © 2022 Fortinet, Inc. All Rights Reserved [Terms of ServicesPrivacy Policy](https://www.fortinet.com/corporate/about-us/legal.html) | Cookie Settings -----