Trojan-Banker.BankBot.1

Basic Information

• Samples: 4
• Creation Date: 2014-02
• Detected Date: 2015-03
• Fraud: No
• Studied Sample: /BankBot/variety1/f0a1475583278466b673ac902b664e42.apk
• References:
  http://vms.drweb.com/virus/?i=4059936&lng=en
• Language:

Composition Strategy

• Standalone: ✔
• Repackaging:
• Library:

Installation Strategy

• Drop:
• Drive-by Download:

Activation Strategy

• Event: BOOT, MAIN, SMS
• By Host App:
• Scheduling: ✔

Information Stealing

• Personal Information: Audio/Picture, Call Log, Contacts, Phone Number, SMS
• Device Information: ✔

Persistence

• Clean Evidence: block sms, block notification
• Prevent Destroy:

Privilege Escalation

• Request Device Admin: ✔
• Root Exploits:

C&C

• Internet Server: ✔
• SMS Server: ✔
• Command Encoding: custom_protocol

Anti-analysis Techniques

• Renaming:
• String Encryption:
• Dynamic Loading:
• Native Payload:
• Evade Dynamic Analysis:

Monetization Methods

• Subscribe to Premium Service:
• Banking Trojan: ✔
• Ransom:
• Aggressive Advertisement:

Documentation