关键词
银行木马、DawDropper、DaaS服务、规避检测
本文将对DawDropper银行木马下载器的技术细节进行分析，并详细介绍与暗网中DaaS有关的网络犯罪活动。
今年，攻击者通过恶意下载器偷偷地将越来越多的银行木马添加到Google Play Store中，这证明了这种技术在逃避检测方面是有效的。此外，由于对传播移动恶意软件的新方法的需求很高，一些攻击者声称，他们的下载器可能会帮助其他网络犯罪分子在Google Play Store上传播恶意软件，从而形成下载器即服务(DaaS)模式。
在2021下半年，趋势科技团队发现了一起恶意活动，使用了一种新的下载器变体，并将其命名为DawDropper。DawDropper在若干Android应用程序的伪装下，例如Just-In:Video Motion、Document Scanner Pro、Converge Darkness、simpli Cleaner和Unicc QR Scanners，使用Firebase Realtime Database这一第三方云服务来逃避检测，并动态获取有效负载下载地址。它还在GitHub上托管恶意有效负载。目前，Google Play Store不再提供这些恶意应用。
图1. Google Play Store提供的DawDropper恶意应用
DawDropper的变体可以删除四种类型的银行特洛伊木马，包括Octo、Hydra、Ermac和TeaBot。所有DawDropper变体都使用Firebase实时数据库，这是一个合法的云托管NoSQL数据库，用于存储数据，作为其命令和控制(C&C)服务器，并在GitHub上托管恶意有效负载。
近日， CheckPoint Research于2021发现的一个名为Clast82的下载器也使用了Firebase实时数据库作为C&C服务器。
DawDropper的C&C服务器返回与Clast82数据类似的数据：
图7.DawDropper C&C服务器响应
Dawdroper的Octo恶意软件负载与之前报告的变体相似，该软件包使用编程语言关键字来混淆恶意功能。
图9.2022年3月和6月部署的同类型Octo有效载荷包
图10.Octo恶意软件感染链
本节回顾自2022年初以来，下载器是如何出现在Google Play Store上的，分析这些下载器之间的差异和演变，并了解网络犯罪分子是如何传播它们的。
银行木马下载器之间的差异
| 银行dropper名称及其发布日期 | 动态地址 | 第三方存储 | 加密有效载荷 |
Vultur dropper Jan 12, 2022 (com.privacy.account.safetyapp) | ✓ | ||
Sharkbot dropper Jan 14, 2022 (com.pagnotto28.sellsourcecode.supercleaner) | ✓ | ||
Octo dropper (Gymdrop dropper) Feb 17, 2022 (com.moh.screen) Feb. 6, 2022 (Vizeeva.fast.cleaner) | ✓ | ||
Ermac dropper (DawDropper) Mar 25, 2022 (com.qaz.universalsaver) | ✓ (Firebase Realtime Database) | ✓ (GitHub) | |
TeaBot dropper Apr 3, 2022 (com.zynksoftware.docuscanapp) Feb 11, 2022 (com.scanner.buratoscanner) | ✓ (GitHub) | ✓ (GitHub) | |
Hydra dropper(DawDropper) Apr 23, 2022 (com.casualplay.leadbro) | ✓ (Firebase Realtime Database) | ✓ (GitHub) | |
Hydra dropper (Gymdrop dropper) May 30, 2022 (com.anatolijserba.docscanner) | ✓ |
图13.Vultur dropper的恶意负载解密
在此前对使用下载器的银行特洛伊木马的调查中观察到，2021年首次报告的下载器——Gymdrop可以连接到一个管理面板(trackerpdfconnect[.]com和smartscreencaster[.]online)，网络犯罪分子可以使用该管理面板管理下载器和有效载荷，同时还发现Gymdrop在一个暗网论坛上被视作为典型的DaaS。
为了避免成为恶意应用的受害者，用户可采用以下措施：
查看应用程序评论，看看用户是否投诉负面体验。
在调查应用程序开发人员和发布者时，应进行尽职调查，避免从可疑网站下载应用程序。
避免安装来自未知来源的应用程序。
DawDropper
SHA-256 | 包名 | 检测名称 | C&C 服务器 | 载荷地址 | 有效载荷族 |
022a01566d6033f6d90ab182c4e69f80a13505050505aaaa386c8fa1a9435cb55c91 | com.caduta.aisevsk | AndroidOS_DawDropper.HRX | call-recorder66f03-defaultrtdb[.]firebaseio[.]com | hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk | Octo |
e13505050505d86925b13505050505fda00e02eb41fdcc75559f10c80acd182fd1f0e23a | com.vpntool.androidweb | AndroidOS_DawDropper.HRXA | rooster945d8defaultrtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/golgofan.apk | Hydra |
8fef8831cbc864ffe16e281b0e4af8e13505050505c13505050505ac80ffb13505050505 | com.j2ca.callrecorder | AndroidOS_DawDropper.HRXA | callrecorderad77f-defaultrtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/gala.apk | Octo |
05b3e4071f62763b3925fca9db383aeaad6183c690eecbbf532b080dfa6a5a08 | com.codeword.docscann | AndroidOS_DawDropper.HRXA | docscannercff1ddefaultrtdb[.]firebaseio[.]com | hxxps://github.com/lotterevich/lott/raw/main/maina.apk | TeaBot |
