Tuesday, May 9, 2017

Tracking Android BankBot



Free stuff are great, aren’t they? Sure, but not always, especially when it comes to security and leaked source codes. Leaked or intentionally published source codes of malware can bring new variants of infiltrations. It was proved by leaked code of Zeus, NukeBot, GMBot, Mirai or BankBot. Every hacker wannabe can slightly change the code and spread it without any hard effort using someone else work to steal money from bank accounts and send subscription or premium-rate text messages.



In this blog post I will focus on Android BankBot and mainly I would like to update this blog post with new derivatives of BankBot including C&C’s, number of bots, APK samples or hashes, distribution vector if possible, targeted countries, targeted banking or financial institution apps or added new functionality. 

If you come across a new variant of Android BankBot and you don’t mind to share, feel free to let me know at Lukas and I will update this blog post with your catch and particular acknowledgement. 

Feel free to share it between Android security researchers to contribute.


Why?

Simply to spread awareness including infiltration details between security researchers, AV malware analyst or maybe even potential victims. Share malicious samples, URL’s and C&C’s to blacklist and of course to take down these botnets.

Never heard of Android BankBot?

BankBot variant distributed via SMS


Samples 


[September 21, 2017]  
VT(24/62): com.example.livemusay.myapplication
C&C: http://andver19.zzz.com.ua/index.php?cont=kliets&page=1
Number of bots: 31 bots



[September 21, 2017]  
VT(24/59): com.example.livemusay.myapplication
C&C: https://centrume.ru
Number of bots: ? bots



[September 21, 2017]  
VT(23/62): com.example.livemusay.myapplication
C&C: http://148.251.231.114
Number of bots: ? bots



[September 14, 2017]  
VT(25/61): com.example.livemusay.myapplication
C&C: http://alexbbxj.beget.tech
Number of bots: ? bots

[September 13, 2017]  
VT(13/58): ec153fdc987f078802752cd6f699335c7bbc64b9
C&C: http://umktjnk4774.tk
Number of bots: 1 bots



[September 8, 2017]  
VT(23/61): com.example.livemusay.myapplication
C&C: http://j734306.myjino.ru
Spread: hxxp://wsexxi.gq/Runetki.apk
Number of bots: ? bots



[September 8, 2017]  
VT(24/62): com.example.livemusay.myapplication
C&C: http://alexbb1347.mcdir.ru/index.php?cont=kliets&page=1
Spread: http://transfiles1.ru/getFiles/214622
Sample: Free_Runetki.apk
Number of bots: 40+ bots
Kudos: Fernando



[September 6, 2017]  
VT(/): com.droidgroup.service
C&C: http://droidgroup17.xyz/index.php?cont=kliets&page=1
Number of bots: 126 bots



[September 6, 2017]
VT(/):7747DC767E72AD26FEAAFA17244B8ADB82807641
C&C: http://snowflake.mcdir.ru/?cont=kliets&page=1
Spread: hxxp://31.131.27.168:8081/browser.apk
Number of bots: 2 bots



[September 6, 2017]
VT(31/62): com.example.livemusay.myapplication
C&C: http://bn.mcdir.ru/?cont=kliets&page=1
Spread: hxxp://nrhk.epizy.com/Video%20calls.apk
             hxxp://nrhk.epizy.com/%d0%a4%d0%be%d1%82%d0%be%20%d0%b0%d1%80%d1%85%d0%b8%d0%b2.apk
             hxxp://bbnet.rf.gd/Messenger.apk
Number of bots: 17 bots
Kudos: Fernando



[September 6, 2017]  
VT(32/62): com.example.livemusay.myapplication
C&C: http://yesbot.ru

Number of bots: 17 bots
Kudos: Fernando



[September 6, 2017]  
VT(25/62): com.example.livemusay.myapplication
C&C: http://beta.meetporn.ru/?cont=kliets&page=1
Spread: hxxp://ds2.nashobmen.org/fo/get/3824554/durak_na_razdevanie-wap_sasisa_ru.apk 
             hxxp://meetporn.ru/adobe_flash.apk
Sample: Adobe Flash
Number of bots: 17 bots
Kudos: Fernando



