Full Report
A malware campaign was recently detected in Brazil, distributing a malicious LNK file using WhatsApp. It delivered a new Maverick banker, which features code overlaps with Coyote malware.
Analysis Summary
# Tool/Technique: Maverick Banking Trojan
## Overview
Maverick is a new banking trojan specifically designed to target Android users, notable for its mass-scale distribution method which heavily abuses the WhatsApp messaging platform. Its primary goal is financial fraud.
## Technical Details
- Type: Malware family (Banking Trojan)
- Platform: Android
- Capabilities: Intercepting SMS messages (including 2FA codes), overlay attacks on banking applications, overlay display, information gathering, and potential mass distribution via WhatsApp.
- First Seen: Not explicitly stated in the provided context, but described as "new."
## MITRE ATT&CK Mapping
Since the provided text is a high-level article description without detailed TTP mapping, the mappings below are inferred based on the description of a typical banking trojan and its distribution method:
- **TA0001 - Initial Access**
- T1211 - Exploitation of Attack Surface
- T1211.001 - Exploitation of External Communication Tools (Inferred due to WhatsApp abuse)
- **TA0005 - Defense Evasion**
- T1070 - Indicator Removal on Host (Potential for lingering behavior removal)
- **TA0006 - Credential Access**
- T1111 - Brute Force (If targeting credentials)
- **TA0007 - Discovery**
- T1083 - File and Directory Discovery (Likely to locate WhatsApp data or banking apps)
- **TA0011 - Command and Control**
- T1071 - Application Layer Protocol (Used for communication with C2)
- **TA0010 - Impact**
- T1554 - Compromise Client Software (If manipulating or abusing legitimate applications like WhatsApp)
## Functionality
### Core Capabilities
- Delivery and installation on Android devices.
- Abuse of the WhatsApp platform for large-scale distribution.
- Financial objectives, typical of banking Trojans.
### Advanced Features
- **Overlay Attacks**: Displaying fake login screens over legitimate banking applications to steal user credentials.
- **SMS Interception**: Capturing incoming SMS messages, crucial for bypassing Two-Factor Authentication (2FA) codes sent via SMS.
## Indicators of Compromise
*(Note: Specific hashes, filenames, and network indicators are not present in the provided context snippet.)*
- File Hashes: [N/A in context]
- File Names: [N/A in context]
- Registry Keys: [N/A in context (Android specific locations implied)]
- Network Indicators: [N/A in context, but expected C2 communication]
- Behavioral Indicators: Launching overlay windows when banking apps are detected; requesting SMS read permissions; attempts to access WhatsApp data/media.
## Associated Threat Actors
- [Not specified in the provided context snippet, but typically financially motivated groups]
## Detection Methods
*(Note: Specific details are not present, generalized methods apply)*
- Signature-based detection: Identifying unique binary signatures associated with the malware payload.
- Behavioral detection: Monitoring abnormal application behavior, such as a non-system process injecting overlays over legitimate financial applications or unauthorized SMS reading.
- YARA rules: Based on unique strings or compiled code structures of the Maverick payload.
## Mitigation Strategies
- Strict user vigilance regarding links or attachments received via WhatsApp, especially those promising free items or urgent action.
- Ensuring Android operating system and applications (including WhatsApp) are kept up-to-date.
- Restricting permissions granted to newly installed applications, particularly SMS read/write and Accessibility permissions.
- Employing strong mobile security solutions capable of detecting overlay and SMS interception behaviors.
## Related Tools/Techniques
- Other Android Banking Trojans (e.g., Cerberus, FluBot, Xenomorph).
- The technique of using social engineering via encrypted messaging apps (like WhatsApp) for initial payload delivery.