Hirudo Android RAT Replaces Banking Apps With Trojanized Versions
Summary
ThreatFabric describes Hirudo, an Android banking RAT that replaces targeted Indonesian banking apps with modified copies designed to hide security checks while stealing credentials and enabling remote device control.
Key points
- Hirudo is delivered through a dropper bundled in apps advertised as shopping, adult video, or short-drama content on social media.
- It targets eight Indonesian banking apps; its code suggests potential targeting of banks in China, India, Mexico, Morocco, and Thailand.
- After detecting a targeted banking app, Hirudo displays a fake update prompt, removes the legitimate app, and installs a modified bank-specific replacement.
- The replacement uses hooks to conceal its signing status and Accessibility service, and to interfere with screen-capture and Play Integrity checks.
- The RAT can steal banking credentials, remotely control the device, view screens, access the front and rear cameras, and collect SMS messages.
- ThreatFabric recommends server-side Play Integrity enforcement, layered behavioral analytics, treating local Accessibility and screen-capture signals as supporting evidence, and retaining backend transaction-risk controls.
Article Details
- Attack Vectors
- A dropper embedded in genuine-looking shopping, adult video, or short-drama apps advertised through social media installs the Hirudo RAT if it is not already present.
- Hirudo detects targeted Indonesian banking apps, displays a fake update prompt, uninstalls the genuine app, and downloads a modified bank-specific replacement.
- The modified app uses an internal hooking engine to conceal security-check results, including signing-certificate, Accessibility, screen-capture, and Play Integrity checks.
- Hirudo steals banking credentials and SMS messages and enables remote control of victim devices, including screen viewing, camera access, and interaction through Android Accessibility Services.
- Defensive Notes
- Verify and enforce Play Integrity server-side; the article warns that a valid verdict alone is insufficient because Hirudo relays Integrity requests through its own server.
- Use layered defenses and behavioral analytics to help identify fraudulent activity; treat missing behavioral data as potentially suspicious.
- Treat Accessibility and screen-capture signals as supporting evidence, not standalone blocking evidence, and incorporate checks into risk scoring.
- Retain backend transaction-risk controls for login, credential recovery, beneficiary creation, and payment approval; do not rely on forged local results.
MITRE ATT&CK
T1476A dropper delivering Hirudo is contained in downloaded, genuine-looking apps promoted via social media.T1512Hirudo provides remote access to the device's front and rear cameras.T1513Hirudo provides live screen viewing of the victim device.T1516Hirudo uses Android Accessibility Services for remote interaction with the victim device.T1636.003Hirudo collects SMS messages, including an initial 90-day scan and messages from configured bank and wallet senders.
Malware
Products
AndroidHirudo is a remote access banking trojan for Android that combines elements of a traditional banking trojan and a full-featured RAT: it includes on-device credential theft with live remote control of the same phone.Play IntegrityThis modified version of the app includes a hooking engine to blind signature, Accessibility, screen-capture and Play Integrity checks from within the app.
Countries
ChinaInternal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand.IndiaInternal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand.MexicoInternal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand.MoroccoInternal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand.ThailandInternal code suggests it could also be used to target banks in China, India, Mexico, Morocco and Thailand.