BankBot, an Android malware based on a source code leaked online

Antivirus firm Dr. Web spotted a new Android malware dubbed BankBot that is based on a source code that was leaked on an underground forum.

Bad news for Android users, researchers from the Russian antivirus maker Dr. Web have reported that the source code for another Android banking malware has been leaked on an underground hacking forum. The leakage online of malicious source code is an ill-omened event, crooks could easily use it for their illegal activities and could also improve it by implementing their own features, including new evasion capabilities.

The experts from Dr. Web have already discovered an Android banking trojan (Dubbed BankBot) in the wild that was likely developed starting from the leaked source code.

The leaked code is related to an Android banking Trojan that was developed to siphon money from bank accounts of the victims, it gains administrator privileges on the mobile devices in order to control them.

“A banking Trojan that targets Android devices. It is distributed under the guise of benign programs, e.g., Google programs with the Play Store icon.” states the analysis published by Dr. Web.

The source code was leaked online along with detailed instructions, security experts fear an escalation in the number of cyber attacks leveraging on the leaked code.

The Android BankBot Trojan also has the ability to get administrator privileges on the infected mobile device. Once the malware obtains full privileges it is able to hide its presence by removing the app’s icon from the home screen while it is active in the background.

“Information on found matches is sent to the C&C server. The Trojan receives a list of files to be monitored from execution. After one of them is launched, Android.BankBot.149.origin displays WebView on top of the attacked application with a fraudulent authentication form to access the user account. Then the entered information is sent to the server. The following are the examples of such fraudulent authentication forms:”

BankBot remains hidden waiting for victims open mobile banking or social media apps, then it launches a phishing login overlays in order to trick victims to re-enter their login credentials or payment card details. BankBot is able to create phishing login overlays for a number of applications, including Facebook, WhatsApp, Instagram, Twitter, Youtube, Snapchat, Viber, WeChat, imo, Uber, and the Google Play Store.

The android malware is also able to intercept text messages and delete them from the victim’s device, in this way it could bypass 2FA implemented by banks.

In February 2016, experts at the IBM X-Force threat intelligence have discovered that the source code for another Android malware, the GM Bot Trojan, was leaked online.