关键词
银行木马、DawDropper、DaaS服务、规避检测
本文将对DawDropper银行木马下载器的技术细节进行分析，并详细介绍与暗网中DaaS有关的网络犯罪活动。
今年，攻击者通过恶意下载器偷偷地将越来越多的银行木马添加到Google Play Store中，这证明了这种技术在逃避检测方面是有效的。此外，由于对传播移动恶意软件的新方法的需求很高，一些攻击者声称，他们的下载器可能会帮助其他网络犯罪分子在Google Play Store上传播恶意软件，从而形成下载器即服务(DaaS)模式。
在2021下半年，趋势科技团队发现了一起恶意活动，使用了一种新的下载器变体，并将其命名为DawDropper。DawDropper在若干Android应用程序的伪装下，例如Just-In:Video Motion、Document Scanner Pro、Converge Darkness、simpli Cleaner和Unicc QR Scanners，使用Firebase Realtime Database这一第三方云服务来逃避检测，并动态获取有效负载下载地址。它还在GitHub上托管恶意有效负载。目前，Google Play Store不再提供这些恶意应用。
图1. Google Play Store提供的DawDropper恶意应用
DawDropper的变体可以删除四种类型的银行特洛伊木马，包括Octo、Hydra、Ermac和TeaBot。所有DawDropper变体都使用Firebase实时数据库，这是一个合法的云托管NoSQL数据库，用于存储数据，作为其命令和控制(C&C)服务器，并在GitHub上托管恶意有效负载。
近日， CheckPoint Research于2021发现的一个名为Clast82的下载器也使用了Firebase实时数据库作为C&C服务器。
图6.从C&C服务器获取的数据格式(来源：com.abcd[.]evpnfree)
DawDropper的C&C服务器返回与Clast82数据类似的数据：
图7.DawDropper C&C服务器响应
Dawdroper的Octo恶意软件负载与之前报告的变体相似，该软件包使用编程语言关键字来混淆恶意功能。
图9.2022年3月和6月部署的同类型Octo有效载荷包
图10.Octo恶意软件感染链
本节回顾自2022年初以来，下载器是如何出现在Google Play Store上的，分析这些下载器之间的差异和演变，并了解网络犯罪分子是如何传播它们的。
-
银行木马下载器之间的差异
| 银行dropper名称及其发布日期 | 动态地址 | 第三方存储 | 加密有效载荷 |
|
Vultur dropper Jan 12, 2022 (com.privacy.account.safetyapp) |
✓ | ||
|
Sharkbot dropper Jan 14, 2022 (com.pagnotto28.sellsourcecode.supercleaner) |
✓ | ||
|
Octo dropper (Gymdrop dropper) Feb 17, 2022 (com.moh.screen) Feb. 6, 2022 (Vizeeva.fast.cleaner) |
✓ | ||
|
Ermac dropper (DawDropper) Mar 25, 2022 (com.qaz.universalsaver) |
✓ (Firebase Realtime Database) |
✓ (GitHub) |
|
|
TeaBot dropper Apr 3, 2022 (com.zynksoftware.docuscanapp) Feb 11, 2022 (com.scanner.buratoscanner) |
✓ (GitHub) |
✓ (GitHub) |
|
|
Hydra dropper(DawDropper) Apr 23, 2022 (com.casualplay.leadbro) |
✓ (Firebase Realtime Database) |
✓ (GitHub) |
|
|
Hydra dropper (Gymdrop dropper) May 30, 2022 (com.anatolijserba.docscanner) |
✓ |
图13.Vultur dropper的恶意负载解密
在此前对使用下载器的银行特洛伊木马的调查中观察到，2021年首次报告的下载器——Gymdrop可以连接到一个管理面板(trackerpdfconnect[.]com和smartscreencaster[.]online)，网络犯罪分子可以使用该管理面板管理下载器和有效载荷，同时还发现Gymdrop在一个暗网论坛上被视作为典型的DaaS。
为了避免成为恶意应用的受害者，用户可采用以下措施：
-
查看应用程序评论，看看用户是否投诉负面体验。
-
在调查应用程序开发人员和发布者时，应进行尽职调查，避免从可疑网站下载应用程序。
-
避免安装来自未知来源的应用程序。
DawDropper
|
SHA-256 |
包名 |
检测名称 |
C&C 服务器 |
载荷地址 |
有效载荷族 |
|
022a01566d6033f6d90ab182c4e69f80a3851565aaaa386c8fa1a9435cb55c91 |
com.caduta.aisevsk |
AndroidOS_DawDropper.HRX |
call-recorder66f03-defaultrtdb[.]firebaseio[.]com |
hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk |
Octo |
|
e1598249d86925b6648284fda00e02eb41fdcc75559f10c80acd182fd1f0e23a |
com.vpntool.androidweb |
AndroidOS_DawDropper.HRXA |
rooster945d8defaultrtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/golgofan.apk |
Hydra |
|
8fef8831cbc864ffe16e281b0e4af8e3999518c15677866ac80ffb9495959637 |
com.j2ca.callrecorder |
AndroidOS_DawDropper.HRXA |
callrecorderad77f-defaultrtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/gala.apk |
Octo |
|
05b3e4071f62763b3925fca9db383aeaad6183c690eecbbf532b080dfa6a5a08 |
com.codeword.docscann |
AndroidOS_DawDropper.HRXA |
docscannercff1ddefaultrtdb[.]firebaseio[.]com |
