A new Android banking Trojan named SharkBot has been identified that has capabilities that go beyond most mobile banking Trojans.
This new Android malware stands out due to its use of an Automatic Transfer System (ATS) technique that allows it to bypass multi-factor authentication controls and automate the process of stealing funds from victims’ accounts. In order to steal funds from accounts, most Trojans require human input. SharkBot keeps human interaction to a minimum by auto-filling fields, such as those that need to be completed to make money transfers.
SharkBot can intercept SMS messages, such as those containing multi-factor authentication codes sent by financial institutions, and can hide those SMS messages to make it appear that they have not been received. SharkBot can also perform overlay attacks, where a benign pop-up is displayed over an application to trick a user into performing tasks, such as giving permissions. SharkBot is also a keylogger and can record and exfiltrate sensitive information such as credentials to the attacker’s command and control server and bypasses the Android doze component to ensure it stays connected to its C2 servers.
The malware has been configured to steal money from bank accounts and cryptocurrency services in the United States, United Kingdom, and Italy, and targets 27 financial institutions – 22 banks and 5 cryptocurrency apps.
During installation, the user is bombarded with popups to give the malicious app the permissions it needs, with those popups only stopping appearing if the user provides the required permissions, which include enabling Accessibility Services. When the malicious app is installed, the app’s icon is not displayed on the home screen. Users are prevented from uninstalling the malware via settings by abusing Accessibility Services.
The ATS technique used by the malware allows it to redirect payments. When a user attempts to make a bank transfer, information is auto-filled to direct payments to an attacker-controlled account, unbeknown to the victim.
The malware was analyzed by researchers at Cleafy, who found no similarities with any other malware variants. Since the malware has been written from scratch, it currently has a low detection rate. The researchers believe the malware is still in the early stages of development, and new capabilities could well be added to make it an even bigger threat.
One of the main problems for developers of malware targeting Android devices is how to get the malware installed on a device. Google performs checks of all apps available before adding them to the Google Play Store, so getting a malicious app on the Play Store is difficult. Even if that is achieved, Google is quick to identify and remove malicious apps.
SharkBot has been identified masquerading as a variety of apps such as an HD media player, data recovery app, and live TV streaming app, which is delivered via sideloading on rooted devices and by using social engineering techniques on compromised or attacker-owned websites to convince victims to download the fake app.
SharkBot uses a wide range of techniques to prevent detection and analysis, including obfuscation to hide malicious commands, an anti-emulator to check if it has been installed on a real device, by downloading malicious modules once it has been installed, and by encrypting all communications between the malware and the C2 servers.
Users of mobile phones tend not to be as cautious as they are with laptops and computers, but the same cybersecurity best practices should be followed. It is important to avoid clicking hyperlinks in emails and to only download apps from official app stores. The malware also serves as a reminder that while multi-factor authentication is an effective security measure, it is not infallible.
