Banking Trojan Targets Spanish BBVA Bank Customers

In May 2020, the BBVA bank issued a warning about an Android malware campaign where a malicious app was distributed through smishing.

Recently, Cyble Research Labs came across a Twitter Post where a researcher mentioned that this Android malware was spreading through smishing campaigns where it was disguised as official messages from the BBVA bank.

This indicates that the campaign is still live and actively targeting BBVA bank customers.  

BBVA bank users have highlighted this campaign on Twitter and posted screenshots of the SMSs forwarded by the Threat Actor (TA). These SMSs contain a message which translates, “Your bank account has been suspended. For your safety, it is mandatory to log in from the BBVA protect app. Download it here“.

Figure 1 shows the SMS received by BBVA bank users.

The TA has designed this campaign to steal the account balance and banking credentials of BBVA bank users. Once the user clicks the phishing link present in the received SMS, it asks the user to download the malicious BBVA Protect app that pretends to be a legitimate BBVA bank application.

Technical Analysis   

APK Metadata Information   

• App Name: BBVA Protect 
• Package Name: com.gallery.become    
• SHA256 Hash: caee54ae322d5418f051e468c13a4ec04263f02f8b8bd6b5db34e388dbbb331a

   

Figure 2 shows the metadata information of an application.  

Manifest Description  

The malicious application asks for 27 permissions, of which the TA exploits 6. The harmful permissions requested by the malware are listed below:  

Permission	Description
RECEIVE_SMS	Allows an application to receive SMS messages
READ_SMS	Allows an application to read SMS messages
SYSTEM_ALERT_WINDOW	Allows an app to create windows shown on    top of all other apps.
READ_EXTERNAL_STORAGE	Allows an application to read from external storage
RECORD_AUDIO	Allows an application to record audio
WRITE_EXTERNAL_STORAGE	Allows an application to write to external    storage

Source Code Review  

Apart from the application’s subclass, the rest of the components identified from the Manifest file are missing – indicating that the application is packed.  

Upon execution, the malicious application unpacks the DEX file present in the assets folder and then loads the classes. In this case, the dropped dex file’s name is “baq.json” which has all the missing classes.

On installing the application, it loads the URL “hxxps://movil[.]bbva[.]es” into Webview, which redirects the user to the phishing site “hxxps://movil[.]bbva[.]es/apps/woody/index[.]html“.

The phishing site impersonates BBVA bank and asks the users for credentials such as username (NIF, NIE, ID card, or Passport) and password.

After loading the phishing page into Webview, the malware injects the malicious JavaScript files “jscript.js” and “jscript2.js” that are present in the assets folder to steal the account balance information and credentials entered by the victim, as shown below.

The below image showcases the code used by the malware to send account balance information and credentials to the Command and Control (C&C) server -“hxxps://privasol[.]xyz/banzreceiver/receiver[.]php?id=” by injecting JavaScripts.

The malware has defined the SMS Receiver class used to collect incoming SMSs from the victim’s device. The incoming SMSs could contain OTPs, which can be used to bypass the Two-Factor Authentication to steal the money from the victim’s bank account.

The above analysis is the classic example of a sophisticated phishing attack implemented within an Android app that can steal account balance and banking credentials and can intercept SMSs to bypass Two-Factor Authentication.

Conclusion 

The campaign has been actively spreading across Spain since 2020 to rapidly target BBVA Bank users. Although the bank has warned its users not to download any application from such SMS links, some users may unintentionally download and log in to the phishing site resulting in them incurring monetary losses and potentially falling victim to financial fraud.

Users should treat such SMSs as untrustworthy to avoid getting infected with this malware and report phishing SMSs to the bank to stop this malware infection chain.

Our Recommendations 

We have listed some essential cybersecurity best practices that create the first line of control against attackers. We recommend that our readers follow the best practices given below:  

How to prevent malware infection? 

• Download and install software only from official app stores like Google Play Store or the iOS App Store. 
• Use a reputed anti-virus and internet security software package on your connected devices, such as PCs, laptops, and mobile devices. 
• Use strong passwords and enforce multi-factor authentication wherever possible. 
• Enable biometric security features such as fingerprint or facial recognition for unlocking the mobile device where possible. 
• Be wary of opening any links received via SMS or emails delivered to your phone. 
• Ensure that Google Play Protect is enabled on Android devices. 
• Be careful while enabling any permissions. 
• Keep your devices, operating systems, and applications updated. 

How to identify whether you are infected? 

• Regularly check the Mobile/Wi-Fi data usage of applications installed on mobile devices. 
• Keep an eye on the alerts provided by Anti-viruses and Android OS and take necessary actions accordingly. 

What to do when you are infected? 

• Disable Wi-Fi/Mobile data and remove SIM card – as in some cases, the malware can re-enable the Mobile Data. 
• Perform a factory reset. 
• Remove the application in case a factory reset is not possible. 
• Take a backup of personal media Files (excluding mobile applications) and perform a device reset. 

What to do in case of any fraudulent transaction? 

• In case of a fraudulent transaction, immediately report it to the concerned bank. 

What should banks do to protect their customers? 

• Banks and other financial entities should educate customers on safeguarding themselves from malware attacks via telephone, SMS, or emails. 

MITRE ATT&CK® Techniques 

Tactic	Technique ID	Technique Name
Initial Access	T1476	Deliver Malicious App via Other Mean.
Initial Access	T1444	Masquerade as Legitimate Application
Defense Evasion	T1406	Obfuscated Files or Information
Credential Access	T1412	Capture SMS Messages
Exfiltration	T1567	Exfiltration over web services
Input Capture	T1417	Input Capture

Indicators of Compromise (IOCs) 

Indicators	Indicator Type	Description
caee54ae322d5418f051e468c13a4ec04263f02f8b8bd6b5db34e388dbbb331a	SHA256	Hash of the analyzed APK file
a58cf4de95d582e079fd7b6252cb9b614563f00c	SHA1	Hash of the analyzed APK file
0a69fb5ee436640724dbb0dcb256cb3b	MD5	Hash of the analyzed APK file
hxxps://movil[.]bbva[.]es	URL	Phishing URL
hxxps://privasol[.]xyz	URL	C&C Server
7394a5b7e15eba380a4add9c6954b15c85cd082bc8e881380cdf3d2b9f5209d9	SHA256	Hash of the analyzed APK file
f32a8329d1832bd375f55e7aaa7a7b3b67fe2ff7	SHA1	Hash of the analyzed APK file
1598dda06539be5641deffbb73ee2bc6	MD5	Hash of the analyzed APK file
hxxps://bbva[.]movil-es[.]icu	URL	Malware distribution site
hxxps://clientesbbvalock[.]com	URL	C&C server