Full Report
Discovered by Group-IB in mid-2024, the Qwizzserial, which was initially not very active, began to spread strongly in Uzbekistan, masquerading as legitimate applications. The malware steals banking information and intercepts 2FA sms, transmitting it to fraudsters via Telegram bots.
Analysis Summary
# Tool/Technique: Qwizzserial
## Overview
Qwizzserial is an Android-based banking trojan discovered by Group-IB in mid-2024. Primarily targeting users in Uzbekistan, the malware masquerades as legitimate applications (such as banking utilities or system updates) to deceive users. Its primary purpose is to harvest sensitive financial information and bypass multi-factor authentication by intercepting SMS messages and exfiltrating data via Telegram bots.
## Technical Details
- **Type:** Malware Family (Banking Trojan / SMS Stealer)
- **Platform:** Android
- **Capabilities:** SMS interception, data exfiltration, overlay attacks, 2FA bypass, and contact list harvesting.
- **First Seen:** Mid-2024
## MITRE ATT&CK Mapping
- **[TA0037 - Command and Control]**
- [T1102.002 - Web Service: Bidirectional Communication (Telegram Bots)]
- **[TA0035 - Collection]**
- [T1636.004 - Mobile Device Data: SMS Messages]
- [T1430 - Access Contact List]
- **[TA0030 - Credential Access]**
- [T1411 - Input Injection (Overlay Attacks)]
- **[TA0031 - Discovery]**
- [T1420 - File and Directory Discovery]
## Functionality
### Core Capabilities
- **SMS Interception:** Captures incoming SMS messages, specifically targeting one-time passwords (OTPs) and 2FA codes from financial institutions.
- **Data Exfiltration:** Utilizes Telegram Bot API as a Command and Control (C2) mechanism to transmit stolen data to the attackers.
- **Application Masquerading:** Distributes itself using icons and names of popular Uzbek banks or generic system apps to gain user trust.
- **Permission Harvesting:** Requests intrusive Android permissions (Accessibility Services, SMS access) to automate actions and monitor user activity.
### Advanced Features
- **Telegram C2 Integration:** By using Telegram bots, the malware evades traditional network security filters that might block unknown IP addresses or domains.
- **Targeted Geographic Focus:** Specifically tailored for the Uzbekistan region, including support for local language and imitation of local financial infrastructure.
## Indicators of Compromise
### File Hashes (SHA-256)
- `6176cb44279239ad9649b65bffc68a76a4d94da2e5c51506353b51d172ed1d56`
- `95c1560926616524d66b1399d7406febd2838a248f7ded3846887f8b8554bad5`
- `221ae99b20352fe0052090a238a14c1c565a91f54111d440e405ac9d9a229c11`
- `91b5ef1465ec2c89ca7902caf0494103b594e7c518f8cf54545da1b2a9f42f28`
- `da51fca28d467fdb2b82704542030a9d57d7de27ed83113bf6fea01ad9bf3d74`
- `c5d1c98a86de7c71fabfe6dc3a1f618c140b7f5f74081b2880c707b50e4a2c7b`
- `06a6461c0bb2cb84c1c2c0f16067ba0e278262e5cc944ba5f4accf6da0c1b0f7`
- `88d9140b270b8497f5448bb05554e77d`
- `bbb58d04216d6dca63cdc4251380ac17e7f5b3944a30021b0ef99e5cc6d5f2c0`
### Network Indicators
- `api.telegram[.]org/bot<token>/sendMessage` (Defanged)
### Behavioral Indicators
- Requesting `BIND_ACCESSIBILITY_SERVICE` permission upon installation.
- Hidden application icon after the first launch.
- Continuous background processes monitoring for incoming SMS.
## Associated Threat Actors
- Unknown (Current activity points to financially motivated cybercriminals focusing on Central Asia).
## Detection Methods
- **Signature-based detection:** Scanning for the SHA-256 hashes listed above.
- **Behavioral detection:** Identifying Android applications that request both Accessibility Services and SMS permissions while communicating with Telegram API endpoints.
- **YARA Rules:** Monitoring for APK strings related to Telegram bot token patterns combined with SMS-related Android API calls.
## Mitigation Strategies
- **User Education:** Advise users against downloading APKs from unofficial sources or third-party links.
- **Permission Management:** Audit applications that use Accessibility Services, as this is a common vector for banking trojans.
- **Platform Hardening:** Enable "Play Protect" on Android devices and disable the installation of apps from "Unknown Sources."
- **Financial Monitoring:** Implement behavioral fraud detection at the bank level to identify suspicious logins originating from devices with intercepted 2FA.
## Related Tools/Techniques
- **Medusa (Android Trojan):** Similar SMS interception and accessibility abuse features.
- **Anubis:** A well-known banking trojan that utilized similar overlay and SMS theft techniques.
- **Telegram-based C2:** A common technique used by various mobile malware families to simplify infrastructure management.