IBM X-Force Delves Into ExoBot’s Leaked Source Code

** This blog post was written with IBM X-Force researcher Shahar Tavor who reversed ExoBot's source code **

Following the recent source code leak of the Android banking Trojan ExoBot, IBM X-Force research delved into the malware’s inner workings to help uncover insights into its dynamic mechanisms and the features that help criminals use it in cross-channel bank fraud.

 

ExoBot Genesis

ExoBot is Android malware that was based originally on a previous code known as Marcher. This code represents a banking Trojan that uses the overlay technique — that is, popping up fake windows that hide the original app users open — to trick victims into tapping their banking credentials into a fake interface. After stealing account access details, the malware can also intercept SMS messages and phone calls, thereby enabling criminals to take over the victim’s bank account and other financial accounts at their discretion.

Some of the capabilities that enable ExoBot to facilitate fraudulent activity on infected devices include gaining admin privileges, launching overlay screens, and exfiltrating SMS, data and other information from the infected device.

In 2016, ExoBot’s developer was selling the malware on the clear web for a while, even advertising an upgrade in May 2017. In January 2018, the actor decided to sell it off in the underground, but by May 2018, the source code was leaked online by an unknown actor.

Source code leaks, especially those of Android malware codes, have happened in the recent past. When they do, they give rise to variants and variations of the same malware, lowering the bar for more criminals to enter the mobile malware scene and try their hand at mobile banking fraud.

Delving Into ExoBot’s Inner Workings

The following sections describe technical details about ExoBot as analyzed by X-Force mobile threat researcher Shahar Tavor.

Looking for the technical rundown? Check out the original post here.