IBM X-Force Research detected a recently updated version of the GM Bot mobile banking malware designed to deploy on Android 6 operating systems and bypass new security applied to the platform. Android officially released this Marshmallow OS, code-named M, in October 2015. The GM Bot version we analyzed can work on all Android versions up to the Marshmallow distribution.

This new finding is notable since GM Bot’s developer was banned in underground boards where he used to sell the malware. A competitor claimed that the original developer has stopped selling it. However, it’s now obvious that GM Bot is still alive and continuously updated to circumvent Android security. Attackers have been actively using the new version in the wild.

GM Bot Continues to Evolve

Overlay Trojans, such as GM Bot and its derivatives, are designed to superimpose fraudulent message windows on top of banking and payment applications to phish credentials, credit card information and other personally identifiable information (PII). GM Bot’s spyware features also empower remote attackers to access transaction authorization codes sent via short message service (SMS), view device information, intercept, forward or initiate phone calls, or lock the device’s screen. Overlay malware is ultimately a cybercriminal’s way to gather victims’ online banking credentials and authentication factors all on one device.

In general terms, the overlay scheme works when the malware can:

  • Identify which app was opened by the user and which app is running in the foreground.
  • Launch a matching fake app screen on top of the running app.

The first task is often achieved by abusing Android getRunningTasks() application program interface (API). The option was deprecated starting with the Android Lollipop release, thus temporarily hampering the ability of overlay Trojans to figure out what the user is looking at.

Of course, cybercriminals operating Trojans of this type are not going to wait to find the next fix. Malware developers tried a variety of tricks to get past the new deprecation block, including:

  • Getting the current foreground application via getRunningAppProcesses(), which was introduced and worked on Android 5.0 and 5.1 (Android L);
  • Abusing the accessibility service to find out what’s running on the screen; and
  • In some cases, abusing the UsageStatsManager API.

GM Bot’s developer, known as GanjaMan, also found a way to bypass the deprecation block and implemented it in the most recent version of the malware. In this case, the developer did not go far into programming genius. Rather, he used an open-source method documented on GitHub and began implementing a process enumeration to find out which app was running in the foreground — a good, heuristic way to figure it out.

Worried about Mobile security? Read this white paper

In the screen capture below, we can see GM Bot calling on four functions. Next, it will choose how to get the foreground app, depending on the Android version running on the infected device:

The updated GM Bot is able to fetch the enumeration trick to get information on the app running in the foreground:

With that information available to guide it, GM Bot can once again fetch a matching fake overlay to present to the victim, even on devices running Android M.

GanjaMan Bounces Back

GM Bot is one of the best-known commercialized mobile malware codes in the overlay category. It first surfaced in October 2014 in underground discussion boards. The developer sold it continually to fraudsters until a GM Bot customer leaked the source code in February 2016.

The leak was apparently of no consequence to the developer, who promptly released a second version of the malware later that month. In his post, he indicated that the new version was the fruit of six months’ work, since he had rewritten he malware “from scratch.” He also claimed to have incorporated three different Android OS exploits for infecting user devices, thus tripling the original price of a GM Bot kit from $5,000 to $15,000.

But code development and customer service are two distinct art forms. Soon after the second release, GanjaMan was banned from the forums on which he sold his malware as a result of a customer dispute. Since then, GM Bot was believed to have vanished, but we did not expect the author to abandon his misdeeds altogether due to a mere forum ban.


Details on the GM Bot sample we analyzed appear below:

  • Malware Sample MD5: da88bdcb3d53d3ce7ab9f81d15be8497
  • Unpacked Sample MD5: 12b4ae334b31c752f7f6174a1450e9da

For more information on how to protect your Android-based device from malware like GM Bot, refer to these helpful tips for mitigating malware.

More from Endpoint

Combining EPP and EDR tools can boost your endpoint security

6 min read - Endpoint protection platform (EPP) and endpoint detection and response (EDR) tools are two security products commonly used to protect endpoint systems from threats. EPP is a comprehensive security solution that provides a range of features to detect and prevent threats to endpoint devices. At the same time, EDR is specifically designed to monitor, detect and respond to endpoint threats in real-time. EPP and EDR have some similarities, as they both aim to protect endpoints from threats, but they also have…

The needs of a modernized SOC for hybrid cloud

5 min read - Cybersecurity has made a lot of progress over the last ten years. Improved standards (e.g., MITRE), threat intelligence, processes and technology have significantly helped improve visibility, automate information gathering (SOAR) and many manual tasks. Additionally, new analytics (UEBA/SIEM) and endpoint (EDR) technologies can detect and often stop entire classes of threats. Now we are seeing the emergence of technologies such as attack surface management (ASM), which are starting to help organisations get more proactive and focus their efforts for maximum…

X-Force identifies vulnerability in IoT platform

4 min read - The last decade has seen an explosion of IoT devices across a multitude of industries. With that rise has come the need for centralized systems to perform data collection and device management, commonly called IoT Platforms. One such platform, ThingsBoard, was the recent subject of research by IBM Security X-Force. While there has been a lot of discussion around the security of IoT devices themselves, there is far less conversation around the security of the platforms these devices connect with.…

X-Force prevents zero day from going anywhere

8 min read - This blog was made possible through contributions from Fred Chidsey and Joseph Lozowski. The 2023 X-Force Threat Intelligence Index shows that vulnerability discovery has rapidly increased year-over-year and according to X-Force’s cumulative vulnerability and exploit database, only 3% of vulnerabilities are associated with a zero day. X-Force often observes zero-day exploitation on Internet-facing systems as a vector for initial access however, X-Force has also observed zero-day attacks leveraged by attackers to accomplish their goals and objectives after initial access was…