Andromeda

Capabilities

Andromeda is a malware family that is under development, as some of its features are a work in progress. The malware development shows a clear direction, and it would not be surprising if, in a few weeks or months, it would resurface with additional features and a refined code base.

SMS control / Overlay

Like many other banking malware families, Andromeda features the capability to perform overlay attacks and monitor SMS messages received and sent by the victim. This combination allows criminals to obtain important PIIs, such as web banking or Pix credentials, One-Time Password (OTP) codes, and much more.

At the time of analysis, no overlay was available, confirming once again the testing nature of this malware. Considering the application name, which is consistently some variation of "Modulo de Segurança", translated to "security module" in Portuguese, it is likely that the area of interest of this new malware is going to be Brazil-focused.

It is clear that criminals are testing new features by abusing the overlay mechanism. In these test samples, they defined three specific setups of Layout Parameters for the overlays used by Andromeda. We will discuss the first two, while the third one allows criminals to create overlays that support the introduction of a keyboard:

this.params_no_touchable = new WindowManager.LayoutParams(-1, -1, 0x7F0, 0x2003B8, -3);

this.params_touchable = new WindowManager.LayoutParams(-1, -1, 0x7F0, 0x2003A8, -3);

It is interesting to analyse each value of the LayoutParams to understand what is the meaning of these two objects:

• -1, -1: These are the width and height parameters of the layout, respectively. -1 corresponds to MATCH_PARENT in Android, which means the layout will match the width and height of its parent layout.
• x7F0: This is the type field of the layout parameters, which tells Android what kind of window this is. 0x7F0 corresponds to TYPE_ACCESSIBILITY_OVERLAY. This window type is used by accessibility services to draw overlays on the screen.
• The third parameter is used to set specific flags. Here are the values of the flags:
  • FLAG_NOT_FOCUSABLE: The window will not take focus or take it away from another window.
  • FLAG_NOT_TOUCH_MODAL: The system will send touch events to the window behind this one if it is not directly targeted by the touch event.
  • FLAG_KEEP_SCREEN_ON: The screen should remain on while the window is visible.
  • FLAG_LAYOUT_IN_SCREEN: The window should be laid out in such a way as to fit the entire screen, ignoring any constraints from the parent window.
  • FLAG_LAYOUT_NO_LIMITS: The window can extend beyond the screen limits.
  • FLAG_SECURE: The content of this window can't be captured or copied through normal means, such as screenshots.
  • FLAG_NOT_TOUCHABLE: This is the only flag that is different between the two setups, and it stops the window from receiving touch events.
• -3: This is the format parameter, which represents the pixel format. -3 corresponds to PixelFormat.TRANSLUCENT, meaning the window will be translucent, and the content behind it can be seen.

This creates an overlay that does not take focus but takes the whole screen. The option to be "not touchable" allows the criminal to stop the user from interacting with the device, effectively blocking them out.

In addition, there is some experimentation in the source code of Andromeda, which was present only in the more recent samples. If we explore one of the classes named transparentX (with X being a number between 1 and 8), we will see the following screen:

In the screenshot above is a specific layout file, present in the assets in the .bal format, which is a binary file used to save layouts in B4A. The criminals are experimenting with partial overlays, which are based on the class name and might become transparent and displayed on top of other activities of the application.

Andromeda aims at creating an overlay, which could be fully transparent or display some specific URL, together with an additional transparent partial overlay that can be used to hide partial areas of the screen, potentially track inputs where it is positioned, as well as blocking access and touches to such areas.

WebRTC Powered Remote Access

The other main feature of Andromeda is the capability of creating Remote Access sessions to the infected device. This enables criminals to perform Device Take-Over attacks, which are demonstrated to be much harder to detect by Fraud Scoring engines.

The implementation of such sessions is done using a Janus WebRTC server to handle all the communication between the infected device and the C2 server. This choice is unique, as very few malware families have chosen this service to implement their media and data streaming.

Once again, we want to be sure to highlight that the Janus WebRTC project is a completely legitimate product, and the developers who created this project have no control over the misuse of their software.