[September 6, 2017]  
VT(25/62): com.system.adobe.FlashPlayer
C&C: http://www.trolitrader.pw
Number of bots: ? bots

[September 6, 2017]  
VT(16/62): com.and.kase.can
C&C: http://fatur1s.life
Number of bots: ? bots

[September 6, 2017]  
VT(20/62): com.android.koop.stopone
C&C: http://kvp41.life
Number of bots: ? bots

[September 6, 2017]  
VT(31/61): com.example.livemusay.myapplication
C&C: https://centrume.ru
Number of bots: ? bots
Kudos: MalwTr1ck



[September 6, 2017]  
VT(32/61): com.example.livemusay.myapplication
C&C: http://test.agressivex.com
Number of bots: ? bots
Kudos: MalwTr1ck



[September 6, 2017]  
VT(27/62): com.example.livemusay.myapplication
C&C: http://vilso.ru
Number of bots: ? bots

[September 6, 2017]  
VT(20/62): com.example.livemusay.myapplication
C&C: http://pravilnoe-hudenie.ru/index.php?cont=kliets&page=1
Number of bots: ? bots



[September 6, 2017]  
VT(29/61): MMS.apk
C&C: http://dolly2cyan.temp.swtest.ru
Spread: hxxp://gipsms.gq/MMS.apk 
Number of bots: ? bots

[August 31, 2017]  
VT(29/61): com.example.livemusay.myapplication
C&C: http://dolly2cyan.temp.swtest.ru/?cont=kliets&page=1
Sample: MMS Flash Player 12
Number of bots: 40+ bots
Kudos: Fernando



[August 31, 2017]  
VT(18/61): com.android.koop.stopone
C&C: http://kvp41.life
Number of bots: ? bots

[August 31, 2017]  
VT(24/61): Bass Booster patch.apk
C&C: http://paperty.epizy.com/?cont=kliets&page=1
Number of bots: 1 bots



[August 31, 2017]  
VT(25/62): com.example.livemusay.myapplication
C&C: http://j731449.myjino.ru
Spread: hxxp://wsexxi.ga/sex_znakomstva.apk 
             hxxp://wsexxi.tk/sex_drug.apk
Number of bots: ? bots




[August 30, 2017]  
VT(26/61): com.example.bob_root.musya_and_vasya
C&C: http://sven.mcdir.ru
Number of bots: ? bots


[August 25, 2017]  
VT(34/60): com.example.livemusay.myapplication 
C&C: http://95.169.184.114/?cont=kliets&page=1
Spread: hxxp://stim-arch.ru/cms/app.apk
Number of bots: 0 bots




[August 25, 2017]  
VT(23/61): com.example.livemusay.myapplication
C&C: http://j728870.myjino.ru 

Spread: hxxp://tusexxi.ml/sex_drug.apk
Number of bots: ? bots

Kudos Pitbool



[August 24, 2017]  
VT(25/61): app-release.apk
C&C: http://realmoney.mcdir.ru/index.php?cont=kliets&page=1
Number of bots: 4 bots

Kudos Malwtr1ck



[August 23, 2017]  
VT(26/61): com.example.livemusay.myapplication
C&C: http://q.j725051.myjino.ru

Sample: Sex Drug
Number of bots: ? bots





[August 21, 2017]  
VT(24/61): com.example.livemusay.myapplication
C&C: http://j725051.myjino.ru
Number of bots: ? bots





[August 08, 2017]  
VT(29/61): com.example.livemusay.myapplication
C&C: h
ttp://j721422.myjino.ru
Number of bots: ? bots


 

[August 02, 2017] 
VT(9/60): com.androis.svac.twoo
C&C: http://b1502b.gdn
Number of bots: ? bots
 
[July 28, 2017] 
VT(14/61): MMS.apk
C&C: http://xyu77s8c.beget.tech/
Spread: hxxp://vievpda.gq/MMS.apk
Number of bots: ? bots

