Anatsa Banking Trojan Campaign Targets US, UK and DACH Banks
Summary
ThreatFabric reports Anatsa dropper campaigns on Google Play with over 30,000 installations, targeting banks in the US, UK and DACH. The Trojan steals financial data and enables device-takeover fraud.
Key points
- ThreatFabric reported over 30,000 installations across multiple Anatsa dropper campaigns monitored since March 2023.
- Five droppers appeared over four months, disguised as PDF or document apps; Google removed reported apps, but replacements appeared within days or weeks.
- Some droppers fetched payload download URLs from GitHub; the payloads posed as add-ons to the original apps.
- Anatsa’s target list contained nearly 600 financial apps worldwide, including more than 90 newly targeted apps compared with August 2022.
- The malware can collect credentials, card details, balances and payment information through overlays and keylogging, then enable fraudulent transactions using device-takeover capabilities.
- ThreatFabric said it was aware of confirmed fraud cases and losses attributed to Anatsa; the article also warned that droppers remained available at the time of writing.
Article Details
- Attack Vectors
- Malicious Google Play dropper apps disguised as PDF readers or file-management apps delivered the Anatsa banking Trojan.
- Dropper apps retrieved a payload download URL from a page hosted on GitHub, then downloaded the payload, also hosted on GitHub.
- Victims were routed to the malicious apps through advertisements.
- Anatsa used overlay attacks and keylogging to collect banking credentials, credit-card details, balance information, and payment information, then enabled Device-Takeover Fraud.
- Defensive Notes
- ThreatFabric reported the identified dropper apps to Google, after which they were removed from Google Play; the article also notes that new droppers appeared within days or weeks.
- The article recommends client-side visibility and adaptability before and during the banking customer journey, including fraud intelligence and SDKs built into banking applications.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 128820e1c5d62523f675042da9d1e11af3191217afe308bcc17e51ad8c2ece03 | SHA-256 hash listed for a malicious Anatsa dropper app named PDF Reader & Editor. |
| SHA256 | 3740e6b4d259efe6a72f503429fb67db96363935a29f7428ccab5b78fa9bee73 | SHA-256 hash listed for a malicious Anatsa dropper app named All Document Reader & Editor. |
| SHA256 | 7231546ee377738cbe9075791eb6e76b7bc163c1b91831e05e81b4756fff4028 | SHA-256 hash listed for an Anatsa campaign dropper app named moh.filemanagerrespdf. |
| SHA256 | db7df65f2699817fa3ebfb3ebef106a3801a96b9da1ba6d88e727a253ae34da6 | SHA-256 hash listed for a malicious Anatsa dropper app named All Document Reader and Viewer. |
| SHA256 | ecce34c0ba83120ccf1f8e1640cd867fbfeb490dbc8a41d1cf8c577d508819c3 | SHA-256 hash listed for a malicious Anatsa dropper app named PDF Reader - Edit & View PDF. |
MITRE ATT&CK
T1056.001 · KeyloggingAnatsa used keylogging to collect sensitive information from infected devices.T1411Anatsa collected banking credentials and other sensitive information through overlay attacks.T1476Dropper applications posing as PDF readers or file-management apps were published on Google Play to deliver Anatsa.
Malware
Vendors
Products
Fraud Risk SuiteThreatFabric’s Fraud Risk Suite enables safe and frictionless online customer journeys by integrating industry-leading mobile threat intel, behavioural analytics, advanced device fingerprinting and over 10.000 adaptiveGoogle Play StoreAs of March 2023, ThreatFabric’s cyber fraud analysts have been monitoring multiple ongoing Google Play Store dropper campaigns delivering the Android banking Trojan Anatsa, with over 30.000 installations.
Countries
FinlandAnatsa’s actors added targets from Germany, Spain, Finland, South Korea, Singapore.GermanyThis campaign is no exception: we see a strong shift towards targeting banking institutions in the DACH region, specifically in Germany.SingaporeAnatsa’s actors added targets from Germany, Spain, Finland, South Korea, Singapore.South KoreaAnatsa’s actors added targets from Germany, Spain, Finland, South Korea, Singapore.SpainAnatsa’s actors added targets from Germany, Spain, Finland, South Korea, Singapore.