Rewterz Threat Alert – Gustuff Banking Trojan Uses New Tactics

Severity

High

Analysis Summary

The Gustuff Banking Trojan is now coming with the addition of a “poor man scripting engine” based on JavaScript that provides the operator with the ability to execute scripts while using its own internal commands backed by the power of JavaScript language. The actors have eventually disabled the C2. Campaigns have been detected running via Instagram, Facebook and SMS that aimed to deploy the Gustuff Trojan. The malware is targeting financial institutions in Australia. In addition the malware uses useless targets to send propagation SMS messages. Each target is requested to send SMSs at a rate of 300 per hour. The list of anti-virus/anti-malware software that Gustuff blocks as a self-defense mechanism is now also loaded during the activation cycle, as below.

The threat actors are targeting Australian banks and digital currency wallets. This new version seems to target hiring sites’ mobile apps. It comes with dynamic loading of webviews. It can receive a command to create a webview targeting specific domains, while fetching the necessary injections from a remote server. It also appears to be targeting credentials used on the official Australian government’s web portal.

During the activation cycle, the malware now asks the user to update their credit card information without immediately showing a panel for the user to provide the information. Instead, it will wait for the user to do it and — leveraging the Android Accessibility API — will harvest it. 

Impact

• Credential Theft
• Theft from digital currency wallets
• Financial loss

Indicators of Compromise

Domain Name

• instagram-shared[.]pw
• instagram-shared[.]net
• instagram-shared[.]com
• video-hd33[.]site
• video-hd30[.]site
• video-hd29[.]site
• video-hd24[.]site
• video-hd20[.]site
• video-hd18[.]site
• video-hd17[.]site
• hd-video4[.]site
• video-hosting[.]site
• video-hd1[.]site
• video-hd[.]site
• homevideo641a[.]cf
• homevideo651a[.]cf
• homevideo54-1a[.]ml
• videohosting32-e[.]cf
• videohosting23c[.]cf
• videohosting62-b[.]tk

Source IP

• 88.99.174[.]142
• 88.99.175[.]152
• 78.46.201[.]36
• 88.99.174[.]140
• 88.99.173[.]179

Remediation

• Block the threat indicators at respective controls.
• Use token-based two-factor authentication.
• Only download apps from official app stores.
• Do not download random files/click on links found on social media platforms.