[July 28, 2017] 
VT(28/62): com.basy.elqua.ggc
C&C: http://b1v2a5.gdn
Spread: hxxp://flesplyer.net/Adobe-Flash-Player-TR-51.2.5/A1329432/FlashPlayer.apk
Number of bots: ? bots

[July 25, 2017] 
VT(24/61): app-release.apk
C&C: http://ajidgmailc.temp.swtest.ru
Number of bots: ? bots
Kudos to Fernando and


  
[July 25, 2017] 
VT(23/62): javamonkey2.apk
C&C: http://whiteswan.club/andr/inj/
Spread: hxxp://beautyinthemobile.com/javamonkey2.apk
Number of bots: ? bots
 



[July 25, 2017] 
VT(19/62): FlashPlayer.apk
Sample: Adobe Flash Player
C&C: http:/elsssee.gdn
Targets: 28 Russian and Turkish banks 
Spread: hxxp://fleshplayerr.xyz/Adobe-Flash-Player-TR-37.7.4/C195109/FlashPlayer.apk  
             hxxp://fleshplayerr.xyz/Adobe-Flash-Player-TR-37.7.4/A105910/FlashPlayer.apk 
Number of bots: ? bots
Kudos: @4chr4f2


 

[July 24, 2017] 
VT(17/62): FlashPlayer.apk
C&C: http://b5k31.gdn
Spread: hxxp://flashplayeer.xyz/Adobe-Flash-Player-TR-37.7.4/B209414/FlashPlayer.apk
Number of bots: ? bots

[July 21, 2017] 
VT(15/62): flashplayer_install.apk
C&C: http://blastornado.biz/private/
Number of bots: ? bots

[July 21, 2017] 
VT(7/61): flash_player.apk
C&C: http://ipsiteanalitics.review/private/kliets.php
Spread: hxxp://rag-soft.com/banner/flash_player.apk 
             hxxp://sv.darkfetishnet.com/flash_start.apk
Targets: 100+ banks from FR, DE, TR, USA, RU, UA, PL including Trade stocks and invest apps
Number of bots: ? bots



[July 20, 2017] 
VT(23/61): anu_bispro.app
C&C: http://nmfutureimports.com/private
Number of bots: ? bots





[July 20, 2017] 
VT(24/62): com.qor.firee.teaas
C&C: http://b1k51.gdn
Spread:hxxp://flashplayeer.com/Adobe-Flash-Player-TR-35.5.1/C30594/FlashPlayer.apk
Number of bots: ? bots

[July 17, 2017] 
VT(24/62): sex_drug.apk
C&C: http://fyu.myjino.ru
Spread: hxxp://osabiro.tk/sex_drug.apk
             hxxp://xxxdrug.cf/sex_drug_vokrug.apk
Number of bots: ? bots






[July 17, 2017] 
VT(17/61): com.swi.qiwi.katrana
C&C: htt10as05.gdn
Spread: hxxp://flashpleyr.top/Adobe-Flash-Player-TR-35.5.1/C30594/FlashPlayer.apk
             hxxp://flashpleyr.net/Adobe-Flash-Player-TR-35.5.1/A12546/FlashPlayer.apk
Number of bots: ? bots

[July 14, 2017] 
VT(19/61): FlashPlayer.apk
C&C: http://wechaatt.gdn
Spread: hxxp://fleshplayerr.net/Adobe-Flash-Player-TR-25.0.6/A1144983251/FlashPlayer.apk
Number of bots: ? bots


[July 07, 2017]
VT(16/61): com.example.gameclient.downloader
C&C: http://ce99999.mcdir.ru/?cont=kliets&page=1
Spread: hxxp://server.ce99999.mcdir.ru/brawl.apk
Number of bots: 30+ bots
Thanks to Nikolaos Chrysaidos




[July 06, 2017] 
VT(26/60): com.sell.anti.Player
C&C: http://osmangaziadobeeflash.com
Number of bots: ? bots


[July 06, 2017] 
VT(26/60): com.burns.antipati.Player
C&C: http://servertestapi.eu
Number of bots: ? bots


