Android Banking Trojan Stealing User’s Data Via Screen Recording and Keylogging
In September 2021, the Indian Computer Emergency Response Team (CERT-In) issued a warning about a new malware strain targeting Indian taxpayers and mentioned that customers of around 27 banks were at risk of this attack.
The Threat Actors (TA) behind this campaign were suspected of using Drinik malware. An early variant of Drinik malware was first spotted in 2016 as an SMS stealer. Around August 2021, the malware was observed to be active again, this time evolving into an Android banking trojan.
Cyble Research & Intelligence Labs (CRIL) has constantly been monitoring the different variants of Drinik Android malware. In September 2021, CRIL released a blog on a masquerading income tax application that targeted Indian taxpayers to steal Personally Identifiable Information (PII) and banking credentials through phishing attacks.
Recently, CRIL identified an upgraded version of Drinik impersonating the Income Tax Department of India and targeting 18 Indian banks (bank names are explicitly mentioned in the malicious APK file).
The TA uses the same campaign theme to lure the victim, but the malware has been upgraded with advanced capabilities. We have listed the main features implemented in the new variant, making the malware an advanced threat:
- Screen Recording to harvest credentials
- Keylogging
- Abusing CallScreeningService to manage incoming calls
- Receiving commands via FirebaseCloudMessaging
The malware variant is communicating with Command & Control (C&C) server hxxp://gia[.]3utilities.com, which is hosted on IP 198[.]12.107[.]13. Our investigation confirmed that the previous campaign also used the same IP for its C&C communication, indicating that the Threat Actor (TA) behind both campaigns is the same.
The below figure shows the details of the C&C IP address and its connection with the previous campaign.
Evolution of Drinik:
CRIL observed 3 different variants of this malware since last year. The first variant was observed in September 2021, when the malware used phishing pages to steal credentials. In 2022, two new variants have been identified in the wild, introducing Screen Recording and Keylogging features.
The figure below shows the timeline of Drinik malware and its features.
During our investigation, we found that the first version uses a simple phishing page to steal banking credentials, whereas the second version uses screen recording alongside the phishing technique.
Finally, the third and latest version loads the genuine income tax department site and uses screen recording along with a keylogging functionality to steal the login credentials. The below figure shows the login page of three different versions.
In this analysis, we take a look at the latest sample “iAssist.apk (86acaac2a95d0b7ebf60e56bca3ce400ef2f9080dbc463d6b408314c265cb523)” of Drinik malware observed on October 18, 2022, which has additional code for abusing the CallScreeningService.
By abusing this service, the malware can disallow incoming calls without the user’s knowledge. Additionally, the strings present in the file are encrypted to evade detection by antivirus products, and the malware decrypts them during run time using a custom decryption logic. The figure below shows the code snippet used by the malware to decrypt the encrypted strings.
Technical Analysis
APK Metadata Information
- App Name: iAssist
- Package Name: lincoln.auy.iAssist
- SHA256 Hash: 86acaac2a95d0b7ebf60e56bca3ce400ef2f9080dbc463d6b408314c265cb523
The metadata information of the application is shown below.
Manifest Description
The harmful permissions requested by the malware are:
| Permission | Description |
| RECEIVE_SMS | Allows an application to receive SMS messages |
| READ_SMS | Access phone messages |
| SEND_SMS | Allows the application to send SMS messages |
| READ_CALL_LOG | Allows an app to read the user’s call log |
| READ_EXTERNAL_STORAGE | Allows an application to read from external storage. |
| WRITE_EXTERNAL_STORAGE | Allows an application to write to external storage. |
Source Code Review
Like many other banking trojans, the new variant of Drinik relies on the Accessibility Service. After launching, the malware prompts the victim to grant permissions, followed by a request to enable Accessibility Service.
It then starts abusing the service to obtain the necessary permissions to start screen recording, disable Google Play Protect, execute auto-gestures, and capture key logs.
The latest Drinik variant loads the genuine Indian income tax site hxxps://eportal[.]incometax.gov.in using WebView instead of displaying fake phishing pages.
Before showing the login page to the victim, the malware displays an authentication screen for biometric verification. When the victim enters a PIN, the malware steals the biometric PIN by recording the screen using MediaProjection and also captures keystrokes.
The malware now sends the stolen details to the C&C server, as shown below.
After authentication, the malware displays the genuine site loaded into a Webview. Drinik starts screen recording as soon as the victim enters the User ID (such as PAN/AADHAR/Other valid user ID) and sends the recording to the C&C server.
In the latest version of Drinik, the TA only targets victims with legitimate income tax site accounts.
Once the victim logs in to the genuine site, the malware executes the onPageFinished() method, which further checks the loaded URL to validate the login status.
The malware then checks if the loaded URL is any of the following and confirms the user’s successful login.
- hxxps://eportal.incometax[.]gov.in/iec/foservices/#/dashboard
- hxxps://eportal.incometax[.]gov.in/iec/foservices/#/login
If the onPageFinished() method receives a URL hxxps://eportal.incometax[.]gov.in/iec/foservices/#/login, this indicates that the login has failed.
The malware can also save the login state and retrieves them using the getLogingStat command, which can identify whether the victim is new or has already logged in.
If the victim is new, the malware shows a message “To use this functionality, you are required to log in first!” and prompts them to log in. Otherwise, the malware will initiate the phishing activity, considering the user logged in successfully. The below figure shows the code snippet to receive the login status.
