Shakedown Social

ANY.RUN🚨 ALERT: Banking Apps Under Attack: Credentials Hijacked via Telegram ⚠️ A <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#malware</a> dropper delivers a stealer disguised as the IndusInd Bank app. It embeds a phishing website inside the Android app to steal victims’ financial data, posing a threat to mobile banking users and financial institutions. 🔍 Analysis: <a href="https://app.any.run/tasks/fe800ccb-fccc-42a6-a11d-a3d2b6e89edf/?utm_source=mastodon&utm_medium=post&utm_campaign=android_banking_app&utm_term=200325&utm_content=linktoservice" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://app.any.run/tasks/fe800ccb-fccc-42a6-a11d-a3d2b6e89edf/?utm_source=mastodon&utm_medium=post&utm_campaign=android_banking_app&utm_term=200325&utm_content=linktoservice</a>The malware tricks users into entering their sensitive information (registered mobile number, Aadhaar number, PAN card, net banking user ID, etc.) through a fake banking interface embedded in the app. 📥 Once submitted, the stolen data is sent to both the <a href="https://infosec.exchange/tags/phishing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#phishing</a> site and a C2 server controlled via Telegram. The AndroidManifest.xml shows that the dropper APK has permissions to install applications. The <a href="https://infosec.exchange/tags/dropper" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dropper</a> contains base.apk, the malicious <a href="https://infosec.exchange/tags/payload" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#payload</a>, and is responsible for dropping and executing it. 👨‍💻 Our new <a href="https://infosec.exchange/tags/Android" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Android</a> sandbox allows <a href="https://infosec.exchange/tags/SOC" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SOC</a> teams reveal base.apk behavior: communication via Telegram, starting from another location, monitoring incoming messages, and more. Fast access to threat details enables deep analysis and proactive response, mitigating potential damage. The APK is obfuscated, with all strings <a href="https://infosec.exchange/tags/XOR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#XOR</a>-encrypted with the ‘npmanager’ key. The CyberChef recipe below reveals the script that sends intercepted data to Telegram: <a href="https://gchq.github.io/CyberChef/#recipe=From_Hex%28%27Auto%27%29XOR%28%7B%27option%27%3A%27UTF8%27%2C%27string%27%3A%27npmanager%27%7D%2C%27Standard%27%2Cfalse%29%26oeol%3DNEL" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://gchq.github.io/CyberChef/#recipe=From_Hex%28%27Auto%27%29XOR%28%7B%27option%27%3A%27UTF8%27%2C%27string%27%3A%27npmanager%27%7D%2C%27Standard%27%2Cfalse%29%26oeol%3DNEL</a> <a href="https://infosec.exchange/tags/IOCs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#IOCs</a>: <a href="https://infosec.exchange/tags/Phish" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Phish</a> URL: hxxps://t15[.]muletipushpa[.]cloud/page/ C2 Server (Telegram Bot): hxxps://api[.]telegram[.]org/bot7931012454:AAGdsBp3w5fSE9PxdrwNUopr3SU86mFQieE More IOCs and insights will be shared in our blog post. Let us know if you're interested! 💬 🚀 Expose Android threats in seconds with real-time APK analysis in <a href="https://infosec.exchange/tags/ANYRUN" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ANYRUN</a> Sandbox: <a href="https://app.any.run/?utm_source=mastodon&utm_medium=post&utm_campaign=android_banking_app&utm_term=200325&utm_content=linktoregistration#register/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://app.any.run/?utm_source=mastodon&utm_medium=post&utm_campaign=android_banking_app&utm_term=200325&utm_content=linktoregistration#register/</a> <a href="https://infosec.exchange/tags/Cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cybersecurity</a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>

Jason H. Moore, Ph.D.Two interesting XOR circuits inside the Intel 386 processor <a href="https://www.righto.com/2023/12/386-xor-circuits.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.righto.com/2023/12/386-xor-circuits.html</a> <a href="https://mastodon.online/tags/xor" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#xor</a> <a href="https://mastodon.online/tags/intel386" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#intel386</a> <a href="https://mastodon.online/tags/retrocomputing" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#retrocomputing</a>

Recent searches

Search options

Administered by:

Server stats:

#xor