LocalizeApp banking trojan: yet again abusing Accessibility Services

“Find it now” in English — to find your misplaced smartphone.
When the malware successively connects to the socket server, it receives a “connect” event.
The server sends commands as socket events, e.g “seta_tela_cef”. The events are handled here by the code of the malware, adjusting the malware’s configuration.
Socket events the malware handles
The malware can also send a structure which contains a list of operations to perform (see BKING_OPERA socket event). This table lists some of the possible operations. We will detail how some of them are implemented in the rest of this article.
<service android:description="@string/TESTE" android:enabled="true" android:exported="true" android:label=": Localize Já! Rastreio Online para android" android:name="com.gservice.autobot.Acessibilidade" android:permission="android.permission.BIND_ACCESSIBILITY_SERVICE">
<intent-filter>
<action android:name="android.accessibilityservice.AccessibilityService"/>
</intent-filter>
<meta-data android:name="android.accessibilityservice" android:resource="@xml/accessibilityservice"/>
</service>
<accessibility-service android:accessibilityEventTypes="0xffffffff" android:accessibilityFeedbackType="0xffffffff" android:accessibilityFlags="0x53" android:canPerformGestures="true" android:canRequestFilterKeyEvents="true" android:canRetrieveWindowContent="true" android:description="@string/TESTE" android:notificationTimeout="100" xmlns:android="http://schemas.android.com/apk/res/android"/>
Granting Accessibility rights cannot be hidden to the end-user. So the app makes the end-user believe this is necessary for the app to work.
When the list of operations contains the keyword ND_CLICK_POS, the malware automatically performs a click on the given coordinates of the screen.
If the inspected node contains the given (x,y) coordinates, and is clickable, the method performs the ACTION_CLICK.
If the current node contains the coordinates (x,y), the code insert text in the node. If the current node does not contain (x,y), the search continues recursively with child nodes.
The following actions occur when the CnC provides operations named respectively ND_BACK, ND_REBLLT, ND_HOME and ND_RECENTES
In LocalizeApp, this code dumps information for all visible nodes
infos = nodeinfo_x + ":" + nodeinfo_y + ";!!;" + nodeinfo_text + ";!!;0xxx;!!;" + isclickable + ";!!;" + isvisible + ";!!;" + viewidres + ";!!;" + contentdesc + ";!!;" + packagename + ";!!;" + node_classname + ";!!;" + rect_info + "@";

--

--

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store