A previously unreported advanced banking trojan named Gustuff can steal funds from accounts at over 100 banks across the world and rob users of 32 cryptocurrency Android apps.
Introduction of Gustuff banking trojan
Group-IB, an international company that specializes in preventing cyberattacks, has detected the activity of Gustuff a mobile Android Trojan, which includes potential targets of customers in leading international banks, users of cryptocurrency services, popular e-commerce websites and marketplaces. Gustuff has previously never been reported. Gustuff is a new generation of malware complete with fully automated features designed to steal both fiat and cryptocurrency from user accounts en masse. The Trojan uses the Accessibility Service, intended to assist people with disabilities.
Group-IB‘s Threat Intelligence system first discovered Gustuff on hacker forums in April 2018. According to its developer, nicknamed Best offer, Gustuff became the new, updated version of the AndyBot malware, which since November 2017 has been attacking Android phones and stealing money using web fakes disguised as mobile apps of prominent international banks and payment systems. The price for leasing the «Gustuff Bot» was $800 per month.
The analysis of Gustuff sample revealed that the Trojan is equipped with web fakes designed to potentially target users of mobile Android apps of top international banks including Bank of America, Bank of Scotland, J.P.Morgan, Wells Fargo, Capital One, TD Bank, PNC Bank, and crypto services such as Bitcoin Wallet, BitPay, Cryptopay, Coinbase, etc. Group-IB specialists discovered that Gustuff could potentially target users of more than 100 banking apps, including 27 in the US, 16 in Poland, 10 in Australia, 9 in Germany, and 8 in India and 32 cryptocurrency apps.
Initially designed as a classic banking Trojan, in its current version, Gustuff has significantly expanded the list of potential targets, which now includes, besides banking, crypto services and fintech companies’ Android programs, users of apps of marketplaces, online stores, payment systems and messengers, such as PayPal, Western Union, eBay, Walmart, Skype, WhatsApp, Gett Taxi, Revolut etc.
How it works!
Gustuff infects Android smartphones through SMS with links to malicious Android Package (APK) file, the package file format used by the Android operating system for distribution and installation of applications. When an Android device is infected with Gustuff, at the server’s command Trojan spreads further through the infected device’s contact list or the server database. Gustuff’s features are aimed at mass infections and maximum profit for its operators — it has a unique feature — ATS (Automatic Transfer Systems), that auto-fills fields in legitimate mobile banking apps, cryptocurrency wallets and other apps, which both speeds and scales up thefts.
The analysis of the Trojan revealed that the ATS function is implemented with the help of the Accessibility Service, which is intended for people with disabilities. Gustuff is not the first Trojan to successfully bypass security measures against interactions with other apps’ windows using Android Accessibility Service. That being said, the use of the Accessibility Service to perform ATS has so far been a relatively rare occurrence.
What happens after being infected by this Gustuff banking trojan!
After being uploaded to the victim’s phone, the Gustuff uses the Accessibility Service to interact with elements of other apps’ windows including crypto wallets, online banking apps, messengers, etc. The Trojan can perform several actions, for example, at the server’s command, Gustuff can change the values of the text fields in banking apps. Using the Accessibility Service mechanism means that the Trojan can bypass security measures used by banks to protect against the older generation of mobile Trojans and changes to Google’s security policy introduced in new versions of the Android OS. Moreover, Gustuff knows how to turn off Google Protect; according to the Trojan’s developer, this feature works in 70% of cases.
Gustuff is also able to display fake push notifications with legitimate icons of the apps mentioned above. Clicking on fake push notifications has two possible outcomes: either a web fake downloaded from the server pops up and the user enters the requested personal or payment (card/wallet) details; or the legitimate app that purportedly displayed the push notification opens — and Gustuff at the server’s command and with the help of the Accessibility Service, can automatically fill payment fields for illicit transactions.
The malware is also capable of sending information about the infected device to the C&C server, reading/sending SMS messages, sending USSD requests, launching SOCKS5 Proxy, following links, transferring files (including document scans, screenshots, photos) to the C&C server, and resetting the device to factory settings.
But while the trojan is more advanced than most of its competition, it has not been that popular. Gustuff was never deployed inside apps uploaded on the official Google Play Store, as it currently appears to be unable to bypass Google’s security scans unlike most of its rivals.
Currently, the only way threat actors have been seen distributing the trojan has been through SMS spam that carries links to the trojan’s APK installation file, Group-IB said.
The trojan has been on the market since April 2018, when its author first started advertising it on a well-known forum for Russian-speaking cybercriminals.
