# Rewards plus: Fake mobile banking rewards apps lure users to install info-stealing RAT on Android devices **microsoft.com/security/blog/2022/09/21/rewards-plus-fake-mobile-banking-rewards-apps-lure-users-to-install-info-stealing-rat-on-android-** devices/ September 21, 2022 Our analysis of a recent version of a previously reported info-stealing Android malware, delivered through an ongoing SMS campaign, demonstrates the continuous evolution of mobile threats. Masquerading as a banking rewards app, this new version has additional remote access trojan (RAT) capabilities, is more obfuscated, and is currently being used to target customers of Indian banks. The SMS campaign sends out messages containing a link that points to the info-stealing Android malware. The malware’s RAT capabilities allow the attacker to intercept important device notifications such as incoming messages, an apparent effort to catch two-factor authentication (2FA) messages often used by banking and financial institutions. The malware’s ability to steal all SMS messages is also concerning since the data stolen can be used to further steal users’ sensitive info like 2FA messages for email accounts and other personally identifiable information (PII). ----- _Figure 1. Typical SMS campaign attack flow_ Our investigation of this new Android malware version started from our receipt of an SMS message containing a malicious link that led us to the download of a fake banking rewards app. The fake app, detected as TrojanSpy:AndroidOS/Banker.O, used a different bank name and logo compared to a similar [malware reported in 2021. Moreover, we found that this fake app’s command and control (C2) server is](https://blog.cyble.com/2021/12/27/spyware-targeting-customers-of-top-indian-banks/) related to 75 other malicious APKs based on open-source intelligence. Some of the malicious APKs also use the same Indian bank’s logo as the fake app that we investigated, which could indicate that the actors are continuously generating new versions to keep the campaign going. This blog details our analysis of the recent version’s capabilities. We strongly advise users never to click on unknown links received in SMS messages, emails, or messaging apps. We also recommend seeking your bank’s support or advice on digital options for your bank. Further, ensure that your banking apps are downloaded from official app stores to avoid installing malware. ## Observed activity ### What the user sees We have seen other campaigns targeting Indian banks’ customers based on the following app names: Axisbank_rewards.apk Icici_points.apk Icici_rewards.apk SBI_rewards.apk Our investigation focused on icici_rewards.apk (package name: com.example.test_app), which presents itself as ICICI Rewards. The SMS campaign sends out messages containing a malicious link that leads to installing a malicious APK on a target’s mobile device. To lure users into accessing the link, the SMS claims that the user is being notified to claim a reward from a known Indian bank. ----- _Figure 2. The text message with a malicious_ _link sent to users_ Upon user interaction, it displays a splash screen with the bank logo and proceeds to ask the user to enable specific permissions for the app. ----- _Figures 3 and 4. App installed on the Android device. The app asks users to enable permissions on text_ _messaging and contacts, to name a few_ The fake app asks for credit card information upon being granted all permissions. This should raise users’ suspicions on the app’s motive as apps typically ask for sensitive information only through user-driven transactions like paying for purchases. The app displays another fake screen with further instructions to add to its legitimacy once users supply the information needed. ----- _Figures 5 and 6. A fake page where the app asks users to provide information, and the resulting message_ _once data is added_ ### What happens in the background Analyzing the XML file AndroidManifest further identifies the entry points of the malware along with the permissions requested. It also defines services that can run in the background without user interaction. The app uses the following permissions: _READ_PHONE_STATE_ _ACCESS_NETWORK_STATE_ _READ_SMS_ _RECEIVE_SMS_ _READ_CALL_LOG_ _FOREGROUND_SERVICE_ _MODIFY_AUDIO_SETTINGS_ _READ_CONTACTS_ _RECEIVE_BOOT_COMPLETED_ _WAKE_LOCK_ ----- The malware uses MainActivity, AutoStartService, and RestartBroadCastReceiverAndroid functions to carry out most of its routines. These three functions interact to ensure all the malware’s routines are up and running and allow the app to remain persistent on the mobile device. **MainActivity** _MainActivity, also called the launcher activity, is defined under com.example.test_app.MainActivity. It is_ launched first after installation to display the fake app’s ICICI splash screen. This launcher activity then calls _OnCreate() method to check the device’s internet connectivity and record the timestamp of the malware’s_ installation, and Permission_Activity to launch permission requests. Once the permissions are granted, _Permission_Activity further calls AutoStartService and login_kotak._ _Figure 7. Actions under MainActivity_ The class login_kotak is responsible for stealing the user’s card information. It shows the fake credit card input page (Figure 5) and temporarily stores the information in the device while waiting for commands from the attacker. ----- _Figure 8. login_kotak class steals card information and other personally identifiable information (PII)_ **AutoStartService** _AutoStartService, themain handler of the malware, functions based on the commands it receives. The_ handler provides the malware with the following capabilities: **Enforcing its RAT commands** This malware’s new version adds several RAT capabilities that expands its information stealing. It enables the malware to add call log uploading, SMS