Rocinante Android Banker Malware Targets Brazilian Banks with Keylogging and Remote Control
Summary
ThreatFabric researchers describe Rocinante, an Android banking trojan targeting Brazilian institutions. Distributed through phishing sites, it uses Accessibility Services for keylogging and remote actions, while phishing screens steal financial data.
Key points
- Rocinante targets customers of Brazilian banks and payment services, including Bradesco, Itaú, Banco do Brasil, Caixa, Santander, PicPay and Mercado Pago.
- Phishing websites distribute malicious APKs posing as security updates, courier or rewards apps, and banking apps.
- After users grant Accessibility Service access, the malware logs on-screen activity and displays bank-specific phishing pages to collect personal and financial information.
- It uses Firebase messaging, HTTP, WebSocket connections and Telegram bots to register infected devices, receive commands, and exfiltrate data.
- Remote commands can simulate touches and swipes and modify text fields, enabling attackers to navigate device screens and attempt fraudulent transactions.
- Researchers report that older versions incorporated code from leaked Ermac/Hook sources; newer versions changed or removed some of that code. They could not establish whether versions were separate project forks.
- ThreatFabric says the malware has been observed in the wild and remains under active development; the article provides sample hashes and package names.
Article Details
- Attack Vectors
- Phishing websites trick users into installing malicious APKs disguised as security updates, courier applications, rewards applications, or banking applications.
- Rocinante presents bank-specific phishing screens to collect victims' personally identifiable and financial information.
- After Accessibility Service privileges are granted, Rocinante logs device UI events and can simulate touches and gestures or modify text fields to navigate the device and authorize fraudulent transactions.
- Rocinante communicates through HTTP and WebSocket connections, uses Firebase messaging to register installations, and sends stolen information through Telegram bots.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 23c51ed174a6014b3207b41a82c2aee0eea16df8fa1cd14c2864fb3307215070 | SHA-256 hash of a Rocinante sample identified as containing Ermac / Hook code. |
| SHA256 | 64ec090ea5e22648e46651b12569107f94b10c1e8e4635ef42716aaec28fd6bd | SHA-256 hash of a Rocinante sample identified as not containing Ermac / Hook code. |
| SHA256 | a39a3acc18c84624489d91d25c4517097f18bf4cc3bb8282aa2689bcfd860b0f | SHA-256 hash listed among Rocinante samples identified as not containing Ermac / Hook code. |
| SHA256 | a4886346e8bcfd20f6b5131f2440004675cf851fa86fef7594f8096f63eb6a38 | SHA-256 hash of a Rocinante sample identified as not containing Ermac / Hook code. |
MITRE ATT&CK
T1417.001Rocinante uses the Accessibility Service to log UI events and capture information shown on the infected device.T1437.001Rocinante uses HTTP traffic to contact C2 infrastructure and set up WebSocket communication.T1453Rocinante leverages granted Accessibility Service privileges to monitor the device and perform remote actions.T1516Rocinante can simulate touches and gestures and modify text fields on the infected device in response to C2 commands.
Malware
ERMACThe authors of Rocinante are influenced by developments in the threat landscape in other regions, adding parts of the source code of Ermac / Hook to their implementationHookThe authors of Rocinante are influenced by developments in the threat landscape in other regions, adding parts of the source code of Ermac / Hook to their implementationRocinanteRecently, we were able to identify a new strain of malware, originating from Brazil, which embodies this new wave of bankers, which we called Rocinante.
Products
FirebaseRocinante uses a combination of Firebase messaging, HTTP traffic, Websocket traffic, and the Telegram API to register the infected device, exfiltrate the information, and perform Device TakeoverTelegramRocinante uses a combination of Firebase messaging, HTTP traffic, Websocket traffic, and the Telegram API to register the infected device, exfiltrate the information, and perform Device Takeover