Hirudo Android Trojan Replaces Banking Apps to Evade Security
A new Android banking trojan, Hirudo, circumvents security by replacing legitimate banking applications with specially patched versions designed to bypass built-in checks.
A novel Android banking trojan, identified as Hirudo by mobile security firm ThreatFabric, has emerged with a sophisticated technique that involves replacing legitimate banking applications with modified versions. These tampered apps are engineered to circumvent security measures from within, enabling attackers to facilitate financial fraud more effectively. The trojan has been observed specifically targeting at least eight Indonesian banking applications, though its credential-stealing operations span a wider geographical area including China, India, Mexico, Morocco, and Thailand.
Hirudo's operational capabilities are comprehensive, encompassing credential theft, device takeover, screen and camera capture, and SMS data exfiltration, all managed through a mature backend infrastructure. The malware is typically distributed via dropper applications disguised as shopping, adult video, or entertainment apps. These droppers deliver Hirudo as a separate installation package, often presented to the user as an in-app update, thereby masking its malicious intent.
Examples of these deceptive dropper apps include "Shopora" (com.agbbh.kjdrttt), "1V1 X" (com.onev.vip), "KoiShort" (com.koishort.app), and "ZoyaTV" (com.zoyatv.app). ThreatFabric notes that the lure apps are functional, presenting legitimate content to users, which enhances their credibility. Behind this facade, the dropper executes a routine that collects tracking data, fetches campaign configurations, and checks for the presence of the Hirudo Remote Access Trojan (RAT) with its necessary permissions already enabled.
If Hirudo is not detected, the dropper prompts the user with a fake in-app update, initiating the malware's installation. It is crucial to note that Hirudo is installed as a secondary application and requires explicit user permission to proceed with its malicious activities. To evade detection, Hirudo employs an anti-detection mechanism similar to that seen in the StreamRat malware, which involves blocking internet access by configuring a non-functional VPN connection. This is intended to prevent cloud-based security checks by services like Google Play Protect.
While this VPN technique may hinder online reputation and code-analysis mechanisms, it does not entirely disable Google Play Protect's offline detection capabilities for known malicious applications. The dropper apps are also designed to display fake screens to capture payment PINs, solicit login credentials for banking and wallet applications, present fake lock screen patterns and PIN overlays, and enable complete remote control of the device, depending on the specific lure used.
The most distinctive feature of Hirudo is its method of replacing target banking apps with specially crafted, tampered copies. These replacements embed a hooking engine designed to blind signature, accessibility, screen-capture, and Play Integrity checks from within the application itself. The process involves detecting the installed banking app, verifying its signing certificate against a stored reference, and then presenting a fake update prompt. The genuine app is then uninstalled, and the malicious replacement is downloaded and installed in parallel.
This replacement mechanism allows Hirudo to bypass the banking app's own security checks by feeding it attacker-controlled responses. This includes returning the genuine app's signing certificate, providing an empty list for accessibility services, and stripping the FLAG_SECURE flag to enable remote screen recording. Key-attestation certificates are re-signed using a leaked keybox, and Play Integrity requests are relayed to an operator-controlled server, which then returns a fabricated verdict. This means a valid Integrity response alone is not proof of an untampered app.
The distribution method relies on fake web pages mimicking Google Play Store interfaces for various app categories. Users are reportedly directed to these malicious sites through advertisements on Meta-owned social media platforms. The entire operation is supported by a robust backend capable of managing device control, different campaigns, and vast amounts of stolen data, including device records, lock-screen history, and financial profiles. Hirudo represents a significant escalation in Android banking trojan tactics, shifting the battleground to the application's internal integrity checks and employing a reusable engine that can be adapted to new apps and regions.