Anatsa Banking Trojan Resurges in Europe Using Staged Droppers and AccessibilityService Abuse
Summary
ThreatFabric reports five Anatsa campaign waves targeting European regions, with five Google Play droppers exceeding 100,000 installations. The droppers use staged downloads, abuse AccessibilityService and bypass Android 13 restrictions.
Key points
- ThreatFabric detected five campaign waves beginning in November 2023, targeting regions including Slovakia, Slovenia and Czechia as well as previously targeted countries.
- Five droppers promoted on Google Play had more than 100,000 installations, according to the report; installation could lead to Anatsa infection and fraud.
- The droppers download configuration, DEX files and payloads in stages from a command-and-control server, allowing the actors to change components such as the payload URL.
- The report says all three observed droppers bypass Android 13 AccessibilityService restrictions; some also exploit the service to automate malicious actions.
- One dropper initially appeared harmless, then received an update a week after release that enabled malicious AccessibilityService behavior targeting Samsung devices.
- Anatsa has device-takeover capabilities; ThreatFabric advises financial institutions to educate customers about app permissions and monitor suspicious applications and account activity.
Article Details
- Attack Vectors
- Anatsa was distributed through cleaner-app droppers promoted on Google Play, with updates introducing malicious code after an initially harmless period.
- Droppers used AccessibilityService to automatically click UI buttons and install payloads, including by bypassing Android 13 restricted-settings protections.
- Droppers dynamically downloaded configuration, DEX files, and Anatsa payloads from command-and-control servers; the DEX code was loaded into memory.
- The reported campaign used device-takeover capabilities to control infected devices and perform actions on victims’ behalf.
- Defensive Notes
- Educate customers about the risks of installing applications, including those from official stores, and enabling AccessibilityService for apps that do not require it.
- Detect and monitor malicious applications and unusual customer-account activity to identify potential fraud.
- When customers report unusual device behavior or unrecognized transactions, ask about recently installed applications and permissions granted, particularly AccessibilityService.
MITRE ATT&CK
T1407Droppers dynamically downloaded Anatsa payloads from C2 servers and installed them.T1437Anatsa was delivered and executed as a downloaded Android payload.T1453The dropper abused AccessibilityService to automatically click buttons and perform actions through the device UI.T1476Anatsa droppers were promoted on Google Play and disguised as cleaner applications.T1620 · Reflective Code LoadingThe dropper dynamically loaded a malicious DEX file into memory.
Malware
Vendors
Products
AccessibilityServicethis campaign, Anatsa's Modus Operandi has evolved, displaying more sophisticated tactics such as AccessibilityService abuse, a multi-staged infection process, and the ability to bypass Android 13's restrictedAndroidtactics such as AccessibilityService abuse, a multi-staged infection process, and the ability to bypass Android 13's restricted settings.Google PlayOur analysis reveals that Anatsa's activity can be classified as "targeted," with threat actors focusing on 3-5 regions at a time while promoting dropper applications on Google Play in these specific areas.
Countries
CzechiaWhile Anatsa has previously targeted the UK, Germany, and Spain, its expansion into Slovakia, Slovenia, and Czechia signals a new phase in its operational strategy.GermanyWhile Anatsa has previously targeted the UK, Germany, and Spain, its expansion into Slovakia, Slovenia, and Czechia signals a new phase in its operational strategy.SlovakiaWhile Anatsa has previously targeted the UK, Germany, and Spain, its expansion into Slovakia, Slovenia, and Czechia signals a new phase in its operational strategy.SloveniaWhile Anatsa has previously targeted the UK, Germany, and Spain, its expansion into Slovakia, Slovenia, and Czechia signals a new phase in its operational strategy.SpainWhile Anatsa has previously targeted the UK, Germany, and Spain, its expansion into Slovakia, Slovenia, and Czechia signals a new phase in its operational strategy.