Money Doesn't Stink - Cybercriminal Business Insight of A New Android Botnet
summary
Researchers execute an HD bot inside a lab, intercept bidirectional traffic and reconstruct a separate Android botnet (called Geost/Girls) that exfiltrates SMS and account balances to a C2 panel; analysis finds roughly 1 million victims, about 700 SMS per victim per year, 17 related IPs, five impacted banks, and dozens of fake APKs (no exploits, emulator-detection, social‑engineering installs). Pivoting into a leaked chat log 6,000 lines reveals roles, traffic/installation services, click/SMS premium monetization and money‑exchange laundering workflows.
AI-written summary · about
chapters (28)
- 0:00Introduction
- 1:32Taggers
- 2:10Botnet
- 3:48Analyzing the Traffic
- 5:18Access to the Control Panel
- 8:29Infrastructure
- 9:48Fake Applications
- 11:16Victims
- 13:12Phones
- 15:13Chat Log
- 17:10Slang
- 17:30Russian slang
- 18:58Social research
- 19:36Puppeteer
- 19:52PowerFire
- 20:42Murex
- 23:26Domains blocked
- 24:35Conversation patterns
- 25:13The third person
- 26:31The second person
- 28:06Conversations
- 29:05disloyaltv
- 30:07alcohol
- 30:48money exchangers
- 36:03final thoughts
- 38:11year of the walk
- 39:56questions
- 40:58traffic buying
related talks
33mSMS PVA Services Fueled by Compromised Supply-Chain Mobile Botnets
49mThe State Of Malware From The Eye Of The Tiger
44mBehind the Scenes: How Criminal Enterprises Pre-infect Millions of Mobile Devices
24mAll Your Money Belongs to Us (Me)
31mFlubot - Pandemic in Our Pockets
37mYour Phone is Not Your Phone: A Dive Into SMS PVA Fraud
26mTracking the World's Dumbest Cyber Mercenaries
42mIf 6,000 Mobile Malware Applications Could Talk! Ow, They Do, And A Lot!