SlemBunk: An Evolving Android Trojan Family Targeting Users of Worldwide
Banking Apps[html]
FireEye mobile researchers recently identified a series of Android
trojan apps that are designed to imitate the legitimate apps of 33
financial management institutions and service providers across the
globe. We dub the family “SlemBunk,” and have seen it covering three
major continents: North America, Europe, and Asia Pacific.
SlemBunk apps masquerade as common, popular applications and stay
incognito after running for the first time. They have the ability to
phish for and harvest authentication credentials when specified
banking and other similar apps are launched. At the time of this
writing, we can confirm that a set of the control servers gathering
gleaned credentials is still live and active.
We have not observed any instances of SlemBunk on Google Play, so
users will only get infected if the malware is sideloaded or
downloaded from a malicious website. Newer versions of SlemBunk were
observed being distributed via porn websites. Users who visit these
sites are incessantly prompted to download an Adobe Flash update to
view the porn, and doing so downloads the malware.
- Our comprehensive investigation of SlemBunk has led to the
identification of more than 170 samples in the wild. These SlemBunk
samples exhibit a range of characteristics and behaviors,
including: - Highly customized login UI for a variety of
financial management services such as high profile banks;
- Running in the background and monitoring the active running
processes; - Detecting the launch of specified legitimate apps
and intelligently displaying corresponding fake login
interfaces; - Hijacking user credentials and transmitting to a
remote command and control (CnC) server; - Harvesting and
exfiltrating sensitive device information to the CnC servers
including phone number, installed app list, device model, OS
version; - Receiving and executing remote commands sent through
text messages and network traffic; - Persisting on the
infected device via device administrator privilege.
Our in-depth analysis into the full set of samples provides more
insights into this malware family. Since its debut, SlemBunk has gone
through several iterations, with each one raising the bar of
sophistication by adding more advanced capabilities. Based on our
examination of SlemBunk over time, we observed the following developments:
Advanced features are added to support more remote control commands;
- Remote CnC servers keep changing among samples;
- More
financial services apps are added into the list, with new UI and
their corresponding logic; - Different levels of obfuscation
mechanisms are adopted to avoid detection.
Through our investigation, we have discovered SlemBunk spoofing the
apps of 31 banks across the globe – some of which are among the
biggest banks in the world – as well as users of two popular mobile
payment service provider apps.
While financial gain is the primary goal of this malware, SlemBunk
is also interested in user data. This is reflected by its attempt to
hijack the login credentials of high profile Android applications,
including popular social media apps, utility apps instant messaging apps.
Technical Details
The remainder of this blog presents the technical and operational
aspects of this malware in greater detail.
Major Components
The core objective of SlemBunk is to phish for authentication
credentials – primarily for financial institutions – by pushing a fake
login interface when a specified app is running in the foreground.
Figure 1 – the Manifest file from one of the non-obfuscated samples
with package name "org.slempo.service" – shows an overview
of the main components of SlemBunk.
ServiceStarter: An Android receiver that will be
invoked once an app is launched or the device boots up. Its
functionality is to start the monitoring service,
MainService, in the background.
MainService: An Android service that runs in the
background and monitors all running processes on the device. It
prompts the user with an overlay view that resembles the legitimate
app when that app is launched. This monitoring service also
communicates with a remote host by sending the initial device data,
notifying of device status and app preferences.
MessageReceiver: An Android receiver that handles
incoming text messages. In addition to the functionality of
intercepting the authentication code from the bank, this component
also acts as the bot client for remote command and control.
activities/Card: One UI view designed to mimic those of
the targeted apps.
MyDeviceAdminReceiver: Device admin functionality
requested the first time this app is launched. This makes the app
more difficult to remove.