The Bot communicates with the server using RESTful API using the following endpoints called with the URL format restapi?decision=<cmd>:

The malware then can perform touches, press buttons, and in general interact with the device's UI using traditional Accessibility Services Actions, triggered by the commands received from the server.

The commands are received over WebSocket communication. Here is the list retrieved from the latest sample:

It is interesting how actors pay attention to the quality and encoding types used in the WebRTC media streaming, probably to introduce control that could allow them to run the malware on multiple types of devices, as well as connections.

All the code responsible for the remote actions is contained in the class "nw.compass.older". The code used in this class has many connections to the library used by AmexTroll to perform Accessibility actions, even though it adds some functions while missing some others. It is likely that the creators of both families started from the same library, and added the code necessary for their needs.

Possible Attribution

The malware itself is quite interesting, and could potentially be distributed in the future, once it leaves the test phase, to perform DTO fraud in Brazil.

Initially, as we mentioned, we thought that these samples might have been connected with AmexTroll, due to the use of the same exact image as the icon and some similarities in the code base. However, after confirming that there was not enough code shared among the two families, what really sparked our interest was something else.

Here is a brief list of the package names of the discovered samples:

The abundance of the "new" keyword makes it hard to miss, as we mentioned before, Andromeda is a product under development. However, something else caught our attention, the different package names all contain variations around the word "sicko". This is important, as Sicko (aka SickoDevz) is known to be a criminal developer or group active in Brazil, and more specifically the author developing and distributing the GoatRAT malware family.

Currently, GoatRAT, which goes also by the name FantasyMW or CriminalBot, is quite active,  and targets multiple financial institutions in Brazil.

The package name alone is not definitive proof of the connection between the authors of these two malware families. ThreatFabric suspects that Andromeda is likely to be the latest project of this actor. In addition to the package name, and the area of origin of the malware author, another clue comes from samples ThreatFabric identified, as belonging to the GoatRAT family.

Older samples, which are currently not circulating anymore, presented implementations of Janus Servers to support the WebRTC streaming services, including TextRooms plugins for text exchange between the host and the remote server, and the Streaming plugin for the media streaming. Considering that Janus is a relatively rare option for such services in malware, it strengthens the connection between the development of GoatRAT and the development of Andromeda.

It is worth noting that the Janus experiment for GoatRAT ran from February to March 2023, which is incidentally the month in which the first sample of Andromeda appeared.

One of the online shops connected to the GoatRAT family mentions SickoDevz (the name also present in the package name of the GoatRAT samples using Janus), hinting at the possibility of this being a group of more than a single person. This could also mean that Andromeda is the latest project of one member of SickoDevz, testing out B4A, which we discussed is a platform that is quite popular and successful amongst Brazilian criminals.

For the time being, due to the limited amount of samples connected to the Andromeda family, and the testing nature of such samples, t is possible only to find traces of this possible link. ThreatFabric will continue its monitoring to confirm these theories. 

Conclusions

Andromeda is one of the latest examples of Android Banking malware active in Brazil. It is an in-development piece of software, which features the necessary capabilities to exfiltrate PII from victims and perform fraudulent transactions.

It lacks some of the refined options that are present in other malware families, but this will be very likely addressed in the following variants that will appear in the near future. ThreatFabric identified 3 major versions of the malware appearing within just a few weeks of each other, suggesting a current development activity from the criminals behind it. If, as we suspect, this is the work of the SickoDevz group, there is likely no hurry in the development, due to the existence of GoatRAT/FantasyMW/CriminalBot as the currently used Banker.

We suspect that Andromeda will likely receive additional features, present in other malware families developed with B4A like AmexTroll, thanks to the extensive code sharing present among Brazilian criminals.

ThreatFabric will continue closely tracking Andromeda and its potential new developments.

Fraud Risk Suite

ThreatFabric’s Fraud Risk Suite enables safe and frictionless online customer journeys by integrating industry-leading mobile threat intel, behavioural analytics, advanced device fingerprinting, and over 10.000 adaptive fraud indicators. This will give you and your customers peace of mind in an age of ever-changing fraud.

Appendix

Andromeda Samples

Andromeda C2