Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies
ThreatFabric details Hirudo, an Android banking RAT that swaps Indonesian bank apps for trojanized copies.
ThreatFabric analyzed Hirudo, an Android banking remote-access trojan that steals credentials and remotely controls the same phone. A dropper inside shopping, adult-video, or short-drama apps advertised on social media installs the payload, which currently targets eight Indonesian banking apps; internal code suggests possible use against banks in China, India, Mexico, Morocco, and Thailand. Hirudo shows a fake update, uninstalls the genuine app, and installs a modified copy whose hooking engine spoofs the signing certificate and hides Accessibility, screen-capture, and Play Integrity checks. It also offers WebRTC live screen viewing, camera access, Accessibility-based interaction, and SMS collection including a 90-day initial scan.
- Dropper hides in shopping, adult, or drama apps from social ads.
- It currently replaces eight Indonesian banking applications.
- Hooks spoof certificates and hide Accessibility and integrity checks.
- Capabilities include WebRTC viewing, cameras, remote control, and SMS theft.
- ThreatFabric urges server-side integrity and transaction-risk controls.
- ATT&CK
- T1204.002 User Execution: Malicious FileT1113 Screen CaptureT1562.001 Impair Defenses: Disable or Modify Tools
- Products
- Android
- Malware
- Hirudo
- Organizations
- ThreatFabric
From the original article
2 min read at securityweek.com
The Hirudo malware combines elements of a traditional banking trojan and a full-featured RAT. The post Novel Android RAT ‘Hirudo’ Replaces Banking Apps With Trojanized Copies appeared first on SecurityWeek.
By Kevin Townsend · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.