Rocinante Malware Lets Hackers Hijack Android Devices

Brazilian-origin malware Rocinante, a new banking trojan, has emerged, targeting local banking institutions and leveraging the Accessibility Service. It captures keystrokes and steals personally identifiable information (PII) through phishing screens, then uses Firebase, HTTP, Websocket, and Telegram to exfiltrate data and establish remote device access. 

Drawing inspiration from Ermac/Hook, Rocinante’s authors have incorporated elements from these trojans, demonstrating a growing interconnectedness in the global malware landscape.

The malware family under discussion is currently known internally as “Pegasus” or “PegasusSpy” by its developers. However, due to the existence of a highly notorious spyware family called “Pegasus” developed by NSO Group, adopting this name would lead to significant confusion. 

The malware in question, often targeting Brazilian banking institutions for financial gain, is significantly less sophisticated than NSO Group’s Pegasus. 

To avoid potential misunderstanding, analysts have decided to rename this malware family “Rocinante,” a reference to Don Quixote’s horse, reflecting its aspirations to be something it is not.

Brazilian malware campaigns, primarily distributed through phishing websites, often target banking and financial institutions, which typically employ static target lists, unlike their counterparts in other regions. 

While limiting geographical reach, this simplifies malware design and allows for easier control, making it a common practice among local cybercriminals.

The Pegasus malware, a sophisticated banking Trojan, targets Brazilian financial institutions with a large user base. Once installed, it steals user credentials by displaying fake login screens and communicates with its command-and-control servers using multiple protocols, including HTTP and WebSocket. 

It registers infected devices with Firebase to obtain a unique identifier used for communication and also uses a third server to correlate this identifier with the installation token, allowing for targeted attacks.

The malware Rocinante, once granted Accessibility Service privileges, logs all UI events on the infected device and sends detailed information about each event, including coordinates, text, and visibility, via a websocket channel. 

Sensitive information, such as PII extracted from phishing pages, is processed locally and sent to a Telegram bot, which extracts relevant PII and publishes it in a chat accessible to criminals, including device details, personal identifiers, and login credentials obtained from fake login pages.

Rocinante, banker malware, leverages Accessibility Service privileges to perform remote actions on infected devices. Through simulated touches, gestures, and text modifications, it can navigate UI screens and initiate fraudulent transactions. 

Instructions for these actions are received from a C2 server via a WebSocket channel. Older versions of Rocinante utilized code from the leaked Ermac/Hook source, including logic for cryptocurrency wallet attacks. 

However, newer versions have replaced some of this logic or removed it entirely, focusing on different attack vectors. While the relationship between these two versions is unclear, they likely represent separate forks of the same initial project.

According to Threat Fabric, Rocinante targeting Brazilian banking customers is under development but already active, steals login credentials through keylogging and phishing, and offers remote access for complete control over the device. 

It incorporates code from Ermac/Hook, signifying a potential shift in LATAM cybercriminals’ interest towards broader hacking techniques and demonstrating how even basic functionalities can be lucrative for attackers during development, further fueling its growth.  

Also Read:

Corona Mirai Botnet Exploits Zero-Day to Recruit New Bots

See more