A Trojan for Android designed to steal confidential banking information. It operates similar to Android.BankBot.20.origin. The command and control server is located at http://xxx.xxx.197.203:80 (not available at the moment).
Android.Banker.22.origin can replace the following online banking applications with fake ones:
- nh.smart,
- com.shinhan.sbanking,
- com.webcash.wooribank,
- com.kbstar.kbbank,
- com.hanabank.ebk.channel.android.hananbank,
- com.epost.psf.sdsi,
- com.ibk.neobanking,
- com.smg.spbs,
- com.kftc.citismb,
- com.sc.danb.scbankapp,
- com.areo.bs.
The Trojan can replace those programs not only upon receiving a command from the server but also on a command from an SMS message that looks as follows: “b:bank_name” where “bank_name” indicates a corresponding program from the list ({“NH”, “SH”, “WO”, “KB”, “HA”, “EP”, “NE”, “SP”, “CT”, “SC”, “BS”}).
