MalwarePublished 1 Aug 2025Updated 31 Aug 2025

Behind Random Words: DoubleTrouble Mobile Banking Trojan Revealed

Source AlienVault OTX General

Description

A sophisticated mobile banking trojan, DoubleTrouble, has evolved in distribution methods and capabilities. Initially spread through phishing websites impersonating European banks, it now utilizes Discord channels for distribution. The malware employs advanced obfuscation techniques, abuses Android's Accessibility Services, and features screen capture, keylogging, and application blocking capabilities. It uses fake overlays to steal credentials and leverages sophisticated screen recording techniques. The trojan can block specific applications, implement a highly advanced keylogger, and execute a wide range of commands received from its Command and Control server. The malware's extensive functionalities enable credential theft, device manipulation, and persistent control over infected devices.

Impact

For European organizations, particularly banks and financial institutions, DoubleTrouble poses a substantial risk. The Trojan targets mobile banking users, potentially leading to widespread credential theft and unauthorized financial transactions. This can result in direct financial losses for customers and reputational damage for banks. The malware's ability to block legitimate applications and manipulate device behavior can disrupt normal banking operations and customer trust. Additionally, the use of Discord for distribution highlights a risk vector that may bypass traditional email and web filtering defenses, complicating detection and response efforts. The abuse of Accessibility Services can also lead to broader device compromise, threatening the confidentiality and integrity of sensitive corporate and personal data stored on mobile devices. Given the increasing reliance on mobile banking in Europe, the Trojan's capabilities could facilitate large-scale fraud campaigns, regulatory scrutiny, and increased operational costs for incident response and remediation.

Defensive guidance

European organizations should implement multi-layered defenses specifically tailored to mobile banking threats. Banks should enhance user education campaigns to raise awareness about phishing attempts, especially those impersonating legitimate banking websites and the risks of installing apps from unofficial sources like Discord channels. Mobile security solutions with behavioral analysis and advanced detection capabilities should be deployed to identify obfuscated malware and abuse of Accessibility Services. Application allowlisting and restricting Accessibility Service permissions to only trusted apps can reduce the attack surface. Banks should implement multi-factor authentication (MFA) that does not rely solely on credentials susceptible to keylogging or overlay attacks, such as hardware tokens or biometric factors. Monitoring network traffic for unusual C2 communications and employing threat intelligence feeds to detect emerging malware variants like DoubleTrouble can improve early detection. Collaboration with Discord and other platform providers to identify and remove malicious distribution channels is also recommended. Finally, incident response plans should include specific procedures for mobile malware infections, including device isolation, forensic analysis, and credential resets.

Indicators of compromise

Domains 3

begans.cfd
unicredit.appaggiornamento.com
volksbank.applogininfo.com

IP addresses 3

104.238.34.15CC=US ASN=AS8100 quadranet enterprises llc
41.216.183.248CC=PL ASN=AS400377 serverion llc
82.115.223.2CC=RU ASN=AS209821 ao mirs

Hashes 76

04458f7f74b36af9496b7c3258aab500MD5 of 84faf02309080076fe526f8bc8c427fa6bb407c5da42c31866ba47c1478cbde9
06591f7f08dea97a2d49080d12951d27MD5 of e3f84482977854a5c79d253f6dcca83b2911b8c1dc7cc76b533bdc7fc31255c9
12455c52b070fbe4a5a16ef02adc3f48MD5 of 91f5a4164bd557b34442550d204ad5e024dc02e2d5febf86699a7feae0a38480
19e01afcfac407a82d8504067b96a468MD5 of d002f0e354841d7090df5f20dd2b2b4c8b9d2216ce331690807bb58414390a29
1a519169642773fccbb0f6fe1240e149MD5 of 64977c8e167609f52ebd89a4eda1a83282e3b9ea07115bf68acd7d9836e04a1b
305860b80927ee2aa0d527f56d921358MD5 of 2f9d70c75330b49a1a97479587d5e0b6016cf8004e454badf2b021e8bbb28469
35f7bd6034dddecf9b4fc906e1629dc9MD5 of d45cb00646d1ead9b54810be048323179414097087ef873d0b86d8d9bcf77217
37c178e12f292b5bd4c5a8dc9164cc4eMD5 of b187a29d1e9e3e616f166d2fa3076bc22b9268d0b7b01b59ea8bd89f39a90010
4d46a7821e3759beaba6b3c8660cdfdaMD5 of c247d9ec3fa20803ba769308c66d2b4c836ca0ac90f71d68a07f44d57eb8a501
4efc193e763b6afcbce32e89e296baa5MD5 of b9a13c4fe93d5b42dc38ae1c864d17388a32bcb89e7279f4bb649c92f67f1498

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 1 Aug 2025, 14:32 UTC

MITRE ATT&CK techniques3 from threat tags

Technical details

Indicators of compromise

Domains 3

IP addresses 3

Hashes 76

Community reviews

Related threats