hxxps://github.com/lotterevich/lott/raw/main/maina.apk |
TeaBot |
|
f4611b75113d31e344a7d37c011db37edaa436b7d84ca4dfd77a468bdeff0271 |
com.virtualapps.universalsaver |
AndroidOS_DawDropper.HRXA |
universalsaverprodefaultrtdb[.]firebaseio[.]com |
hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk |
Octo |
|
a1298cc00605c79679f72b22d5c9c8e5c8557218458d6a6bd152b2c2514810eb |
com.techmediapro.photoediting |
AndroidOS_DawDropper.HRXA |
eaglephotoeditor2d4e5defaultrtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/lolipop.apk |
Hydra |
|
eb8299c16a311ac2412c55af16d1d3821ce7386c86ae6d431268a3285c8e81fb |
com.chestudio.callrecorder |
AndroidOS_DawDropper.HRXA |
call-recorder-pro-371bc-default-rtdb.firebaseio.com |
hxxps://github.com/sherrytho/test/raw/main/golgol.apk |
Hydra |
|
d5ac8e081298e3b14b41f2134dae68535bcf740841e75f91754d3d0c0814ed42 |
com.casualplay.leadbro |
AndroidOS_DawDropper.HRXA |
loader-acb47-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/briangreen7667/2705/raw/main/addon2.apk |
Hydra |
|
b4bd13770c3514596dd36854850a9507e5734374083a0e4299c697b6c9b9ec58 |
com.utilsmycrypto.mainer |
AndroidOS_DawDropper.HRXA |
crypto-utils-l-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/asFirstYouSaid/test/raw/main/110.apk hxxps://github.com/asFirstYouSaid/test/raw/main/SecureChat%20(1).apk |
Ermac |
|
77f226769eb1a886606823d5b7832d92f678f0c2e1133f3bbee939b256c398aa |
com.cleaner.fixgate |
AndroidOS_DawDropper.HRXA |
fixcleaner-60e32-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/latte.apk |
Hydra |
|
5ee98b1051ccd0fa937f681889e52c59f33372ffa27afff024bb76d9b0446b8a |
com.olivia.openpuremind |
AndroidOS_DawDropper.HRX |
crypto-sequence-default-rtdb[.]firebaseio.com |
N/A |
N/A |
|
0ebcf3bce940daf4017c85700ffc72f6b3277caf7f144a69fbfd437d1343b4ab |
com.myunique.sequencestore |
AndroidOS_DawDropper.HRX |
coin-flow-a179b-default-rtdb.firebaseio.com |
N/A |
N/A |
|
2113451a983916b8c7918c880191f7d264f242b815b044a6351c527f8aeac3c8 |
com.flowmysequto.yamer |
AndroidOS_DawDropper.HRX |
incrypted-app-default-rtdb.firebaseio.com |
N/A |
N/A |
|
71c44a78cd77a8f5767096f268c3193108ac06ff3779c65e78bc879d3b0ff11d |
com.qaz.universalsaver |
AndroidOS_DawDropper.HRX |
saver-9a43a-default-rtdb[.]firebaseio.com |
hxxps://raw.githubusercontent.com/asFirstYouSaid/awdaw/main/Xnode_new.apk hxxps://raw.githubusercontent.com/asFirstYouSaid/test/main/GoogleMaps%20(2)_obf.apk |
Ermac |
|
9b2064f8808d3aaa2d3dc9f5c7ee0775b29e29df3a958466a8953f148b702461 |
com.luckyg.cleaner |
AndroidOS_DawDropper.HRXA |
lucky-cleaner-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/gohhas/gate/raw/main/live.apk |
Octo |
|
ff8110883628f8d926588c0b7aedae8841df989d50f32c140d88f1105d1d3e02 |
com.scando.qukscanner |
AndroidOS_DawDropper.HRX |
cleaner-f40c4-default-rtdb[.]firebaseio[.]com |
hxxps://raw.githubusercontent.com/k6062019/qq/main/clown.apk |
Octo |
|
02499a198a8be5e203b7929287115cc84d286fc6afdb1bc84f902e433a7961e4 |
com.qrdscannerratedx |
AndroidOS_DawDropper.HRX |
Qrscanner-f6d8d-default-rtdb.firebaseio.com |
