Kaspersky experts have analyzed a recent campaign by Zanubis, a banking Trojan distinguished by its adeptness at assuming the guise of legitimate applications. The investigation also sheds light on the recently AsymCrypt cryptor/loader and the evolving Lumma stealer, underscoring the increasing need for enhanced digital security.
Zanubis, an Android banking trojan, surfaced in August 2022, targeting financial and crypto users in Peru. Impersonating legitimate Peruvian Android apps, it tricks users into granting Accessibility permissions, surrendering control. In April 2023, Zanubis evolved, posing as the official app for the Peruvian governmental organization SUNAT (Superintendencia Nacional de Aduanas y de Administración Tributaria), showcasing increased sophistication. Zanubis is obfuscated with the help of Obfuscapk, a popular obfuscator for Android APK files. Once it gets permission to access the device, it tricks a victim by loading a real SUNAT website using WebView, making it seem legitimate.
To communicate with its controlling server, it uses WebSockets and a library called Socket.IO. This allows it to adapt and stay connected even if there are issues. Unlike other malware, Zanubis doesn’t have a fixed list of target apps. Instead, it can be programmed remotely to steal data when specific apps are running. This malware even creates a second connection, which could give the bad actors full control over your device. And the worst part is, it can disable your device by pretending to be an Android update.
Another recent discovery made by Kaspersky is AsymCrypt cryptor/loader, which targets crypto wallets and is being sold on underground forums. As the investigation showed, it is an evolved DoubleFinger loader version, acting as a “front” to a TOR network service. Buyers customize injection methods, target processes, startup persistence, and stub types for malicious DLLs, concealing the payload in an encrypted blob within a .png image uploaded to an image hosting site. Execution decrypts the image, activating the payload in memory.
Kaspersky’s tracking of cyber threats has also led to the Lumma stealer, an evolving malware lineage. Originally known as Arkei, the rebranded Lumma retains 46% of its former attributes. Disguised as a .docx to .pdf converter, its deceptive distribution triggers the malicious payload when uploaded files return with a double extension .pdf.exe.
Kaspersky unveils banking Trojan’s sneaky evolution and cryptocurrency threats
