Android Malware Posing As Indian Bank Apps
This report analyzes a sophisticated Android malware targeting Indian banking apps. The malware uses a dropper and main payload structure, leveraging permissions like SMS access and silent installation to steal credentials, intercept messages, and perform unauthorized financial activities. It employs Firebase for command and control, phishing pages to mimic banking interfaces, and techniques like call forwarding abuse. The malware's modular architecture, evasion tactics, and persistence mechanisms pose significant threats to mobile banking security. Distribution methods include smishing, fake websites, and malvertising. The report provides detailed static and dynamic analysis, highlighting the malware's capabilities in data exfiltration, debit card harvesting, and remote command execution.
Pulse ID: 68835c6fda683e2a665d5722
Pulse Link: https://otx.alienvault.com/pulse/68835c6fda683e2a665d5722
Pulse Author: AlienVault
Created: 2025-07-25 10:29:03
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
