Fake SBI App: Android VPN-Hijacking Trojan Analysis

The sample

A WhatsApp group was taken over, renamed and given an official-looking logo, then used to push an APK called SBI AADHAR UPDATE.APK to its members. Because the message came from a group people already trusted, it skipped most of the suspicion a random SMS would get.

This is the kind of fake-APK lure that later became a core part of the India Threat Tracker, and it was one of the first samples I took apart end to end.

What it does

The trojan runs two attacks at once.

In front of the user, it shows a fake installation screen for the real "YONO SBI" banking app, then opens a WebView that imitates the SBI Reward Points login page and asks for the username, password and mobile number.

In the background, it starts an Android VpnService and calls addRoute("0.0.0.0", 0). That one line sends every app's network traffic through the malware's tunnel, which puts it in a position to watch everything the phone sends.

How I analysed it

• Anti-analysis first. apktool crashed on a deliberately malformed ZIP header (invalid CEN header), a common trick to break reverse-engineering tools. JADX could still load it.
• Manifest. The app asks for BIND_VPN_SERVICE for the tunnel and REQUEST_INSTALL_PACKAGES, which lets it act as a dropper.
• Obfuscation. Renamed identifiers, strings encrypted into short[] arrays, and control-flow flattening. I traced the VPN payload to a background thread in a single obfuscated class.
• The C2 hunt. I couldn't recover a command-and-control address statically. The code included a heavily obfuscated copy of a legitimate Android class that looked like the C2 logic and turned out to be a decoy, and the real endpoint is most likely loaded at runtime or hidden in native code.
• Sandboxes. Any.Run and Hybrid Analysis confirmed the fake install screen and the phishing page, but saw no C2 traffic at all. That points to the sample staying quiet when it detects an emulator.

Indicators

What I took away

The phishing page is the visible part, but the VPN tunnel is the dangerous part: it keeps working after the victim closes the app, and it sees traffic from every other app on the phone. For defenders, a newly installed app asking to become a VPN, outside the Play Store, is one of the strongest single signals there is.

The full report, with screenshots from each stage, is in the repository.