Malicious Document Reader App in Google Play With 50K Downloads Installs Anatsa Malware

Zscaler ThreatLabz identified a deceptive Google Play app (“Document Reader – File Manager”) that downloads the Anatsa/TeaBot banking trojan after install; the report describes the trojan’s credential theft, keylogging and overlay phishing capabilities, advanced evasion (runtime string decryption, emulator checks, malformed ZIPs), permissions abuse (accessibility, SYSTEM_ALERT_WINDOW, READ_SMS), and provides specific IOCs (package name, installer/payload MD5s, download URL, and C2 server IPs) to support detection and forensics.