Shopora

Shopora is an Android dropper application disguised as a functional shopping app and used to distribute the Hirudo banking Trojan. It presents genuine-looking storefront content through a WebView while collecting promotion-tracking data, retrieving campaign configuration, and checking whether the separate malicious payload is installed and has the required permissions. When the payload is absent, it displays a fake in-app update prompt to induce installation. Hirudo is installed as a separate application and requires its own permissions, including Android Accessibility access.

An analyzed Shopora dropper activates a deliberately nonfunctional VPN during payload installation, blocking the device's IPv4 traffic to impede online reputation and cloud-based security checks. This technique does not eliminate offline malware detection.

The delivered Hirudo payload supports banking-credential theft, SMS collection, screen and camera surveillance, and remote device control. It also attempts to replace legitimate banking applications with modified copies that undermine application security checks. Dedicated replacements have been identified for eight Indonesian banking applications covering seven banks. These banking-app replacement and surveillance capabilities belong to Hirudo rather than to the Shopora shopping wrapper itself.