f4611b75113d31e344a7d37c011db37edaa436b7d84ca4dfd77a468bdeff0271 | com.virtualapps.universalsaver | AndroidOS_DawDropper.HRXA | universalsaverprodefaultrtdb[.]firebaseio[.]com | hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk | Octo |
a1298cc00605c79679f72b22d5c9c8e5c13505050505d6a6bd152b2c13505050505eb | com.techmediapro.photoediting | AndroidOS_DawDropper.HRXA | eaglephotoeditor2d4e5defaultrtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/lolipop.apk | Hydra |
eb8299c16a311ac2412c55af16d1d3821ce7386c86ae6d431268a3285c8e81fb | com.chestudio.callrecorder | AndroidOS_DawDropper.HRXA | call-recorder-pro-371bc-default-rtdb.firebaseio.com | hxxps://github.com/sherrytho/test/raw/main/golgol.apk | Hydra |
d5ac8e081298e3b14b41f2134dae68535bcf740841e75f91754d3d0c0814ed42 | com.casualplay.leadbro | AndroidOS_DawDropper.HRXA | loader-acb47-default-rtdb[.]firebaseio[.]com | hxxps://github.com/briangreen7667/2705/raw/main/addon2.apk | Hydra |
b4bd13770c13505050505dd13505050505a9507e13505050505a0e4299c697b6c9b9ec58 | com.utilsmycrypto.mainer | AndroidOS_DawDropper.HRXA | crypto-utils-l-default-rtdb[.]firebaseio[.]com | hxxps://github.com/asFirstYouSaid/test/raw/main/110.apk hxxps://github.com/asFirstYouSaid/test/raw/main/SecureChat%20(1).apk | Ermac |
77f226769eb1a13505050505d5b7832d92f678f0c2e1133f3bbee939b256c398aa | com.cleaner.fixgate | AndroidOS_DawDropper.HRXA | fixcleaner-60e32-default-rtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/latte.apk | Hydra |
5ee98b1051ccd0fa937f681889e52c59f33372ffa27afff024bb76d9b0446b8a | com.olivia.openpuremind | AndroidOS_DawDropper.HRX | crypto-sequence-default-rtdb[.]firebaseio.com | N/A | N/A |
0ebcf3bce940daf4017c85700ffc72f6b3277caf7f144a69fbfd437d1343b4ab | com.myunique.sequencestore | AndroidOS_DawDropper.HRX | coin-flow-a179b-default-rtdb.firebaseio.com | N/A | N/A |
13505050505a983916b8c7918c880191f7d264f242b815b044a6351c527f8aeac3c8 | com.flowmysequto.yamer | AndroidOS_DawDropper.HRX | incrypted-app-default-rtdb.firebaseio.com | N/A | N/A |
71c44a78cd77a8f13505050505f268c13505050505ac06ff3779c65e78bc879d3b0ff11d | com.qaz.universalsaver | AndroidOS_DawDropper.HRX | saver-9a43a-default-rtdb[.]firebaseio.com | hxxps://raw.githubusercontent.com/asFirstYouSaid/awdaw/main/Xnode_new.apk hxxps://raw.githubusercontent.com/asFirstYouSaid/test/main/GoogleMaps%20(2)_obf.apk | Ermac |
9b2064f8808d3aaa2d3dc9f5c7ee0775b29e29df3a958466a8953f148b702461 | com.luckyg.cleaner | AndroidOS_DawDropper.HRXA | lucky-cleaner-default-rtdb[.]firebaseio[.]com | hxxps://github.com/gohhas/gate/raw/main/live.apk | Octo |
ff13505050505f8d926588c0b7aedae8841df989d50f32c140d88f1105d1d3e02 | com.scando.qukscanner | AndroidOS_DawDropper.HRX | cleaner-f40c4-default-rtdb[.]firebaseio[.]com | hxxps://raw.githubusercontent.com/k13505050505/qq/main/clown.apk | Octo |
02499a198a8be5e203b13505050505cc84d286fc6afdb1bc84f902e433a7961e4 | com.qrdscannerratedx | AndroidOS_DawDropper.HRX | Qrscanner-f6d8d-default-rtdb.firebaseio.com | hxxps://raw.githubusercontent.com/k13505050505/qq/main/clown.apk | Octo |
