GhostBat RAT Android Malware Poses as Fake RTO Apps to Steal Banking Data from Indian Users
The GhostBat RAT campaign employs multiple infection vectors, including WhatsApp, SMS with shortened URLs, GitHub-hosted APKs, and compromised websites, to distribute malicious Android droppers.
The GhostBat RAT campaign employs multiple infection vectors, including WhatsApp, SMS with shortened URLs, GitHub-hosted APKs, and compromised websites, to distribute malicious Android droppers.
Once installed, these droppers use multi-stage workflows, ZIP header manipulation, and string obfuscation to evade detection and reverse engineering. Native libraries (.so) are used to resolve API calls dynamically, with payloads that include banking credential stealers and cryptocurrency miners.
Phishing pages mimic the mParivahan app, requesting mobile numbers, vehicle details, and UPI payments. SMS containing banking-related keywords are exfiltrated to C&C servers, and incoming messages may be forwarded for OTP harvesting. Device registration is conducted via the Telegram bot GhostBatRat_bot.
Initially documented in July 2024, the malware masqueraded as Regional Transport Office applications, targeting contacts and SMS messages. From September 2025, over forty samples were observed spreading through WhatsApp and SMS, redirecting users to GitHub-hosted APKs.
Variants employ custom packers and anti-emulation routines, ultimately delivering a malicious version of the mParivahan app.
Once installed, these droppers use multi-stage workflows, ZIP header manipulation, and string obfuscation to evade detection and reverse engineering.
GhostBat RAT's architecture includes multi-stage dropper workflows, native binary packing, ZIP header corruption, runtime anti-emulation checks, and string obfuscation. The first-stage dropper verifies device architecture, terminating on x86 or x86_64 to avoid emulated environments.
String obfuscation and decryption processes complicate reverse engineering. The dropper decrypts an asset file and executes a second-stage payload, which in turn decrypts another asset using an AES key. This leads to a third-stage module housed in a classes.zip container.
The final stage downloads and executes a cryptominer library before installing the primary malicious APK for banking data theft. Some variants use a native packer to decrypt and deploy additional binaries, deploying both a credential stealer and a cryptocurrency miner.
Upon installation, victims encounter a fake Google Play update page, prompting installation from unknown sources and displaying a phishing interface for mobile and vehicle details. A fake payment flow requests a UPI PIN, forwarding it to a Firebase endpoint.
SMS messages containing banking-related keywords are filtered and exfiltrated to the C&C server. Incoming messages can be uploaded or forwarded for OTP interception, enabling unauthorized transactions.
The GhostBat RAT campaign exemplifies a sophisticated evolution of RTO-themed Android malware, utilizing multi-stage dropper techniques, anti-analysis defenses, native code exploitation, and social engineering to bypass traditional detection mechanisms. The campaign highlights the importance of SMS permission management, caution with shortened URLs, and continuous mobile threat intelligence to counter emerging threats.
Based on reporting by GBHackers.