[July 03, 2017]
Sample: com.example.livemusay.myapplication
C&C: http://fortog.myjino.ru
Spread: hxxp://sukus.ru/sex_babi.apk
Number of bots: ? bots



[July 03, 2017]
Sample: Flash_Player.apk
C&C: hxxp://traind-blax2.ru
Spread:  hxxp://www.video-xxx2.com/Flash_Player.apk
Number of bots: ? bots

[July 03, 2017]
VT(29/61):
Spread: hxxps://ru.files.fm/down.php?i=h4ty2amk
C&C: hxxp://checkitsworks.atspace.cc
Number of bots: 8 bots




[July 03, 2017]
VT(23/61): com.kkk.amd.adobe
Spread: hxxp://adobeeflsh.net/Adobe-Flash-Player-TR-41.1.1/E541/FlashPlayer.apk
C&C: hxxp://sp0rts.xyz/
Number of bots: ? bots


[July 03, 2017]
 

VT(26/60): com.example.banking.cert
C&C: hxxp://grapfix-desgin-ltd24.at/xddsdfwjewffkD/private/kliets.php
Number of bots: ? bots


[June 27, 2017]
VT(8/59): forbidden-sex-porn.apk
Spread: hxxp://forbidden-sex-porn.bbsindex.com/forbidden-sex-porn.apk
C&C: hxxp://85.17.29.67
Number of bots: 115+ bots



[June 27, 2017]
VT(8/59): 1E72F4DEF0EC8965C9D5220536208D235FDCB7E5
Spread: hxxp://142.91.104.188/bb.apk
C&C: hxxp://77.72.84.48/
Number of bots: 70+ bots



[June 26, 2017]
VT(16/60): FlashPlayer.apk
Sample: com.akk.nukleer.adobe 
Spread:
hxxp://onlineislemtv.com/Adobe-Flash-Player-TR-40.2.5/C704/FlashPlayer.apk 
hxxp://onlineislemtv.com/Adobe-Flash-Player-TR-40.2.5/A530/FlashPlayer.apk
C&C: hxxp://taxii.xyz
Number of bots: ?+ bots
Kudos to 4chr4fa

[June 26, 2017]
VT(4/60): dd.aS.dd.ssdfgfdgd 
C&C: hxxp://77.72.84.48/
Number of bots: 162+ bots
Kudos to 4chr4fa



[June 23, 2017]
Sample: com.example.livemusay.myapplication
C&C: hxxp://ce39009.mcdir.ru/?cont=kliets&page=1
Spread: hxxp://www.app-nns.ml/MMS.apk 
             hxxp://pocta-bank.ga/PochtaBank.apk

Number of bots: 45+ bots
Kudos to Fernando




[June 21, 2017]
VT(15/60): com.afd.servace.adobe
C&C: hxxp://onlineislem.ltd
Number of bots: ~? bots


[June 19, 2017]
VT(9/60): com.jsk.servic.playerr
C&C: hxxp://vieww.gdn
Number of bots: ~? bots


[June 16, 2017]
VT(28/59):
SparkasseVerify.apk
Sample: MeineBank Verify 
C&C: hxxp://bot.backend-moneymaking.info/index.php?cont=kliets&page=1
Number of bots: 3 bots

Kudos to Fernando


[June 16, 2017]
VT(3/60): app-release.apk

Sample:  com.make.life.easier
C&C: hxxp://biobotpro.com/private/kliets.php
Number of bots: 4 bots

Kudos to Fernando


[June 16, 2017]
VT(33/59): com.example.livemusay.myapplication

Sample:  Flash Player 11
Spread: http://rusapp.cf/MMS.apk

             http://cap-mms.tk/MMS.apk
             http://mms-pac.tk/MMS.apk
             http://vac-mms.ga/MMS.apk
             http://vac-mms.gq/MMS.apk
C&C: hxxp://papi2s.mcdir.ru
Number of bots: 120+ bots

Kudos to Fernando 

 

[June 16, 2017]
VT(11/59): com.tesla.includes.Adobe
C&C: hxxp://p0st.gdn
Number of bots: ~? bots


