Anatsa’s Latest Updates

Technical analysis of the Anatsa Android banking trojan: the report describes an installer that performs emulation and device-model checks, decrypts strings at runtime with a generated DES key, and downloads a DEX payload hidden in JSON and a malformed APK/ZIP to evade static and dynamic analysis. Once installed it requests accessibility and SMS permissions, enables manifest permissions, deploys a keylogger and banking-page injection framework tailored to detected financial apps, and communicates with C2 servers using a single-byte XOR (sample C2 IPs/domains are provided).