Anatsa Android Trojan Targets Victims in the US and Europe

A recent Android malware campaign has been identified, aiming to distribute the Anatsa banking trojan and target customers of financial institutions in the United States, United Kingdom, Germany, Austria, and Switzerland since March 2023.

According to ThreatFabric, the group behind Anatsa intends to steal login credentials used in mobile banking apps and engage in Device-Takeover Fraud (DTO) to carry out fraudulent transactions. The cybersecurity company mentioned that dropper apps infected with Anatsa, which were found on the Google Play Store, have already amassed over 30,000 installations. This indicates that the official app store has become an effective means of distributing the malware.

Anatsa, also known as TeaBot and Toddler, initially emerged in early 2021 and has been observed disguising itself as harmless utility apps like PDF readers, QR code scanners, and two-factor authentication (2FA) apps on the Google Play Store to extract users' credentials. It has since become one of the most widespread banking trojans, targeting more than 400 financial institutions worldwide.

The trojan possesses backdoor-like capabilities to extract data and utilizes overlay attacks to steal credentials and record user activities by exploiting Android's accessibility services API. Moreover, it can bypass existing fraud control measures to execute unauthorized fund transfers.

ThreatFabric pointed out that detecting Anatsa has proven challenging for banking anti-fraud systems since the fraudulent transactions are initiated from the same device regularly used by the targeted bank customers.

Anatsa's Mode of Operation

In the recent campaign observed by ThreatFabric, the dropper app, once installed, sends a request to a GitHub page that redirects to another GitHub URL hosting the malicious payload. The goal is to deceive victims by presenting themselves as app add-ons. It is suspected that users are directed to these apps through suspicious advertisements.

A notable characteristic of the dropper is its exploitation of the restricted "REQUEST_INSTALL_PACKAGES" permission, which has been repeatedly abused by malicious apps distributed through the Google Play Store to install additional malware on infected devices. The names of the five dropper apps used in this campaign are as follows:

• All Document Reader & Editor (com.mikijaki.documents.pdfreader.xlsx.csv.ppt.docs)
• All Document Reader and Viewer (com.muchlensoka.pdfcreator)
• PDF Reader - Edit & View PDF (lsstudio.pdfreader.powerfultool.allinonepdf.goodpdftools)
• PDF Reader & Editor (com.proderstarler.pdfsignature)
• PDF Reader & Editor (moh.filemanagerrespdf)

All of these dropper apps have been updated after their initial release, likely as an attempt to stealthily introduce malicious functionality after successfully passing the app review process during the first submission.

The countries of significant interest to Anatsa, based on the number of targeted financial applications, include the United States, Italy, Germany, United Kingdom, France, United Arab Emirates, Switzerland, South Korea, Australia, and Sweden. Finland, Singapore, and Spain are also mentioned in the list of targeted countries.