[June 16, 2017]
VT(): 725D68DF77C5DC2687CC20A2B3745794772F9AFC
C&C: hxxp://p0w3r.gdn
Number of bots: ~? bots


[June 11, 2017]
VT(22/60): System Update
C&C: hxxp:/
/a202702.mcdir.ru
Number of bots: 150+ bots
Thanks to Nikolaos Chrysaidos


[June 8, 2017]
VT(): bd0af72f7aeed27abfc2ff131aa85bf185b692cf1f1ad200d2044fb249e3dae9
C&C: hxxp://mixail7p.beget.tech
Number of bots: ~46 bots

Thanks to Nikolaos Chrysaidos



[June 8, 2017]
VT():
C&C: hxxp://4r3a.gdn/
Number of bots: ~? bots


[June 6, 2017]
VT():
C&C: hxxp://imjusttesting.epizy.com/shitstorm/
Number of bots: 0 bots




[June 6, 2017]
VT(17/61): anu_bispro.app
C&C: hxxp://gusewets.mcdir.ru
Number of bots: ~? bots




[June 6, 2017]
VT(10/61): com.Adobe.Systems.Software
C&C: hxxp://l1nks.gdn
Number of bots: ~? bots


[June 5, 2017]
VT(): com.Adobe.Systems.Software
C&C: hxxp://locati0ns.gdn
Number of bots: ~? bots


[June 4, 2017]
C&C: hxxp://174.138.51.124
Number of bots: 1 bot

Kudos to David Montenegro



[June 2, 2017]
VT(23 /61): 7d5b7a5cf2a39739cd64fd6a4e3fda979ff89301
C&C: hxxp://medcheckclinic.ca
Number of bots: ~? bots
 



[June 2, 2017]
C&C: hxxp://
ust41.gdn
Number of bots: ~? bots 
Kudos to David Montenegro


[May 30, 2017]
Download injecting payload from C&C.
VT(): com.downloadervideo.apk
Sample: com.downloadervideo
Target: ?
C&C: hxxp://
ughdsay3.tk
Installs from Google Play: 100 - 500
Number of bots: ~? bots 

Info: BankBot on Google Play
Kudos to Fernando






[May 30, 2017]
VT(26 /61): SexChat.apk
Sample: com.example.livemusay.myapplication
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://diores.myjino.ru
Number of bots: ~? bots
 
Kudos to Fernando 




[May 29, 2017]
VT(24 /61): com.example.livemusay.myapplication
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://77.38.216.249
Number of bots: ~3 bots




[May 29, 2017] 
VT(21 /58): bankturov.apk
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://95.183.13.21
Number of bots: ~? bots


[May 29, 2017] 
VT(9 /61): app-release-unsigned.apk
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://212.8.244.236
Number of bots: ~? bots


[May 29, 2017]
VT(/): 8114021E81BAB2D319298CD02436A6BCA508EAFF
Spread: hxxp://www.kisa.link/url_redirector.php?url=5sFI
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://th3.gdn
Number of bots: ~? bots


[May 29, 2017] 
VT(/): 05C33D8800B93E6857C89E8F879CC459BDDBB7F3
Target: 27 Russian, Ukraine banking apps
C&C: hxxp://g0m4x.gdn
Number of bots: ~? bots



[May 26, 2017]  
VT(25 /59): com.example.livemusay.myapplication
C&C: hxxp://a0138037.xsph.ru
Number of bots: ~? bots
Thanks to Nikolaos Chrysaidos



[May 26, 2017]
VT(15 /58): FlashPlayer.apk
C&C: hxxp://sh0wt1m3.gdn
Target: 31 Russian, Ukraine banking apps 
Number of bots: ~? bots

[May 25, 2017] 
C&C: hxxp://www.wewaha.mcdir.ru
Number of bots: ~? bots


[May 25, 2017]
VT(/): Flash Player.apk
Spread: hxxp://mamesikan.in.ua/Flash Player.apk
Target: 34 France, Germany, Turkish, Russian, Ukraine banking apps
C&C: hxxp://zaebis.mcdir.ru
Number of bots: ~? bots


