Tracking Android BankBot

Free stuff are great, aren’t they? Sure, but not always, especially when it comes to security and leaked source codes. Leaked or intentionally published source codes of malware can bring new variants of infiltrations. It was proved by leaked code of Zeus, NukeBot, GMBot, Mirai or BankBot. Every hacker wannabe can slightly change the code and spread it without any hard effort using someone else work to steal money from bank accounts and send subscription or premium-rate text messages.

In this blog post I will focus on Android BankBot and mainly I would like to update this blog post with new derivatives of BankBot including C&C’s, number of bots, APK samples or hashes, distribution vector if possible, targeted countries, targeted banking or financial institution apps or added new functionality. 

If you come across a new variant of Android BankBot and you don’t mind to share, feel free to let me know at Lukas and I will update this blog post with your catch and particular acknowledgement. 

Feel free to share it between Android security researchers to contribute.

Why?

Simply to spread awareness including infiltration details between security researchers, AV malware analyst or maybe even potential victims. Share malicious samples, URL’s and C&C’s to blacklist and of course to take down these botnets.

Never heard of Android BankBot?

First variant of BankBot from underground Russian forum.

BankBot on Google Play
Kudos to Fernando

 

[May 30, 2017]
VT(26 /61): SexChat.apk
Sample: com.example.livemusay.myapplication
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://diores.myjino.ru
Number of bots: ,? bots 
Kudos to Fernando 

[May 29, 2017]
VT(24 /61): com.example.livemusay.myapplication
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://77.38.216.249
Number of bots: ,3 bots

[May 29, 2017] 
VT(21 /58): bankturov.apk
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://95.183.13.21
Number of bots: ,? bots

[May 29, 2017] 
VT(9 /61): app-release-unsigned.apk
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://212.8.244.236
Number of bots: ,? bots

[May 29, 2017]
VT(/): 8114021E81BAB2D319298CD02436A6BCA508EAFF
Spread: hxxp://www.kisa.link/url_redirector.php?url=5sFI
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://th3.gdn
Number of bots: ,? bots

[May 29, 2017] 
VT(/): 05C33D8800B93E6857C89E8F879CC459BDDBB7F3
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://g0m4x.gdn
Number of bots: ,? bots


[May 26, 2017]  
VT(25 /59): com.example.livemusay.myapplication
C&C: hxxp://a0138037.xsph.ru
Number of bots: ,? bots
Thanks to Nikolaos Chrysaidos


[May 26, 2017]
VT(15 /58): FlashPlayer.apk
C&C: hxxp://sh0wt1m3.gdn
Target: 31 Russian, Ukraine banking apps 
Number of bots: ,? bots

[May 25, 2017] 
C&C: hxxp://www.wewaha.mcdir.ru
Number of bots: ,? bots

[May 25, 2017]
VT(/): Flash Player.apk
Spread: hxxp://mamesikan.in.ua/Flash Player.apk
Target: 34 France, Germany, Turkish, Russian, Ukraine banking apps
C&C: hxxp://zaebis.mcdir.ru
Number of bots: ,? bots

[May 25, 2017] 
VT(12 / 61): FlashPlayer.apk
Target: 31 Russian, Ukraine banking apps
C&C: hxxp://b46.gdn
Number of bots: ,? bots

[May 25, 2017] 
VT(11 / 59): FlashPlayer.apk
Target: 31 Russian, Ukraine banking apps
C&C: hxxp://c0m3.gdn
Number of bots: ,? bots

[May 25, 2017] 
VT(14 / 60): FlashPlayer.apk
Target: 31 Russian, Ukraine banking apps
C&C: hxxp://r4al.gdn
Number of bots: ,? bots

[May 22, 2017]
VT(28 / 60): avito.apk
Sample: com.example.livemusay.Avito
Spread: hxxp://m.vidcp.ru/avito.apk
Target: 31 Russian, Ukraine banking apps 
C&C: hxxp://kolhoz124.ru
Number of bots: ,4 bots

[May 22, 2017]
VT(12 / 60): com.get.adobe.Flash 
Target: 27 Russian, Ukraine banking apps 
C&C: hxxp://b46.gdn
Number of bots: ,? bots



[May 20, 2017]

VT(): FEA11E5AF944C73328F81CEF0FF3768C4F78DF53

Target: 27 Russian, Ukraine banking apps + WhatsApp, Facebook, Viber, Skype

C&C: hxxp://popularappsgames.com

Number of bots: ,54 bots

[May 19, 2017]