What makes these Google Play distribution campaigns very difficult to detect from an automation (sandbox) and machine learning perspective is that dropper apps all have a very small malicious footprint. This small footprint is a (direct) consequence of the permission restrictions enforced by Google Play.

A good example is the modification introduced on November 13th, 2021 by Google, which limits the use of the Accessibility Services, which was abused by earlier dropper campaigns to automate and install apps without user consent.

This policing by Google has forced actors to find ways to significantly reduce the footprint of dropper apps. Besides improved malware code efforts, Google Play distribution campaigns are also more refined than previous campaigns. For example, by introducing carefully planned small malicious code updates over a longer period in Google Play, as well as sporting a dropper C2 backend to fully match the theme of the dropper app (for example a working Fitness website for a workout focused app).

To make themselves even more difficult to detect, the actors behind these dropper apps only manually activate the installation of the banking trojan on an infected device in case they desire more victims in a specific region of the world. This makes automated detection a much harder strategy to adopt by any organization.

VirusTotal does not showcase the evolution of detections of antivirus products over time, but almost all campaigns have or had a 0/62 FUD score on VirusTotal at some point in time, confirming the difficulty of detecting dropper apps with a minimal footprint.

Families and statistics

In the paragraphs below we outline the Modus Operandi (MO) of each of the families distributed recently via Google Play. Each of these families has its own banking apps target list, which can be found in the Appendix.

Anatsa campaign

During the research dedicated to the distribution techniques of different malware families, our analysts found numerous droppers located in Google Play, designed to distribute specifically the banking trojan Anatsa. Anatsa was discovered by ThreatFabric in January 2021.

Anatsa is a rather advanced Android banking trojan with RAT and semi-ATS capabilities. It can also perform classic overlay attacks in order to steal credentials, accessibility logging (capturing everything shown on the user’s screen), and keylogging. Previously ThreatFabric reported cases when Anatsa was distributed side-by-side with Cabassous in smishing campaigns all over Europe. Our latest findings show that Anatsa now utilizes Google Play dropper apps.

Thousands of victims

We discovered the first dropper in June 2021 masquerading as an app for scanning documents. In total, ThreatFabric analysts were able to identify 6 Anatsa droppers published in Google Play since June 2021.

These apps posed as QR code scanners, PDF scanners, and cryptocurrency apps. One dropper app was installed more than 50.000 times, with the combined total of installations of all droppers reaching more than 100.000 installations.

The process of infection with Anatsa looks like this: upon the start of installation from Google Play, the user is forced to update the app in order to continue using the app. In this moment, Anatsa payload is downloaded from the C2 server(s), and installed on the device of the unsuspecting victim.

Actors behind it took care of making their apps look legitimate and useful. There are large numbers of positive reviews for the apps. The number of installations and presence of reviews may convince Android users to install the app. Moreover, these apps indeed possess the claimed functionality, after installation they do operate normally and further convince victim in their legitimacy.

Despite the overwhelming number of installations, not every device that has these droppers installed will receive Anatsa, as the actors made efforts to target only regions of their interest. We will cover this and other technical details in the next section.

Technical details

All Anatsa droppers look similar code-wise. Upon the start of the app, a service is started to check if the “update” was installed. The dropper makes a request towards the C2 sending information about the device, including device ID, device name, locale, country, Android SDK version.

As mentioned previously, not every device will receive the “update”. At this point, the C2 backend decides whether to provide the Anatsa payload or not based on the device information. Depending on the C2 response, the dropper will decide whether or not to download Anatsa.

Such approach allows actors to target devices from specific regions and easily switch focus to another area. This behavior is in line with Anatsa moving from region to region, constantly updating its list of targeted financial institutions. Moreover, filtering allows cybercriminals to prevent the dropper from downloading the “update” during the evaluation process when publishing the app on Google Play.

Our analysts have identified Anatsa droppers that initially (in their first versions published on Google Play) had no malicious functionality, but modified their behavior in later versions, adding the dropping functionality, and a wider set of permissions required.

When all conditions are met and the payload is ready, the user will be prompted to download and install it.

After successfully downloading the “update”, the user will be asked for the permission to install apps from unknown sources. The user, previously convinced that the update is necessary for the app to work properly, grants the permission. After the installation is complete, Anatsa is running on the device and immediately asks the victim to grant Accessibility Service privileges.

After enabling Accessibility Service, Anatsa has full control over the device and can perform actions on the victim’s behalf. At the same time, the dropper app is also running and operating as a legitimate app, the victim will probably remain unsuspecting.

Hydra and Ermac campaign

Brunhilda : The return of the Valkyrie

ThreatFabric identified multiple instances of malware dropped by the Brunhilda threat actor group, and in line with previous campaigns, it constituted of trojanized apps. Brunhilda was observed dropping different malware families.

In the first case, we observed Brunhilda posing as a QR code creator app, Brunhilda dropped samples from established families, like Hydra, as well as novel ones, like Ermac.

The apps dropped by this Brunhilda campaign do not differ in functioning too much from the previous versions we have observed during 2021. As it did in the previous iterations, Brunhilda sends a registration request to its C2 using the gRPC protocol. Upon successful registration, and after communicating more detailed information about the device, the dropper is instructed by the C2 to download and install the payload package.

