Loading malware…
BankBot is an Android banking trojan family that emerged in 2016 and became one of the most influential mobile banker codebases after its source code leaked publicly in late 2016. It is designed primarily to steal banking credentials from Android users by masquerading as legitimate applications, hiding its presence after installation, and presenting phishing overlays or spoofed web content when targeted financial applications are opened. The family has also been associated with campaigns that impersonated system utilities, Flash Player updates, and topical lures such as COVID-19 alert applications, and some variants were distributed through both unofficial Android markets and the official Google Play store via trojanized apps and droppers.
Core BankBot functionality includes credential theft through overlay attacks, collection of device information, interception and exfiltration of SMS messages used for one-time passwords, and anti-removal measures such as requesting device administrator privileges and hiding the launcher icon. Documented variants have checked infected devices for installed banking applications, downloaded or displayed server-provided phishing pages tailored to those targets, and in some cases terminated outgoing calls to bank helplines to hinder victim reporting or remediation. BankBot-derived samples and closely related codebases have also shown use of obfuscation, packing, runtime loading of secondary DEX payloads, and abuse of Android permissions to support persistence and defense evasion.
The family has targeted banking customers across multiple countries, with repeated reporting on campaigns focused on Turkish, Russian, and Ukrainian financial institutions, while broader campaigns targeted large international banking app sets. BankBot’s leaked source code materially lowered the barrier to entry for mobile cybercrime and contributed to a proliferation of variants and offshoots across the Android malware ecosystem. It is frequently discussed alongside or in relation to other Android banking trojans such as Anubis, Exobot, MazarBot, LokiBot, and GM Bot, and some later samples have been labeled or marketed under overlapping names including Anubis and Nautilus Bot. BankBot is widely regarded as a foundational Android banking trojan family whose code reuse and derivative strains helped drive the expansion of mobile banking malware campaigns in 2017 and beyond.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
the latest campaigns we have seen use techniques such as legitimate applications containing malicious behavior on a timer (in this case two hours) in order to circumvent Google Play’s automated detection solutions.
The credentials are leaked using a standard HTTP POST request directly to the CC PHP script, located at /private/add_inj.php
the latest campaigns we have seen use techniques such as legitimate applications containing malicious behavior on a timer (in this case two hours) in order to circumvent Google Play’s automated detection solutions.
the latest campaigns we have seen use techniques such as legitimate applications containing malicious behavior on a timer (in this case two hours) in order to circumvent Google Play’s automated detection solutions.
Another way to take over a device is through the misuse of the Android Accessibility service.
The dropper will run the same check on device boot and if it succeeds it will also start the service.
the classes in the .dex files are usually named using random words that are connected in some way, as if they were picked in succession from a glossary. This is the only sort of obfuscation present in the application
That path is not in the DEX. This typically indicates the sample is packed, and the manifest references names of an unpacked DEX that we need to recover.
In most cases, the application poses as a Flash Player or some kind of Android System tool.
The malware sets up a broadcast receiver for SMS in order to handle received messages and extract the information needed from them. Moreover, it is cautious enough to delete SMS from both the “inbox” and “sent” folders.
We search in the APK and quickly spot a Pa.json among the assets. Unfortunately, it is not a DEX, nor a ZIP, but encrypted content. So, at some point the asset Pa.json is read, then decrypted, then loaded with DexClassLoader.
it then displays a webview downloaded from the server of the specific banking site spoofing-page. | it hides itself and then tricks the user into typing his or her credentials into fake bank web pages that have been injected onto the device’s screen.
Intercepting, redirecting, sending and deleting SMS messages, to bypass SMS-based 2-factor authentication
The first time it is run, the application asks the user to grant it device admin privileges.
It then sends device information to the CC server, such as like IMEI, contacts, and SMS messages sent and received.
243 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
15 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Android banking trojan variant delivered via drive-by download (dropped APK) from compromised CMS-injected JavaScript; connects to attacker-controlled C2 endpoints for command-and-control and likely credential/financial theft typical of BankBot/Anubis families.
Referenced as a comparison point for similarities with the analyzed sample; described implicitly as banker malware focused on stealing banking credentials.
Referenced as an earlier leaked Android banking trojan codebase that spawned other trojans.
Android banking malware masquerading as a COVID-19 alert app. The sample is packed, uses DexClassLoader to load an unpacked/decrypted DEX from an encrypted asset (Pa.json), and is identified as Android/BankBot.AH!tr.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.