Researchers at Cyfirma have identified the BankBot-YNRK banking trojan, which targets devices running Android 13 and earlier. The malware exploits vulnerabilities in accessibility services to gain elevated permissions without explicit user consent. It focuses on stealing banking credentials and accessing cryptocurrency wallets.
The malicious code initiates environmental scans shortly after installation. It detects emulators to avoid sandbox analysis. It then identifies models from manufacturers such as Samsung, Oppo and Google. This adaptation allows for personalized attacks.
- Checks real or emulated environment.
- Identifies specific manufacturer and model.
- Customizes code for greater effectiveness.
Malware cloaking and persistence mechanisms
BankBot-YNRK disables notifications from installed applications. It mutes sound settings to operate without alerts.
The trojan alters Android’s JobScheduler. This modification guarantees automatic booting with the system. It maintains constant connection with command and control server.
Criminals send remote commands via C2. They simulate ringtones and install additional APKs. The malware exfiltrates contacts, SMS and device location.
Accessibility exploration for administrative privileges
The OPEN_ACCESSIBILITY re commandDirects the user to the settings screen. The malware requests activation of accessibility services.
With privileges obtained, he periodically opens banking apps. Captures screens with sensitive data on display.
The trojan attempts to obtain seed phrases from crypto wallets. It avoids interactions with biometrics to minimize detection. Unauthorized transactions occur if biometrics are not configured.
Without active biometrics, the risk of theft increases significantly. The malware performs transfers directly.
BankBot-YNRK Extended Remote Capabilities
The malware manages APK installations and uninstallations. It updates and opens applications on command.
Interact with the interface by simulating gestures and touches. Unlocks the screen and navigates through system menus.
- Forward calls and send SMS.
- Captures photos and hides floating windows.
- Insert text into form fields.
- Manages file downloads and executions.
BankBot-YNRK presents itself as an Indian government app. This tactic bypasses initial checks on APK installations.
It appears in specific packages like com.westpacb4a.payqingynrk1b4a. Others include com.westpacf78.payqingynrk1f78.
Prevention measures against banking trojans
Install apps only from the Google Play Store. Avoid unknown sources to reduce exposure to malicious APKs.
Enable two-step verification on financial accounts. Configure biometrics in digital wallets to block unauthorized access.
Keep your Android system up to date with security patches. Use reliable antiviruses for regular device scanning.
