Hirudo Android Banking RAT Replaces Banking Apps With Patched Copies
Summary
ThreatFabric details Hirudo, an Android banking RAT that uses lure apps to install a separate payload and replaces some Indonesian banking apps with patched copies that hide its activity and weaken security checks.
Key points
- Hirudo arrives through shopping, video, and short-drama lure apps that prompt victims to install a separate RAT payload.
- The RAT steals banking credentials, payment PINs, SMS, and device-unlock secrets, and can capture screens and camera feeds or remotely control the phone.
- It replaces eight Indonesian banking apps across seven banks with modified copies that use hooking to interfere with signature, Accessibility, screen-capture, and Play Integrity checks.
- The replacements require the genuine banking app to be uninstalled and the victim to authorize installation, creating opportunities to interrupt the process.
- The campaign uses advertising and attribution tools, while an exposed APK-processing panel could rebuild lure and patched banking apps.
- Backend records captured in August 2026 included thousands of credential entries, device records, lock-screen history, and financial profiles.
- ThreatFabric recommends server-side, session-bound integrity checks and transaction-risk controls; locally generated app signals can be manipulated.
Article Details
- Attack Vectors
- Shopping, adult-video, and short-drama lure apps carry Hirudo as a separate APK and prompt victims to install it through a fake in-app update.
- Hirudo uses Accessibility to detect banking apps, prompt for their replacement, and drive the installer after removing the genuine app.
- Patched banking apps use YAHFA and Dobby hooks to interfere with signing-certificate, Accessibility, screen-capture, key-attestation, and Play Integrity checks.
- The payload captures banking and wallet credentials, payment PINs, device-unlock secrets, SMS, screens, and camera feeds; it also provides live remote control.
- Hirudo's patched apps relay Play Integrity requests to an operator-controlled server.
- Defensive Notes
- Verify and enforce Play Integrity server-side, bind checks to the session and protected action, and check attestation revocation.
- Use behavioral analytics and retain server-side transaction-risk controls for login, credential recovery, beneficiary creation, and payment approval.
- Treat Accessibility and screen-capture signals as supporting evidence rather than standalone blockers, because patched apps can hide or alter them.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | d21gcldn8gp80l[.]cloudfront[.]net | KoiShort casino-route download host. |
| HOSTNAME | d3q4tlm7pw29zr[.]cloudfront[.]net | Download host for the eight malicious patched banking apps. |
| HOSTNAME | dydjjnnjg7jeb[.]cloudfront[.]net | KoiShort short-drama download host. |
| HOSTNAME | jiekou[.]baojingtextile[.]cn | Hirudo RAT configuration API. |
| HOSTNAME | www[.]helloharmonyos[.]com | Hirudo lure registration and channel-configuration infrastructure. |
| IPV4 | 134[.]122[.]153[.]136 | Hirudo HTTP API endpoints on ports 8085 and 18085, and MQTT broker on ports 1883 and 1884. |
| IPV4 | 134[.]122[.]153[.]68 | Hirudo APK-processing panel host on port 8080. |
| IPV4 | 134[.]122[.]153[.]92 | Hirudo APK-processing panel host on port 8080. |
| IPV4 | 18[.]139[.]79[.]161 | Hirudo APK source host and app-management console. |
| IPV4 | 43[.]225[.]157[.]157 | Operator-controlled Play Integrity relay used by four patched apps on port 8766. |
| SHA256 | 0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7 | Hash of the 1v1 vip lure and dropper. |
| SHA256 | 2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b | Hash of the KoiShort lure and dropper used on the casino route. |
| SHA256 | 425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83 | Hash of a July build of the Hirudo RAT. |
| SHA256 | b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99 | Hash of Hirudo RAT version 7.8.166. |
| SHA256 | d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d | Hash of the ZoyaTV lure and dropper. |
| SHA256 | f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248 | Hash of the Hirudo shopping lure and dropper. |
| URL | hxxp[:]//43[.]225[.]157[.]157:8766/request_token | Play Integrity relay used by four patched apps. |
Malware
Products
AndroidThreatFabric's Mobile Threat Intelligence team has identified a new Android banking remote access trojan we track as Hirudo.Play IntegrityEight Indonesian banking apps, covering seven banks, have purpose-built replacements that embed a hooking engine to blind signature, Accessibility, screen-capture and Play Integrity checks from within the app.
Tools
DobbyThe engine is built on two well-known open-source frameworks: YAHFA, which replaces Java methods, and Dobby, which hooks native functions.Meta PixelLures are served from Amazon CloudFront and tied to campaigns through OpenInstall attribution and Meta Pixel IDs; some download routes were still live in October 2026.OpenInstallLures are served from Amazon CloudFront and tied to campaigns through OpenInstall attribution and Meta Pixel IDs; some download routes were still live in October 2026.YAHFAThe engine is built on two well-known open-source frameworks: YAHFA, which replaces Java methods, and Dobby, which hooks native functions.
Countries
ChinaCredential targets named in code span Indonesia, China, India, Mexico, Morocco and Thailand, and the bundled fake checkout carries Malaysian bank and wallet branding.IndiaCredential targets named in code span Indonesia, China, India, Mexico, Morocco and Thailand, and the bundled fake checkout carries Malaysian bank and wallet branding.IndonesiaTargeting reaches well beyond Indonesia.MexicoCredential targets named in code span Indonesia, China, India, Mexico, Morocco and Thailand, and the bundled fake checkout carries Malaysian bank and wallet branding.MoroccoCredential targets named in code span Indonesia, China, India, Mexico, Morocco and Thailand, and the bundled fake checkout carries Malaysian bank and wallet branding.ThailandCredential targets named in code span Indonesia, China, India, Mexico, Morocco and Thailand, and the bundled fake checkout carries Malaysian bank and wallet branding.