Date: 10/26/2026
Severity: Critical
Summary
Hirudo is an Android banking remote access trojan (RAT) that steals banking credentials and allows attackers to control infected devices remotely. It spreads through shopping and entertainment apps that trick users into installing the malware through fake update prompts. The trojan replaces legitimate banking apps with modified versions that bypass security checks and use a hooking engine to capture sensitive information. The campaign targets eight Indonesian banking apps across seven banks, with infections reported in Indonesia, China, India, Mexico, Morocco, Thailand, and Malaysia. Backend data from August 2026 revealed thousands of stolen credentials and device records, while no related CVE or official security patch has been reported.
Indicators of Compromise (IOC) List
Domains/URLs | jiekou.baojingtextile.cn www.helloharmonyos.com http://43.225.157.157:8766/request_token |
IP Address | 134.122.153.136 134.122.153.68 134.122.153.92 43.225.157.157 |
Hash | 3ccd2c02cf0661613816ca30032b4cdd
3b14859a3a1219515f89ff453c7031f3dc8a95d7
0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7
2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b
425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83
b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99
d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d
f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "www.helloharmonyos.com" or url like "www.helloharmonyos.com" or siteurl like "www.helloharmonyos.com" or domainname like "jiekou.baojingtextile.cn" or url like "jiekou.baojingtextile.cn" or siteurl like "jiekou.baojingtextile.cn" or domainname like "http://43.225.157.157:8766/request_token" or url like "http://43.225.157.157:8766/request_token" or siteurl like "http://43.225.157.157:8766/request_token" |
Detection Query 2 : | dstipaddress IN ("134.122.153.92","134.122.153.136","43.225.157.157","134.122.153.68") or srcipaddress IN ("134.122.153.92","134.122.153.136","43.225.157.157","134.122.153.68") |
Detection Query 3 : | md5hash IN ("3ccd2c02cf0661613816ca30032b4cdd")
|
Detection Query 4 : | sha1hash IN ("3b14859a3a1219515f89ff453c7031f3dc8a95d7")
|
Detection Query 5 : | sha256hash IN ("425cd7072b5e9386ac94e97fe272980b6ef36240df6b5d77b371ab7378004c83","b2270c29b3d0a49a716730d6ef108cffec0b1a4b159dd02e93333fb85e492b99","d51f2bd7ffb49c224d8eaec2c8ca1c8ab9fce2fd5fdceea01eb54296c2f47b4d","2e45277acfde3fb704179476b08f428f66a03670bbdbf2e8ec79c0b0333c009b","f796eb9ecf516e4f1fafcf89200d9f7d8ddd234f705e63f1bc8fc3ef583f0248","0097a0406be20544e98e981075427f40789db40fe4a53b1b4523383a945328b7")
|
Reference:
Hirudo: From Fake Updates to Patched Banking Apps