Full Report
Android Trojan named «Gustuff» capable of targeting more than 100 global banking apps, a number of cryptocurrency and marketplace applications
Analysis Summary
# Tool/Technique: Gustuff
## Overview
Gustuff is a sophisticated Android Trojan primarily designed for financial theft. It targets users of global banking applications, cryptocurrency wallets, and e-commerce marketplaces. Its most distinctive feature is the use of Android Accessibility Services to automate interactions with legitimate apps, enabling "Automatic Transfer Systems" (ATS) to drain funds without manual intervention by the attacker.
## Technical Details
- **Type:** Malware family (Banking Trojan / ATS)
- **Platform:** Android
- **Capabilities:** Accessibility Service abuse, ATS (Automatic Transfer System), credential phishing, SMS interception, data exfiltration (contacts, logs).
- **First Seen:** Approximately 2018 (gained significant prominence in 2019).
## MITRE ATT&CK Mapping
- **TA0030 - Persistence**
- T1624.001 - Event Notification: Accessibility Service
- **TA0037 - Credential Access**
- T1417.001 - Input Capture: Adversary-in-the-Middle (Phishing Overlays)
- **TA0035 - Collection**
- T1412 - Capture SMS Messages
- T1432 - Access Contact List
- **TA0038 - Impact**
- T1456 - Financial Theft (via ATS)
## Functionality
### Core Capabilities
- **Accessibility Service Exploitation:** Requests permissions to use Accessibility Services to monitor the device screen and interact with UI elements.
- **Phishing Overlays:** Displays fake login windows over legitimate banking and cryptocurrency apps to steal credentials and credit card information.
- **SMS Harvesting:** Intercepts, sends, and deletes SMS messages, allowing it to bypass Two-Factor Authentication (2FA) codes.
- **Data Theft:** Uploads the victim's contact list and device logs to the Command and Control (C2) server.
### Advanced Features
- **Automatic Transfer System (ATS):** Uses Accessibility Services to automatically fill out fields in legitimate banking apps (e.g., recipient account, amount) and press "send," facilitating theft without manual input from the operator.
- **Application Targeting:** Capable of targeting over 100 global banking apps and 32 cryptocurrency apps (including Bitcoin, BitPay, and Coinbase).
- **Encrypted C2 Communication:** Utilizes a custom algorithm to encrypt HTTP traffic between the infected device and the C2 server to evade network detection.
## Indicators of Compromise
- **Network Indicators (Defanged):**
- hxxp://[C2_Domain]/api/v1/set_state.php
- hxxp://[C2_Domain]/api/v1/get.php
- hxxp://[C2_Domain]/api/v1/load_sms.php
- hxxp://[C2_Domain]/api/v1/load_ab.php
- hxxp://[C2_Domain]/api/v1/set_card.php
- hxxp://[C2_Domain]/api/v1/records.php
- **Behavioral Indicators:**
- Repeated prompts to enable "Accessibility Services."
- Unexpected SMS activity or missing 2FA notifications.
- Presence of fake "Google Play Market" phishing windows requesting card details.
## Associated Threat Actors
- Generally attributed to Russian-speaking cybercriminals (based on code artifacts and original forum advertisements).
## Detection Methods
- **Signature-based:** Traditional AV signatures for known Gustuff APK samples.
- **Behavioral Detection:** Monitoring for apps that request Accessibility Services and immediately begin querying the list of installed packages or interacting with financial applications.
- **Network Analysis:** Identifying JSON-formatted POST requests to specific PHP endpoints (`/api/v1/...`) that do not match known legitimate traffic patterns.
## Mitigation Strategies
- **For Users:**
- Disable "Install from Unknown Sources" and only download apps from the official Google Play Store.
- Be extremely cautious when an app requests "Accessibility Service" permissions.
- Regularly update the Android OS to receive the latest security patches.
- **For Organizations:**
- Implement device fingerprinting to detect logins from new or suspicious devices.
- Utilize behavior analytics to identify automated UI interactions characteristic of ATS.
## Related Tools/Techniques
- **Anubis:** A similar Android banking Trojan that also utilizes accessibility services.
- **Red Alert 2.0:** Another Android Trojan known for overlay attacks and SMS interception.
- **Marcher:** A prevalent Android Trojan focused on overlay-based credential theft.