CAUTION: This 29 Android Apps Can Steal From Your Bank, Practically!

One major difference between Android OS by Google and iOS by Apple, is the fact that Android is Open Source operating system, why iOS is not. By open source, it means anybody within the ecosystem can contribute towards the development of the operating system (OS), mostly inderectly, through application developments.

Unfortunately, not all app developers within the Android ecosystem have good integrity; while some developers put in efforts to offer well optimized applications to users within the ecosystem, some selfish developers are seeking ways to exploit users within same ecosystem.

Google on it end, has put up different measures to restrict the presence of this developers within the Android ecosystem, at least, Google has put up extensive verification method and checks, to ensuring that such apps that exploit users does not make it ways to the official Google Android Play store.

But overtime, we’ve seen dubious developers beating and tricking Google into believing that their apps are safe, but the contrary, leading to bad apps making it to Google app Store. But again, all credits to Google for always responding quickly to researchers and other developers report concerning malicious apps on the play store.

Today, we are presenting to our readers in a caution, of 29 malicious Android apps that is capable of practically stealing money from your bank account. These apps belong to the category of sophisticated mobile banking malware with complex functionality and a heavy focus on stealth.

As mentioned above, the 29 malicious apps have all been removed from the official Android store in the meantime after ESET and fellow researchers notified Google of their malicious nature. But unfortunately, before the 29 apps were pulled from Google play store, a total of about 30,000 Android users had already installed the apps. So it is important to go through the list below, and ensure to remove such apps from your Android enabled smartphone ASAP.

How Does These Apps Operates?

Once launched, the apps either display an error claiming they have been removed due to incompatibility with the victim’s device and then proceed to hide themselves from the victim’s view, or deliver the promised functionality – such as displaying horoscopes.

Regardless of which of the preceding activities one of these apps displays, the main malicious functionality is hidden in an encrypted payload located in each app’s assets. This payload is encoded using base64 and then encrypted with an RC4 cipher using a hardcoded key. The first stage of the malware’s activity is a dropper that initially checks for the presence of an emulator or a sandbox. If these checks fail, it then decrypts and drops a loader, and a payload that contains the actual banking malware. Some of the apps we analyzed contained more than one stage of such encrypted payloads.

The functionality of the final payload is to impersonate banking apps installed on the victim’s device, intercept and send SMS messages, and download and install additional applications of the operator’s choice. The most significant feature is that the malware can dynamically impersonate any app installed on a compromised device. This is achieved by obtaining the HTML code of the apps installed on the device and using that code to overlay legitimate apps with bogus forms once the legitimate apps are launched, giving the victim very little chance to notice something is amiss.

How to stay safe

Fortunately, these particular banking Trojans (the full list can be found in the IoCs section) do not employ advanced tricks to ensure their persistence on affected devices. Therefore, if you suspect you have installed any of these apps, you can simply uninstall them under Settings > (General) > Application manager/Apps.

We also advise you to check your bank account for suspicious transactions and consider changing your internet banking password/PIN code.

To avoid falling victim to banking malware, we recommend that you:

• Only download apps from Google Play; this does not ensure the app is not malicious, but apps like these are much more common on third-party app stores, where they are rarely removed once uncovered, unlike on Google Play
• Make sure to check the number of downloads, app ratings and the content of reviews before downloading apps from Google Play
• Pay attention to what permissions you grant to the apps you install
• Keep your Android device updated and use a reliable mobile security solution; ESET products detect and block this threat as Android/TrojanDropper.Agent.CIQ.

Indicators of Compromise (IoCs)