Cloud Mining Scam Distributes Roamer Banking Trojan

 Rising Concerns: Android Malware Takes Aim at Cryptocurrency Wallets and Banking Apps

       In recent years, cloud mining has become a convenient option for individuals interested in entering the cryptocurrency realm without extensive technical expertise or costly mining hardware. This concept offers users the opportunity to remotely mine digital currencies like Bitcoin or Ethereum by renting computing power from cloud mining companies.

However, along with the growth of this industry, a darker side has emerged. Cybercriminals have identified the potential for exploitation in cloud mining and have resorted to deceptive tactics to defraud unsuspecting individuals. Recently, Cyble Research & Intelligence Labs (CRIL) identified a cloud mining scam involving a Threat Actor (TA) operating a fraudulent website and distributing Android malware to unsuspecting victims through various phishing sites.

The discovered phishing site hxxps://cloudmining.uk[.]com claims to be a cloud mining platform and prompts users to download a malicious application to start mining. The TA behind this malicious scheme has put significant effort into designing the website to appear genuine, with the intention of tricking victims into downloading the malicious application.

The TA has implemented a deceptive tactic on its phishing site. Instead of properly redirecting users to the official Google Play or App Store platforms, they have just used the “Google Play” and “App Store” buttons. When users click on these buttons, the phishing site initiates the direct download of an APK file named “CloudMining.apk.” As a result, users unwittingly download the malicious application without being redirected to the legitimate app store platforms as intended.

While investigating the above phishing site, we encountered a Telegram channel called “CloudMiningTeam”, operated by the TA. This channel has been active since May 15, 2023, and the TA has been conducting a fraudulent campaign through it. The Telegram channel has a subscriber base of over 5000 individuals, and the TA regularly posts updates and information regarding the cloud mining scheme.

The TA is employing its Telegram channel to distribute yet another phishing website, hxxps://cloud-miner[.]cc. The phishing site closely resembles the interface of the website mentioned above and prompts users to download an identical APK file named “CloudMining.apk”.

The image below showcases one of the posts shared by the TA within the Telegram channel, disseminating the phishing link to unsuspecting users.

Furthermore, we have discovered an additional phishing website, hxxps://cloud-miner[.]top, that is also involved in this scam. While the UI of this phishing site differs from the previously mentioned sites, it follows a similar theme related to cloud mining. Just like the other phishing sites, this one also prompts the download of the same malware file named “CloudMining.apk.”

The TA has also provided the “Login” or “Register Now” buttons on the phishing sites. Upon clicking the buttons on any of these phishing sites, users are redirected to a common cloud mining scam website, hxxps://cloud-mining[.]vip. This fraudulent website allows users to create an account and purportedly earn profits through TRX (Tron) cloud mining.

   

After granting the requested permissions, installing the “CloudMining.apk” leads to the launch of the same cloud mining scam website. However, in addition to opening the fraudulent scam website, the TA has added a malicious module within the application, as shown in figure 7. This module is designed to extract sensitive information from the infected device and targets various crypto wallets, as well as certain banking applications

During our investigation, we noticed over 15 similar malware samples that employed different themes for distribution. These samples frequently utilized gaming or shopping mall names and icons.

Throughout this analysis, we will refer to this malware as the “Roamer” Banking Trojan due to the consistent presence of the tag name in the AppConfig class across all identified malicious applications.

CONCLUSION:

In summary, the emergence of the Roamer Banking Trojan has become a significant and widespread threat to both cryptocurrency wallet applications and banking institutions. The threat actor behind this malicious scheme has employed deceptive tactics, such as phishing websites and a fraudulent Telegram channel, to distribute the malware and expand their nefarious operations.

The Roamer Banking Trojan's ability to target both cryptocurrency wallets and banking institutions significantly increases the potential harm it can cause to victims. This underscores the threat actor's determination to exploit stolen information for financial gain. To protect themselves, users should exercise caution and avoid following suspicious cryptocurrency mining channels on platforms like Telegram, as these channels can result in substantial financial losses and compromise sensitive personal data.

To effectively mitigate the risks associated with the Roamer Banking Trojan and similar malware attacks, it is crucial for individuals and organizations to remain vigilant, implement robust security measures, and stay informed about emerging cyber threats. By taking these proactive steps, users can enhance their defenses and reduce their vulnerability to such malicious activities.