Malicious PDF Reader With 10,000+ Installs on Google Play Delivers Anatsa Banking Trojan
Zscaler found a fake Android PDF reader with 10,000+ Google Play installs acting as dropper for the Anatsa banking trojan, with full IOCs published.
Zscaler ThreatLabz identified an Android PDF reader (package com.railforge.footplate.documentreader_pdfviewer, 10,000+ installs) on Google Play serving as an Anatsa (TeaBot) dropper, publishing installer MD5 152d8649a03667dbf4b94312d185c41d, payload MD5 2451fae883ec7a4e7876d6abe486e1eb, and three command-and-control endpoints. Anatsa requests SMS and accessibility permissions, contacts its C2, and overlays fake login pages matching installed financial apps to steal credentials. An earlier Anatsa document-reader campaign exceeded 100,000 downloads before Google removed it; Google has not confirmed removal of this listing.
- Dropper app requests SMS/accessibility permissions, then pulls the Anatsa payload as an update
- Fake banking overlays capture credentials entered for apps on the device
- IOCs include package name, two MD5 hashes, and three C2 URLs
- Prior Anatsa reader campaign topped 100,000 downloads before Google removal
- Some samples check device environment to evade analysis, plus malformed APK headers
- ATT&CK
- T1204.002 User Execution: Malicious FileT1105 Ingress Tool TransferT1056.002 Input Capture: GUI Input CaptureT1497.001 System Checks
- Organizations
- Zscaler ThreatLabzAnatsaTeaBotGoogle
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | railforgefootplate.com | d8649a03667dbf4b94312d185c41d Installer hash C2 URL https://railforgefootplate[.]com/disclaimers.txt Installer endpoint MD5 2451fae883ec7a4e78 |
| ipv4 | 162.252.173.37 | tp://193.24.123[.]18:85/api/ Payload endpoint C2 URL http://162.252.173[.]37:85/api/ Payload endpoint Note: IP addresses and domains a |
| ipv4 | 193.24.123.18 | 2451fae883ec7a4e7876d6abe486e1eb Payload hash C2 URL http://193.24.123[.]18:85/api/ Payload endpoint C2 URL http://162.252.173[.]37:8 |
| md5 | 152d8649a03667dbf4b94312d185c41d | .footplate.documentreader_pdfviewer Google Play listing MD5 152d8649a03667dbf4b94312d185c41d Installer hash C2 URL https://railforgefootplate[.]com/disc |
| md5 | 2451fae883ec7a4e7876d6abe486e1eb | forgefootplate[.]com/disclaimers.txt Installer endpoint MD5 2451fae883ec7a4e7876d6abe486e1eb Payload hash C2 URL http://193.24.123[.]18:85/api/ Payload |
From the original article
4 min read at cybersecuritynews.com
A malicious Android PDF reader distributed through Google Play has recorded more than 10,000 installs while serving as an installer for the Anatsa banking trojan. The finding shows how a routine document tool can become a route for malware that puts banking passwords and financial accounts at risk. The installation figure describes the reach of […]
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.