bankbot-mazain

In recent years we've struggled against different types of malware that targeting Turkish banking and financial institution's apps. It has been observed that malicious banking applications have increased over the last two years. Especially on the mobile side, many new types of malicious software has spread via phishing, smishing etc.

As the spread of Zeus botnet's source code, Bankbot or Maza-in bot and C&C source code is also open sourced and different variants of this bots are spread in underground portals. Entire code of the Android application, as well as the complete C&C panel in PHP is available in different forums

Some of them:

hxxp://nora.biz/index.php?threads/Пишем-android-бота-с-нуля.1425/

hxxps://forum.exploit.in/index.php?s=52f9e19ea5173f0ea43855edabafff41&showtopic=113555

hxxp://a0007517.xsph.ru/threads/pishem-svoj-android-botnet-s-nulja.6/

the software that used in C&C servers has small PHP code. C&C portal is managing android bots via commands. And it is stealing SMS messages to get OTP.

This C&C server basically add bots to panel and catch SMS messages from android phones. There are lots of active C&C servers in the wild

Almost all C&C servers are served on domain with .gdn TLD https://en.wikipedia.org/wiki/.gdn & some of them are served on domain with .pw TLD

Observed domains are:

ifc3yb3rs3cur1tych0.pw
1nj3ct10n.gdn
r0n4ld4.gdn
t4l1sc4.gdn
trolitrader.pw
bigbustown.pw
ch4pr6.gdn
n0309.gdn
tr4f0.pw
t1lk1.gdn
b46.gdn
... this list will be updated after other domains has found

The person who owns these domains has previously used different domains as serving phishing sites and C&C servers.

hxxp://e-trafikcezasiodemesi.net
hxxp://guvenliktrafikcezasiodemeyeri.com
hxxp://jethgsyukle.com

old ones are:

When you visited the following Turkish sites with mobile devices, the site helped spread mentioned android bot.

hxxp://ircforumlari.net
hxxp://filmindirsene.net

If you visit sites mentioned above with mobile devices or browser with the user-agent strings set as one of the android browsers, site offers to install android application via shortened link.

You need to install Flash Player for Android from the link below so you can visit the site.

hxxp://dogrulama.link site which is serving URL shortening service is hosting fake flash player application.

SHA256 hashes of FlashPlayer.apk and its variants.

62ca7b73563f946df01d65447694874c45d432583f265fad11b8645903b6b099
3bf02ae481375452b34a6bd1cdc9777cabe28a5e7979e3c0bdaab5026dd8231d
6b93f837286da072f1ec7d5f5e049491d76d4d6ecc1784e1fadc1b29f4853a13
d8b28dbcc9b0856c1b7aa79efae7ad292071c4f459c591de38d695e5788264d1
bd194432a12c35ae6ae8a82fa18f9ecac3eb6e90c5ff8330d20d19e85a782958
e0da58da1884d22cc4f6dfdc2e1da6c6bfe2b90194b86f57f9fc01b411abe8de

It seems that some of the class names are written in Turkish.

and some also Russian (original ones are already found on the Russian forums).

ПРОВЕРКА! & Запрос USSD выполнен

After installing the flashplayer.apk to phone the malware asks the user to give the device admin privileges for the first time.

the other permissions that malware want to use are:

Malware has some services to run.

The Trojan can receive the following commands from the C&C:

Unstructured Supplementary Service Data request
Request Admin/Root Privileges
Send SMS

Malware scans all running process defined in statham class.

After it has received the all running process list, It Compares to its own list of mobile banking applications.

Almost all of the Turkish Mobile Banking and Financial applications are affected by BankBot malware right now:

com.ziraat.ziraatmobil
com.ziraat.ziraattablet
com.tmobtech.halkbank
com.vakifbank.mobile
com.pozitron.vakifbank
com.akbank.android.apps.akbank_direkt
com.akbank.softotp
com.akbank.android.apps.akbank_direkt_tablet
tr.com.sekerbilisim.mbank
com.teb
com.pozitron.iscep
com.softtech.isbankasi
com.ykb.android
com.ykb.androidtablet
com.tmob.denizbank
com.tmob.tabletdeniz
com.garanti.cepsubesi
biz.mobinex.android.apps.cep_sifrematik
com.htsu.hsbcpersonalbanking
com.ingbanktr.ingmobil
com.magiclick.odeabank
com.finansbank.mobile.cepsube
finansbank.enpara
com.pozitron.albarakaturk
com.kuveytturk.mobil

And also The phone numbers in the source code are blocked by Bankbot.

