Fakebank Malware Variant that Intercepts Android user’s Banking Calls

The Fakebank malware comes back, with its new Fakebank malware variant that intercepts the Android users’ banking incoming and outgoing calls. Attackers distributed the app through third-party Android markets and social media websites.

Security researchers from Symantec identified the malicious behavior of the apps infected with Android.Fakebank that intercepts the calls made by the users to their banks.

With the current variant it targets Korean bank clients, so far 22 apps have been identified infected with the Fakebank malware. The previous variant of the Fakebank malware intercepts the SMS applications to gather financial information.

The previous version of the Fakebank malware variant targets Russian speaking nations and Russian banks with high Obfuscation technique to steal highly sensitive information.

Fakebank Malware Variant

When the app triggered it collects the personal information from user’s phone and submits to the command and control servers. The server responds with the configuration that specifies the phone number.

Researchers said “When users call a real banking phone number, the malware is able to intercept and transfer the call to the scammer’s configured phone number. When a call comes in from a scammer, the app will overlay a fake UI dialog that spoofs a legitimate bank caller ID and number”.

The API and associated permissions evolved based on the Android versions (android.permission.SYSTEM_ALERT_WINDOW). With Android version’s below 6 the permission needs to be declared in the manifest file and it requires permission at the time of installation.

With Android version 6 & 7 if the permission declared in the manifest file and the app downloaded from Google Play, it won’t prompt users for permission. From the Android version 8, the app is not allowed to overlay system so the malware will not execute.

Common Defences On Mobile Threats

• Give careful consideration to the permission asked for by applications.
• Download applications from trusted sources.
• Stay up with the latest version.
• Encrypt your devices.
• Make frequent backups of important data.
• Install anti-malware on their devices.
• Stay strict with CIA Cycle.