Android Malware Targeting Banking Users Across Europe
During our routine Open-Source Intelligence (OSINT) research, Cyble Research Labs came across a Twitter post wherein researchers mention an Android bankbot named GodFather with the name apkversion1.1.5.43 and an icon similar to the default Settings app.
We found notable similarities with Cereberus and Medusa banking trojans upon analyzing the malware sample. GodFather malware acts on the commands from Threat Actor’s (TA’s) Command & Control (C&C) server to steal sensitive information from the victim’s device.
Upon successful execution, the malware can perform malicious activities such as transferring money, getting device information such as phone number, installed app list, battery info, etc.
By further abusing the permissions on the affected device, the malware can also steal SMSs, control device screen using VNC, forward calls, and open URLs without the user’s knowledge.
Technical Analysis
APK Metadata Information
- App Name: apkversion1.1.5.43
- Package Name: com.rduzmauwns.jieliysagr
- SHA256 Hash: 0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8
Figure 1 shows the metadata information of an application.
The figure below shows the application icon and name displayed on the Android device.
Manifest Description
The malware requests users for 23 different permissions, out of which it abuses 11. These dangerous permissions are listed below.
| Permissions | Description |
| Read_SMS | Access SMSs from the victim’s device. |
| RECEIVE_SMS | Intercept SMSs received on the victim’s device |
| READ_CONTACTS | Access phone contacts |
| READ_PHONE_STATE | Allows access to phone state, including the current cellular network information, the phone number and the serial number of the phone, the status of any ongoing calls, and a list of any Phone Accounts registered on the device. |
| RECORD_AUDIO | Allows the app to record audio with the microphone, which attackers can potentially misuse. |
| SEND_SMS | Allows an application to send SMS messages. |
| CALL_PHONE | Allows an application to initiate a phone call without going through the dialer user interface for the user to confirm the call. |
| WRITE_EXTERNAL_STORAGE | Allows the app to write or delete files in the device’s external storage |
| WRITE_SMS | Allows the app to modify or delete SMSs |
| DISABLE_KEYGUARD | Allows the app to disable the keylock and any associated password security |
| BIND_ACCESSIBILITY_SERVICE | Used for Accessibility Service |
We observed a defined launcher activity in the malicious app’s manifest file, which loads the application’s first screen, as shown below.
Source Code Review
During our analysis, we observed that the malware initially requests the victims to enable Accessibility, and then it hides its icon from the Android device’s screen.
The malware uses the code snippet shown in the below image to hide its icon from the device screen.
The malware calls the SendNewUser() method to get the victim’s device details and post them to the TA’s C&C server, as shown in Figure 5.
The malware can perform money transfers by making USSD (Unstructured Supplementary Service Data) calls without using the dialer user interface, as shown in the below code snippet.
The malware also uses the method SmsSender() to send multi-part text-based SMSs, as shown below. This is done to bypass character limitations while sending SMSs.
The below code snippet represents the malware’s ability to steal SMSs present in the victim’s device.
The malware uses the method callForward() – which forwards the victim’s incoming calls to a number provided by TAs C&C server, as shown in the below figure.
The method linkopen() provides the feature to the malware to open URLs in the device browser without the user’s intervention, as shown in Figure 10.
Figure 11 demonstrates the code that illustrates the malware’s ability to steal application key logs.
The malware also uses VNC Viewer to remotely view/control the screens of an infected device, as shown below.
The malware fetches the C&C URL from the Telegram channel hxxps://t[.]me/dobrynyanikitichsobre, which will send the sensitive data from the victim’s device as shown in Figure 13. While analysing the sample, we could not observe any C&C communication activity as the malware failed to get the C&C URL from the Telegram channel.
The malware can also terminate itself whenever it gets the corresponding commands from the C&C server.
Below, we have listed the commands used by the TAs to control infected devices:
| Command | Description |
| startUSSD | To Transfer money using USSD |
| sentSMS | To Send SMS to a particular number |
| startApp | To Launch the Application Activity |
| getSMS | To Get SMSs Present in the Device |
| startforward | To forwarding Calls |
| linkopen | To Open URL in Browser |
| killbot | To Kill Itself |
Conclusion
Banking threats are increasing with every passing day and growing in sophistication. The GodFather malware variant is one such example. The malicious code present in the malware gives it the capability to steal sensitive information from the compromised device.
There is also the additional threat of TAs using this sensitive data to commit financial fraud and further propagate the malware to other devices.
Our Recommendations
We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:
How to prevent malware infection?
- Download and install software only from official app stores like Google Play Store or the iOS App Store.
- Use a reputed anti-virus and internet security software package on your connected devices, such as PCs, laptops, and mobile devices.
- Use strong passwords and enforce multi-factor authentication wherever possible.
- Enable biometric security features such as fingerprint or facial recognition for unlocking the mobile device where possible.
- Be wary of opening any links received via SMS or emails delivered to your phone.
- Ensure that Google Play Protect is enabled on Android devices.
- Be careful while enabling any permissions.
- Keep your devices, operating systems, and applications updated.
How to identify whether you are infected?
- Regularly check the Mobile/Wi-Fi data usage of applications installed in mobile devices.
- Keep an eye on the alerts provided by Anti-viruses and Android OS and take necessary actions accordingly.
What to do when you are infected?
- Disable Wi-Fi/Mobile data and remove SIM card – as in some cases, the malware can re-enable the Mobile Data.
- Perform a factory reset.
- Remove the application in case a factory reset is not possible.
- Take a backup of personal media Files (excluding mobile applications) and perform a device reset.
What to do in case of any fraudulent transaction?
- In case of a fraudulent transaction, immediately report it to the concerned bank.
What should banks do to protect their customers?
- Banks and other financial entities should educate customers on safeguarding themselves from malware attacks via telephone, SMSs, or emails.
MITRE ATT&CK® Techniques
| Tactic | Technique ID | Technique Name |
| Initial Access | T1476 | Deliver Malicious App via Other Mean. |
| Initial Access | T1444 | Masquerade as Legitimate Application |
| Execution | T1575 | Native Code |
| Collection | T1412 | Capture SMS Messages |
| Command and Control | T1436 | Commonly Used Por |
Indicators of Compromise (IOCs)
| Indicators | Indicator Type | Description |
| 0b72c22517fdefd4cf0466d8d4c634ca73b7667d378be688efe131af4ac3aed8 | SHA256 | GodFather APK |
| 3fa48a36d22d848ad111b246ca94fa58088dbb7a | SHA1 | GodFather APK |
| ec9f857999b4fc3dd007fdb786b7a8d1 | MD5 | GodFather APK |
| c79857015dbf220111e7c5f47cf20a656741a9380cc0faecd486b517648eb199 | SHA256 | GodFather APK |
| 2b3b78d3a62952dd88fc4da4688928ec6013af71 | SHA1 | GodFather APK |
| d7118d3d6bf476d046305be1e1f9b388 | MD5 | GodFather APK |
| hxxps://t[.]me/dobrynyanikitichsobre | URL | Telegram Channel Used to Fetch URL |
Comments are closed.