{"id":1894,"date":"2025-02-11T10:03:37","date_gmt":"2025-02-11T10:03:37","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2025\/02\/11\/finstealer-malware-attacking-leading-indian-banks-mobile-users-to-steal-login-credentials\/"},"modified":"2025-02-11T10:03:37","modified_gmt":"2025-02-11T10:03:37","slug":"finstealer-malware-attacking-leading-indian-banks-mobile-users-to-steal-login-credentials","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2025\/02\/11\/finstealer-malware-attacking-leading-indian-banks-mobile-users-to-steal-login-credentials\/","title":{"rendered":"FinStealer Malware Attacking Leading Indian Bank\u2019s Mobile Users To Steal Login Credentials"},"content":{"rendered":"

FinStealer Malware Attacking Leading Indian Bank\u2019s Mobile Users To Steal Login Credentials
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A sophisticated malware campaign dubbed \u201cFinStealer\u201d is actively targeting customers of a leading Indian bank through fraudulent mobile applications.<\/p>\n

The malware, identified as Trojan.rewardsteal\/joxpk, employs advanced tactics to steal banking credentials and personal information from unsuspecting users.<\/p>\n

The malicious campaign operates through a suspicious website (motocharge[.]online) that distributes fake banking apps mimicking legitimate ones.<\/p>\n

\n
\"\"
APK Details (Source \u2013 CYFIRMA)<\/figcaption><\/figure>\n<\/div>\n

CYFIRMA analysts identified that the malware is built using Kotlin and exhibits sophisticated capabilities.<\/p>\n

\n
\"\"
Obfuscated Code (Source \u2013 CYFIRMA)<\/figcaption><\/figure>\n<\/div>\n

The capabilities include XOR-based string obfuscation to evade detection, a dual command-and-control (C2) infrastructure utilizing both IP-based servers (41.216.183.97) and Telegram bots, and advanced WebView exploitation for credential harvesting.<\/p>\n

Core functionality of FinStealer<\/strong><\/h2>\n

Technical analysis revealed the malware\u2019s core functionality through this critical code snippet:-<\/p>\n

public class NPStringFog {\n    public static String KEY = \"npmanager\";\n    private static final String hexString = \"0123456789ABCDEF\";\n    public static String decode(String str) {\n        ByteArrayOutputStream baos = new ByteArrayOutputStream(str.length() \/ 2);\n        for (int i = 0; i < str.length(); i += 2) {\n            baos.write((hexString.indexOf(str.charAt(i)) << 4) | hexString.indexOf(str.charAt(i + 1)));\n        }\n        \/\/... [obfuscation logic]\n    }\n}<\/code><\/pre>\n
\n
\"\"
Obfuscated Module (Source \u2013 CYFIRMA)<\/figcaption><\/figure>\n<\/div>\n
The malware communicates with its C2 infrastructure through a Telegram bot (API key: 7754264825:AAEqSBGNuEbuMqnWFqN7E_SvhS5sy_IFjEE) to exfiltrate sensitive data including:-<\/p>\n