hxxps://raw.githubusercontent.com/k6062019/qq/main/clown.apk |
Octo |
|
022a01566d6033f6d90ab182c4e69f80a3851565aaaa386c8fa1a9435cb55c91 |
com.caduta.aisevsk |
AndroidOS_DawDropper.HRX |
call-recorder-66f03-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk |
Octo |
|
e1598249d86925b6648284fda00e02eb41fdcc75559f10c80acd182fd1f0e23a |
com.vpntool.androidweb |
AndroidOS_DawDropper.HRXA |
rooster-945d8-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/golgofan.apk |
Hydra |
|
8fef8831cbc864ffe16e281b0e4af8e3999518c15677866ac80ffb9495959637 |
com.j2ca.callrecorder |
AndroidOS_DawDropper.HRXA |
call-recorder-ad77f-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/gala.apk |
Octo |
|
05b3e4071f62763b3925fca9db383aeaad6183c690eecbbf532b080dfa6a5a08 |
com.codeword.docscann |
AndroidOS_DawDropper.HRXA |
doc-scanner-cff1d-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/lotterevich/lott/raw/main/maina.apk |
TeaBot |
|
f4611b75113d31e344a7d37c011db37edaa436b7d84ca4dfd77a468bdeff0271 |
com.virtualapps.universalsaver |
AndroidOS_DawDropper.HRXA |
universalsaverpro-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk |
Octo |
|
a1298cc00605c79679f72b22d5c9c8e5c8557218458d6a6bd152b2c2514810eb |
com.techmediapro.photoediting |
AndroidOS_DawDropper.HRXA |
eaglephotoeditor-2d4e5-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/lolipop.apk |
Hydra |
|
eb8299c16a311ac2412c55af16d1d3821ce7386c86ae6d431268a3285c8e81fb |
com.chestudio.callrecorder |
AndroidOS_DawDropper.HRXA |
call-recorder-pro-371bc-default-rtdb.firebaseio.com |
hxxps://github.com/sherrytho/test/raw/main/golgol.apk |
Hydra |
|
d5ac8e081298e3b14b41f2134dae68535bcf740841e75f91754d3d0c0814ed42 |
com.casualplay.leadbro |
AndroidOS_DawDropper.HRXA |
loader-acb47-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/briangreen7667/2705/raw/main/addon2.apk |
Hydra |
|
b4bd13770c3514596dd36854850a9507e5734374083a0e4299c697b6c9b9ec58 |
com.utilsmycrypto.mainer |
AndroidOS_DawDropper.HRXA |
crypto-utils-l-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/asFirstYouSaid/test/raw/main/110.apk hxxps://github.com/asFirstYouSaid/test/raw/main/SecureChat%20(1).apk |
Ermac |
|
77f226769eb1a886606823d5b7832d92f678f0c2e1133f3bbee939b256c398aa |
com.cleaner.fixgate |
AndroidOS_DawDropper.HRXA |
fixcleaner-60e32-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/butcher65/test/raw/main/latte.apk |
Hydra |
|
5ee98b1051ccd0fa937f681889e52c59f33372ffa27afff024bb76d9b0446b8a |
com.olivia.openpuremind |
AndroidOS_DawDropper.HRX |
crypto-sequence-default-rtdb[.]firebaseio.com |
N/A |
N/A |
|
0ebcf3bce940daf4017c85700ffc72f6b3277caf7f144a69fbfd437d1343b4ab |
com.myunique.sequencestore |
AndroidOS_DawDropper.HRX |
coin-flow-a179b-default-rtdb.firebaseio.com |
N/A |
N/A |
|
2113451a983916b8c7918c880191f7d264f242b815b044a6351c527f8aeac3c8 |
com.flowmysequto.yamer |
AndroidOS_DawDropper.HRX |
incrypted-app-default-rtdb.firebaseio.com |
N/A |
N/A |
|
71c44a78cd77a8f5767096f268c3193108ac06ff3779c65e78bc879d3b0ff11d |
com.qaz.universalsaver |
AndroidOS_DawDropper.HRX |