After successful login, the genuine site redirects to the dashboard URL “hxxps://eportal.incometax[.]gov.in/iec/foservices/#/dashboard”. The malware now checks whether this URL is in the onPageFinished() method and displays a fake dialogue box mentioning the below message:
Our database indicates that you are eligible for an instant tax refund of Rs.57,100.\– from your previous tax miscalculations till date. Click Apply to apply for instant refund and receive your refund in your registered bank account in minutes.
When the victim clicks the “Apply” button, the malware opens the phishing URL hxxp://gia.3utilities[.]com/Refund/redir.php?i=RefundApproved&source=App&uid= as shown in the below figure.
The phishing URL redirects to: hxxp://192.227.196[.]185/1305275237/uv4h.php?action=Refund_Approved&id=YWI1MzYxY0A3OTEyNDA0MzY2NTMuY29t&owner=QWRtaW4%3D&source=App&uid= site which impersonates the genuine Income Tax Department of India to lure victims into submitting sensitive data.
After clicking on the “Proceed to the verification steps” button, the malware prompts the victim to submit personal details such as full name, Aadhar number, PAN number, and other details along with financial information, which includes Account number, Credit card number, CVV, and PIN.
This stolen data is further sent to the C&C server and can be used by the TA to perform fraudulent transactions.
After submitting details, the malware displays the confirmation page with all the details entered by the victim. Further, it prompts the victim to verify ITR (Income Tax Returns) details using net banking credentials.
Alongside stealing credentials via screen recording and phishing pages, we also observed the malware targeting Indian banks by abusing the Accessibility Service.
Whenever any event triggers the Accessibility Service, the malware checks the source of the event with the bank keywords stored in a shared preference key “newCLICKJACK”. If the keyword matches, the malware collects the keylogging data, which could contain banking credentials.
The malware has registered a CallScreeningService in the manifest file. Default dialers or third-party apps use the CallScreeningService to allow or disallow incoming calls before displaying them to users.
Drinik malware abuses this service to disallow incoming calls, likely to prevent the interruption of any ongoing malicious activities, and sends the incoming call status to the C&C server.
The malware receives the command via FirebaseCloudMessaging (FCM) and saves them to the variable “processCMD”.
The malware further executes the respective malicious task based on the commands received from FCM to perform other malicious activities on an infected device. Some of the commands received via FCM are:
| Command | Description |
| VERIFYMOBILE | Verify the device registration status |
| OPENAPPCOMPONENT | Starts the app component activity received from the server |
| GETAUTOCMD | Sends AutoCMD value from shared preference file to the C&C server |
| DISABLE_ICON | Hides the icon |
| KILLSOUND | Silent audio for calls and notifications |
| CHECKOVERLAY | Sends the overlay status |
| DEFOREGROUNDIFY | Stops foreground service |
Conclusion
Some well-known Android banking trojans such as Hydra, BRATA, Anubis, and several others heavily rely on the Accessibility Service and have developed advanced features by successfully abusing this service.
CRIL observed that Drinik malware is also similarly evolving into an advanced threat by implementing powerful features that we have observed in other banking trojans.
Our analysis indicates that the TA behind Drinik is constantly working on updating their malware with new and advanced features. The TA had initially started developing malware by implementing sophisticated phishing pages for credential harvesting. However, our observations show that they have enhanced their framework with advanced features such as screen recording and keylogging to steal credentials of genuine income tax sites, banking credentials, and biometric details as well.
The malware is still developing, and we may observe a new variant of Drinik malware with new targets and techniques to target their victims.
Our Recommendations
- Download and install software only from official app stores like Play Store or the iOS App Store.
- Never share your Card Details, CVV number, Card PIN, and Net Banking Credentials with an untrusted source.
- Enable biometric security features such as fingerprint or facial recognition for unlocking the mobile device to avoid unauthorized access obtained using malicious activities such as keylogging and screen recording.
- Using a reputed antivirus and internet security software package is recommended on connected devices, including PC, laptops, and mobile.
- Use strong passwords and enforce multi-factor authentication wherever possible.
- Be wary of opening any links received via SMS or emails delivered to your phone.
- Ensure that Google Play Protect is enabled on Android devices.
- Be careful while enabling any permissions.
- Keep your devices, operating systems, and applications updated.
MITRE ATT&CK® Techniques
| Tactic | Technique ID | Technique Name |
| Initial Access | T1476 | Deliver Malicious App via Other Means. |
| Initial Access | T1444 | Masquerade as a Legitimate Application |
| Defense Evasion | T1418 | Application discovery |
| Discovery | T1426 | System Information Discovery |
| Impact | T1616 | Call Control |
| Collection | T1513 | Screen Capture |
| Persistence | T1402 | Broadcast Receivers |
| Collection | T1412 | Capture SMS Messages |
| Credential Access | T1411 | Input Prompt |
| Exfiltration | T1567 | Exfiltration Over Web Service |
Indicators of Compromise (IOCs)
| Indicators | Indicator Type | Description |
| 86acaac2a95d0b7ebf60e56bca3ce400ef2f9080dbc463d6b408314c265cb523 | SHA256 | Hash of the analyzed APK file |
| ba2fb55bb89c98aec3a2130b22584d8c299451ba | SHA1 | Hash of the analyzed APK file |
| 0c6257e385f33e46c1839f59bc4b53d7 | MD5 | Hash of the analyzed APK file |
| hxxp://gia.3utilities[.]com | URL | C&C URL |
| hxxp://192[.]227.196.185 | URL | Malicious IP hosting fake ITR site |
| 198[.]12.107[.]13 | IP | IP hosting C&C server |
