—
Lightning talk: Digging for Coper

VirusTotal

$ whoami

Fernando Diaz
Software Engineer || Frida Wizard
VirusTotal- Automated dynamic analysis development,- Focus on banking trojan analysis and APTs.
- Teaching binary instrumentation at University of Malaga’s
Malware Intelligence MSc.
- Author of Frida Handbook: learnfrida.info
Contact →E-mail: fdiaz@virustotal.com
Twitter: @entdark_

VirusTotal

CoperCoper is an Android banking trojan targeting both banks and crypto exchange users.
Different campaigns mix targeted regions, for example Spain and Canada; Japan and New Zealand;
Poland and Italy. Decoded strings indicate the real targets.
Core functionality is comprised of a small subset of features but enough to harvest credentials fromvictims.
Settings can be updated on every tick via the remote C&C.

VirusTotal

Distribution

Attackers use various ways of distributing their malware:● Fraudulent Ad campaigns to spread.
● GitHub accounts and repositories to host malware samples. An
account under the username uliaknazeva888 has the most extensive
activity map - 159 commits since Jun 23, 2021 up to April 30, 2022.
● Compromised websites: Used to host malicious APKs. Somegovernmental sites were also affected.
● Discord: Attackers use it mostly as a “secure” hosting service.

VirusTotal

VirusTotal

Activity map

VirusTotal

Core functionality

Coper uses VNC to observe and control the victims’ device. This feature
can be enabled/disabled remotely.
To avoid interference with other remote administration tools, it attempts
to uninstall other known apps such as TeamViewer.
This is usually paired with its keylogger feature, allowing remoteattackers to extract key information.

VirusTotal

Core functionality II

Coper hides push notiﬁcations from the targeted bank applications to prevent victims from seeing important messages
such as 2FA codes and notiﬁcations related to fraudulent transactions and warning messages.
It takes advantage of the accessibility API to obtain both dot-pattern and regular PIN unlock patterns.

VirusTotal

C2 Communications<string name="domains">
https://232fdnsjds.top/OGYyZmMyZmVlMGI0/|https://sdxasd1.top/OGYyZmMyZmVlMGI0/|https://fdghhoo1.top/
OGYyZmMyZmVlMGI0/|</string>

All the communications are done via HTTPS to a rotating list of C2s.
Communications are encrypted using the following pattern for both incoming andoutgoing messages:
BASE64ENCODE(AES_ECB(TEXT_TO_ENCRYPT))*All data sent is gzip compressed.

The AES key is shared between many samples independently of the campaign
waves. It can be extracted by instrumenting javax.crypto.spec.SecretKeySpec

VirusTotal

Unpacking

The real payload is hidden at an embedded resource stored in /res/raw/
with a random name and no ﬁle extension.
On app startup an embedded library is loaded and automatically decrypts
the payload. This library decrypts the ﬁle in memory using RC4, usuallywith key nxYUBCMVV3xmvdvz2T9mjMp5GQRkOO8Q and the decrypted
output is a DEX V35 ﬁle.

VirusTotal

Extracting the RC4 key on runtime[*] android_dlopen_ext("/data/app/~~Hbz8xKtZX7kc7pdjxJqmnA==/com.spellsaw2-7LrubLkVk3BrvP2z3V6Ctg==/lib/arm64/libbfuIS.so ")nxYUBCMVV3xmvdvz2T9mjMp5GQRkOO8Q
VirusTotal

—Questions?
If interested, request full analysis at
fdiaz@virustotal.com
VirusTotal