Pragmatic Crocodilus: A New Variant In the Horizon

This report describes zLabs' investigation into the Crocodilus Android banking trojan ecosystem, reporting 17 previously unreported dropper trojans, 21 new banker samples, six new command-and-control servers, and a previously undocumented native-code variant called "Pragma" that decrypts and dynamically loads encrypted DEX payloads from PNG assets to execute malicious routines, enabling device takeover, overlay attacks, keylogging, and OTP harvesting.