Menu
Source code for powerful Android banking malware is leaked

Source code for powerful Android banking malware is leaked

More attacks are expected as cybercriminals use the code

The source code for a powerful Android malware program that steals online banking credentials has been leaked, according to researchers with IBM.

The malware family is known by several names, including GM Bot, Slempo, Bankosy, Acecard, Slempo and MazarBot. 

GM Bot has been sold on underground hacking forums for around US$500. But it appears someone who bought the code then leaked it on a forum in December, perhaps to increase his standing, wrote Limor Kessem, a cybersecurity analyst with IBM Trusteer.

The person included an encrypted archive file containing the source code of GM Bot, according to Kessem.

"He indicated he would give the password to the archive only to active forum members who approached him," Kessem wrote. "Those who received the password in turn passed it on to other, unintended users, so the actual distribution of the code went well beyond that discussion board’s member list."

The source code of powerful banking trojans has been leaked before with apps such as Zeus, SpyEye and Carberp, Kessem wrote.

"While GM Bot may not be as prolific as the major banking Trojans mentioned here, it is definitely a game changer in the realm of mobile threats," Kessem added.

GM Bot emerged in late 2014 on Russian-speaking forums. It exploits an issue known as activity hijacking in older Android devices that allow an overlay to be displayed over a legitimate application.

Google has put in defenses against activity hijacking in Android versions higher than 5.0.

The overlay looks like what a user would expect to see after launching a legitimate banking app, but that app is actually running underneath the overlay. The user then inputs their authentication credentials, which are sent to the attackers.

Since GM Bot has full control over the device, it can also steal SMSes, such as one-time authentication codes.

"Previous mobile malware — before overlays became commercially available to fraudsters — could steal SMS codes, but those would have been meaningless without phishing schemes or a trojan on the victim’s PC to steal access credentials," Kessem wrote.

Since the leak of GM Bot's code, it appears its creators have developed a second version "which is sold in financial fraud-themed underground boards," Kessem wrote.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments