Full Report
Cybersecurity researchers have disclosed details of a new Android banking trojan called Hirudo that works by replacing legitimate banking apps with purpose-built patched versions designed to bypass security checks from inside the app itself, marking a new escalation in financial fraud. Dutch mobile security company ThreatFabric said it identified replacements for eight Indonesian banking
Analysis Summary
# Tool/Technique: Hirudo
## Overview
Hirudo is a sophisticated Android banking trojan that represents an escalation in mobile financial fraud. It employs a "patched app" strategy, where it replaces legitimate banking applications with tampered versions. These malicious replacements include a built-in hooking engine designed to neutralize the original app's security features (such as Play Integrity and signature checks) from within the application process itself.
## Technical Details
- **Type:** Malware family (Banking Trojan / Remote Access Trojan)
- **Platform:** Android
- **Capabilities:** Credential theft, device takeover, screen and camera capture, SMS theft, and security check bypass via app replacement.
- **First Seen:** October 2026 (Publicly disclosed)
## MITRE ATT&CK Mapping
- **[TA0031 - Initial Access]**
- [T1444 - Masquerading]
- **[TA0032 - Execution]**
- [T1643 - User Execution] (Fake in-app updates)
- **[TA0034 - Persistence]**
- [T1624.001 - Event Triggered Execution: Accessibility Service]
- **[TA0035 - Privilege Escalation]**
- [T1548.005 - Abuse Elevation Control Mechanism: Accessibility Service]
- **[TA0037 - Credential Access]**
- [T1417 - Input Capture] (Keylogging/Overlays)
- **[TA0038 - Discovery]**
- [T1420 - File and Directory Discovery] (Scanning for target banking apps)
- **[TA0040 - Impact]**
- [T1491.001 - Defacement: Internal Defacement] (Fake UI overlays)
## Functionality
### Core Capabilities
- **Credential Theft:** Uses fake login screens and overlays to capture PINs and bank credentials.
- **Remote Access (RAT):** Provides live remote control of the infected device to the operator.
- **Data Exfiltration:** Capable of capturing SMS messages (often used for MFA) and using the camera/screen recording.
- **Accessibility Abuse:** Leverages Android Accessibility Services to automate actions and observe user interactions.
### Advanced Features
- **App Replacement Strategy:** Identifies specific banking apps, initiates an uninstaller prompt for the legitimate app, and installs a "patched" version in parallel.
- **Security Check Hooking:** The patched apps contain a hooking engine that blinds signature checks, accessibility service detection, and screen-capture protection (stripping `FLAG_SECURE`).
- **Play Integrity Bypass:** Relays Play Integrity requests to a C2 server to return valid-looking verdicts to the device.
- **Anti-Detection VPN:** Configures a non-functional VPN connection during installation to block internet access for security services like Google Play Protect, preventing cloud-based analysis.
## Indicators of Compromise
### File Hashes (Droppers)
- **Shopora:** `com.agbbh.kjdrttt`
- **1V1 X:** `com.onev.vip`
- **KoiShort:** `com.koishort.app`
- **ZoyaTV:** `com.zoyatv.app`
### Network Indicators
- **C2 Communication:** Relays Play Integrity requests via plain HTTP to operator-controlled servers (URLs not specified in source).
### Behavioral Indicators
- Requests for Accessibility Service and Notification Access.
- Prompting for a non-functional VPN connection setup.
- Unexpected uninstallation prompts for legitimate banking applications followed by "update" requests.
## Associated Threat Actors
- Unknown (ThreatFabric research identifies targeting primarily in Indonesia, with credential theft reaching China, India, Mexico, Morocco, and Thailand).
## Detection Methods
- **Behavioral Detection:** Monitoring for apps that attempt to uninstall other packages or request excessive accessibility permissions.
- **Integrity Monitoring:** Detecting the removal of the `FLAG_SECURE` attribute within sensitive applications.
- **Network Monitoring:** Identifying unusual HTTP traffic related to Play Integrity attestation relaying.
## Mitigation Strategies
- **Prevention:** Instruct users to never install app updates via browser prompts or from within non-official "dropper" apps (entertainment/adult video apps).
- **Hardening:** Enable Google Play Protect and ensure it is updated; avoid granting Accessibility Services to apps that do not clearly require them for their stated purpose.
- **Validation:** Banking institutions should implement server-side checks that can detect anomalies in device integrity reports that have been relayed/tampered with.
## Related Tools/Techniques
- **StreamRat:** Also uses the non-functional VPN technique to bypass cloud-based security checks.
- **Fvncot / SeedSnatcher:** Shared history of utilizing VNC and credential grabbing techniques.