022a01566d6033f6d90ab182c4e69f80a13505050505aaaa386c8fa1a9435cb55c91 | com.caduta.aisevsk | AndroidOS_DawDropper.HRX | call-recorder-66f03-default-rtdb[.]firebaseio[.]com | hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk | Octo |
e13505050505d86925b13505050505fda00e02eb41fdcc75559f10c80acd182fd1f0e23a | com.vpntool.androidweb | AndroidOS_DawDropper.HRXA | rooster-945d8-default-rtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/golgofan.apk | Hydra |
8fef8831cbc864ffe16e281b0e4af8e13505050505c13505050505ac80ffb13505050505 | com.j2ca.callrecorder | AndroidOS_DawDropper.HRXA | call-recorder-ad77f-default-rtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/gala.apk | Octo |
05b3e4071f62763b3925fca9db383aeaad6183c690eecbbf532b080dfa6a5a08 | com.codeword.docscann | AndroidOS_DawDropper.HRXA | doc-scanner-cff1d-default-rtdb[.]firebaseio[.]com | hxxps://github.com/lotterevich/lott/raw/main/maina.apk | TeaBot |
f4611b75113d31e344a7d37c011db37edaa436b7d84ca4dfd77a468bdeff0271 | com.virtualapps.universalsaver | AndroidOS_DawDropper.HRXA | universalsaverpro-default-rtdb[.]firebaseio[.]com | hxxps://github.com/uliaknazeva888/qs/raw/main/1.apk | Octo |
a1298cc00605c79679f72b22d5c9c8e5c13505050505d6a6bd152b2c13505050505eb | com.techmediapro.photoediting | AndroidOS_DawDropper.HRXA | eaglephotoeditor-2d4e5-default-rtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/lolipop.apk | Hydra |
eb8299c16a311ac2412c55af16d1d3821ce7386c86ae6d431268a3285c8e81fb | com.chestudio.callrecorder | AndroidOS_DawDropper.HRXA | call-recorder-pro-371bc-default-rtdb.firebaseio.com | hxxps://github.com/sherrytho/test/raw/main/golgol.apk | Hydra |
d5ac8e081298e3b14b41f2134dae68535bcf740841e75f91754d3d0c0814ed42 | com.casualplay.leadbro | AndroidOS_DawDropper.HRXA | loader-acb47-default-rtdb[.]firebaseio[.]com | hxxps://github.com/briangreen7667/2705/raw/main/addon2.apk | Hydra |
b4bd13770c13505050505dd13505050505a9507e13505050505a0e4299c697b6c9b9ec58 | com.utilsmycrypto.mainer | AndroidOS_DawDropper.HRXA | crypto-utils-l-default-rtdb[.]firebaseio[.]com | hxxps://github.com/asFirstYouSaid/test/raw/main/110.apk hxxps://github.com/asFirstYouSaid/test/raw/main/SecureChat%20(1).apk | Ermac |
77f226769eb1a13505050505d5b7832d92f678f0c2e1133f3bbee939b256c398aa | com.cleaner.fixgate | AndroidOS_DawDropper.HRXA | fixcleaner-60e32-default-rtdb[.]firebaseio[.]com | hxxps://github.com/butcher65/test/raw/main/latte.apk | Hydra |
5ee98b1051ccd0fa937f681889e52c59f33372ffa27afff024bb76d9b0446b8a | com.olivia.openpuremind | AndroidOS_DawDropper.HRX | crypto-sequence-default-rtdb[.]firebaseio.com | N/A | N/A |
0ebcf3bce940daf4017c85700ffc72f6b3277caf7f144a69fbfd437d1343b4ab | com.myunique.sequencestore | AndroidOS_DawDropper.HRX | coin-flow-a179b-default-rtdb.firebaseio.com | N/A | N/A |
13505050505a983916b8c7918c880191f7d264f242b815b044a6351c527f8aeac3c8 | com.flowmysequto.yamer | AndroidOS_DawDropper.HRX | incrypted-app-default-rtdb.firebaseio.com | N/A | N/A |
