Android.BankBot.Coper.1

SHA1:

9ee6d59459a879d7a07e129b93e85b24e2515bd6

Description

Android.BankBot.Coper.1 is a malicious dropper program designed to install banking trojans from the Android.BankBot.Coper Coper family onto Android devices. The modification in question installs the Android.BankBot.Coper.2 trojan.

The dropper is spread under the guise of the Bancolombia Personas banking app, but installed on devices as an app called Webview Update.

Operating routine

The application package of the Android.BankBot.Coper.1 contains two malicious components encrypted with the RC4 algorithm:

o.htm;
PViwFtl2r3.mp3.

They are decrypted with the native library libm3zed.so and a t9oMwsl6HPxVsmfxgJzh key.

Upon launch, the dropper first decrypts file o.htm. The resulted trojan dex file is detected by Dr.Web as Android.BankBot.Coper.2.origin. One of its functions is to install another trojan component. The dropper then controls its integrity and reinstalls it if it was deleted.

After the dropper runs the Android.BankBot.Coper.2.origin, it decrypts the second file PViwFtl2r3.mp3 the same way. The decrypted file represents the apk package of the Android.BankBot.Coper.2 trojan application. It contains an encrypted dex file detected by Dr.Web as Android.BankBot.Coper.1.origin and performs the main malicious actions.

With that, there is no second-stage encryption of the main malicious module in the earlier versions of the trojan.

Indicators of compromise

More details on Android.BankBot.Coper.2

More details on Android.BankBot.Coper.2.origin

More details on Android.BankBot.Coper.1.origin

News about the trojan

Curing recommendations

Android

If the mobile device is operating normally, download and install Dr.Web for Android Light. Run a full system scan and follow recommendations to neutralize the detected threats.
If the mobile device has been locked by Android.Locker ransomware (the message on the screen tells you that you have broken some law or demands a set ransom amount; or you will see some other announcement that prevents you from using the handheld normally), do the following:
- Load your smartphone or tablet in the safe mode (depending on the operating system version and specifications of the particular mobile device involved, this procedure can be performed in various ways; seek clarification from the user guide that was shipped with the device, or contact its manufacturer);
- Once you have activated safe mode, install the Dr.Web для Android Light onto the infected handheld and run a full scan of the system; follow the steps recommended for neutralizing the threats that have been detected;
- Switch off your device and turn it on as normal.

Find out more about Dr.Web for Android