DoubleTrouble Cell Banking Trojan Revealed

Govt Abstract

Over the previous few months, our zLabs crew has been actively monitoring a complicated banker trojan pressure that has quickly developed in each its distribution strategies and capabilities. Initially, this menace was unfold by phishing web sites impersonating well-known European banks. Early variants of the trojan primarily utilized overlays to steal banking credentials, captured lock display screen data, and featured keylogging performance.

In its newest iteration, the trojan’s distribution technique has shifted, now leveraging bogus web sites that host malware samples instantly inside Discord channels. This evolution in supply is accompanied by an enlargement of the malware’s capabilities, which now incorporate superior options resembling display screen seize and a wide range of new instructions. To this point, our crew has collected 25 samples of the earlier variant and 9 samples, encompassing each droppers and payloads, from this ongoing marketing campaign.

Technical Evaluation

The malware employs a complicated obfuscation method that hinders static evaluation by assigning nonsensical two-word mixtures to its strategies and sophistication names.

Just like different fashionable banker households, this variant depends closely on abusing Android’s Accessibility Providers to execute its fraudulent actions. To bypass the standard restrictions positioned on accessibility permissions, the malware makes use of a session-based set up technique. On this method, the precise malicious payload is hid inside the app’s Sources/uncooked listing. To trick the sufferer into putting in it, the malware disguises itself as an extension or add-on, and makes use of the Google Play icon (Fig.1) to look reliable. As soon as the app is operating, the malware prompts the sufferer to allow Accessibility Providers. After efficiently gaining entry, it begins executing its malicious actions within the background, together with knowledge theft and unauthorized management of the machine.

Fig.1: Layouts proven to the person throughout set up

Instructions and Capabilities

In its newest evolution, the malware has built-in a number of new and superior options, considerably increasing its capabilities past earlier iterations. These enhancements allow simpler knowledge theft, machine manipulation, and evasion strategies. The brand new functionalities embody: displaying malicious UI overlays to steal PIN codes or unlock patterns, complete display screen recording capabilities, the power to dam the opening of particular purposes, and superior keylogging performance.

Prompting Sufferer to enter pin/password/sample

The malware leverages open supply libraries, particularly PatternLockView and PinLockView, to show pretend lock screens. This permits the malware to steal sample, pin or password-based lock screens credentials (Fig. 2). The malware then saves this enter domestically in SharedPreferences earlier than exfiltrating the captured password to its command and management server.

Fig.2: Faux UI’s created by the malware to steal machine lockscreen

Display screen Recording Function

The malicious software program employs refined strategies to covertly purchase display screen content material, primarily leveraging Android’s MediaProjection and VirtualDisplay APIs. This course of begins with the malware requesting display screen seize permission, usually by a meticulously hid exercise to keep away from person detection. As soon as this permission is granted, the malware proceeds to create a digital show that acts as a real-time mirror of the person’s energetic display screen, exactly replicating all visible data because it seems.

To extract the visible knowledge, an ImageReader is utilized to seize particular person frames from this digital show. These uncooked frames are then transformed to JPEG format. Subsequently, the JPEG photos are additional encoded into base64 format – a typical technique for transmitting binary knowledge over text-based protocols. The encoded photos are then meticulously encapsulated inside a JSON object that’s enriched with metadata, together with the exact display screen dimensions and the picture format, offering the attacker with complete context concerning the captured visible knowledge.

Upon completion of this packaging, the JSON payload is transmitted to the Command and Management (C2) server. This silent exfiltration of knowledge grants the attacker an unobstructed and real-time view of the person’s display screen exercise. The ramifications of such interception are extreme, because it allows the attacker to compromise a wide selection of delicate data together with, however shouldn’t be restricted to, typed credentials resembling usernames and passwords, one-time passwords (OTPs) used for multi-factor authentication, exercise inside cryptocurrency wallets, the contents of password managers, and the interfaces of banking purposes. The power to observe these interactions precisely because the person sees them permits the attacker to bypass many conventional safety measures and achieve direct entry to extremely confidential knowledge.

Blocking Banking Functions

The malware actively interferes with person expertise by blocking purposes based mostly on a dynamic checklist from its command and management (C2) server. It screens foreground purposes (Fig. 3) and, upon detecting a focused app, shows a misleading “System Upkeep Discover” (Fig. 4). This tactic prevents person entry, disrupting machine utilization for malicious functions like blocking banking or safety apps.

Whereas the motive of this isn’t totally clear, it seems to function a preparation step previous to deploying the overlay assault.

Fig.3: Monitoring the foreground purposes

Fig.4: System upkeep overlay proven on prime of the applying to dam

A Extremely Refined Keylogger

The malware establishes a keylogger that actively screens each keystroke and detects window or software modifications in actual time. Particularly, it listens for TYPE_VIEW_TEXT_CHANGED and TYPE_VIEW_TEXT_SELECTION_CHANGED occasions, that are triggered each time the person sorts or modifies textual content inside enter fields.

All captured occasions are systematically recorded and silently written to a file named heart_beat.xml (Fig. 5) inside the app’s SharedPreferences, permitting the malware to persistently log and retailer person exercise. Moreover, two different information are maintained in SharedPreferences: launched_apps.xml, which incorporates an inventory of all purposes launched by the sufferer, and sent_apps.xml, which shops an inventory of all put in purposes.

Fig.5: An energetic keylogger to observe every keystroke from the sufferer

Conventional Overlays

Along with its different functionalities, the malware employs typical pretend overlays. These overlays current a fabricated “Account verification” type over authentic purposes, designed to deceive customers into divulging delicate data resembling usernames, passwords, and bank card numbers.

Captured credentials are secretly saved within the app’s cache listing earlier than being exfiltrated to the attacker’s Command and Management (C2) server. The malware leverages Android’s Accessibility Providers to detect when a person opens a selected software, subsequently overlaying a pretend UI tailor-made for that app. Fig. 6 exhibits an instance overlay for the Play Retailer, titled “Account Verification”.

Fig.6: Overlay acquired from the server

Full Set of Instructions

This part offers a complete overview of all of the instructions that the subtle banker malware is able to receiving and executing from its Command and Management (C2) server. These instructions spotlight the intensive management the attackers exert over contaminated gadgets, enabling a variety of malicious actions from knowledge exfiltration to machine manipulation. Every command detailed beneath represents a selected performance designed to facilitate credential theft, bypass safety measures, and preserve persistence on the compromised system.

Zimperium vs DoubleTrouble

Zimperium’s Cell Risk Detection (MTD) and Runtime Software Safety (zDefend) efficiently determine each the older and newer variants of DoubleTrouble utilizing our on-device dynamic detection engine. Which means Zimperium prospects have been protected even when:

● The malware was distributed by novel channels like Discord-hosted APKs

● The payloads used customized obfuscation strategies and repackaging

● Samples had by no means been seen earlier than within the wild

As this menace actor continues to innovate and push new capabilities, real-time, on-device cellular menace protection turns into important to guard each people and organizations from credential theft, account takeover, and monetary fraud.

MITRE ATT&CK Strategies

Indicators of Compromise

The checklist of IOCs might be present in this repository.