71c44a78cd77a8f13505050505f268c13505050505ac06ff3779c65e78bc879d3b0ff11d | com.qaz.universalsaver | AndroidOS_DawDropper.HRX | saver-9a43a-default-rtdb[.]firebaseio.com | hxxps://raw.githubusercontent.com/asFirstYouSaid/awdaw/main/Xnode_new.apk hxxps://raw.githubusercontent.com/asFirstYouSaid/test/main/GoogleMaps%20(2)_obf.apk | Ermac |
9b2064f8808d3aaa2d3dc9f5c7ee0775b29e29df3a958466a8953f148b702461 | com.luckyg.cleaner | AndroidOS_DawDropper.HRXA | lucky-cleaner-default-rtdb[.]firebaseio[.]com | hxxps://github.com/gohhas/gate/raw/main/live.apk | Octo |
ff13505050505f8d926588c0b7aedae8841df989d50f32c140d88f1105d1d3e02 | com.scando.qukscanner | AndroidOS_DawDropper.HRX | cleaner-f40c4-default-rtdb[.]firebaseio[.]com | hxxps://raw.githubusercontent.com/k13505050505/qq/main/clown.apk | Octo |
02499a198a8be5e203b13505050505cc84d286fc6afdb1bc84f902e433a7961e4 | com.qrdscannerratedx | AndroidOS_DawDropper.HRX | Qrscanner-f6d8d-default-rtdb.firebaseio.com | hxxps://raw.githubusercontent.com/k13505050505/qq/main/clown.apk | Octo |
Github存储库
存储地址 | 描述 |
hxxps://github.com/butcher65/test | 托管Octo和Hydra 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/lotterevich/lott | 托管TeaBot 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/asFirstYouSaid/test | 托管Ermac 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/asFirstYouSaid/awdaw | 托管Ermac 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/gohhas/gate | 托管Octo 银行特洛伊木马的GitHub存储库 |
hxxps://raw.github.com/k13505050505/qq | 托管Octo 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/briangreen7667/2705 | 托管Octo 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/uliaknazeva888/main | 托管Octo 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/kazakovadana44/1.apk | 托管Octo 银行特洛伊木马的GitHub存储库 |
hxxps://github.com/sherrytho/test | 托管Octo 银行特洛伊木马的GitHub存储库 |
网络指标 | 描述 |
vntososupplsos.live | Octo C&C 服务器 |
olopokogulya.site | Octo C&C 备份服务器 |
nbvb3954.fun | Octo C&C 备份服务器 |
nbvvvb.hair | Octo C&C 备份服务器 |
nbvbbn.lol | Octo C&C 备份服务器 |
nbvber.makeup | Octo C&C 备份服务器 |
nbvbsd.mom | Octo C&C 备份服务器 |
nbvbwe.monster | Octo C&C 备份服务器 |
nbvb.one | Octo C&C 备份服务器 |
vbnbvb.online | Octo C&C 备份服务器 |
ccnbvb.pics | Octo C&C 备份服务器 |
xxnbvb.quest | Octo C&C 备份服务器 |
eenbvb.sbs | Octo C&C 备份服务器 |
asqwnbvb.shop | Octo C&C 备份服务器 |
qwnbvb.skin | Octo C&C 备份服务器 |
qqnbvb.space | Octo C&C 备份服务器 |
wwerenbvb.store | Octo C&C 备份服务器 |
Ermac有效载荷
SHA-256 | 包名 | 下载地址 | 检测名称 |
cdf66b98f90a9e83b204bf2bb13505050505f9e9ad4d2fb86648d1d1f7d3152dadd | com.ceveluriseze.xuca | hxxps://raw.githubusercontent.com/asFirstYouSaid/awdaw/main/Xnode_new.apk hxxps://raw.githubusercontent.com/asFirstYouSaid/test/main/GoogleMaps%20(2)_obf.apk | AndroidOS_Anubis.GCL |
13505050505fc16e90fe05e1eb032c3591d878c7cfd197d02113d7d006e2d7b171f | com.ceveluriseze.xuca | hxxps://github.com/asFirstYouSaid/test/raw/main/110.apk hxxps://github.com/asFirstYouSaid/test/raw/main/SecureChat%20(1).apk | AndroidOS_Anubis.GCL |
编辑|梁爽
审校|何双泽、金矢