<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-mobile-banking-trojans
description: >-
  Identify and analyze mobile banking trojans through behavioral analysis,
  overlay detection, accessibility service abuse, SMS interception hooks,
  and C2 communication patterns using Frida, YARA rules, and dynamic
  instrumentation on Android and iOS.
domain: cybersecurity
subdomain: mobile-security
tags:
  - banking-trojan
  - malware-analysis
  - overlay-attack
  - accessibility-abuse
  - sms-interception
  - frida
  - yara
  - c2-detection
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1411", "T1417", "T1409", "T1481"]
  owasp-mobile: ["M1", "M8"]
  tools: ["frida", "yara", "mobsf", "androguard", "tcpdump"]
---

# Detecting Mobile Banking Trojans

## Overview

Mobile banking trojans steal financial credentials through overlay attacks,
accessibility service abuse, SMS interception for OTP theft, and keylogging.
Families like Anatsa, Cerberus, and SharkBot use dropper techniques to bypass
Play Store defenses. Detection combines static indicators, behavioral hooks,
and network C2 pattern analysis.

## Prerequisites

```bash
pip install frida-tools androguard yara-python
apt install yara tcpdump
# MobSF: docker run -it -p 8000:8000 opensecurity/mobile-security-framework-mobsf
```

## Workflow

### Step 1: Static Indicator Analysis

```bash
# Decompile and search for banking trojan indicators
apktool d suspect.apk -o apktool_out/
jadx -d jadx_out/ suspect.apk --deobf

# Accessibility service abuse — primary trojan vector
grep -rn 'AccessibilityService\|BIND_ACCESSIBILITY_SERVICE' apktool_out/
grep -rn 'onAccessibilityEvent\|AccessibilityNodeInfo' jadx_out/

# Overlay / window injection
grep -rn 'TYPE_APPLICATION_OVERLAY\|TYPE_SYSTEM_ALERT\|SYSTEM_ALERT_WINDOW' jadx_out/
grep -rn 'WindowManager.LayoutParams' jadx_out/

# SMS interception
grep -rn 'SmsReceiver\|SMS_RECEIVED\|pdus\|getMessageBody' jadx_out/
grep -rn 'RECEIVE_SMS\|READ_SMS\|SEND_SMS' apktool_out/AndroidManifest.xml

# Device admin abuse
grep -rn 'BIND_DEVICE_ADMIN\|DeviceAdminReceiver' apktool_out/
```

### Step 2: YARA Rule Scanning

```bash
# Scan APK with banking trojan YARA rules
yara -r banking_trojan_rules.yar suspect.apk
yara -r banking_trojan_rules.yar jadx_out/

# Example rule structure (see references for full rules)
# rule Anatsa_Indicators {
#     strings:
#         $a1 = "injectPayload" ascii
#         $a2 = "overlayAttack" ascii
#         $a3 = "grabSMS" ascii
#     condition:
#         2 of ($a*)
# }
```

### Step 3: Dynamic Behavioral Analysis with Frida

```bash
# Hook accessibility service methods
frida -U -f com.suspect.app -l hook_accessibility.js --no-pause

# Monitor overlay window creation
frida -U -f com.suspect.app -l hook_window_manager.js --no-pause

# Track SMS access
frida -U -f com.suspect.app -l hook_sms.js --no-pause

# Monitor outbound C2 connections
frida -U -f com.suspect.app -l hook_network.js --no-pause
```

### Step 4: C2 Communication Analysis

```bash
# Capture network traffic during execution
tcpdump -i any -w banking_trojan.pcap &
# Run suspect app...
kill %1

# Analyze with tshark
tshark -r banking_trojan.pcap -Y 'http || tls.handshake' -T fields \
  -e ip.dst -e http.host -e tls.handshake.extensions_server_name

# Check for DGA patterns
tshark -r banking_trojan.pcap -Y 'dns' -T fields -e dns.qry.name | sort -u

# Detect Tor/proxy usage
tshark -r banking_trojan.pcap -Y 'tcp.dstport == 9050 || tcp.dstport == 9051'
```

### Step 5: Target List Extraction

```bash
# Banking trojans carry target app lists — extract them
grep -rn 'com\..*\.bank\|com\..*\.finance\|org\..*credit' jadx_out/
strings suspect.apk | grep -E 'com\.[a-z]+\.(bank|pay|wallet|finance)'

# Extract encrypted config (common trojan pattern)
frida -U -f com.suspect.app -l dump_config.js --no-pause
# Hook SharedPreferences and file writes to capture decrypted target list
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|-------------|
| Accessibility abuse | Manifest + runtime | BIND_ACCESSIBILITY_SERVICE with overlay |
| SMS interception | Manifest + hooks | RECEIVE_SMS + SmsReceiver registration |
| Overlay injection | WindowManager hooks | TYPE_APPLICATION_OVERLAY creation |
| C2 beaconing | Network capture | Periodic connections to suspicious domains |
| Target list | Static strings | List of banking app package names |
| Device admin | Manifest | BIND_DEVICE_ADMIN for persistence |

```yaml
title: Mobile Banking Trojans Detection
id: 1291f335-8df6-416b-8905-00f4674a21c5
status: experimental
description: Detects suspicious activity related to detecting mobile banking trojans techniques in mobile security context
logsource:
  category: application
  product: android
detection:
  selection:
    EventType: error
  condition: selection
level: medium
tags:
  - attack.t1411
  - attack.t1417
  - attack.t1409
  - attack.t1481
  - attack.initial_access
falsepositives:
  - Mobile device management platform enforcing security policies
```

## Verification

- [ ] Accessibility service usage analyzed
- [ ] Overlay attack capability confirmed
- [ ] SMS interception hooks identified
- [ ] C2 communication endpoints extracted
- [ ] Target banking app list recovered
- [ ] YARA rules matched against known families

## References

- [MITRE T1411 — Input Injection](https://attack.mitre.org/techniques/T1411/)
- [MITRE T1417 — Input Capture](https://attack.mitre.org/techniques/T1417/)
- [ThreatFabric Banking Trojan Reports](https://www.threatfabric.com/blogs)
- [OWASP MASTG — Dynamic Analysis](https://mas.owasp.org/MASTG/)
