Spyware Masquerading As Banking App Targets Koreans

This report examines an Android spyware campaign that distributes a fake Woori Bank app via phishing pages targeting Korean users; the malware is packed and obfuscated, decrypts embedded DEX files using native libraries, performs anti-sandbox/emulator/root/VPN checks, abuses the Accessibility service to enable permissions, collects contacts, SMS, call logs, audio/video, location and screen content, and exfiltrates encrypted data to identified C2 servers. The analysis includes APK metadata, code excerpts, command mappings, persistence mechanisms, recommended mitigations, and a list of IoCs (SHA256 hashes, phishing URLs, and C2 IPs).