Android.BankBot.Coper

the trojan can also change other settings, including: a list of targeted applications determining which windows will be overlaid by a phishing window upon launch

Upon launch, the dropper decrypts and runs an executable dex file ( Android.BankBot.Coper.2.origin ) located in its resources and disguised as a web document named o.htm.

One of its tasks is to obtain access to the Accessibility Services functions. Using these functions, the trojan will have full control over the infected device and imitate user actions like pressing the menu button and closing windows.

the trojan intercepts and sends the contents of the incoming push notifications to the C&C server.

One of its tasks is to obtain access to the Accessibility Services functions. Using these functions, the trojan will have full control over the infected device and imitate user actions like pressing the menu button and closing windows.

One of its tasks is to obtain access to the Accessibility Services functions. Using these functions, the trojan will have full control over the infected device and imitate user actions

All Android.BankBot.Coper samples discovered and investigated by our malware analysts were spread as the official Bancolombia financial institution app called Bancolombia Personas.

For example, they check if they’re running in a virtual environment, verify if there’s an active SIM card and also check user’s country of residence. If one of these checks fails, the droppers will immediately stop running.

they check if they’re running in a virtual environment, verify if there’s an active SIM card and also check user’s country of residence. If one of these checks fails, the droppers will immediately stop running.

Next, this malicious module conceals its icon from the list of installed apps located on the home screen, hiding from the user.

Next, this malicious module conceals its icon from the list of installed apps located on the home screen, hiding from the user.

the trojan intercepts and sends the contents of the incoming push notifications to the C&C server.

the trojan intercepts and sends the contents of the incoming push notifications to the C&C server.

For example, they check if they’re running in a virtual environment, verify if there’s an active SIM card and also check user’s country of residence. If one of these checks fails, the droppers will immediately stop running.

they check if they’re running in a virtual environment, verify if there’s an active SIM card and also check user’s country of residence. If one of these checks fails, the droppers will immediately stop running.

Then, it notifies the C&C server about the successful infection and waits for further commands. The trojan maintains a constant connection to the C&C server by sending out requests every minute.

Using these functions, the trojan will have full control over the infected device and imitate user actions like pressing the menu button and closing windows.

It tries to disable Google Play Protect, built-in malware protection in the operating system; it also tries to allow installing apps from unknown sources