saver-9a43a-default-rtdb[.]firebaseio.com |
hxxps://raw.githubusercontent.com/asFirstYouSaid/awdaw/main/Xnode_new.apk hxxps://raw.githubusercontent.com/asFirstYouSaid/test/main/GoogleMaps%20(2)_obf.apk |
Ermac |
|
9b2064f8808d3aaa2d3dc9f5c7ee0775b29e29df3a958466a8953f148b702461 |
com.luckyg.cleaner |
AndroidOS_DawDropper.HRXA |
lucky-cleaner-default-rtdb[.]firebaseio[.]com |
hxxps://github.com/gohhas/gate/raw/main/live.apk |
Octo |
|
ff8110883628f8d926588c0b7aedae8841df989d50f32c140d88f1105d1d3e02 |
com.scando.qukscanner |
AndroidOS_DawDropper.HRX |
cleaner-f40c4-default-rtdb[.]firebaseio[.]com |
hxxps://raw.githubusercontent.com/k6062019/qq/main/clown.apk |
Octo |
|
02499a198a8be5e203b7929287115cc84d286fc6afdb1bc84f902e433a7961e4 |
com.qrdscannerratedx |
AndroidOS_DawDropper.HRX |
Qrscanner-f6d8d-default-rtdb.firebaseio.com |
hxxps://raw.githubusercontent.com/k6062019/qq/main/clown.apk |
Octo |
Github存储库
|
存储地址 |
描述 |
|
hxxps://github.com/butcher65/test |
托管Octo和Hydra 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/lotterevich/lott |
托管TeaBot 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/asFirstYouSaid/test |
托管Ermac 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/asFirstYouSaid/awdaw |
托管Ermac 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/gohhas/gate |
托管Octo 银行特洛伊木马的GitHub存储库 |
|
hxxps://raw.github.com/k6062019/qq |
托管Octo 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/briangreen7667/2705 |
托管Octo 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/uliaknazeva888/main |
托管Octo 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/kazakovadana44/1.apk |
托管Octo 银行特洛伊木马的GitHub存储库 |
|
hxxps://github.com/sherrytho/test |
托管Octo 银行特洛伊木马的GitHub存储库 |
|
网络指标 |
描述 |
|
vntososupplsos.live |
Octo C&C 服务器 |
|
olopokogulya.site |
Octo C&C 备份服务器 |
|
nbvb3954.fun |
Octo C&C 备份服务器 |
|
nbvvvb.hair |
Octo C&C 备份服务器 |
|
nbvbbn.lol |
Octo C&C 备份服务器 |
|
nbvber.makeup |
Octo C&C 备份服务器 |
|
nbvbsd.mom |
Octo C&C 备份服务器 |
|
nbvbwe.monster |
Octo C&C 备份服务器 |
|
nbvb.one |
Octo C&C 备份服务器 |
|
vbnbvb.online |
Octo C&C 备份服务器 |
|
ccnbvb.pics |
Octo C&C 备份服务器 |
|
xxnbvb.quest |
Octo C&C 备份服务器 |
|
eenbvb.sbs |
Octo C&C 备份服务器 |
|
asqwnbvb.shop |
Octo C&C 备份服务器 |
|
qwnbvb.skin |
Octo C&C 备份服务器 |
|
qqnbvb.space |
Octo C&C 备份服务器 |
|
wwerenbvb.store |
Octo C&C 备份服务器 |
Ermac有效载荷
|
SHA-256 |
包名 |
下载地址 |
检测名称 |
|
cdf66b98f90a9e83b204bf2bb28915784f9e9ad4d2fb86648d1d1f7d3152dadd |
com.ceveluriseze.xuca |
hxxps://raw.githubusercontent.com/asFirstYouSaid/awdaw/main/Xnode_new.apk hxxps://raw.githubusercontent.com/asFirstYouSaid/test/main/GoogleMaps%20(2)_obf.apk |
AndroidOS_Anubis.GCL |
|
71927786fc16e90fe05e1eb032c3591d878c7cfd197d02113d7d006e2d7b171f |
com.ceveluriseze.xuca |
hxxps://github.com/asFirstYouSaid/test/raw/main/110.apk hxxps://github.com/asFirstYouSaid/test/raw/main/SecureChat%20(1).apk |
AndroidOS_Anubis.GCL |
编辑|梁爽
审校|何双泽、金矢
本文为CNTIC编译整理，不代表本公众号观点，转载请保留出处与链接。联系信息进入公众号后点击“关于我们”可见。
原文始发于微信公众号（国家网络威胁情报共享开放平台）：分析DawDropper银行木马下载器和暗网中的DaaS
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论