Toast.makeText((Context)context, (CharSequence)"Giden Aramalar Engellendi.", (int)0).show();

Each of these phone numbers is used to access the related bank's phone banking system.

this.b = arrayList.getStringExtra("incoming_number");

arrayList = new ArrayList();
arrayList.add("+9008502200000");
arrayList.add("+908502200000");
arrayList.add("+904440000");
arrayList.add("+9008502220400");
arrayList.add("+908502220400");
arrayList.add("+904440400");
arrayList.add("+9008502220724");
arrayList.add("+908502220724");
arrayList.add("+904440724");
arrayList.add("+9008502222525");
arrayList.add("+908502222525");
arrayList.add("+904442525");
arrayList.add("+9008502227878");
arrayList.add("+908502227878");
arrayList.add("+904447878");
arrayList.add("+9008502000666");
arrayList.add("+908502000666");
arrayList.add("+904440832");
arrayList.add("+9002166353535");
arrayList.add("+902166353535");
arrayList.add("+9008507240724");
arrayList.add("+908507240724");
arrayList.add("+904440202");
arrayList.add("+9008502220444");
arrayList.add("+908502220444");
arrayList.add("+904440444");
arrayList.add("+9008502220800");
arrayList.add("+908502220800");
arrayList.add("+904440800");
arrayList.add("+9008502220333");
arrayList.add("+908502220333");
arrayList.add("+904440333");
arrayList.add("+9008502110111");
arrayList.add("+908502110111");
arrayList.add("+9008502220600");
arrayList.add("+908502220600");
arrayList.add("+904448444");
arrayList.add("+9002123048444");
arrayList.add("+902123048444");
arrayList.add("+9008502220900");
arrayList.add("+908502220900");
arrayList.add("+904440900");
arrayList.add("+9008502223663");
arrayList.add("+908502223663");
arrayList.add("+9008502225666");
arrayList.add("+908502225666");
arrayList.add("+904445666");
arrayList.add("+9002166660101");
arrayList.add("+902166660101");
arrayList.add("+9008502510123");
arrayList.add("+908502510123");
arrayList.add("+9002123541111");
arrayList.add("+902123541111");
arrayList.add("08502200000");
arrayList.add("8502200000");
arrayList.add("4440000");
arrayList.add("08502220400");
arrayList.add("8502220400");
arrayList.add("4440400");
arrayList.add("08502220724");
arrayList.add("8502220724");
arrayList.add("4440724");
arrayList.add("08502222525");
arrayList.add("8502222525");
arrayList.add("4442525");
arrayList.add("08502227878");
arrayList.add("8502227878");
arrayList.add("4447878");
arrayList.add("08502000666");
arrayList.add("8502000666");
arrayList.add("4440832");
arrayList.add("02166353535");
arrayList.add("2166353535");
arrayList.add("08507240724");
arrayList.add("8507240724");
arrayList.add("4440202");
arrayList.add("08502220444");
arrayList.add("8502220444");
arrayList.add("4440444");
arrayList.add("08502220800");
arrayList.add("8502220800");
arrayList.add("4440800");
arrayList.add("08502220333");
arrayList.add("8502220333");
arrayList.add("4440333");
arrayList.add("08502110111");
arrayList.add("8502110111");
arrayList.add("08502220600");
arrayList.add("8502220600");
arrayList.add("4448444");
arrayList.add("02123048444");
arrayList.add("2123048444");
arrayList.add("08502220900");
arrayList.add("8502220900");
arrayList.add("4440900");
arrayList.add("08502223663");
arrayList.add("8502223663");
arrayList.add("08502225666");
arrayList.add("8502225666");
arrayList.add("4445666");
arrayList.add("02166660101");
arrayList.add("2166660101");
arrayList.add("08502510123");
arrayList.add("8502510123");
arrayList.add("02123541111");
arrayList.add("2123541111");

The person who developed the malware is likely to be a bit lazy or have little experience in programming. Various sources on Internet shows that same string used for intercept/blocking outgoing calls.

Also C&C server has special login pages for getting credentials from user.

display phishing window WebView with content downloaded from the link specified in a command.

We are likely to face many cases this year with the spread of open source malicious mobile banking application.

bemre/bankbot-mazain

bankbot-mazain