Sturnus Android Banking Trojan Steals Credentials and Reads Encrypted Messaging Apps
Summary
Researchers describe Sturnus, an Android banking trojan that steals credentials, remotely controls devices, and reads messages from WhatsApp, Telegram, and Signal after decryption. Activity appears limited as operators test the malware.
Key points
- Sturnus uses fake banking-app overlays and Accessibility-based logging to capture credentials, PINs, passwords, and user activity.
- It reads WhatsApp, Telegram, and Signal content from the device screen after the apps decrypt messages, bypassing encryption at the endpoint.
- Remote-control features include screen streaming, UI-based actions, text injection, and black overlays to hide activity.
- The malware uses device administrator privileges to resist removal and monitors system activity, security settings, and signs of analysis.
- Researchers assess that activity is in an evaluation or limited-testing phase, with observed targeting focused on Southern and Central Europe.
- Its command-and-control communications use HTTP and WebSocket, with RSA key exchange and AES-encrypted messages.
- Reported C2 domains include amoled[.]multicoloredhdrsupport[.]xyz and walnut[.]almondcollections[.]com.
Article Details
- Attack Vectors
- Sturnus is delivered as an Android banking trojan; the article does not specify its initial distribution method.
- It displays HTML overlays that imitate targeted banking applications and forwards entered credentials to its C2.
- It uses Android Accessibility Service events and UI-tree collection to capture keystrokes, PINs, passwords, and activity in banking and messaging apps.
- It captures screen content after legitimate messaging apps decrypt it, allowing operators to view WhatsApp, Telegram, and Signal communications.
- It provides remote device control, including screen streaming, UI interaction, text injection, app management, and black-screen overlays.
- It abuses Android Device Administrator privileges to resist removal and interrupts attempts to revoke its administrator status.
- The malware communicates with its C2 over HTTP and WebSocket channels, including persistent WebSocket connections.
- Defensive Notes
- The article reports that Sturnus uses Device Administrator privileges to hinder uninstallation; manually revoking those privileges is identified as a prerequisite for removal.
- Monitor for suspicious Accessibility Service use, device-administrator activation, banking-app overlays, and unexpected remote-control activity.
- The article supplies two SHA-256 sample hashes and two C2 domains for investigation.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | amoled[.]multicoloredhdrsupport[.]xyz | C2 domain listed for the Sturnus sample with the preceding SHA-256 hash. |
| DOMAIN | walnut[.]almondcollections[.]com | C2 domain listed for the Sturnus sample with the preceding SHA-256 hash. |
| SHA256 | 045a15df1121ec2a6387ba15ae72f8e658c52af852405890d989623cf7f6b0e5 | SHA-256 hash listed for a Sturnus sample. |
| SHA256 | 0cf970d2ee94c44408ab6cbcaabfee468ac202346b9980f240c2feb9f6eb246d | SHA-256 hash listed for a Sturnus sample. |
MITRE ATT&CK
T1056.001 · KeyloggingSturnus uses Android Accessibility events to record text entered by the victim, including credentials.T1406The article reports that Sturnus uses code obfuscation as an evasion capability.T1411Sturnus displays HTML overlays imitating banking applications and captures submitted credentials.T1417.002Sturnus captures PINs and passwords through keylogging and Accessibility-based collection.T1430Sturnus collects screen and UI-tree content from messaging apps after messages have been decrypted on the device.T1512Sturnus captures device screen content using the display-capture framework and an Accessibility-based screenshot fallback.T1571 · Non-Standard PortSturnus communicates with its C2 over HTTP and WebSocket channels, including WebSocket traffic for VNC sessions.T1626.001Sturnus obtains Android Device Administrator privileges to hinder removal and remotely lock the device.T1636.003Sturnus monitors SMS-related data and includes commands to send, delete, and hide SMS messages.
Malware
SturnusMTI Security researchers have identified Sturnus, a privately operated Android banking trojan.Sturnus.ACurrent evidence indicates that Sturnus.A is still in an evaluation and tuning phase, with relatively few samples and short, intermittent campaigns rather than sustained large-scale activity.
Products
SignalBy capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal.TelegramBy capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal.WhatsAppBy capturing content directly from the device screen after decryption, Sturnus can monitor communications via WhatsApp, Telegram, and Signal.