SHA1:
- 9ee6d59459a879d7a07e129b93e85b24e2515bd6
Description
Android.BankBot.Coper.1 is a malicious dropper program designed to install banking trojans from the Android.BankBot.Coper Coper family onto Android devices. The modification in question installs the Android.BankBot.Coper.2 trojan.
The dropper is spread under the guise of the Bancolombia Personas banking app, but installed on devices as an app called Webview Update.
Operating routine
The application package of the Android.BankBot.Coper.1 contains two malicious components encrypted with the RC4 algorithm:
- o.htm;
- PViwFtl2r3.mp3.
They are decrypted with the native library libm3zed.so and a t9oMwsl6HPxVsmfxgJzh key.
Upon launch, the dropper first decrypts file o.htm. The resulted trojan dex file is detected by Dr.Web as Android.BankBot.Coper.2.origin. One of its functions is to install another trojan component. The dropper then controls its integrity and reinstalls it if it was deleted.
After the dropper runs the Android.BankBot.Coper.2.origin, it decrypts the second file PViwFtl2r3.mp3 the same way. The decrypted file represents the apk package of the Android.BankBot.Coper.2 trojan application. It contains an encrypted dex file detected by Dr.Web as Android.BankBot.Coper.1.origin and performs the main malicious actions.
With that, there is no second-stage encryption of the main malicious module in the earlier versions of the trojan.
More details on Android.BankBot.Coper.2
More details on Android.BankBot.Coper.2.origin