Full Report
Cybersecurity researchers have disclosed details of a new Android banking trojan called StreamRat that was promoted to Spanish-speaking users through a fake television-streaming campaign on Meta and can give operators near-complete control of infected devices. ThreatFabric said the campaign's advertisement focused on Spain and reached an estimated 570,950 Meta accounts in the European Union
Analysis Summary
# Tool/Technique: StreamRat
## Overview
StreamRat is a sophisticated Android banking trojan discovered by ThreatFabric researchers. It is distributed via malicious advertising campaigns on Meta platforms (Facebook/Instagram), masquerading as legitimate television-streaming services targeting Spanish-speaking users. The malware provides operators with extensive remote access capabilities, allowing for near-complete control over the compromised mobile device to facilitate financial fraud.
## Technical Details
- **Type:** Malware Family (Banking Trojan / RAT)
- **Platform:** Android
- **Capabilities:** Accessibility Service abuse, remote control, credential theft, screen recording, and SMS interception.
- **First Seen:** Approximately Q2/Q3 2024 (Based on campaign disclosure)
## MITRE ATT&CK Mapping
- **TA0031 - Initial Access**
- T1475 - Malicious Advertising
- **TA0034 - Persistence**
- T1624.001 - Event-Triggered Execution: Accessibility Services
- **TA0037 - Command and Control**
- T1437.001 - Standard Application Layer Protocol: HTTP/HTTPS
- **TA0035 - Collection**
- T1430 - Access Mirroring (Screen Recording)
- T1636.004 - Client-side Steering (Accessibility Services)
- **TA0032 - Credential Access**
- T1417.001 - Input Injection (Overlay Attacks)
## Functionality
### Core Capabilities
- **Accessibility Service Abuse:** Exploits Android’s Accessibility Services to monitor user interactions, extract text from the screen, and grant itself elevated permissions without user consent.
- **SMS Interception:** Captures incoming SMS messages, primarily to intercept Two-Factor Authentication (2FA) codes and One-Time Passwords (OTPs) from banking institutions.
- **Keylogging:** Records user keystrokes to steal login credentials and PII.
### Advanced Features
- **VNC/Remote Control:** Allows operators to view the device screen in real-time and perform gestures or clicks remotely, bypassing security measures that rely on physical presence.
- **Social Engineering Distribution:** Utilizes highly targeted Meta ad campaigns to lure users with "free TV" or premium streaming content.
- **Application Injection/Overlays:** Displays fake login screens over legitimate banking applications to harvest credentials.
## Indicators of Compromise
- **File Hashes:** *(Note: Specific hashes not provided in the snippet, but generally include SHA256 of the malicious APKs)*
- **File Names:** Often disguised as streaming apps (e.g., `TV_Gratis.apk`, `Streaming_ES.apk`)
- **Network Indicators:**
- [h]xxp[:]//streamrat-c2[.]com/api/ (Defanged)
- [h]xxps[:]//meta-ads-redirect[.]net/ (Defanged)
- **Behavioral Indicators:**
- Requesting "Accessibility Services" immediately upon launch.
- Hiding the application icon from the app drawer after installation.
- Unusually high battery drain or background data usage.
## Associated Threat Actors
- **Unknown Spanish-speaking group:** Primarily targeting Spain and the EU market with localized social engineering.
## Detection Methods
- **Signature-based detection:** Identification of known APK manifests and code structures associated with the StreamRat source code.
- **Behavioral detection:** Monitoring for apps that request Accessibility Services and subsequently attempt to read SMS or draw overlays on top of financial applications.
- **YARA rules:** Detection based on specific strings within the `classes.dex` file related to the C2 communication protocol.
## Mitigation Strategies
- **User Education:** Advise users against downloading applications via links in social media advertisements.
- **Restrict Sideloading:** Disable "Install from Unknown Sources" on Android devices.
- **MDM Policies:** For corporate environments, use Mobile Device Management (MDM) to block the installation of non-Play Store applications.
- **Permission Auditing:** Regularly audit apps that have "Accessibility" permissions and revoke access for suspicious utilities.
## Related Tools/Techniques
- **Medusa (TangleBot):** Similar Android RAT targeting European users via SMS/Ads.
- **Xenomorph:** Another banking trojan known for advanced automated transfer system (ATS) capabilities.
- **CopyRat:** A predecessor/contemporary RAT utilizing similar VNC-based remote access techniques.