Dissection Of Zertsecurity - Banking Trojan.

Zertsecurity is a simple Android banking Trojan targeting German users via phishing: it prompts victims for account numbers and PINs, encrypts and stores the credentials in cfg.txt, exfiltrates the file to a hardcoded C&C server, and accepts SMS-based commands (identified by the string '&Sign28tepXXX'). The malware uses AES and Base64 encoding and requests SMS receive permissions to enable remote control.