Full Report
Discovered by Group-IB in May 2024, the Ajina.Banker malware is a major cyber threat in the Central Asia region, disguising itself as legitimate apps to steal banking information and intercept 2FA messages.
Analysis Summary
# Tool/Technique: Ajina.Banker
## Overview
Ajina.Banker is a sophisticated Android banking trojan first identified by Group-IB in May 2024. Its primary purpose is to exfiltrate financial data and bypass security measures by intercepting Two-Factor Authentication (2FA) messages. The malware specifically targets users in the Central Asia region, leveraging localized social engineering tactics to deceive victims.
## Technical Details
- **Type:** Malware Family (Banking Trojan)
- **Platform:** Android
- **Capabilities:** SMS interception, 2FA bypass, credential theft, overlay attacks, and data exfiltration.
- **First Seen:** May 2024
## MITRE ATT&CK Mapping
- **[TA0031 - Initial Access]**
- [T1474 - Supply Chain Compromise (via spoofed apps)]
- **[TA0037 - Persistence]**
- [T1624.001 - Event-Triggered Execution: Broadcast Receivers]
- **[TA0035 - Collection]**
- [T1636.002 - Client Configurations: SMS Messages]
- **[TA0030 - Credential Access]**
- [T1411 - Input Capture (Overlay Attacks)]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **SMS Interception:** Captures incoming SMS messages to harvest one-time passwords (OTPs) and 2FA codes.
- **Phishing Overlays:** Displays fraudulent login screens over legitimate banking applications to capture user credentials.
- **Social Engineering:** Disguises itself as trusted applications (e.g., government services, banking utilities, or media players) to gain user trust and necessary permissions.
### Advanced Features
- **Regional Localization:** Specifically tailored for Central Asian victims, using local languages and targeting regional financial institutions.
- **Permission Exploitation:** Requests extensive Android permissions (Accessibility Services, SMS access) to automate actions and prevent uninstallation.
## Indicators of Compromise
### File Hashes (SHA256)
- 996fea7f234747510fba04b087e8f486fddb68c8c9525f1e0d6fc541e52cda9f
- 2d808d37909be66ac9018129be5265cf0f5f0cdff6de7eb6251e0c6cc1f9aa58
- 618233eed19404681b3ae025aa2effa1cfc77ac6c4a5c75122fa1a8b9f2af68e
- 1b5e072f2ac38e11907518dad61f91069d7d695abc6706e89d957b93f3fe1c46
- 991935dac885149793755aba47dad6c5d2bbc92b468074c5f3657a4ff15a89b1
### Network Indicators (Defanged)
- 79[.]137[.]205[.]212
- 46[.]226[.]160[.]19
- 109[.]120[.]135[.]42
- 77[.]105[.]166[.]215
- 5[.]42[.]77[.]147
- 147[.]45[.]42[.]85
- 79[.]137[.]202[.]32
- 77[.]221[.]136[.]21
- 46[.]226[.]167[.]24
- 45[.]15[.]157[.]38
## Associated Threat Actors
- Currently attributed to unnamed cybercriminal groups focusing on financial theft within the Central Asia region.
## Detection Methods
- **Signature-based detection:** Scanning for the SHA256 hashes listed in the IOC section.
- **Behavioral detection:** Monitoring for apps requesting excessive permissions (Accessibility Services + SMS) or processes attempting to draw overlays over financial apps.
- **Communication Monitoring:** Detecting outbound traffic to known C2 IP addresses listed above.
## Mitigation Strategies
- **Prevention:** Avoid downloading APKs from third-party websites or unofficial telegram channels.
- **Hardening:** Disable "Install from Unknown Sources" in Android settings.
- **Education:** Train users to be wary of apps requesting "Accessibility Services" permissions unless absolutely necessary for the app's primary function.
## Related Tools/Techniques
- **TeaBot / Anatsa:** Similar Android banking trojans using overlay techniques and SMS interception.
- **EventBot:** Another mobile malware family focusing on financial data theft through accessibility exploitation.