Anatsa Banker: The Trojan Hiding in a Google Play PDF Reader
A relationship manager at Larkfield Mutual installs a five-star PDF and QR reader from the Google Play store onto her managed Android handset. It is an Anatsa (TeaBot) dropper: it stages a DEX payload disguised as an app update, sidesteps sandbox checks, downloads the final banking trojan, and abuses the Accessibility service to overlay a fake bank login. Walk the EMM/MDM and web-proxy logs step by step to trace the install, the staged downloads, the C2 callback, and the final payload.
Start this operation
Investigation Tasks
Complete each task by investigating alerts and submitting your findings.
Brief: a five-star PDF reader that was anything but
0A relationship manager's corporate Android phone started talking to suspicious internet hosts this afternoon, shortly after she installed a new app from the Google Play store. Before you dig into the logs, get oriented on how this kind of attack works.
Name the app that started it all
15The infection began when the victim installed a single app from the Google Play store. Identify the package name of the app that acted as the dropper.
Find the host the dropper phoned home to
15Right after install, the dropper reached out to an internet host and pulled down files it did not ship with. Identify the domain it used for that staging.
Fingerprint the final payload
15After passing its sandbox checks, the dropper downloaded the final Anatsa banking trojan as an APK. Darius on the mobile security team wants the file's MD5 hash so he can hunt for it across the rest of the fleet. Find it.
Spot the command-and-control callback
15Once the trojan was running, it registered the infected phone with its operators over a connection that should never come from a managed handset. Identify the IP address the trojan first registered with.
Map this chain to MITRE ATT&CK
10One move in this chain is the reason every other move was possible: when the store inspected this app, the part that does the harm was not there to be found. Give the MITRE ATT&CK Mobile technique that names that move.
6 tasks · 70 points total
Training Tools
Skills You'll Build
Ideal for newcomers to SOC operations. Guided investigation with clear indicators.
Prerequisites
- No prior experience required
- Familiarity with SIEM concepts
- Familiarity with Firewall concepts
Ready to investigate?
More Operations
View allOneNote Attachment to RAT: A Guided First Investigation
A logistics contracts employee at Glacierline Freight opens an attachment that arrived in her inbox and clicks a button inside it. Minutes later her workstation is running something that appears on no software inventory and is talking to a host that no business process uses. Walk the email gateway records, the file artifacts and the endpoint process tree one step at a time, and work out for yourself which message carried the delivery, what landed on disk, and what ran.
Hijacked Discord Invite to ClickFix Loader: Tracing the Lure
A finance analyst at Halcyon Wealth Partners followed a recycled Discord invite that quietly redirected the browser to a fake verification page. They did what the page asked, and inside the hour the workstation was running a remote-access trojan alongside an info-stealer that shipped browser data straight out of the building. Walk the proxy, endpoint and firewall evidence step by step to trace the lure, the loader, the C2 beacon and the data theft.
Overdue Invoice, Compromised Endpoint: Tracing a Finance Workstation Intrusion
A finance clerk at Brightwater Logistics worked through her inbox at her desk one Tuesday morning. Inside the hour her workstation, bwl-fin-wks-042, was running programs no accounts-payable machine has any business running and reaching hosts that have nothing to do with freight. You have the mail gateway records for her mailbox and the endpoint telemetry for that hour, and nothing else. Work the morning in order: establish what was delivered, what ran, what it left behind so that it would run again, and where it reported to.