Introduction

In early December 2020 ThreatFabric discovered Cabassous, which was later renamed by PRODAFT to FluBot. This is a classic Android bot, equipped with credential stealing capabilities such as the use of overlays (fake login screens) for crypto-currency wallet apps and Android banking apps. Besides harvesting credentials, the bot also gathers all contact information (phone numbers) from a victim’s device to spread itself using SMS messages (smishing).

Another banking trojan named Anatsa was discovered by ThreatFabric analysts in January 2021. It should be considered a stronger threat compared to Cabassous, due to its more extensive and advanced set of features. Anatsa’s functionalities include the classic credential-stealing overlay attacks, which are first downloaded and stored on the device, and then launched locally. Other features include keylogging, contact information and device information exfiltration, and accessibility logging. This last feature is very advanced and very dangerous for victims. It grants information to the malicious actors about everything displayed in the device’s screen, allowing the bot to interact with the UI elements and record all the information that is displayed in them. We also covered this threat in our latest blog.

Anatsa has been relatively quiet in the first months of the year, but it has recently increased its activity now including Dutch banks in its target list.

With this threat update we want to inform the users about a new SMS phishing campaign we spotted in the Netherlands masquerading as UPS apps and distributing both Cabassous and Anatsa.

Previous campaigns

On April 18th, Cabassous began to use multiple DGA seeds in every sample allowing it to be more scalable: the Trojan generates corresponding C2 server address to receive the overlay target list specific for the victim’s country. This means that every botnet can have its own overlay specific to country of the targeted banking and wallet apps.

As reported by ThreatFabric, enormous SMS phishing campaigns reported by major telecom operators have been observed in multiple new targeted countries, including the UK, Norway, Sweden, Finland, Denmark, Netherlands, and Japan. This also matches with the current smishing campaign reported in the UK masquerading as UPS and DHL apps.

Usually, the SMS contains some link that claims to provide the information about your parcel from DHL or UPS. The link leads to the page with a localized text corresponding to the region defined by the victim’s IP location. The text contains instructions to download and install an application, which is the Cabassous Trojan itself.

Latest developments

On May 5th, ThreatFabric analysts spotted a new smishing campaign in the Netherlands masquerading as UPS apps. That is a common MO for Cabassous that has been described above.

However, besides Cabassous, ThreatFabric analysts were able to obtain the Anatsa Trojan from the same links. That means that at the moment of writing this blog, Anatsa and Cabassous are distributed side-by-side in the Netherlands both masquerading as UPS apps. Nevertheless, there is no solid proof that the actor(s) behind these families are the same.

At the moment of writing Cabassous does not target any application of Netherlands banks, the C2 responsible for the campaign targeting Norway, Sweden, Finland, Denmark, Netherlands and Poland only serves the target list for banking apps in Poland. Anatsa however does have the banking apps from the Netherlands in its target list. The following images are examples of overlays used for the Dutch banks:

The full lists of targeted applications used by Anatsa and Cabassous can be found in the Appendix.

The danger of Anatsa

When comparing Cabassous with Anatsa, the more dangerous of the two appears to be Anatsa due to its RAT capability. The Trojan can receive a command called “start_client” from the C2 and initiate a connection to a specified IP and port. This connection is used to send and receive data that enables actor(s) to do the following:

• Observe the screen of the victim’s device on a real-time basis
• Perform clicks and actions on behalf of the victim
• Open applications (like banking application or web-browser)
• Manipulate text input

This capability leads to another type of fraud - so called on-device fraud, when actor(s) perform the actual fraud from the device of the victim. The following code snippet represents the actor(s) ability to manipulate text input:

while (counter < numberOfActions) {
    int leftBound = byteBuffer.getShort();
    int bottomBound = byteBuffer.getShort();
    byteBuffer.getShort();
    byteBuffer.getShort();
    int length = byteBuffer.getShort();
    byte[] textBytes = new byte[length];
    byteBuffer.get(textBytes, 0, length);
    String setText = new String(textBytes, StandardCharsets.UTF_8);
    AccessibilityNodeInfo rootNodeInfo = MainAccessibilityService.service.getRootInActiveWindow();
    if (rootNodeInfo != null) {
        for (Object editTextNode: Utils.getAllNodes(rootNodeInfo, "EditText")) {
            AccessibilityNodeInfo accNodeInfo = (AccessibilityNodeInfo) editTextNode;
            Rect v9_1 = new Rect();
            accNodeInfo.getBoundsInScreen(v9_1);
            if (v9_1.left != leftBound || v9_1.bottom != bottomBound) { 
// check position                continue;
            }
            Bundle bundle = new Bundle();
            bundle.putString("ACTION_ARGUMENT_SET_TEXT_CHARSEQUENCE", setText);
            accNodeInfo.performAction(0x200000, bundle);
        }
    }
    ++counter;
}

Bot commands

The Anatsa bot supports the following commands:

Getting rid of the malware

In general, we recommend doing a factory reset when your device is infected with malware. This will put the device back to the state it was in when it was first turned on. For Anatsa and Cabassous it is also enough to uninstall the malware apps from the device (through the Android Settings menu), assuming you know which app is the malware (in this campaign the app name “UPS” is used).

Because both malware variants prevent removing the app through the Android Settings menu, you will have to boot the phone into safe mode (preventing the malware from running) to be able to uninstall the app. Another option, for tech-savvy users, is to use ADB (Android Debug Bridge) to connect to the device via USB and run the command adb uninstall <malware_package_name>.

Anatsa makes it even more difficult to remove it, because in addition to preventing the app to be uninstalled through the Android Settings, it also prevents rebooting or shutting down the device (required for safe mode). If you can’t use ADB, the easiest option is to simply wait until the device turns off because it runs out of power (optionally in the meantime turning off Wi-Fi and data connections to stop the RAT from communicating with its C2) and then boot into safe mode and perform the actions described above.

Client Side Detection

ThreatFabric CSD can be used to detect customers infected with such threats in real-time, therefore avoiding fraud and keeping the risk under control.

Appendix

Cabassous

One of the latest Cabassous samples found in the wild:

The list of targeted applications contains 30 applications:

Anatsa

One of the latest Anatsa samples found in the wild:

The list of targeted applications contains 39 applications: