Crocodilus Android Banking Trojan Steals Credentials, OTPs and Crypto Wallet Seed Phrases
Summary
ThreatFabric analyzes Crocodilus, an Android banking Trojan that uses Accessibility features, overlays and remote control to steal credentials, OTPs and crypto wallet seed phrases. Early campaigns targeted Spain and Turkey.
Key points
- ThreatFabric says Crocodilus is installed through a proprietary dropper that bypasses Android 13+ restrictions, then requests Accessibility Service access.
- The malware monitors targeted apps and uses overlays to intercept credentials; its Accessibility Logger captures on-screen text and other Accessibility events.
- A specific RAT command captures Google Authenticator screen content, including OTP names and values, and sends it to the command-and-control server.
- Crocodilus can remotely control devices while masking activity with a black screen overlay and muted sound.
- A wallet overlay urges victims to back up their seed phrase, which the malware can then harvest through Accessibility logging.
- Early campaigns targeted users in Spain and Turkey and several cryptocurrency wallets; ThreatFabric says the scope may expand.
- ThreatFabric notes a possible link to the actor “sybra” based on the “sybupdate” tag, but says the link is uncertain; the report describes the developer(s) as apparently Turkish-speaking.
Article Details
- Attack Vectors
- Crocodilus is installed through a proprietary dropper that bypasses Android 13+ restrictions.
- After installation, it requests Android Accessibility Service access and monitors Accessibility events to capture screen text and credentials.
- The malware displays overlays targeting applications, including cryptocurrency wallets, and tricks victims into navigating to wallet seed phrases.
- Crocodilus uses remote-control capabilities and a black-screen overlay to hide activity while operators perform actions on an infected device.
- Defensive Notes
- ThreatFabric recommends that financial institutions use layered security, including thorough device and behaviour-based risk analysis on customers’ devices, rather than relying on basic signature-based detection alone.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | register-buzzy[.]store | C2 domain listed for Crocodilus. |
| SHA256 | c5e3edafdfda1ca0f0554802bbe32a8b09e8cc48161ed275b8fec6d74208171f | SHA-256 hash listed for the Crocodilus app sample. |
MITRE ATT&CK
T1411The malware captures the displayed Google Authenticator OTP code and sends it to its C2.T1437Crocodilus receives instructions from a C2 server and supports remote-control sessions.T1456Crocodilus uses overlays targeting applications to intercept credentials.T1517Crocodilus monitors Accessibility events and captures text displayed on the device, including OTP codes and wallet seed phrases.T1616The command list includes enabling call forwarding.T1624The malware monitors application launches and displays overlays for targeted applications.T1626Crocodilus requests Accessibility Service access and includes a command to request Device Admin privileges.T1628Crocodilus displays a black overlay to conceal its remote activity from the victim.T1629.001Crocodilus can mute the infected device to keep its activity unnoticed.T1636.001Crocodilus can capture text entered in focused fields and displayed on screen.T1636.002The malware can retrieve the device's contact list.T1636.003The malware can retrieve SMS messages from the infected device.T1636.004Crocodilus can send SMS to a specified number, all contacts, or specified numbers in bulk.T1636.005A RAT command captures images from the device's front camera.
Threat Actors
Malware
Anatsathreat landscape has been shaped over the years by well-established banking Trojan families such as Anatsa, Octo, Hook, each evolving to introduce new techniques for evading detection and maximising financialCrocodilusThis environment has paved the way for the emergence of Crocodilus, a new and highly capable mobile banking Trojan discovered by ThreatFabric.Hooklandscape has been shaped over the years by well-established banking Trojan families such as Anatsa, Octo, Hook, each evolving to introduce new techniques for evading detection and maximising financial gain.MetaDroidactor in mobile threat landscape, “sybra”, that we already observed operating one of the Ermac forks, "MetaDroid", as well as using Hook and Octo mobile malware.Octolandscape has been shaped over the years by well-established banking Trojan families such as Anatsa, Octo, Hook, each evolving to introduce new techniques for evading detection and maximising financial gain.
Products
AndroidThese malware strains have demonstrated how effective mobile-focused threats can be, particularly when equipped with capabilities like overlay attacks, keylogging, and abuse of Android’s Accessibility Services.Google AuthenticatorRAT command “TG32XAZADG” triggers a screen capture on the content of the Google Authenticator application, and this too is done using the aformentioned Accessibility Logging capabilities.
Countries
SpainInitial campaigns observed by our Mobile Threat Intelligence team show targets primarily in Spain and Turkey, along with several cryptocurrency wallets.TurkeyInitial campaigns observed by our Mobile Threat Intelligence team show targets primarily in Spain and Turkey, along with several cryptocurrency wallets.
Industries
BankingThe mobile threat landscape has been shaped over the years by well-established banking Trojan families such as Anatsa, Octo, Hook, each evolving to introduce new techniques for evading detection and maximising financialCryptocurrencyInitial campaigns observed by our Mobile Threat Intelligence team show targets primarily in Spain and Turkey, along with several cryptocurrency wallets.