Full Report
Detecting MaliBot, a fresh Android banking trojan, with a Fraud Protection solution
Analysis Summary
# Tool/Technique: MaliBot
## Overview
MaliBot is a sophisticated Android banking trojan designed to steal financial credentials, crypto-wallet information, and personal data from infected mobile devices. It gained notoriety for its ability to bypass Multi-Factor Authentication (MFA) and its use of VNC (Virtual Network Computing) to remotely control infected devices.
## Technical Details
- **Type:** Malware Family (Banking Trojan)
- **Platform:** Android
- **Capabilities:** Credential theft (overlays), MFA bypass, VNC remote control, SMS interception, and information stealing.
- **First Seen:** Approximately May/June 2022
## MITRE ATT&CK Mapping
- **TA0037 - Persistence**
- T1624.001 - Event Notification: Accessibility Service
- **TA0030 - Privilege Escalation**
- T1548 - Abuse Elevation Control Mechanism (Abusing Accessibility Services)
- **TA0033 - Credential Access**
- T1417.001 - Input Capture: GUI Overlay
- T1636.002 - SMS Messages
- **TA0035 - Lateral Movement**
- T1534 - Internal Spreading (via SMS spamming)
- **TA0040 - Impact**
- T1491.001 - Defacement: External (Changing device wallpaper/settings)
## Functionality
### Core Capabilities
- **Overlay Attacks:** Creates fake login screens over legitimate banking and cryptocurrency apps to harvest credentials.
- **SMS Interception:** Reads, deletes, and sends SMS messages, primarily used to intercept One-Time Passwords (OTPs) and spread to the victim's contacts.
- **Accessibility Service Abuse:** Exploits Android’s Accessibility Services to gain broad permissions, automate interactions, and prevent the user from uninstalling the malware.
- **Data Exfiltration:** Steals contact lists, device information, and installed application lists.
### Advanced Features
- **VNC Support:** Allows attackers to view the device screen in real-time and perform remote actions, effectively taking complete control of the UI.
- **MFA Bypass:** By combining VNC and SMS interception, it can bypass even robust two-factor authentication methods.
- **C2 Communication:** Uses encrypted channels to receive commands and upload stolen data to attacker-controlled infrastructure.
## Indicators of Compromise
- **File Names:** Frequently disguised as "Chrome," "Mining X," or "Update" to trick users.
- **Network Indicators:**
- `162.241.115[.]165` (Example C2)
- `api.malibot[.]xyz` (Defanged)
- **Behavioral Indicators:**
- Requesting high-risk permissions immediately after installation (Accessibility Services).
- Attempts to become the "Default SMS Application."
- Sudden battery drain or unauthorized outgoing SMS messages to international or unknown numbers.
- **Suspicious Permissions:**
- `PROCESS_OUTGOING_CALLS`
- `SEND_SMS`
- `WRITE_EXTERNAL_STORAGE`
- `RECEIVE_SMS`
## Associated Threat Actors
- While specific named groups (like APTs) are often not publicly linked, the malware is believed to be operated by cybercriminal groups focused on financial gain, potentially originating from Eastern Europe based on code comments and target language sets found in early versions.
## Detection Methods
- **Signature-based detection:** Comparing application certificates and code snippets against known MaliBot samples.
- **Behavioral detection:** Monitoring for unauthorized use of Accessibility Services, detection of overlay windows, and tracking anomalies in user interaction (e.g., automated screen taps).
- **Fraud Intelligence:** Monitoring for device fingerprint deviations and known malicious C2 infrastructure.
## Mitigation Strategies
- **User Education:** Avoid downloading APKs from third-party websites or suspicious SMS links (Smishing).
- **Least Privilege:** Do not grant "Accessibility Service" permissions to apps that do not clearly require them for a legitimate purpose.
- **Security Software:** Install a reputable mobile security solution that scans for malicious behavior and overlays.
- **System Updates:** Keep the Android OS updated to the latest security patch level to mitigate known exploit vectors.
## Related Tools/Techniques
- **FluBot:** Similar Android trojan that utilized SMS-based spreading and overlay attacks.
- **Anubis:** A predecessor in the Android banking trojan space known for overlay and SMS theft.
- **TeaBot:** Another prominent Android malware family utilizing Accessibility Services for financial fraud.