Full Report
A new Android malware called Hirudo steals bank account credentials by replacing legitimate banking apps with modified versions that disable security checks. [...]
Analysis Summary
# Tool/Technique: Hirudo
## Overview
Hirudo is a sophisticated Android banking trojan that employs a novel "app replacement" technique. Instead of simply overlaying fake windows, it replaces legitimate banking applications with malicious, patched versions. These modified apps integrate a hooking engine to disable internal security checks, bypass Play Integrity, and suppress screenshot protections, allowing attackers to steal credentials and perform real-time fraud.
## Technical Details
- **Type**: Malware family (Banking Trojan / Loader)
- **Platform**: Android
- **Capabilities**: Credential theft, SMS interception, remote screen streaming, camera access, security check bypass (Play Integrity/Accessibility), and automated app uninstallation/reinstallation.
- **First Seen**: Reported October 2024 (Article dated October 2026/Current context).
## MITRE ATT&CK Mapping
- **[TA0031 - Persistence]**
- **[T1398 - Modify Shared/Existing Code]**: Patches legitimate banking apps with malicious hooking engines.
- **[TA0037 - Defense Evasion]**
- **[T1624.001 - OS Hooking]**: Uses YAHFA and Dobby frameworks to intercept system calls.
- **[T1406 - Obfuscated Files or Information]**: Forges signing certificates and Play Integrity attestations.
- **[TA0035 - Collection]**
- **[T1417.001 - Access SMS Messages]**: Steals 2FA codes and messages.
- **[T1513 - Screen Capture]**: Disables `FLAG_SECURE` to record or stream the screen.
- **[TA0041 - Impact]**
- **[T1456 - Financial Theft]**: Exfiltrates banking credentials and payment PINs.
## Functionality
### Core Capabilities
- **Malicious Loading**: Delivered via dropper apps (shopping, adult content, short drama) that prompt for a fake "update" to gain Accessibility permissions.
- **App Replacement**: Abuses Accessibility services to uninstall the genuine banking app and install a pre-patched malicious version.
- **Credential Stealing**: Uses fake checkout pages to harvest payment PINs and passwords.
- **SMS & Device Monitoring**: Collects SMS messages, device-unlock secrets, and hardware profiles.
### Advanced Features
- **Hooking Engine**: Utilizes **YAHFA** and **Dobby** open-source frameworks to run inside the banking app's process.
- **Security Suppression**:
- Substituted signing certificates to fool signature checks.
- Hides its own enabled Accessibility services from the app's detection.
- Relays Play Integrity requests to a C2-controlled server to forge attestation.
- **Real-time Remote Access**: Supports streaming the device screen and accessing both front/rear cameras for live surveillance.
## Indicators of Compromise
- **File Names (Loaders)**:
- Shopora
- 1V1 X
- ZoyaTV
- KoiShort
- **Network Indicators**:
- Operator-controlled attestation servers (Specific URLs/IPs not provided in text; must be monitored via traffic analysis).
- **Behavioral Indicators**:
- Request for Accessibility Services by non-system apps.
- Sudden uninstallation of a banking app followed by a prompt to install an APK.
- `FLAG_SECURE` being disabled in apps where it is usually mandatory.
## Associated Threat Actors
- **Unknown**: Currently targeting Indonesian banks primarily, with secondary targets in China, India, Mexico, Morocco, and Thailand.
## Detection Methods
- **Signature-based**: Detection of the YAHFA/Dobby hooking libraries within APKs.
- **Behavioral**: Monitoring for the specific sequence of an app uninstalling its legitimate counterpart and immediately installing a new APK via Accessibility.
- **Server-Side**: Banks can detect Hirudo by performing server-side revocation checks on Play Integrity certificates (specifically looking for leaked keybox certificates).
## Mitigation Strategies
- **For Users**:
- Disable "Install from Unknown Sources."
- Avoid granting "Accessibility Services" to non-essential apps (especially loaders/shopping apps).
- Use Google Play Protect to scan for known malicious signatures.
- **For Financial Institutions**:
- Move integrity and attestation checks to the server-side.
- Bind security checks to specific sessions and sensitive transactions.
- Implement behavioral risk scoring for suspicious transaction patterns.
## Related Tools/Techniques
- **YAHFA/Dobby**: Open-source Android hooking frameworks used as the engine.
- **Anatsa / TeaBot**: Other Android bankers that abuse Accessibility services (though Hirudo’s patching method is more advanced).