Friday, November 1, 2024
HomeMalwareFakeBank Malware Layered Obfuscation Technique Replace a Default SMS App to Stealing...

FakeBank Malware Layered Obfuscation Technique Replace a Default SMS App to Stealing Highly Sensitive Data

Published on

Malware protection

A New persistent malware family called FakeBank spreading across Russian speaking nations and targetting Russian banks with sophisticated Obfuscation technique to steal highly sensitive information.

Identified samples are mainly abusing Legitimate SMS and MMS based management applications.

This malware specifically targeting to gain the financial information from the SMS applications and periodically gathering pieces of information from the mobile banking system.

- Advertisement - SIEM as a Service

This critical malware has been detected in few countries such as Russia, China, Ukraine, Romania, Germany and other Russian speaking countries.

Also Read:  Fourth Fappening – Hacker Pleads Guilty to Hacking into iCloud accounts of Celebrities

FakeBank Malware Intercepting the Victims SMS

Once the user gets infected, this tricky malware will be connected to the internet and establish a connection to its Command & Control server.

Later it used to gathering an information about the antivirus software with this target machine before it starts its malicious behavior.

Once its find and antivirus software then it simply exits without performing any malicious activities using its persistent capability which helps to remain flying under the radar.

This malware stealing the information such as phone numbers, a list of installed banking apps, the balance on any linked bank card, and even location information, later it will upload the collected information to Its C&C server.

once this Malware installed on the Victims machine, an Icon of this malware app has to display in apps screen and ask for some sensitive permissions such as device administration.

Later it asks user to replace the default SMS app and once the replacement will done then it silently disappears from the screen and malicious behavior gets started.

According to Trend Micro, all this access to the device’s SMS gives the malware an avenue to silently steal money from users’ bank account. Since users bind their bank accounts to their device and receive notifications on the same device, the malware can intercept sensitive account information. It can then reset bank account passwords through received security code messages and start transferring money.

Layered Obfuscation

It also using 2 Layers that provides more obfuscation techniques to evade the detection.

First Layer used for shell protection that provides to APKs to avoid the shellcode detection.

Second layer confusion tactic to make the code harder to understand and also it encrypts all the string, system calls, functions and class name. it using (DES/BASE64)  standard encryption technique.

“The malware has registered numerous C&C domains and many of the domain names are recent, with some still alive.

These C&C domains have common IP addresses (195.22.126.81 and 195.22.126.160) that are located in Poland Warmia-Masuria. Other IP addresses (185.110.132.0 &  185.110.132.255) are located in Russia.” Trend Micro said.

Balaji
Balaji
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Latest articles

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

ATPC Cyber Forum to Focus on Next Generation Cybersecurity and Artificial Intelligence Issues

White House National Cyber Director, CEOs, Key Financial Services Companies, Congressional and Executive Branch...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Konni APT Hackers Attacking Organizations with New Spear-Phishing Tactics

The notorious Konni Advanced Persistent Threat (APT) group has intensified its cyber assault on...

Free Webinar

Protect Websites & APIs from Malware Attack

Malware targeting customer-facing websites and API applications poses significant risks, including compliance violations, defacements, and even blacklisting.

Join us for an insightful webinar featuring Vivek Gopalan, VP of Products at Indusface, as he shares effective strategies for safeguarding websites and APIs against malware.

Discussion points

Scan DOM, internal links, and JavaScript libraries for hidden malware.
Detect website defacements in real time.
Protect your brand by monitoring for potential blacklisting.
Prevent malware from infiltrating your server and cloud infrastructure.

More like this

LightSpy iOS Malware Enhanced with 28 New Destructive Plugins

The LightSpy threat actor exploited publicly available vulnerabilities and jailbreak kits to compromise iOS...

New PySilon RAT Abusing Discord Platform to Maintain Persistence

Cybersecurity experts have identified a new Remote Access Trojan (RAT) named PySilon. This Trojan...

Notorious WrnRAT Delivered Mimic As Gambling Games

WrnRAT is a new malware attack that cybercriminals have deployed by using popular gambling...