Zanubis is an Android banking trojan that specifically targets financial and cryptocurrency users in Peru [2] [4] [8]. It aims to obtain online banking credentials and gain unauthorized access to funds [3].
Description
Zanubis disguises itself as legitimate Android apps and tricks users into granting Accessibility permissions [5], giving the malware full control over the device [1]. It has been observed posing as the official app for the Peruvian governmental organization SUNAT [2] [5], as well as the Peruvian customs and tax agency [1] [6], indicating an increase in sophistication [4] [7] [8].
Once installed, Zanubis uses the Obfuscapk obfuscator for Android APK files [2] [5], making it difficult to detect. It creates the illusion of legitimacy by loading the genuine SUNAT website using WebView [5]. The trojan maintains communication with its controlling server through WebSockets and Socket.IO [5], ensuring connectivity even in adverse conditions [5].
Zanubis has the ability to disable a device by masquerading as an Android update and can also be remotely programmed to steal data when specific apps are in use. It can establish a second connection [5], potentially granting complete control over a compromised device [5].
Additionally, Zanubis logs keystrokes and records the screen when targeted apps are launched [6]. It also monitors attempts to lock or unlock the phone and blocks them [1] [6], rendering the device unusable [1] [6] [9].
Conclusion
Zanubis poses a significant threat to financial and cryptocurrency users in Peru. Its ability to disguise itself as legitimate apps and gain full control over devices makes it challenging to detect and mitigate. The trojan’s increasing sophistication and use of obfuscation techniques highlight the need for improved security measures. Financial institutions and users should remain vigilant and implement strong security practices to protect against this evolving threat.
References
[1] https://vulners.com/thn/THN:8939C4A926689DFB4A22CCD56363021D
[2] https://www.tradingview.com/news/reuters.com,2023-10-02:newsml_Zaw7cZ2dc:0-pressr-unmasking-zanubis-banking-trojan-s-sneaky-evolution-and-cryptocurrency-threats-unveiled/
[3] https://www.pcrisk.com/removal-guides/24747-zanubis-trojan-android
[4] https://www.zawya.com/en/press-release/research-and-studies/unmasking-zanubis-banking-trojans-sneaky-evolution-and-cryptocurrency-threats-unveiled-c1pnnhl6
[5] https://flyytech.com/2023/09/29/android-banking-trojan-zanubis-evolves-to-target-peruvian-users/
[6] https://patabook.com/technology/2023/10/02/zanubis-android-banking-trojan-poses-as-peruvian-government-app-to-target-users/
[7] https://voi.id/en/technology/315703
[8] https://cybersecuritynews.com/new-android-banking-malware-government-app/
[9] https://thehackernews.com/2023/10/zanubis-android-banking-trojan-poses-as.html
