The source code of a top Android banking trojan, Exobot, leaked online, and is spreading at a rapid pace in malware developer communities, which worries researchers who believe a new wave of new malware is coming.
The malware first appeared towards the end of 2016, and its creators mysteriously disappeared in January 2018, after they put its code up for sale.
Nowadays, malware program creators sell their services, providing subscription access to their program. Their services are called Maas or Caas, that is, malware as a service or cybercrime as a service.
source code was released in May
Something similar happens with all malware, as it did with Exobot. Last month, in collaboration with ESET and ThreatFabric, the authenticity of the code was certified.
The code appears to be version 2.5 of Exobot, otherwise known as the “Trump edition”, one of the last versions of the program before it was abandoned by its creators.
Researchers fear the proliferation of malware, and it will not be the first time this happens. In December 2016, the source code of Android BankBot leaked online, and led to a massive wave of malware campaigns up to 2017.
Cengiz Han Sahin, a security researcher at ThreatFabric, says that Exobot is a very capable malware that can infect even the latest Android releases, something very few malware can do. He also adds that it is unprecedented that it does not need to obtain a usage license to infect a device.
Thus, beyond the fact that the source code of Exobot is released free, it is also very powerful, just as BankBot was when it was released in 2016. In the coming months we expect BankBot users to switch to the Exobot code, as it is a significant «free» upgrade.
