Cybersecurity Researchers Decode New Android Banking Trojan ‘Zanubis’

guest · Sep 4, 2022

The new trojan seems to be in a different league than others, as it targeted over 40 applications from Peru, all while hiding and using "Zanubis” as a key to
September 2, 2022

Experts at Cyble Research and Intelligence Labs (CRIL) found a new Android banking trojan ‘Zanubis’. The cybersecurity company shared its report after analyzing several malware strains like Hydra, Ermac, Amextroll, and others. However, the new trojan appeared to be in a different league than others, as it targeted over 40 applications from Peru, all while hiding and using “Zanubis” as a key to decrypt responses received from the Command and Control (C&C) servers.

According to the report, the malware appeared to be a standard PDF document used regularly in offices, banks, government organizations, and educational institutions. At the time the report was published, the malware-injected files had targeted banks in Peru and two social media apps WhatsApp and Gmail. The cybersecurity company did an in-depth analysis of Zanubis, and here is a quick look at the lucid version of the report.
Click to expand...

Zanubis, as a trojan, also had a source code, which was reviewed to see how it operated and what algorithms it used in its operations. Cyble did a test run of the malicious program and found out that the malware first prompts the users to grant Battery Optimization access, followed by the use of a11y (accessibility or practice of making web applications more usable for people with limited physical and mental abilities).

Once the user turns on the ‘Accessibility Service’, the malware prevents the system from deactivating and turns on all the permissions on the target device.
Click to expand...

Cyble: Zanubis: New Android Banking Trojan Spotted In The Wild

Overlay-Based Banking Trojan Targets Peruvian Banks And Social Media Applications
Cyble Research and Intelligence Labs (CRIL) has been tracking the activities of various Android Banking Trojans such as Hydra, Ermac, and Amextroll, amongst several others. During a routine threat-hunting exercise, we came across a Twitter post where a researcher mentioned a malware sample. After an in-depth analysis, the malware was identified as a new Android Banking Trojan variant targeting over 40 applications from Peru.
Click to expand...

The Threat Actor (TA) uses the string “Zanubis” as a key to decrypt responses received from the Command and Control (C&C) server. Hence, we will refer to this unidentified malware variant as “Zanubis.”
Click to expand...

Conclusion
According to our research, Zanubis uses a similar overlay-based attack as we have observed in other banking trojan families to steal the credentials of the targeted application.

The malware is still under development as some mentioned commands are not yet implemented, and the overlay URLs for a few targeted applications are missing. In the coming days, we may see a new variant of this malware with new TTPs and targets.
Click to expand...

Log in or Sign up

Cybersecurity Researchers Decode New Android Banking Trojan ‘Zanubis’

guest Guest

Log in or Sign up

Cybersecurity Researchers Decode New Android Banking Trojan ‘Zanubis’

guest Guest

Useful Searches