Crocodilus Android Banking Trojan Expands Campaigns and Adds Seed-Phrase Theft
Summary
Threat Fabric reports Crocodilus campaigns targeting users across Europe and South America, distributed in part through malicious ads. A new variant improves obfuscation, adds contacts to infected devices, and extracts cryptocurrency wallet seed phrases and private keys
Key points
- Crocodilus campaigns have expanded beyond Turkey to European countries and South America, with target apps also spanning the US, Indonesia, and India.
- A campaign targeting Polish users promoted fake bank and e-commerce apps through Facebook ads; downloads led to a dropper capable of bypassing Android 13+ restrictions.
- Campaigns in Turkey and Spain disguised the malware as an online casino and a browser update, respectively; the malware overlays Turkish financial apps with fake login pages.
- The dropper and payload use code packing, additional XOR encryption, and convoluted code to hinder analysis and detection.
- A new command lets Crocodilus add a specified contact to an infected device; the researchers believe this could support social engineering by making attacker calls appear to come from bank support.
- An added parser uses accessibility-logged screen data and regular expressions to extract seed phrases and private keys from targeted cryptocurrency wallet apps.
- The report lists C2 domains rentvillcr[.]homes and rentvillcr[.]online.
Article Details
- Attack Vectors
- Malicious Facebook Ads promoted apps as bonus-point offers and redirected users to sites delivering the Crocodilus dropper.
- Crocodilus was distributed disguised as an online casino or browser update, and campaigns targeted banking and cryptocurrency apps.
- The malware used fake login overlays on Turkish financial apps and extracted cryptocurrency seed phrases and private keys from on-screen data.
- Defensive Notes
- The article advises organizations and users to remain vigilant and adopt proactive security measures, but does not specify particular controls.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | rentvillcr[.]homes | C2 domain listed in the Crocodilus indicators. |
| DOMAIN | rentvillcr[.]online | C2 domain listed in the Crocodilus indicators. |
| SHA256 | 6d55d90d021b0980528f56d040e78fa7b85a96f5c244e23f330f24c8e80c1cb2 | SHA-256 hash listed for an app associated with Crocodilus. |
| SHA256 | fb046b7d0e385ba7ad15b766086cd48b4b099e612d8dd0a460da2385dd31e09e | SHA-256 hash listed for an app associated with Crocodilus. |
MITRE ATT&CK
Malware
Products
Countries
ArgentinaIn addition to these targeted efforts, MTI has also observed smaller campaigns with very "global" target lists, involving apps from Argentina, Brazil, Spain, the US, Indonesia, and India.BrazilIn addition to these targeted efforts, MTI has also observed smaller campaigns with very "global" target lists, involving apps from Argentina, Brazil, Spain, the US, Indonesia, and India.IndiaIn addition to these targeted efforts, MTI has also observed smaller campaigns with very "global" target lists, involving apps from Argentina, Brazil, Spain, the US, Indonesia, and India.IndonesiaIn addition to these targeted efforts, MTI has also observed smaller campaigns with very "global" target lists, involving apps from Argentina, Brazil, Spain, the US, Indonesia, and India.PolandOne notable campaign that caught our analysts' attention was targeting users in Poland.SpainIn addition to these targeted efforts, MTI has also observed smaller campaigns with very "global" target lists, involving apps from Argentina, Brazil, Spain, the US, Indonesia, and India.TurkeyInitial Crocodilus samples showed evidence of operations in Europe, although early campaigns largely targeted Turkey.United StatesIn addition to these targeted efforts, MTI has also observed smaller campaigns with very "global" target lists, involving apps from Argentina, Brazil, Spain, the US, Indonesia, and India.