Both families have been very active in the last months, even adventuring to markets that were previously untapped, like the United States. This new wave of malware, which started in August 2021, includes also other families like Gustuff and Anatsa.

Alien campaign

As mentioned before, ThreatFabric observed Brunhilda serving different malware families. Some samples were observed having more than 50.000+ installations, and dropping the android trojan Alien.

Also in this case, as it happened with the deployment of Vultur, these aps reached thousands of downloads before being taken down from the store. The samples were very successful in their operation, with samples ranging from 5.000+ downloads to the impressive values of 50.000+ downloads. With these numbers in mind, it is fair to say that this dropper family was likely able to infect hundreds of thousands of victims during its operation.

Gymdrop : a Gym you do not want to visit

In November 2021 ThreatFabric analysts discovered yet another dropper in Google Play. It had 10.000+ installations and masquerades as an app for self-training.

This dropper, that we dubbed “Gymdrop”, is another example of how cybercriminals try to convince victims and detection systems that their app is legitimate. The app website is designed to look legitimate at first glance. However, it is only a template for a gym website with no useful information on it, even still containing ‘Lorem Ipsum’ placeholder text in its pages.

The developer website also serves as C2 for Gymdrop. Just like previously observed, this dropper tried to convince victims to install a fake update. However, in this case, it is done in a more inventive way: the payload is posed as a new package of workout exercises in conformity with the app. After the user clicks “OK”, the dropper will request the permissions needed.

Shortly after the dropper gets its configuration from the C2. The configuration file contains the link to download the payload. Moreover, the configuration contains filter rules based on device model. Based on the models being filtered out and the code of the dropper, we can draw a conclusion that this is done to avoid downloading the payload on emulators or research environment.

If all conditions are met, the payload will be downloaded and installed. This dropper also does not request Accessibility Service privileges, it just requests permission to install packages, spiced with the promise to install new workout exercises - to entice the user to grant this permission. When installed, the payload is launched. Our threat intelligence shows that at the moment this dropper is used to distribute Alien banking trojan.

While writing this blog post, Gymdrop was updated (a new version was uploaded to Google Play). However, the configuration file was not found on C2. It could probably be done to not serve the payload to pass security checks performed by Google before publishing the update on Google Play.

2 dropper APPS to boost botnet-building

It is worth mentioning that the Alien samples of this campaign connect to the same C2 as samples from previously described campaign powered by Brunhilda dropper.

This leads us to the conclusion that the actor(s) behind these Alien campaigns use at least 2 different dropper services in their distribution strategy.

Conclusion

In the span of only 4 months, 4 large Android families were spread via Google Play, resulting in 300.000+ infections via multiple dropper apps.

A noticeable trend in the new dropper campaigns is that actors are focusing on loaders with a reduced malicious footprint in Google Play, considerably increasing the difficulties in detecting them with automation and machine learning techniques.

The small malicious footprint is a result of the new Google Play restrictions (current and planned) to put limitations on the use of privacy concerning app permissions. Permissions such as Accessibility Service, which in previous campaigns was one of the core tactics abused to automate the installation process of Android banking trojans via dropper apps in Google Play.

By limiting the use of these permissions, actors were forced to choose the more conventional way of installing apps, which is by asking the installation permission, with the side-effect of blending in more with legitimate apps. This is one of the core reasons of the significant success of mobile banking threat actors in sneaking into Google’s trusted app store.

A second big factor behind their success is that actors have set restrictions, with mechanisms to ensure that the payload is installed only on the victim’s device and not on testing environments. To achieve this, criminals use a multitude of techniques, which range from location checks to incremental malicious updates, passing by time-based de-obfuscation and server-side emulation checks.

This incredible attention dedicated to evading unwanted attention renders automated malware detection less reliable. This consideration is confirmed by the very low overall VirusTotal score of the 9 number of droppers we have investigated in this blogpost.

How we help our customers

ThreatFabric makes it easier than it has ever been to run a secure mobile payments business. With the most advanced threat intelligence for mobile banking, financial institutions can build a risk-based mobile security strategy and use this unique knowledge to detect fraud-by-malware on the mobile devices of customers in real-time.

Together with our customers and partners, we are building an easy-to-access information system to tackle the ever-growing threat of mobile malware targeting the financial sector. We especially like to thank the Cyber Defence Alliance (CDA) for collaborating and proactively sharing knowledge and information across the financial sector to fight cyber-threats.

ThreatFabric has partnerships with TIPs all over the world.

If you want to request a free trial of our MTI-feed, or want to test our own MTI portal for 30 days, feel free to contact us at: sales@threatfabric.com

If you want more information on how we detect mobile malware on mobile devices, you can directly contact us at: info@threatfabric.com

Appendix: IOC

Brunhilda Dropper Samples

Brunhilda Dropper C2 URL

Anatsa Dropper Samples

Anatsa Dropper C2 URL

Gymdrop Dropper Samples

Gymdrop Dropper C2 URL

Malware Samples dropped

Appendix: Targeted apps

Alien.A Targets

Ermac.A Targets

Anatsa.A Targets

Hydra.C Targets