message and calls interception, and card blocking checks. ----- _Figure 9. Code comparison of 2021 (left) and 2022 (right) samples_ These commands are described below. Command Name Description all_sms_received Flags to enable/disable SMS upload all_call_received Flags to enable/disable call log upload silent Put the mobile device on silent block Checks if the user’s card is blocked sms_filter Filters SMS based on strings (defaults to “ICICI”) online Checks if the user has an active internet connection ----- force_online Uploads received SMS messages to the C2 server is_online Checks if the device is connected to the C2 server force_calls Uploads call logs to the C2 server The silent command, which the malware uses to keep the remote attacker’s SMS sending activities undetected, stands out from the list of commands. Many banking apps require two-factor authentication (2FA), often sent through SMS messages. This malware enabling an infected device’s silent mode allows attackers to catch 2FA messages undetected, further facilitating information theft. _Figure 10. This code is responsible_ _for turning the mobile device’s silent mode on_ **Encryption and decryption of SMS messages** In addition to encrypting all data it sends to the attacker, the malware also encrypts the SMS commands it receives from the attacker. The malware decrypts the commands through its decryption and decoding modules. The malware uses a combination of Base64 encoding/decoding and AES encryption/decryption methods. ----- _Figure 11. The_ _malware’s encoding and decoding modules, as seen in its code_ **Stealing SMS messages** The malware steals all SMS messages from the mobile device’s inbox. It collects all received, sent, read, and even unread messages. Collecting all SMS messages might allow attackers to use the data to expand their stealing range, especially if any messages contain other sensitive information such as SMS-based 2FA for email accounts, one’s personal identification like the Aadhar card commonly used in India, or other financial-related information. _Figure 12._ _Code used to steal all SMS messages_ **Uploading all call logs** The malware also uploads call logs stored on the mobile device. This data may be used for the attacker’s surveillance purposes. ----- _Figure 13. The malware code for stealing call logs_ **Communicating with its C2** [This malware uses the open-source library socket.io to communicate with its C2 server.](https://socket.io/) _Figure 14. Code showing the_ _malware’s C2 server connection_ ### RestartBroadCastReceiver The malware also uses the Android component RestartBroadcastReceiver, which functions based on the type of events received by the mobile device. This receiver launches a job scheduler named JobService, which eventually calls AutoStartService in the background. The receiver reacts when the device is restarted, if the device is connected to or disconnected from charging, when the device’s battery status changes, and changes in the device’s Wi-Fi state. _RestartBroadcastReceiver ensures that the main command handler_ _AutoStartService is always up and running._ ----- _Figure 15. How the Receiver starts AutoStartService_ ## Mitigating the fake app’s unwanted extras This malware’s continuing evolution highlights the need to protect mobile devices. Its wider SMS stealing capabilities might allow attackers to the stolen data to further steal from a user’s other banking apps. Its ability to intercept one-time passwords (OTPs) sent over SMS thwarts the protections provided by banks’ two-factor authentication mechanisms, which users and institutions rely on to keep their transactions safe. Its use of various banking and financial organizations’ logos could also attract more targets in the future. App installation on Android is relatively easy due to the operating system’s open nature. However, this openness is often abused by attackers for their gain. Apart from exercising utmost care when clicking on links in messages and installing apps, we recommend that users follow these steps to protect their devices from fake apps and malware: Download and install applications only from official app stores. Android device users can keep the Unknown sources option disabled to stop app installation from unknown sources. [Use mobile solutions such as Microsoft Defender for Endpoint on Android to detect malicious](https://docs.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-endpoint-android) applications. ## Appendix ### Indicators of compromise **Indicator** **Type** **Description** 734048bfa55f48a05326dc01295617d932954c02527b8cb0c446234e1a2ac0f7 SHA256 da4e28acdadfa2924ae0001d9cfbec8c8cc8fd2480236b0da6e9bc7509c921bd SHA256 icici_rewards.apk icici_rewards.apk ----- 65d5dea69a514bfc17cba435eccfc3028ff64923fbc825ff8411ed69b9137070 SHA256 3efd7a760a17366693a987548e799b29a3a4bdd42bfc8aa0ff45ac560a67e963 SHA256 icici_rewards.apk icici_rewards.apk (first reported by [MalwareHunterTeam)](https://twitter.com/malwrhunterteam/status/1517787583648268288) hxxps://server4554ic[.]herokuapp[.]com/ URL C2 server ### MITRE ATT&CK techniques **Execution** **Persistence** **Defense** **Evasion** **Collection** **Command** **& Control** T1417 Input capture T1636 [Protected](http://attack.mitre.org/techniques/T1636) User Data **Exfiltration** **Impact** T1603 [Scheduled](http://attack.mitre.org/techniques/T1603) Task/Job T1624 Event Triggered Execution T1603 Scheduled Task/Job T1406 [Obfuscated](http://attack.mitre.org/techniques/T1406) files/information **Credential** **Access** T1417 [Input](http://attack.mitre.org/techniques/T1417) capture T1437 Application Layer Protocol T1521 [Encrypted](http://attack.mitre.org/techniques/T1521) Channel T1646 Exfiltration Over C2 Channel T1582 [SMS](http://attack.mitre.org/techniques/T1582) Control **_Shivang Desai, Abhishek Pustakala, and Harshita Tripathi_** _Microsoft 365 Defender Research Team_ -----