Cyble CRIL observed a resurgence of Android malware campaigns impersonating the Indian mParivahan RTO app to steal banking credentials, exfiltrate SMS messages, and perform cryptocurrency mining while registering devices via a Telegram bot. The campaign uses multi-stage droppers, ZIP header manipulation, native .so packers, and phishing pages to harvest UPI PINs and OTPs. #GhostBatRAT #mParivahan
Keypoints
- Malware distributed via WhatsApp, SMS (smishing) with shortened URLs, GitHub-hosted APKs, and compromised websites that serve fake mParivahan installers.
- Campaign uses multi-stage droppers, ZIP header manipulation, heavy string obfuscation, and anti-emulation checks to evade detection and analysis.
- Native libraries (.so) and XOR/AES-based decryption are used to dynamically construct API names, load payloads via JNI, and install the final malicious APK.
- The final mParivahan app displays phishing pages and fake UPI payment flows to capture mobile numbers, vehicle details, UPI PINs, and forwards those to Firebase/C2 endpoints.
- All SMS messages are collected and filtered for banking keywords; incoming SMS may be uploaded or forwarded to attacker-controlled numbers to harvest OTPs.
- Device registration is performed using a Telegram bot (GhostBatRat_bot / bot6751695148), linking the distribution infrastructure to the “GhostBat RAT” label.
- Some variants include a cryptocurrency mining module embedded in the third-stage payload, increasing impact beyond data theft.
MITRE Techniques
- [T1660 ] Phishing – Malware is distributed via Smishing; “malware distributed via Smishing” quoted from the article.
- [T1575 ] Native API – Malware uses native code to drop a payload; “samples load and execute a .so library … resolved and invoked at runtime via JNI” quoted from the article.
- [T1655.001 ] Masquerading: Match Legitimate Name or Location – Malware pretending to be a genuine application; “impersonates RTO applications” quoted from the article.
- [T1406.002 ] Obfuscated Files or Information: Software Packing – Malware uses a native packer; “samples … were observed using a native library to install the final payload” quoted from the article.
- [T1633 ] Virtualization/Sandbox Evasion – Malware implemented an anti-emulation check; “performs an anti-emulation check by validating the device’s architecture and manufacturer” quoted from the article.
- [T1426 ] System Information Discovery – Malware collects device information; “validating the device’s architecture and manufacturer” quoted from the article.
- [T1636.004 ] Protected User Data: SMS Messages – Collects SMSs; “All SMS messages containing banking-related keywords are exfiltrated” quoted from the article.
- [T1437.001 ] Application Layer Protocol: Web Protocols – Malware uses FCM for C&C communication; “Malware uses FCM for C&C communication” quoted from the article.
- [T1646 ] Exfiltration Over C2 Channel – Sending exfiltrated data over the C&C server; “sending matches to its C2 server” quoted from the article.
- [T1582 ] SMS Control – Malware can send SMSs; “incoming SMS messages may be forwarded or uploaded … for OTP harvesting” quoted from the article.
Indicators of Compromise
- [SHA256 ] Downloaded malicious APK file hashes – examples: 98991cd9557116b7942925d9c96378b224ad12e2746ac383752b261c31e02a1f, d3bfcb0fc5cb22a4ba033a38d0cf402bf82bbbc2ab6c8c7481096edd0ccf1563 (and many more hashes).
- [URL ] GitHub/raw APK hosting – examples: raw[.]githubusercontent[.]com/Anb1212312/…/Mparivahan.apk, github[.]com/harshxcmf-dev/V1/releases/download/V1/NextGen_mparivahan.apk.
- [URL ] Shortened/malicious redirect URLs used in smishing – examples: yxbu02[.]short[.]gy/Govt-Check-challan, tinyurl[.]com/E-ChallanRTO.
- [Telegram Bot URL ] Device registration bot endpoint – example: api[.]telegram[.]org/bot6751695148:AAHEYUWDN0BKvpvSycVHp_2kcXPhfeZk75o/ (GhostBatRat_bot).
- [Firebase URL ] Data exfiltration endpoint – example: jeuduc-c3310-default-rtdb[.]firebaseio.com/ (used to receive stolen UPI PINs and other data).
Read more: https://cyble.com/blog/ghostbat-rat-inside-the-resurgence-of-rto-themed-android-malware/