[May 25, 2017] 
VT(12 / 61): FlashPlayer.apk
Target: 31 Russian, Ukraine banking apps
C&C: hxxp://b46.gdn
Number of bots: ~? bots


[May 25, 2017] 
VT(11 / 59): FlashPlayer.apk
Target: 31 Russian, Ukraine banking apps
C&C: hxxp://c0m3.gdn
Number of bots: ~? bots


[May 25, 2017] 
VT(14 / 60): FlashPlayer.apk
Target: 31 Russian, Ukraine banking apps
C&C: hxxp://r4al.gdn
Number of bots: ~? bots


[May 22, 2017]
VT(28 / 60): avito.apk
Sample: com.example.livemusay.Avito
Spread: hxxp://m.vidcp.ru/avito.apk
Target: 31 Russian, Ukraine banking apps 
C&C: hxxp://kolhoz124.ru
Number of bots: ~4 bots




[May 22, 2017]
VT(12 / 60): com.get.adobe.Flash 
Target: 27 Russian, Ukraine banking apps 
C&C: hxxp://b46.gdn
Number of bots: ~? bots



[May 20, 2017]
VT(): FEA11E5AF944C73328F81CEF0FF3768C4F78DF53
Target: 27 Russian, Ukraine banking apps + WhatsApp, Facebook, Viber, Skype
C&C: hxxp://popularappsgames.com
Number of bots: ~54 bots



[May 19, 2017]
VT(23 /61): app-release.apk
Target: 28 Russian, Ukraine and Polish banking apps
C&C: hxxp://zorg.byethost14.com/?cont=kliets&page=1
Number of bots: ~0 bots



[May 19, 2017]
VT(22 /58): app-release.apk
Target: 28 Russian, Ukraine and Polish banking apps
C&C: hxxp://adm.sesok.ru/?cont=kliets&page=1
Number of bots: ~13 bots
Kudos to Oscar




[May 19, 2017]
Probably testing version
VT(23 /57): app-release.apk
C&C: hxxps://zorg-apolo.000webhostapp.com
Number of bots: ~125 bots




[May 19, 2017]
VT(26 /57): Flash players
Spread using links:
hxxp://universitysurgical.com/download/adobe/flashplayer.apk
hxxp://universitysurgical.com/download/vk/VKFOTO.apk
hxxp://universitysurgical.com/download/vk/VKFOTO.apk
C&C: hxxp://62.213.67.124
Number of bots: ~? bots



[May 19, 2017]
VT(11 /61): com.get.adobe.Flash
Target: 27 Turkish banking apps
C&C: hxxp://awpdust.gdn
Number of bots: ~? bots



[May 19, 2017]
VT(11 /58): com.get.adobe.Flash
Target: 27 Turkish banking apps
C&C: hxxp://b3b3kl3r.gdn
Number of bots: ~? bots



[May 18, 2017]
Testing version for now
VT(23 /61): app-release.apk
C&C: hxxp://zorg.byethost14.com/index.php?cont=kliets&page=1
Number of bots: ~3 bots
Kudos to Fernando





[May 17, 2017]
VT(8 /60): FlashPlayer
C&C: hxxp://ch1pr0.gdn
Number of bots: ~? bots



[May 15, 2017]
VT(15 /60): turs.xrumersotre
Sample: turs.xrumersotre
C&C: hxxp://streser.ru
Number of bots: ~? bots
Kudos to Fernando


[May 15, 2017]
VT(11 /60): anu_bispro.app
C&C: hxxp://milfcheeks.com
Number of bots: ~? bots


[May 15, 2017]
VT(15 /60): 831393_0783d8_tmp_17666-menusim_3.2.51276366809.apk
C&C: hxxp://system-spy.ru
Number of bots: ~2 bots



[May 15, 2017] 
VT(25 / 61):  FotoAvito.apk
C&C: hxxp://amazingelectric.ca
Number of bots: ~29 bots
Gathered ~1502 phone numbers





[May 14, 2017]
Probably testing demo
VT(28 / 60):  com.example.livemusay.myapplication
C&C: hxxp://androixd.beget.tech
Number of bots: ~37 bots




