A malicious program for Android mobile devices. Banking Trojan for Android that steals confidential information and executes cybercriminals’ commands. Android.BankBot.211.origin is distributed under the guise of benign programs.
Once installed and launched, in an infinite loop, Android.BankBot.211.origin tries to gain access to the Accessibility Service mode by blocking device operation with a window with the corresponding request.
After the user is forced to grant the Trojan the necessary rights, Android.BankBot.211.origin adds itself to the mobile device administrator list and assigns itself as the default SMS manager and gains access to the screen capturing functions (class MediaProjection is used for this purpose). Each indicated action requires user’s consent, however, after obtaining access to the Accessibility Service, the malicious program does it automatically by independently clicking confirmation buttons.
If the device’s owner attempts to remove the Trojan from the administrator list, Android.BankBot.211.origin will automatically click “Cancel”. In other cases, it clicks “Back” using the performGlobalAction method.
server_poll—add to the table reservas the parameters interval and obtained values.
Besides that, Android.BankBot.211.origin intercepts and sends to the server information about all incoming messages.
fullscreen—display of a phishing window for input of login credentials during the launch of applications for operation with mobile banking and payment systems.
com.eset.ems2.gp – ESET32 – ESET Mobile Security & Antivirus.
Besides that, Android.BankBot.211.origin tracks the operation of keyboard and steals the input user’s data. On each key stroke, the Trojan makes a screenshot and sends the obtained images to the command and control server. It allows malicious program to steal passwords as well, and it is quick enough to save them before they are hidden. Data which is input via visible fields is duplicated in the sent POST request.
Restart the device, perform its full scan with an anti-virus and remove the Trojan after the scanning is complete.