Next-Gen Android Banking Trojan Hides in Digital ID App, Automates Crypto Wallet Theft and Evades Emulators

Cyfirma’s latest malware analysis uncovers Android/BankBot-YNRK, a next‑gen Android banking trojan actively targeting users across Southeast Asia via counterfeit clones of Indonesia’s official Identitas Kependudukan Digital app. The three APK samples share similarities in code structure and C2 patterns, with threat actors believed to be financially motivated and repackaging apps to conceal malicious functionality.

According to Cyfirma, the malware employs anti‑emulation checks, device fingerprinting, accessibility service abuse, and real‑time C2 communication for full device control, including environment detection to evade emulators by cross‑referencing manufacturer strings such as Huawei, Honor and OPPO with a hash map of popular models.

Once active, it uses Accessibility Services to gain privileged access, then can unlock the screen, simulate gestures, open banking apps, forward calls, and capture clipboard data to steal passwords or crypto keys; it also persists via JobScheduler every 30 seconds and registers as a Device Administrator app.

It can silence system sounds, maintains contact with a C2 server at ping.ynrkone[.]top:8181, and even disguises itself as the Google News app to avoid suspicion while running behind the scenes, with automated crypto wallet theft targeting MetaMask, Trust Wallet, Coin98, and Exodus.