[May 13, 2017]
VT(30 / 59): FlashPlayer.apk
Target: 27 Turkish banking apps
C&C: hxxp://ch4pr6.gdn
Number of bots: ~? bots


[May 12, 2017]
VT(12 / 58): FlashPlayer.apk
Target: 27 Turkish banking apps
C&C: hxxp://n0309.gdn
Number of bots: ~99 bots



[May 12, 2017]
VT(12 / 58): FlashPlayer.apk
Target: 27 Turkish banking apps
C&C: hxxp://ch0pr4.gdn
Number of bots: ~45 bots



[May 11, 2017]
VT(12 / 58): FlashPlayer.apk
Target: 27 Turkish banking apps
C&C: hxxp://t1lk1.gdn
Number of bots: ~78 bots



[May 9, 2017]
VT( / ): 19E9AA0DD18A97718C776B1B7C49F9E7
Koodous sample: com.inc.adobe.FlashPlayer.poh
Target: 31 Russian and Turkish banking apps
C&C: hxxp://n0309.gdn
Number of bots: ~24 bots



[May 9, 2017]
VT(23 /60 ): MKAntivirus.apk
Target: 31 Russian and Turkish banking apps
C&C: hxxp://softofmobi.lisx.ru
Number of bots: ~36 bots
Kudos to Fernando




[May 7, 2017]
Test or under development
VT( / ): FlashPlayer.apk
Koodous sample: 19B6D6DCF79FF165E870533F0ED8B94EB6D48319
Target: 31 Russian and Turkish banking apps
C&C: hxxp://t4l1sc4.gdn
Number of bots: ~0 bots


[May 7, 2017]
VT(22 / 59): FlashPlayer.apk
Target: 27 Turkish banking apps
C&C: hxxp://1nj3ct10n.gdn
Number of bots: ~113 bots


[May 7, 2017]
VT(20 /61 ): FlashPlayer.apk
Target: 31 Russian and Turkish banking apps
C&C: hxxp://r0n4ld4.gdn
Number of bots: ~90 bots



[May 6, 2017]
VT(27 / 61): FlashPlayer.apk
Koodous sample: 8a7d88126d9c703b240362bede023388
Target: 31 Russian and Turkish banking apps
C&C: hxxp://www.trolitrader.pw
Number of bots: ~88 bots





[May 6, 2017]
VT(22 / 61): FlashPlayer.apk
Koodous sample: 0da631ffa09a417904f582d8fa275b6d
Target: 27 Russian and Turkish banking apps
C&C: hxxp://tr4f0.pw
Number of bots: ~57 bots



[May 5, 2017]
Test or under development
Target: 28 Russian, Ukraine and Polish banking apps
C&C: hxxp://intraxisinfo.info/images/folder/private/


[May 4, 2017]
Under development
C&C: hxxp://bdwiki.ru



[May 1, 2017]
VT(29 / 60):  System Files
Target: 28 Russian, Ukraine and Polish banking apps
C&C: hxxp://firta.myjino.ru



[April 29, 2017]
VT(9 / 59): FlashPlayer.apk
Target: 31 Russian and Turkish banking apps
C&C: hxxp://ifc3yb3rs3cur1tych0.pw
Number of bots: ~56 bots




[April 25, 2017]
VT(30 / 58): MMS.apk
Target: 28 Russian, Ukraine and Polish banking apps
C&C: hxxp://atest.mcdir.ru
Number of bots: ~240 bots
Kudos to Fernando




[February 23, 2017]
VT (33 / 60): goodish.weather.apk
VT (29 / 59): follon.weather.apk
Koodous sample: goodish.weather
Koodous sample: follon.weather
Target: 68 European banking apps
C&C: hxxp://bigbustown.pw
Number of bots: ~2800 bots


 



1 comment:

  1. Thanks For sharing this helpful and informative blog. I love the way that you describe the things. You are an incredible writer, Thank you so much for sharing the blog. Please keep sharing.
    Mobile Application Development
    Android App Development
    IOS App Development

    ReplyDelete