{"id":18961,"date":"2022-05-06T01:40:10","date_gmt":"2022-05-06T09:40:10","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2022\/05\/06\/news-12694\/"},"modified":"2022-05-06T01:40:10","modified_gmt":"2022-05-06T09:40:10","slug":"news-12694","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2022\/05\/06\/news-12694\/","title":{"rendered":"Warning: GRIM and Magnus Android Botnets are Underground"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

The lifecycle of an Android banking botnet typically consists of two stages: rise<\/b> and fall<\/b>. During the rising phase, the malware author promotes their new code and rents it underground\u2014MaaS (Malware as a Service). As the botnet gains popularity, it evolves with new features and pricing. At some point, though, an issue occurs, triggering its fall. For example, the author gets caught (e.g Anubis<\/a>) or its source code gets released on underground forums (either willingly by the authors themselves, by a competitor, or perhaps an unhappy customer). As a result, the botnet gradually dies. And unfortunately, others pop up on the market to take its place.<\/p>\n

As malware analysts, the Android\/Marcher<\/a>, Locker, and Anubis malware we used to see have been replaced by BianLian<\/a>, Cerberos, and Flubot (and still Anubis). A year ago, threat actor(s) started advertising a newcomer, the Huracan botnet<\/a>. We haven\u2019t seen it in the wild yet\u2014or if we have, we haven\u2019t recognized it (it\u2019s not always obvious to match underground names with the samples we analyze).<\/p>\n<\/p><\/div>\n

<\/div>\n
\n

Underground advertisement
<\/h2>\n

The Magnus<\/b> Botnet has been repeatedly advertised underground by a threat actor named whit3_d3vil<\/i> since February 2022.\u00a0 It is unclear whether whi3_d3vil<\/i> is the author or just a reseller. The botnet implements all the typical features that banking trojans currently have: overlay injection over mobile banking applications, sending SMS, SMS interception, 2FA bypass, remote administration via VNC, etc. And unlike BianLian, communication with C2s is encrypted using AES<\/b>.<\/p>\n<\/p><\/div>\n