This Trojan program steals authentication information from the customers of South Korean banks. It can be installed on Android devices by Android.BankBot.35.origin. The Trojan replaces the following legitimate online banking applications:
- com.wooribank.pib.smart;
- com.kbstar.kbbank;
- com.ibk.neobanking;
- com.sc.danb.scbankapp;
- com.shinhan.sbanking;
- com.hanabank.ebk.channel.android.hananbank;
- nh.smart;
- com.epost.psf.sdsi;
- com.kftc.kjbsmb;
- com.smg.spbs.
After being launched, it mimics the interface of the legitimate online banking applications and prompts users to enter confidential data, such as the login and password they use to access their accounts, their account number and credit card number, information about the digital certificate used to secure their transactions, etc.
Examples of Trojan interfaces:
 |
 |
 |
 |
 |
